This report calls for urgent reform to the Privacy Act to protect against insufficiently regulated data markets in which sensitive and personal data is currently bought, sold and broadcast without controls. It argues that stronger data protections to regulate the flow of this information is required to counteract the risk of scams and foreign interference. 

The way that data is collected and used for most advertising online, called the Real-Time Bidding (RTB) process, sees deeply sensitive data about Australians shown to and shared with unknown parties thousands of times a day. Through RTB, foreign states and nefarious actors can collect huge amounts of data on everyday Australians.

The report argues that these risks are beyond the control of individuals to manage and that only urgent reforms to the Privacy Act can protect Australians from these unnecessary risks. 

Key points 

• The type of data shared includes location and movements over time, sexual interests, financial concerns, personal problems, gambling or drinking habits, and recent online purchases. 
• There is no way to limit or track the spread of RTB data after they are broadcast.
• Because there are no effective limits on who can access this sensitive information, it is available to scammers and other nefarious actors.
• Many of the datasets made available could serve to direct scams at vulnerable targets extremely effectively. 
• Exisiting regulatory framework does not sufficiently address the problem: proactive obligations need to be placed on data firms to exercise fairness and reasonableness in the collection of personal data.
• The protections detailed in the Privacy Act Review are a necessary starting point for protecting Australians’ data and should be acted on immediately.