The Business Council of Australia (BCA) welcomes the opportunity to provide a submission to the Office of the Australian Information Commissioner’s (OAIC) Issues paper on the Children’s Online Privacy Code (the Code).
The BCA represents and advocates for its members, comprised of more than 130 of Australia’s largest employers. We are a member-led organisation, and our submissions reflect engagement with those members and the expertise and practical experience they bring.
Following the completion of the Privacy Act Review (the Review) by the Attorney-General’s Department and the passage of the Privacy and Other Legislation Amendment Act 2024, Australian businesses have shifted focus to strengthening their privacy frameworks and preparing for the next wave of reforms, including the proposed Code, additional changes that may emerge from the government’s response to the Review’s recommendations (tranche 2 reforms), and broader regulatory developments affecting digital platforms.
We welcome the OAIC’s approach to this consultation process. Its commitment, thorough research, and clear consultation timeframes are to be commended. We also acknowledge and appreciate the time it has dedicated to engaging with our members throughout this process. We look forward to continuing to work collaboratively with the OAIC as the next stages of the Code’s development progress.
Over the past decades, investment in privacy controls, awareness, and compliance frameworks has grown significantly – not merely in response to evolving legal obligations – but in recognition of community expectations around the collection, use, and protection of personal information. Our members recognise that privacy is a core element of their brands and their relationships with their customers.
The privacy frameworks established by each of our members are reflective of not only Australian legal requirements, principally the Privacy Act 1988, but also international jurisdictions in which our members operate, and specific requirements set out by their own customers.
We acknowledge the government’s ongoing commitment to strengthening privacy protections in Australia, particularly in relation to safeguarding vulnerable individuals, most notably, children. When the Privacy Act first commenced in 1988, it was designed for a world dominated by analogue records, long before the dominance of the internet and digital platforms. Today, the next generation of Australians face an entirely different set of privacy risks, as the Attorney-General noted in the second reading speech introducing the 2024 amendments:
While all Australians face privacy risks in the online environment, children are particularly vulnerable. For many Australian children, social media has been part of their lives from the time they were born. They have never lived in a world without it.
It’s been estimated that by the time a child turns 13, around 72 million pieces of data will be collected about them.
The OAIC rightly points out that the aim of the Code is not to prevent children from engaging online, but to ensure their personal information is protected. We believe this is an important objective as, notwithstanding the potential risks that come with being online, there are enormous opportunities for young Australians that come with digital engagement and digital literacy. The OAIC should be mindful that, in developing the Code, it does not inadvertently create regulatory barriers that hinder the development of innovative and beneficial online content for children. Care should also be taken to avoid introducing new risks, such as those arising from the collection of additional personal information to verify an individual’s age or from mandated privacy default settings that may inadvertently increase exposure to fraud or scams. We recommend the Code takes a principles-based approach, where any applicable measures are proportionate to any privacy harms posed by a particular APP entity.
Our submission comprises responses to some of the detailed questions included in the Issues Paper, our key observations and recommendations.