February 27, 2024

Singled Out


Consumer understanding — and misunderstanding —
of data broking, data privacy, and what it means for them.

 

In today’s digital age our data is being collected both off and online. But how much do we understand about how data is collected and what happens to our details?  Are we really unidentifiable, or can we be Singled Out?

Together UNSW Sydney and CPRC set out to examine a national sample of Australians and explore how people perceive and understand the various types of personal information that organisations collect, use, and share, along with the associated risks.

Download Full Report

Summary

Businesses are using a range of vague and difficult terms in their privacy policies to describe how consumer data can be sold or used by others.

This joint CPRC and the UNSW Sydney report: 

  • explores consumer perceived understanding of terms used in privacy notices and their perceived risk of being singled out 
  • examines the meanings and inconsistencies behind those vague terms and the challenges they create for Australian consumers. 

This report features insights from a nationally representative survey of n=1,000 Australians.

Key findings

Data harvesting practices

icon

Consumers are being singled out and tracked by businesses they don’t even have a relationship with.

icon

Businesses are able to set their own interpretation of terms without prioritising data concerns.

icon
Privacy policies use a range of vague terms to describe how consumer data can be sold or used by others.
icon
These terms are used inconsistently and in ways that appear to make it deliberately difficult for people to understand.
icon
Data brokers have the capability to distribute large datasets that influence the online advertisements individuals encounter and the prices they're presented
icon
De-identified information is defined in the Privacy Act but not covered by the Australian Privacy Principles.

Only ‘personal information’ is defined in law, but it is limited in its scope. There are no standard definitions in Australia for the following terms:

icon
Pseudonymised information
icon
Anonymous / anonymised information 
icon
Hashed email address
icon
Aggregated information 
icon
Audience data 

Awareness and understanding

Most Australians have little understanding of common personal information terms used in privacy policies.

icon

0%

were unfamiliar or didn’t understand ‘pseudonymised information’

icon

0%

were unfamiliar or didn’t understand ‘hashed email address’

icon

0%

were unfamiliar or didn’t understand ‘advertising ID’


 

Perception and control

icon

More than half of Australians are unaware that certain pieces of information are used to single them out from the crowd.

icon

%

More than 50% are unaware that pieces of information are used to single them out.

icon

%

It can be as high as 70% of consumers who are unaware of terms such as ‘pseudonymised information’ that are used to single them out.

Australians don’t feel in control of their information.

%

72% believe they have little to no control over the information collected by businesses with which they have no direct interaction.

%

71% believe they possess little to no control over businesses sharing their personal information with other entities.

Recommendations

 

Data brokering presents significant concerns for Australians.

The lack of transparency and lack of consent creates privacy risks from extensive data collection where consumers can be singled out.  Targeted advertising can lead to manipulation, potential for discriminatory practices, lack of control over personal data, and susceptibility to security breaches. These issues underscore the need for better regulations to safeguard privacy and ensure ethical data handling practices from businesses.

 

These are the reforms we need to see from the Federal Government: 

icon
Modernise what it means to be identifiable by updating the definitions of both personal information and de-identified information.
icon
Enforce the direct collection rule for consumer tracking profile and targeting. 
icon
Put the onus on businesses by imposing a fair and reasonable obligation on collecting, sharing and using consumer data. 
icon
Implement a future best-interests duty or a duty of care obligations for data to further enhance privacy protections. 
icon
Make unfair data practices illegal through an unfair trading prohibition that protects consumers from businesses that unfairly exploit their customers. 
icon
Empower regulators to swiftly ban or restrict harmful practices that cause direct and clear consumer harms. 

Where to from here?

Laws that put Australians first, and regulators that are empowered to take action early will enable Australians to participate in the digital economy with confidence that their data is not being collected, shared or used in ways that leaves them worse-off.

Australians deserve data protections that work for them today and in the future. The burden of responsibility cannot solely rest on consumers any longer.

 

CPRC welcomes the opportunity to work further on this issue with government, regulators, policy makers, academia and the community sector. 

If you are in one the above groups and would like a one-on-one briefing for your organisation, contact our team now.

Links

Book a Briefing View Media Release

Other reports

Newsletter sign-up

This field is for validation purposes and should be left unchanged.
Skip to content