It depends … some findings from Australia’s Attitude to Privacy Survey

Interested in what Australians think about privacy, use of AI and facial recognition and the protection of children online? Then the recently released OAIC 2023 Australian Community Attitudes to Privacy Survey (ACAPS 2023) will be of great interest.

But what can we take from the report? And how useful is it for Australian privacy professionals?

Background to Privacy Survey

ACAPS 2023 is the sixth survey in a series initiated in 2001 (in its current form) but first conducted in 1990.

The survey is commissioned by the OAIC to evaluate the awareness, understanding, behaviour and concerns about privacy among Australians. It provides longitudinal information on Australians’ attitudes to key privacy issues, their experiences and perspectives around the use and protection of their personal information and the action they take to safeguard their privacy.

Methodology used for Privacy Survey

The methodology used for the survey has, not surprisingly, changed over the past 2 decades (becoming increasingly on-line).

Between 2001 and 2013, all interviews were completed via Computer Assisted Telephone Interviewing (CATI). In 2017, the methodology shifted to a hybrid of online and telephone interviewing methodology, where 800 surveys were conducted via phone and 1,000 were completed online, with respondents reached via an online research panel.

In 2020, all data was collected online, with 39% of respondents recruited via telephone.

In 2023, all data was again collected online, with all respondents reached via an online research panel.

There were roughly 1900 survey respondents, though not all responded to every question. For example, questions about children were directed to parents, and only 679 completed those questions.

Themes from the survey

Angelene Falk, the Office of Information Commissioner, notes in her forward that some significant societal shifts have impacted the attitudes disclosed in the most current survey including the COVID-19 pandemic, high-profile data breaches and the speed of tech innovation.

According to the Commissioner, ‘these events have intensified the focus on the role privacy plays in our sense of control and autonomy, human dignity, freedom and other key values.’

Perhaps building on these themes, the report divides its findings into the following general areas:

• Privacy legislation
• The role of organisations
• Privacy harms
• Digital technologies
• Children’s privacy

These are the areas that are raising most issues generally in the privacy world so it’s no surprise that the survey has taken this particular focus.

Main findings in the survey

In her foreword to the report on the survey, Commissioner Angelene Falk noted that:

• After quality and price, data privacy is the third most important factor when choosing a product or service, coming after quality and price.
• 62% of Australian’s see the protection of their personal information as a major concern in their life.
• 82% care enough about protecting their personal information to do something about it, however 57% do not know what to do.
• Only 32% of Australians feel in control of their data privacy and 84% want more control and choice.
• We are more or less ok with one-to-one uses of biometric information (such as when we go through a passport control) but not ok with biometric analysis of that information, such as making assumptions or predictions about our likely attributes and behaviours.
• We’re definitely not ok with AI. 96% of Australians want some conditions in place before the technology is used to make a decision that might affect them, such as the right to have a human review the decision.
• Data breaches lurk large in our fears with 74% of Australians seeing data breaches as the biggest privacy risk they face and 47% of respondents having been informed that their personal information was involved in a data breach during the previous 12 months.
• Only 24% of Australians say businesses are trustworthy when it comes to the collection and use of biometric information.
• Protecting their child’s personal information is a major concern for 79% of parents. However, only half (50%) feel they are in control of their child’s data privacy and 92% of Australian parents believe children have a right to grow up without being profiled and targeted.

The role of organisations

Main findings relating to the role of organisations include that Australians want organisations to do more to protect their data and be transparent about what they do with their personal information. They frequently do not know what organisations do with their data and often feel they have no choice but to hand over personal information if they want to access a service.

While most Australians expect they might need to share some level of personal information to access a service, they generally only consider it fair and reasonable to provide their name and email address. The information considered fair and reasonable to provide varies by how trustworthy they consider the industry sector to be.

Most trusted organisations?

The survey asked respondents about the industry sector they trusted the most.

Somewhat surprisingly given the number of high profile breaches and the amount of data held, health service providers are the most trusted industry sector when it comes to the protection and use of personal information. This is especially true for older Australians (over 55 years old).

Following health service providers in the list of most trusted organisations are:

• Federal government agencies;
• Financial institutions
• Education providers

Less surprisingly perhaps, social media companies and real estate agencies are the least trusted industry sectors from the list surveyed. Two-thirds (66%) of Australians say they find social media companies to be ‘very’ or ‘somewhat untrustworthy’, with half (46%) saying the same of real estate agencies.

Australians definitely do not trust organisations to ‘do the right thing’ with the personal information of Australians. Less than half of people trust organisations to:

• store their information securely (46% ‘very trustworthy’ or ‘somewhat trustworthy’)
• use and share their information only for the purposes stated (42%)
• collect only the information needed (42%)
• give people access to all their personal information stored (41%)
• delete their information when no longer needed (30%).^[1]

What information are we comfortable disclosing?

Generally, we are happy to divulge our name and email address when accessing a service. From there, it depends on the type of organisation. However, we also generally consider providing phone number, date of birth and address as fair and reasonable.

The survey also shows that our inclination to provide information varies by industry sector.

There is more reluctance to supply some types of personal information, especially date of birth, to technology companies, retailers, real estate agencies and social media companies.  There is a really useful chart showing the type of information we generally think it is OK to share by industry sector.  (See Figure 34.)

This analysis support the contextual understanding of privacy – that our attitudes to what should be collected or shared often depends on the context (health service provider vs social media site).

Fair and reasonable use

The survey provides strong evidence that Australians are not OK with uses of personal information that are seen as more invasive including:

• Online tracking, profiling and targeted advertising to children and vulnerable adults;
• The sale or trading in personal information;
• Location tracking when not required for location based service;
• Targeted advertised using sensitive information;
• Scraping of personal information from online sites;
• Use of personal information as part of AI decision making that has significant effect on individual.[2]

Digital technologies

This section of the report covers biometrics, artificial intelligence and targeted advertising.

Biometrics

Australians’ attitude to biometric information being collected and used depends largely on the type of organisation and the context.

We are most comfortable with the collection and use of their biometric information in border security and law enforcement contexts, wit  moderate support for its use by the private sector for safety and security reasons.

The main areas of concern for Australians when it comes to uses of their biometric information are targeting and profiling for commercial purposes, or when the information is needed to access non‑sensitive services like entertainment.

We are more comfortable with using biometric to identify ourselves for passport control, banking, accessing government services or to use our own device. We are less comfortable where biometrics are used to access our place of work or study (45%) or to verify our age online (42%). Only a third are comfortable with it being used when they want to access a service provided by a business (36%) or enter an entertainment venue (33%).[3]

Artificial intelligence

Australians are cautious about the use of artificial intelligence (AI) to make decisions that might affect them, with 96% saying there should be some conditions in place before AI is used in this way. The conditions considered to be most essential before an organisation uses AI are that people:

• have a right to have a human review the decision (73%); and
• they are told AI is being used (71%).[4]

Interestingly, Australians are more comfortable with government agencies using AI that uses their personal information to make decisions about them than they are with businesses. One in five (20%) Australians are ‘very’ or ‘somewhat comfortable’ with government agencies using the technology to make decisions about them compared to 15% for businesses.

Targeted Advertising

If they must receive ads, just over half (53%) of Australian adults would prefer the ads are targeted and relevant to them. This has increased slightly from 48% in 2020.[5]

Support for privacy reform

The Commissioner is certainly using the survey to support the reform agenda. She notes that right now there is an opportunity to ensure the protections the community expects are reflected in the law, and points to strong support for government legislation that protects personal information.

According to the Commissioner: “We need to consider the laws and practices that will uphold our fundamental human right to privacy and meet community expectations, while enabling innovation and economic growth.”[6]

Remember, two of the main findings from this survey:

• Three in five (62%) Australians see the protection of their personal information as a major concern in their life.
• Eight in ten (82%) people care enough about protecting their personal information to do something about it, however 57% do not know what to do.

Let’s hope that attention is paid to these findings and that Australian get the privacy protections that many of them think they already have and that they deserve.  These should include greater transparency, education and enforcement activity to address the current confusion and lack of understanding of privacy rights and growing community concern about privacy.

And Australian organisations should all probably start thinking about how they can turn around the decline in trust in privacy practices of the Australian community,

References:

[1] https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey-2023#part-3-the-role-of-organisations

[2] Figure 36.

[3] Figure 51.

[4] Figure 54.

[5] Figure 56.

[6] https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey-2023#commissioner%E2%80%99s-foreword