Australia’s privacy laws rely on notification and consent as the primary means of protecting consumers. The onus is on consumers to navigate complex privacy protections in a continuously complex digital economy.  It is time to consider reforms that hold businesses accountable for how they collect, share and use consumer data.  It is time to give regulators the power to pause and assess data practices that are causing or likely to cause consumer harm.

This working paper explores two concepts to address current and emerging data harms:

1. Duty of care or best interest duty: a framework to hold businesses accountable so that the interests of consumers and the community are front of mind when it comes to how they collect, share, and use consumer data.
2. Privacy Safety Regime: a framework to enable governments and regulators to stop or limit obviously harmful uses of data as well as a process for regulators to proactively restrict and test new harmful practices as they evolve.