And a lot of work for children’s advocates! writes Rys Farthing

Privacy protections for children are woefully lacking in Australia. Regular readers of small screen will be all too familiar with some of the problems this has led to, from apps that track and use worrying code to companies that create commercial profiles of children that are truly troubling. For a number of years, children’s advocates — including and especially Children and Media Australia — have been calling for a range of reforms to ensure children’s data is adequately protected as the Privacy Act is reformed. February’s Privacy Act Review brought forward some welcome proposals as possibilities, but the Government’s response to the Review in late September has us positively excited. A number of key proposals put forward for children have been accepted, or accepted-in-principle, and look set to slowly push ahead. This is great news for children and represents a huge opportunity for children’s advocates over the next year.

Among these are proposals for a Children’s Privacy Code which the Government has agreed to advance as soon as supporting legislation is passed. While this may mean we’ve got a bit of a wait ahead of us, we are expecting the Code to help deliver some positive changes. If all of this sounds a bit familiar, it’s because the previous Morrison Government also proposed a Children’s Privacy Code before losing office. However, this time around, there’s more reason for optimism.

All indications are this new Code is going to be drafted by the Privacy Commissioner rather than the industry (a point also confirmed at recent Senate Estimates with the Attorney General’s Department). The deeply problematic co-regulatory process, by which industry drafts codes and then regulators ‘register them’, looks set to be avoided. We recently saw this co-regulatory approach deliver some pretty disappointing Online Safety Codes, so hopefully, this drafting by the Privacy Commissioner signals an openness to experimenting with new approaches beyond co-regulation. While this announcement is strictly about the Children’s Privacy Code, with further safety codes coming down the pipeline, we hope that the Department of Communications is paying attention!

This Privacy Code is expected to apply to all online services that are likely to be accessed by children, to outline that children’s best interests need to be prioritised in privacy decisions and, to the extent possible, the scope of the Code should align with international approaches, such as the UK’s Age Appropriate Design Code. This should hopefully see some of the weird anomalies in Australia remedied (such as defaulting privacy settings to the highest levels only for those aged under 16 rather than those under 18).

But what really has me excited is the possible implementation of a few other proposals that seek to embed the ‘children’s best interests’ principle more broadly across our privacy framework. For example, the Government has agreed in principle that targeting children should be prohibited except when in the best interests of the child (proposal 20.6). It has also agreed in principle that companies should be required to have regard for children’s best interests as part of considering whether data processing is fair and reasonable (proposal 16.4). An in-principle agreement means that the Government essentially likes the idea but needs to undertake further consultation to explore both whether and how they could be implemented with regard to proportionality and regulatory burden.

This means that these proposals are not across the line and still need advocating, but I am excited by the potential. If these reforms manage to pass, they will mainstream a tiny bit of a child-rights approach right across Australia’s privacy protections. Companies would need to not only avoid doing harmful things with children’s data, but would need to reach a higher bar and actively consider and demonstrate that their data processing is in children’s best interests. Some of the most egregious practices, such as targeted advertising and excessive collection of geolocation data, would clearly fail that standard.

But these proposals need to gain approval first. I am sure that further consultation with industry will only muddy the waters and create challenges, and children’s advocates will have an important role to play in clarifying the importance and feasibility of these measures.

Getting a strong Children’s Privacy Code drafted, and getting the ‘children’s best interests’ proposals across the line, is a task that I am sure is going to keep many of us busy over the next year. If anyone wants to be involved in this process, here is an open invitation to collaborate. Either reach out to me or to Children and Media Australia and let’s connect.

Rys Farthing is the Director of Research & Policy at Reset Australia. She works on realising children and young people’s rights in the digital world through policy and regulation and helps coordinate the civil society campaign for a children’s privacy code. She has worked as an academic, for not-for-profits, and at think tanks based in Australia, the UK and the US, including 5Rights Foundation and Fairplay.
This is an editorial extract from the latest edition of the Children and the Media Australia’s “small screen”