Australia to consider European-style right to be forgotten privacy laws

The right to be forgotten and a right to sue for privacy breaches will be considered for the next tranche of Australian legislation, the attorney general has said.

Mark Dreyfus made the comments on Monday, promising to consider European-style privacy reforms after his bill increasing penalties for companies that fail to protect customer data passed in 2022.

After receiving a review of the Privacy Act conducted by the Attorney General’s Department, Dreyfus said in December that the former Coalition government had left it “out of date and not fit-for-purpose in our digital age”.

Dreyfus said this week that there would be a “whole range of … modernisations of the Privacy Act”.

“I’ve already brought in … substantial increases to penalties which I hope has sent a message to corporate Australia that they have to take more care about the privacy of Australians … about the data of Australians that they have in their custody,” he told Guardian Australia on Monday.

“Those changes should have been implemented years ago.”

Dreyfus noted it was a “longstanding recommendation of the Australian Law Reform Commission to create a statutory tort of privacy”, meaning individuals could sue for damages for breaches of their privacy. The attorney said it was “among the matters to be considered”.

Asked about the right to erasure – also known as the right to be forgotten – Dreyfus said “there’s a range of reforms [that] have already occurred in a number of developed countries particularly in the EU and obviously the reforms that were created by the general data protection regulation … are among the matters that will need to be considered”.

• Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup

The European Union’s general data protection regulation (GDPR) gives people the right to have their data erased if it is no longer necessary for the the purpose it was collected or, in some circumstances, where the person withdraws consent.

The GDPR contains a range of other personal rights including the right to data portability; to object to data processing in some circumstances, including where it is used for direct marketing purposes; and not to be subject to automated decision-making and profiling.

In September, the prime minister, Anthony Albanese, described requiring companies to dispose of data when they no longer need it as a “pretty commonsense proposal”. At that time, Dreyfus also raised the prospect companies could be required to delete data collected only for establishing a person’s identity.

The managing director of Digital Industry Group Inc – whose members include Google, Apple, Meta, Twitter and TikTok – Sunita Bose told Guardian Australia it was “strongly in favour of reforming the Privacy Act”.

“All companies have a duty to protect their customers’ personal information, and we need to modernise the law for the digital era,” Bose said.

“Digi is broadly supportive of increased harmonisation between Australia’s privacy regime and the European GDPR which has a lot of strong elements, including consumer rights around data erasure which should be offered in Australia.”

A Meta spokesperson said it “supports stronger privacy protections for Australian consumers … including the introduction of a statutory tort for serious invasions of privacy and a right to erasure in certain circumstances”.

But breach of privacy could prove more controversial for media companies which fear the action can provide the rich and powerful further legal weapons to constrain freedom of the press.

The Business Council of Australia opposed the law reform in earlier consultations, labelling it “premature to introduce a tort that would often overlap with the protections of the Australian Privacy Principles”.

“We are yet to see compelling evidence that there is a need for these, particularly as the Office of the Australian Information Commissioner has reported that its conciliation process has been largely successful in resolving complaints,” it submitted.

In a wide-ranging interview, Dreyfus was asked about comments by the sex discrimination commissioner, Kate Jenkins, in November that the Australian Human Rights Commission is “not resourced” to do LGBTQ+ human rights work, while the president, Rosalind Croucher, told Senate estimates the AHRC “would dearly like to be able to put such a specialist role back in”.

Dreyfus said “the scope of work of the [AHRC] is something that remains under active consideration”.

On Tuesday Dreyfus opened consultation for the creation of a federal judicial commission, to police what he described as the “relatively rare” instances of “problematic conduct by judges”.

Dreyfus said the commission was “longstanding Labor policy” which he understood was “supported by the federal courts”.

“I’m trying to do it in tandem with the establishment of the national anti-corruption commission because for constitutional reasons the [Nacc] cannot cover the courts,” he said.

The commission was an “appropriate companion organisation” that should be up and running “soon after” the Nacc, which will open in mid-2023.

Dreyfus said that calls for a commissioner to protect whistleblowers would be considered by a discussion paper in the second stage of whistleblower reforms.

The government’s first whistleblowing bill is being considered by a Senate inquiry, to report in mid-March.