Australia is eyeing a world-first ‘fair and reasonable’ test for data collection and privacy

The Australian government has released draft legislation for the next major overhaul of the Privacy Act. The Privacy Amendment (Personal Data Protection) Bill 2026 is currently open for public comment. This is the second instalment of privacy reform, which holds significant importance. The bill introduces numerous measures, including stricter consent requirements and a "right to be forgotten".

At its core, the bill proposes a world-first test that could help bypass many loopholes companies use to justify their handling of personal data.

The Privacy Act was initially introduced in 1988, long before the internet, smartphones, and social media became prevalent. The Attorney-General's Department spent three years reviewing it, proposing over 100 changes, and the government agreed with most of them. The first tranche of reforms became law in late 2024, creating a new right to sue for serious invasions of privacy, tackling doxxing, and promising a children's online privacy code.

This new bill contains around 40 measures that, if enacted, will change how businesses and government agencies handle personal information. The bill modernises the basic building blocks, classifying any information related to a person who can be identified, even without a name, as personal information. This includes details obtained through artificial intelligence (AI), precise location-tracking data, and consent to data collection will undergo a significant upgrade.

Companies will need to obtain your consent before trading your personal information, and large digital platforms will be required to delete your data upon request, establishing a "right to be forgotten" for the first time in Australia. Data breaches must now be reported to the regulator within 72 hours. The central concept of the draft legislation is a simple yet innovative test: an organisation can only collect, use, or disclose your personal information if it is "fair and reasonable" in the given circumstances.

This Australian test marks a departure from previous approaches by Europe and the United States, which rely on legal bases for processing data or notice and consent, respectively. The Australian test evaluates whether the data practice is fair, even if consent was given. Businesses cannot simply consent their way out of this requirement.

Factors such as transparency, genuine choice, and weighing risks against benefits will be considered. Additionally, the bill places the best interests of children as a primary consideration in matters related to their personal information.

The government is particularly concerned about wearable technology, such as smart glasses and earbuds with cameras and microphones. These devices can discreetly record people in public, and the consultation paper questions whether the reforms adequately address this technology. The bill will address these concerns by classifying video, audio, and AI-generated inferences as personal information, requiring consent for the collection of biometric templates, and ensuring that data handling by companies deploying these devices is fair and reasonable.

However, there is still a gap in the current law, as individuals generally cannot take legal action. The consultation paper asks what additional measures may be necessary to strengthen privacy protection. The exposure draft for the bill is open for comment until September 18, and the final bill will be released following the feedback received. The direction is clear, as Australia bets on fairness rather than fine print to dictate what happens to personal information.