Wilson Tucker MLC voiced his disappointment that the state’s first privacy act “passed without an opportunity to interrogate how it would operate”. Photo: Facebook.
On the last day of sitting for Western Australia’s parliament, a controversial new bill was passed giving the state its very own dedicated privacy act.
The State Government has secured its Privacy and Responsible Information Sharing Bill 2024 (PRIS), which Innovation and Digital Economy Minister Stephen Dawson claims will “ensure Western Australians’ personal information is protected”.
“As the primary custodians of key data sets which has been provided by the community, it’s our responsibility to ensure they are used to make better decisions, deliver seamless public services and drive innovation for public benefit,” said Minister Dawson.
However independent MLC for the Mining and Pastoral Region, Wilson Tucker, claims the government used extraordinary powers to guillotine debate of the bill and rush it through in the final hours of parliament.
“I proposed amendments to improve the bill and bring us in line with the EU’s (European Union) GDPR (General Data Protection Regulation) – the gold standard for privacy law – but unfortunately the government was not interested,” said Mr Tucker.
“In the end, we have a regime that is an improvement over what existed before, but it also falls short of what I, and many experts, would consider best practice in privacy protection.
“This is an area of law that will need to be re-examined at the earliest opportunity.”
Under the PRIS bill, new privacy principles to guide WA’s public sector agencies on approved systems and processes to handle personal information have been introduced, along with a scheme for mandatory reporting of ‘notifiable information breaches’ to affected individuals and the Information Commissioner.
The latter role was established among others on WA’s last day of parliament, which gave its consent to the Information Commissioner Bill 2024 (IC Bill).
It includes provisions for an Information Access Deputy Commissioner, Privacy Deputy Commissioner and their offices, where they will work to consider and resolve privacy complaints. The IC bill also created a chief data officer, who is expected to lead and develop public sector capability for responsible information sharing.
Ariel Bastian, Julia Powles, Nina Yiannopoulos and Mr Tucker held a panel discussion at UWA on data privacy as the bill was being debated in WA’s Upper House. Photo: Facebook.
Although the Commonwealth’s privacy act only covers the private sector, WA and South Australia were the only jurisdictions left in Australia to not have privacy legislation covering public sector data use.
Yet in spite of battling for such a bill over the past four years, Mr Tucker has been critical, saying the legislation will only deliver “privacy lite” protections.
Earlier this month, the independent MLC brought his proposed amendments to parliament, but with the government’s majority in both houses – the chance for their consideration was slim.
Mr Tucker told InnovationAus.com at the time that it was “the one shot for WA to get these laws right”.
He told the parliament in August that the PRIS bill only included “superficial similarities” to the “global standard and shining example of data privacy” shown in the EU’s GDPR laws. The following month he raised his concerns again and said the bill would be “enabling the public sector to basically do what it wants with our information”.
In response to Mr Tucker’s claim, Minister Dawson rejected the notion that information sharing had been prioritised over privacy.
“The PRIS legislation will enable arrangements for privacy and information sharing to be harmonised in a way that has been difficult to achieve in other jurisdictions,” he told parliament in September.
Part of the government’s urgency to get this legislation through was due to controversies around the Optus data breach and WA Police Force’s (WAPF) use of contract tracing information beyond its original purpose.
There was also concern around WAPF’s plans to hold onto personal information collected by the state’s COVID-19 border management system until 2047, after which it would be archived for good.
According to InnovationAus.com in October 2022, Minister Dawson confirmed the government’s plans for this data from the G2G Pass – something that was discontinued in April that year following the removal of interstate travel restrictions.
