Consumer Rights to

Data Access in

Australia

Dr. James Meese

Senior Lecturer

Email: james.meese@uts.edu.au

2

• Australian Communications Consumer Action Network Grant:

“Consumer Rights to Personal Data”

• The team also includes Professor James Arvanitakis and Dr. Punit

Jagasia.

• Started in July 2018, presenting context for the project and a

working ranking scheme

The operation of the Australian Communications Consumer Action Network is made possible by funding

provided by the Commonwealth of Australia under section 593 of the Telecommunications Act 1997. This

funding is recovered from charges on telecommunications carriers.

RIGHT TO DATA ACCESS

Who are we?

3

Research Project

• Policy and legal analysis (with some comparative elements)

• Interviews with consumers and policy stakeholders

• Data Access Rankings

• Consumer guides for data access (public facing resource)

• Workshop with consumers

4

Today

• Scene setting: Australians and personal data

• Why should we care about data access?

• Our data access rankings

Australians and Personal Data: 2017 Surveys

5

6

Australians and Personal Data

• Digital Rights in Australia, The University of Sydney, 2017.

• Australian Community Attitudes to Privacy, Office of the Australian

Information Commissioner, 2017.

• Consumer Data and the Digital Economy, Consumer Policy

Research Centre, 2017.

7

Australians and Personal Data

• Attitudes towards privacy and personal data

• Knowledge of corporate data collection and technology’s role in

this process

• Habits around privacy and personal data

8

Attitudes

• The “majority of Australians claim to be more concerned about the

privacy of their personal information when using the internet than

five years ago” (OAIC).

• The University of Sydney who found that only 38% of Australians

felt in control of their privacy online (The University of Sydney).

9

Attitudes

• “57% of respondents were concerned about their privacy being

violated by corporations” (The University of Sydney).

• Two-thirds of Australians indicated that they […] “were

uncomfortable with most types of information being shared with

third parties” (CPRC).

• 1 in 5 Australians feeling comfortable with targeted advertising and

1 in 6 comfortable with social networking companies keeping

databases of information on their online actions (OAIC).

10

Knowledge

• 91% of Australians aware that companies could follow their

activities across different websites (CPRC).

• Most people do not know that mobile applications can collect

“device data completely unrelated to the app’s function” (CPRC;

OAIC).

• People are also keen to learn more about “what social media

companies do with the information they collect, share, keep and

use” (The University of Sydney)

11

Habits

• Privacy paradox.

• We’re worried about their privacy but don’t always protect it.

• Research shows that people do not reach privacy policies or terms

and conditions (CPRC, OAIC).

• Australians know how to adjust their online privacy settings or

delete cookies but many don’t do this regularly (CPRC).

12

The overall picture

• Australian consumers feel uncomfortable about the use of their

data but they do not know what’s going on or which strategies are

effective to manage how it spreads.

Why data access?

13

14

Why data access?

• Call for a move away from consumers to companies

• Need data minimisation over regulation

• But data access is still presented as a solution to some of these

information asymmetry problems.

• Facebook launches its “Download Your Information” tool,

employees promoted it as the “flip side” of Facebook “sharing user

data with external developers and websites”.

• CDR sold as a solution to some of the problems around a data-

driven economy

15

Why data access? Prospective benefits.

• Provides some benefits: Transparency, fostering competition,

data literacy.

• Central feature of legislation: see GDPR, APP and CDR so

obviously of some value.

16

Why data access? Ongoing issues.

• Benefits of CDR potentially oversold: “Will improve the flow of

information in the economy”, support innovation and cost reduction

in the creation and delivery of the goods and services” and “support

data driven economic growth and create new high value jobs in

Australia” (Treasury).

• Consumer engagement: “just over a third of Australians (37%)

know that they can request access to their personal information

that is held by government agencies or businesses” (OAIC). No

data on actual requests. Will consumers engage with CDR and do

they care about existing access rights?

17

Why data access? Ongoing issues.

Compliance: Are companies compliant now and will they be

compliant with CDR?

Compliance with the right of access “is a mess” (Mahieu et al.

2018).

Non-compliance with the formal requirements of the law is

widespread, with some organisations failing to answer at all,

and others obstructing transparency in their answers.

Digital platforms have complied with the letter but not the spirit of

GDPR using dark patterns (UX). Considering CDR and accredited

third parties.

Data Access Standards in the Communications Sector.

18

19

Data access in Australia

Australian Privacy Principle 12: Requires an “APP entity that holds

personal information about an individual to give the individual access

to that information on request”.

Only has to provide personal information: [I]nformation or an

opinion about an identified individual, or an individual who is

reasonably identifiable (Privacy Act 1988).

20

Our companies

Digital Platforms: Facebook, Twitter, Instagram, Google.

Telecommunications Companies: Vodafone, Telstra, Optus.

Fitness Trackers: Fitbit and Apple Watch.

Companies presumably retain an ‘Australian link’. Can be proven

through collection of data from Australian citizens See Privacy Act

1988 5B(3)(c)

21

Draft data access standards

Baseline: Do they comply with APP 12?

Expecting the provision of appropriate personal information when

requested.

Taking a standard approach, just asking for “personal information and

any related data”

CDR is rolling out so APP will be the main mechanism for access for

some time yet.

22

Draft data access standards

Best practice: Do they comply with a ideal best practice model?

Context

1) CDR confirmed that APP 12 and the act has limitations.

2) Also setting standards beyond CDR and corporate practice, what

should consumers expect from data custodians?

Standards based on existing legislation (APA, CDR bill, GDPR,

GMSA privacy principles) and prominent issues raised by existing

surveys (i.e. competition, knowledge).

23

Draft data access standards

The Seven Standards

Data portability: Can you move your data?

Scope of data provision: Can you access all your data?

Transparency of data collection: Can you see what data is bring

collected?

Ease of data access: Is it easy to access data?

24

Draft data access standards

Employee understanding: Can staff assist with data requests?

Additional requests: Can you ask for more data?

25

Draft data access standards

Three levels

High (3)

Medium (2)

Low (1)

26

Draft data access standards

Data portability

High: Your personal data is portable. Portability requires a limited

amount of technical literacy or can be achieved through intermediary

support.

Medium: Your personal data is portable. Portability requires some

technical literacy.

Low: No data portability is provided.

27

Draft data access standards

Gold Standard: 21 - 19

Good: 17 - 18

Average: 16 - 12

Poor: < 12

Consumer Rights to

Data Access in

Australia

Dr. James Meese

Senior Lecturer

Email: james.meese@uts.edu.au