The Attorney General has outlined sweeping plans that will change the way data is collected, held and used by companies, with stiffer penalties for non-compliance, greater legal powers to actively seek out privacy breaches, hold companies to account and take them to court, and to make it far easier for individuals to report companies and seek legal and financial redress.

Targeted advertising is set to be regulated under the proposals, including targeting using data ‘which relates to individuals but that may not uniquely identify them’, per the report. That could severely disrupt the ad industry, including the burgeoning industry of alternative ID providers, many of which use hashed identifiers as a means to de-identify individuals while still enabling tracking and targeting. It also raises serious questions about audience segmentation and targeting more broadly.

The AG said it will also give individuals more transparency and control over direct marketing, targeting and sale of their personal information, while rules around use of de-identified data are also set to be strengthened.

Overall, businesses will face far more stringent rules around how individuals’ data is collected and used and will have to identify and mitigate risks, which suggests a significant amount of incoming compliance work.

People will have the right to ask companies for all the data they hold on them - and to delete it. That alone poses major challenges for brands, regardless of whether how they are using data falls foul of the new regime.

According to Peter Leonard, Professor of Practice at UNSW Business School and principle of Data Synergies, the proposed reforms "generally eschew" Australian privacy laws becoming a "mini-me EU GDPR" and continue Australian governments form in finding a "distinctly Australian way" in digital regulation.

Among Leonard's initial obrservations:

• "In particular, these proposals would also extend to use of deidentified information to the extent that this information is used for targeted advertising, which raises difficult questions about how and when any form of audience segmentation will remain practicable in data driven and algorithmically enabled digital marketing. This proposal if taken forward would require substantial changes to existing business practices in targeted marketing and advertising, and therefore will be an area of intense focus and discussion over the next few months."
• "Far reaching initiatives as to restrictions upon direct marketing, targeting and trading in personal information, including conferral upon...individuals of an “unqualified right to opt-out” from information being used for direct marketing purposes and from receiving targeted advertising."
• "Recommendations include restrictions and requirements around handling of deidentified information which potentially could be used to assist reidentification of relevant individuals. This leads to difficult questions of evaluation of reidentification risk and safeguards and controls to mitigate those risks, and emerging (and rapidly evolving) international best practice in use of privacy enhancing technologies."
• Mi3 will publish comprehensive analysis of the Attorney General's proposed privacy reforms in next Tuesday's edition.  

Industry now has until 31 March to digest and respond.