A privacy collision course

National Privacy Principles, legislated this year after five years of development, are not intended to make life simpler for business in the short term.

Indeed, for many businesses, it has raised quite a few questions about how their present practices reconcile with the principles, and whether they will need to do things differently.

Many other businesses who to date have not even heard of the National Privacy Principles  are likely to find that they have to think about the way they treat their customers’ and clients’ information in coming months and years.

Principles are like that. They are intended to set a standard that sits above daily practice where they can act as a benchmark against which particular circumstances and practices can be measured.

The Privacy Commissioner is an important – perhaps the central – intermediary in this process.

Its job is to help translate the Principles and, in some cases, to enforce them.

One would think that other regulatory agencies with responsibility for particular industries would understand and respect the importance of this process.

After all, while implementing the principles is likely to create short term pain, irritation and possibly complaints from businesses, they are there to ultimately help create consumer confidence to ensure that there is economy wide certainty for businesses and their customers about rights and obligations.

That is core business for the regulatory agencies who have the job of overseeing particularly sensitive parts of the economy.

And that is why the decision by the Australian Prudential Regulatory Agency to ignore the advice of the Privacy Commissioner about what APRA should be telling lenders as to how to treat the private information of Australians (as suggested in this article) is so hard to understand, not to say short sighted.

The banks were hostile to the privacy principles when they were being debated by the Parliament, fearful that they might impinge upon the banks’ ability to move large parts of their data and customer management processes overseas, to places such as India, in pursuit of lower costs.

The movement of the sensitive personal information of Australians overseas has, understandably, caused wide concerns among unions and consumers.

The Privacy Commissioner had recommended to APRA that it tell the banks that they were required to follow domestic rules when they transferred private information overseas.  Rather than prevent information going overseas per se, APRA adopted the sensible approach of telling the banks that they needed to advise APRA when personal information went offshore and then put to the relevant financial institution that the privacy protections at the offshore country needed to be at least as robust as our own.

That is, the person overseeing the implementation of the principles to all industries advised the regulator overseeing one particular industry that it should tell that industry how the law applied to it. Nevermind that the industry did not like the law. You don’t have to like a law. You just have to obey it.

Astonishingly, APRA ignored the advice of its fellow regulator.

Instead, it told the banks they should take a measured and cautious approach when sending Australian clients’ data overseas and take account of the “risks”.

Why would one regulator not simply repeat the words of a fellow regulator?

One is tempted to wonder if this is an example of regulatory capture – that the regulator begins to see the industry it oversees as a client and resists saying something that might create conflict.

But the real clients of APRA are the customers of the lenders. Australian citizens are the ones the Privacy Principles aim to protect. That means some businesses face change in order for that to be delivered.

Ultimately, the lenders can’t avoid their obligations under the Privacy Principles. APRA would be doing everyone a service if it just passed on the advice of the expert agency charged with overseeing those obligations.

Matt Healy is chairman is OzHub, an association representing Australian cloud computing companies.