Peter A Clarke

Large tech companies have found themslves under close scrutiny of privacy regulators in Europe of late. The latest is the French data protection authority fining Google $379 million and Chinese e commerce operator Shein $150 million for setting advertising cookies without customers consent.

The story is reported by the Hacker News with Google Fined $379 Million by French Regulator for Cookie Consent Violations. 

The story provides:

The French data protection authority has fined Google and Chinese e-commerce giant Shein $379 million (€325 million) and $175 million (€150 million), respectively, for violating cookie rules.

Both companies set advertising cookies on users’ browsers without securing their consent, the National Commission on Informatics and Liberty (CNIL) said. Shein has since updated its systems to comply with the regulation. Reuters reported that the retailer plans to appeal the decision. Read the rest of this entry »

The question of the status of pseudonymised data confounds many and is the subject of some controversy. OVIC published a report The Limitations of De-Identification – Protecting Unit-Record Level Personal Information. In its guidelines the Privacy Commissioner’s guidelines regarding Pseudonymity state that:

2.6Pseudonymity requires that an individual may deal with an APP entity by using a name, term or descriptor that is different to the person’s actual name. Examples include an email address that does not contain the person’s actual name, a user name that a person uses when participating in an online forum, or an artist who uses a ‘pen-name’ or ‘screen-name’.

2.7 The use of a pseudonym does not necessarily mean that an individual cannot be identified. The individual may choose to divulge their identity, or to volunteer personal information necessary to implement a particular transaction, such as credit information or an address at which goods can be delivered. Similarly, an APP entity may have in place a registration system that enables a person to participate by pseudonym in a moderated online discussion forum, on condition that the person is identifiable to the forum moderator or the entity.

2.8 An APP entity should bear in mind that the object of APP 2 is to provide individuals with the opportunity to deal with the entity without revealing their identity. Personal information should only be linked to a pseudonym if this is required or authorised by law, it is impracticable for the entity to act differently, or the individual has consented to providing or linking the additional personal information. An entity could also restrict access to personal information that is linked to a pseudonym to authorised personnel (for a discussion of the security requirements for personal information, see Chapter 11 (APP 11)).

In EDPS v SRB the Court of Justic of the European Union  confirmed that pseudonymised data will not be personal data in all cases. Whether the data is actually personal depends on the context requiring an assessment of all the means reasonably likely to be used to identify the individual.

The Decision

The Court relevantly stated:

The requirement that Read the rest of this entry »

In a Federal Court class action in the United States involving 98 Google users over 174 million devices The jury found for the claimants and awarded the sum of $425 million against Google for breaching users privacy. The breach was Google collecting data from users even after they turned off a tracking feature in Google Accounts. The orginal claim was for $32 billion.  Jury awards in the United States can be eye watering high.  Appeals courts regularly reduce the size of the award if they are not reduced by agreement between the parties.

The story is covered by the BBC with Google told to pay $425m in privacy lawsuit, Reuters with Google must pay $425 million in class action over privacy, jury rules and Tech xplore with Jury tells Google to pay $425 mn over app privacy.

The BBC story provides:

Read the rest of this entry »

Multi factor authentication is a critical part of any cyber security. While it is becoming standard with many larger organisations it is poorly understood and even more poorly implemented. The National Institute of Science and Technology (“NIST”) has released a report on multi factor authentication for Criminal Justice Information Systems. Very specific perhaps but the contents of the report have a broader application.

The abstract provides:

Most recent cybersecurity breaches have involved compromised credentials. Migrating from single-factor to multi-factor authentication (MFA) reduces the risk of compromised credentials and unauthorized access. Both criminal and noncriminal justice agencies need to access criminal justice information (CJI); to reduce the risk of unauthorized access, the Criminal Justice Information Services (CJIS) Security Policy now requires the use of MFA when accessing CJI. This document provides practical information to agencies that are implementing MFA, reflecting on lessons learned from agencies around the country and from CJI-related technology vendors.

The report is worth reading.  Some interesting Read the rest of this entry »

The National Institute of Science and Technology has published the final version of NIST Internal Report (IR) 8349, Methodology for Characterizing Network Behavior of Internet of Things (IoT) Devices. and a draft of NIST IR 8536, Supply Chain Traceability: Manufacturing Meta-Framework.

Understanding the scope of the Internet of things and how the network operates is key to determining its cyber security requirements.   This 47 page report is worth consideration.  The Internet of Things will become more not less ubiquitous and more and not less prone to cyber attacks.  The Supply Traceability paper is also important but more specific and technical.

Internet of Things

The summary provides:

Characterizing and understanding the expected network behavior of IoT devices is essential for cybersecurity; it enables the implementation of appropriate network access controls to protect the devices and the networks on which they are deployed. Device characterization techniques that describe the communication requirements of IoT devices, in support of the NCCoE Securing Home IoT Devices Using Manufacturer Usage Description (MUD) project, can aid in securing devices and their networks. 

To properly secure networks, network administrators need to understand what devices are on the network and what network communication each device requires to perform its intended functions. In the case of networks that include IoT devices, it is often difficult to identify each individual device, much less know what network access is required by each device to other network components (and what access other network components need to each device). Read the rest of this entry »

Hanson Chambers in South Australia have been hit with a cyber attack. The chambers has 8 barristers; 3 silks and 5 juniors. And one associate member, acting as a mediator. The breach is serious with correspondence and court documents being stolen and listed on the Lynx ransomware site. It has been reported in cyberdaily.au in Exclusive: South Australian barristers’ chambers listed on Lynx ransomware’s leak site.  

The cyberdaily article Read the rest of this entry »

There will be a change to the Rules of the Federal Circuit Court and Family Court (Division 2). New Practice Directions will also take effect being:

• Central Practice Direction: General Federal Law Proceedings
• Central Practice Direction: Migration Proceedings
• General Federal Law Practice Direction: Admiralty and Maritime Proceedings;
• General Federal Law Practice Direction: Intellectual Property Proceedings.

Practice Directions

The Court’s summary of the Practice Directions provides:

Central Practice Direction: General Federal Law Proceedings

• updates to reflect new rule references in the new GFL Rules.
• updates removing child support from the types of proceeding listed as within the Court’s general federal law jurisdiction, to reflect that child support proceedings must now be heard in the family law jurisdiction.
• new item 3.2 on the overarching purpose stating that parties and their lawyers have a duty to co-operate with the Court and amongst practitioners.
• new section 4 stating the procedural requirements for parties seeking to file an urgent application.
• new item 6.3 on case management stating that the Court expects a party to seek consent of all other parties when seeking to adjourn a hearing or vacate a listing date.
• updates to section 8 on ending a proceeding early to reflect that parties can file a notice of discontinuance at any time before the first court date, or, if the proceeding is continued on pleadings, any time before the pleadings have closed. This includes new item 8.2 which states that the notice of discontinuance can be filed at a later date with the leave of the court or the other parties’ consent, if judgment has not been entered.
• new section 10 on parties’ conduct and communication with the Court stating the requirements for parties when communicating with each other, the Court and all Court staff. 

Central Practice Direction: Migration Proceedings

• this is a new Practice Direction, some items in the previous Migration Practice Direction remain and new items have been included.
• updates to reflect new rule references under the new GFL Rules.
• new section 3 including:
  • the assignment of a pseudonym to litigants
  • the requirements for how parties are to be named in migration proceedings
  • the requirement that all Court documents must include the details of the person who prepared the document irrespective of whether that person is a lawyer
  • the obligations under section 486E of the Migration Act 1958 (Cth)
  • the requirements for notifying the other party when filing documents with the Court.
• new section 4 regarding how the Court triages matters before they are allocated to a judicial officer for determination.
• new section 5 stating the requirements for parties seeking to file an urgent application.
• new section 6 regarding the non-removal from Australia of detainees with litigation before the Court.
• new section 7 regarding matters involving a party who is in immigration detention.
• new section 8 regarding the requirement for the solicitor for the Minister to prepare a Court Book and what it must include. This section also includes the Court’s requirements where a party wishes to rely on authorities.
• new section 9 on interview/hearing audio and transcripts.
• new section 10 regarding requests for adjournment.
• new section 12 regarding the requirements for Direct Access Barristers.
• new section 13 on parties’ conduct and communication with the Court stating the requirements for parties when communicating with each other, the Court and all Court staff.

General Federal Law Practice Direction: Admiralty and Maritime Proceedings

• updates to reflect new rule references under the new GFL Rules.
• new item 1.2 reflecting that parties have a duty to act consistently with the overarching purpose, and practitioners must assist parties to comply with the duty.
• removal of section 8 on urgent applications due to new section 4 in the Central Practice Direction – General Federal Law Proceedings.

Read the rest of this entry »

Sam and Brittany Groth have issued proceedings in the Federal Magistrates Court against the Herald and Weekly Times alleging a breach of privacy. Or more accurately a breach of the statutory tort of serious invasion of privacy. The Court number is VID1130/2025 and there are 3 respondents; the Herald and Weekly Times, Stephen Drill and Sam Weir. The story is covered by 3AW (with audio) in Deputy opposition leader launches legal action over controversial reporting. The Australian Financial Review also covers it Read the rest of this entry »

In late July 2025 the Attorney General, Michelle Rowland, said to the Australian Financial Review that the Privacy Act was not fit for the digital age”. She later said during an an appearance on Sky News’ Sunday Agenda regarding the Privacy Act that “..Well, this is the second tranche of privacy reforms. I think it’s fair to say, Andrew, that Australians are sick and tired of their personal information not only being exploited for benefit by third parties, but also the way in which that information is not being protected. We’ve seen that in recent times with data breaches, both by Australian companies as well as multinational tech giants.”

Modern reform often begins with Ministers making noises about the need to address this or that reform.  Putting the issue onto the agenda.  In the privacy context that was done in 2022 – 2023.  The 2022 Privacy Act Review Report proposed 116 recommendations to reform the Privacy Act 1988.

The government accepted 38 of the proposed reforms and agreed to 68 in principle.  It said it would implement the changes in phases.  The first tranche, as it became known, was found in the Privacy and Other Legislation Amendment Act 2024 which passed in November 2024 and became law on 10 December 2024.  It implemented 23 of the reforms, including the introduction of a statutory tort of privacy, anti-doxxing offences and a new tiered civil penalty regime, as well as the development of a new Children’s Privacy Code, which is currently the subject of consultation undertaken by the Office of the Australian Information Commissioner (OAIC). The  obligation to disclose the use of personal information for automated decision making will commence in December 2026.

The Attorney General has now dropped two not very subtle hints that more privacy reform is required.  Nothing detailed about the what and the when but that is not required.  Starting the conversation is the key.  Given the Government has already responded to a report’s recommendation going from discussion to action is a short step.

As to when the second tranche will be introduced into Parliament as a Bill is the subject of some speculation.  It is a more comprehensive  set of reforms and some are Read the rest of this entry »

Regulators are increasing their focus on the proper use of biometrics. Advances in technology has made the collection and mandatory use of biometrics more prevalent. Even common in some industries. That has meant more attention by the regulators as compliance is an issue when it comes to collection, storage, use and disposal of this sort of personal information. On 11 August 2025 the Privacy Commissioner of Canada issued its guidance on the use of biometrics. This follows the New Zealand Privacy Commissioner publishing rules on the use of biometrics earlier this month. The UK Information Commissioner has probably issued the most comprehensive biometric data guidance. While it is referable to UK legislation it’s general advice is very good. The Australian Information Commissioner has not published guidelines on biometrics however has advised that biometric information is sensitive information for the purpose of the Privacy Act 1988.

The key issues from the Canadian guidelines are:

1. Collection, use and dislosure.  Appropriate use
   • At the outset the organisation must have  lawful authority for the collection, use and disclosure of biometric information. The issue is slightly different between sectors:
     • Public sector: In establishing whether Federal institutions have lawful authority to collect biometric information the information must directly relate to a government program or activity.
     • Private sector: organisations must identify a legitimate need for using biometrics.  The collection and use must be effective, minimally intrusive and proportionate to its purpose.
2. Consent
   • As with all privacy legislation consent is important.  As the guidance states it must be valid, informed and meaningful. That includes advising people what biometric information will be collected, why it is needed, who it may be shared with and any risks of harm.
   • Biometrics is not the first and only option.  Where biometrics are not integral to the service, alternatives must be offered.
3.  Privacy Impacts; Necessity and ProportionalityAs is good practice generally prior to implementing a biometrics program there should be a privacy impact assessment. That means showing that biometrics are:
   • Necessary for a specific, legitimate and defensible objective;
   • Effective and reliable in achieving that purpose;
   • Minimally intrusive, with no less invasive alternatives available; and
   • Proportional, ensuring that privacy impacts are commensurate to the benefits gained.
4. Limiting Collection, Use and Retention

   Organisations must only collect and use the biometric characteristics strictly necessary for the stated purpose. The process involves:

   • Favouring verification (one-to-one) systems over identification (one-to-many), where feasible;
   • Avoiding large, centralised biometric databases;
   • Avoiding the extraction of secondary information t;
   • Limiting disclosure; and
   • Retaining biometric information only as long as necessary and destroying it once no longer required.
5. Security/Safeguards

   This encompases having measures to protect personal information against loss, theft or unauthorised access. Biometric information must be secured with physical, administrative and technical measures proportionate to its sensitivity. Best practices involves:

   • Encryption during storage and transmission;
   • Regular penetration testing and vulnerability assessments;
   • Control of employee access; and
   • Breach reporting.
6. Accuracy

   It is important to have accurate information.  The consequences can be even greater with  biometric recognition.  Erroneous information can lead to wrongful denial of services or misidentification. Best practice includes:

   • adopting technologies with appropriate accuracy rates;
   • Testing systems in real-world conditions and across demographic groups to minimise bias and discrimination;
   • Monitoring accuracy on an ongoing basis, as system updates can affect performance; and
   • Developing procedures for false positives and negatives, ensuring timely resolution and human review where decisions have significant consequences.
7. Accountability

   While holding biometric information organisations remain responsible for that biometric information even when using third-party service providers. In that respect organisations obligations include:

   • due diligence on service providers’ practices;
   • having contracts and information-sharing agreements that embed privacy protections;
   • establishing clear governance structures, audit rights and breach response plans; and
   • ensuring there is adequate employee training and oversight.
8. Openness and Transparency

Read the rest of this entry »