The Treasury Laws Amendment (News Media and Digital Platforms Mandatory Bargaining Code) Bill (2021) (Bill) was introduced in 2020 to address concerns about bargaining power imbalances between digital platforms and Australian news media businesses.

The Bill was passed by the Australian Parliament on 25 February 2021. It amends the Competition and Consumer Act 2010 (Cth) and creates a mandatory code (News Media Bargaining Code) for digital platforms aimed at ensuring access to trusted, accurate, informed and impartial news for Australians.

The introduction of the Bill raised significant issues around the need to balance the interests of a free media and democracy. It also raised privacy concerns about the potential for vast amounts of data to circulate between news media businesses and digital platform corporations. Some of the privacy concerns raised by the Bill are discussed below.

Data Collection

Digital platforms collect significant amounts of data about their users, including personal information, anonymised, aggregated and pseudonymised data. Digital platform collecting ‘information or an opinion about an individual, or an individual who is reasonably identifiably’ must treat that information as personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) (s 6(1)).

Minimum Standards – Data Sharing

Under the News Media Bargaining Code, ‘designated digital platform corporations’ will be required to comply with a series of ‘minimum standards’ in relation to their dealings with news media businesses. The standards include the requirement for digital platforms to provide all ‘registered news media businesses’ a list of, and an explanation of the types of ‘user interaction data’ in certain circumstances. The user interaction data must relate to ‘covered news content’ that is made available on a ‘designated digital platform service’.

Put another way, digital platforms are to share user data with relevant news media businesses, and this data sharing that is promoted by the News Media Bargaining Code raises privacy issues.

Under the Bill:

  • A ‘designated digital platform corporation’ is a corporation which operates or controls a digital platform service, which the Minister of Communications, Urban Infrastructure, Cities and the Arts (Minister) may designate under the Bill.
  • ‘User interaction’ with content made available by a digital platform service includes commenting, sharing, modifying or otherwise engaging with ‘covered news content’ in some form. User interaction is defined broadly (see the Bill’s Explanatory Memorandum) and even includes “minimal interactions with content such as pausing, scrolling through, or hovering a cursor over the content, or portions of the content.”
  • ‘Covered news content’ is a broad category of news content including core news content and other content that reports, investigates or explains current issues or events to Australia, which includes sports and entertainments news.
  • A ‘registered news media business’ is a news media business that is registered with the Australian Communications and Media Authority, the Australian media regulator.
  • A ‘designated digital platform service’ is a digital platform service that the Minister may designate under the Bill. A digital platform service will be notified of the Australian’s Government’s intention to designate the platform under the Code prior to any final decision.

Restrictions on data sharing

Importantly, the requirement to share a list of the types of data to all registered news media businesses only exists when the designated digital platform services provides that information to one or more registered news businesses in the first instance. As stated in the Explanatory Memorandum:

“This provision only requires that if a responsible digital platform corporation chooses to share user interaction data with one or more registered news businesses, it must inform all other registered news businesses, at least in general terms, about the types of data it has provided by listing and explaining the shared data.”

All data sharing must still comply with the Privacy Act to the extent the data is considered ‘personal information’. The Explanatory Memorandum makes it clear that the objective of the requirement to share types of data is to ensure transparency amongst registered news media businesses.

Privacy Concerns

The Bill raises some privacy concerns because of the increased likelihood of more user data being shared between digital platforms and news media businesses as well as its potential to further blur the lines between de-identified information and person information.

In response to the Bill, the Office of the Australian Information Commissioner (OAIC) has emphasised that it is important for digital platforms and news media businesses to ensure their data handling practices are compliant with the Privacy Act including the Australian Privacy Principles (APPs).

In a submission to the Australian Competition and Consumer Commission (ACCC) on the Exposure Draft of the Bill, the OAIC stated that it would “seek to remind digital platforms and news media businesses of their existing obligations under Australian Privacy Principle (APP) 1 to take a ‘privacy by design’ approach to projects, activities and initiatives involving personal information.”

To illustrate the ‘privacy by design’ approach, the OAIC reinforced the importance of conducting a Privacy Impact Assessment (PIA) to assess the impact of new data handling practices and to identify and address any associated privacy risks. For example, under the News Media Bargaining Code there may be a significant risk of re-identification of anonymised and pseudonymised information which a PIA, if implemented properly, would likely be adept at identifying.

The OAIC has also recommended that the News Media Bargaining Code should, as a matter of best practice:

  • Require that all data is anonymised, pseudonymised or aggregated in such a way to minimise re-identification;
  • Explicitly state the categories of user data that may be shared;
  • Narrowly define the purposes for which user data may be used; and
  • Include requirements around how user data should be stored, secured and destroyed.

As the debate continues around the News Media Bargaining Code, we anticipate that the OAIC will maintains its focus on ensuring that the Code adequately protects consumer privacy and meets community expectations.

For more information, get in touch with us today.

This article was originally published on OneTrust and is available here