Public Policy Agenda 2024-25

Looking at 2024 and beyond, technology such as quantum computing, blockchain, 5G connectivity and connectivity infrastructure and overall digital platforms and trade exist against a complex backdrop of increased regulation, online safety, sustainable use and investment. This interplay of emerging technology, regulatory and policy processes and investment continues to shape how Australians utilise and consume the internet.  

Building on our inaugural Public Policy Agenda 2023-24, auDA maintains that it is crucial for Australians to be well informed about their rights and are enabled to access and utilise the internet with confidence. auDA continues to advocate for a ‘people-first’ approach to digital transformation in this age of technological innovation change.   

In 2024-25, we continue our focus on three priority areas: (1) cyber security, (2) privacy, and (3) digital identity. These areas continue to be topics of public concern and substantial regulatory and policy attention. auDA notes that tech policy cannot be viewed in silos as policy intersects and impacts other policy areas in a converging digital world.

Cyber threats are an ongoing concern for Australians. The Australian Signals Directorate Cyber Threat Report for 2022-23 reveals a significant rise in cyber threats against the Australian government, critical infrastructure, businesses, and households. The report notes a 32 per cent increase in calls to the Australian Cyber Security Hotline and a 23 per cent rise in cybercrime reports, with ransomware attacks and escalating costs of cybercrime being key concerns. The average cost of cybercrime per report also surged by up to 14 per cent across businesses of various sizes, highlighting the ongoing and evolving threat landscape. Similarly, auDA’s Digital Lives of Australians 2024 research report reveals that 77 per cent of consumers surveyed have experienced some form of cyber security concern.

Thus, cyber security is vital to people’s digital lives and is a key requirement for a healthy digital world. Addressing economy-wide cyber security concerns requires new skills and behaviours to be adopted by everyone in the online world. That is why auDA thinks about cyber security issues broadly, in the context of the digital economy and society.

auDA welcomes the Australian Government’s 2023-2030 Australian Cyber Security Strategy that released on 22 November 2023. In April 2023, auDA lodged its submission to the consultation on the strategy. The whole-of-nation approach to cyber security is appreciated by auDA, and it is promising to note the support for the multi-stakeholder approach to internet governance set out in the Strategy. auDA looks forward to supporting the National Cyber Security Coordinator, appointed February 2024.

auDA believes cyber security is an important risk to the digital wellbeing of Australians. It is, and should be seen as, ‘a means to an end’ i.e., a risk to be managed. Like the way food security or energy security is managed, cyber security matters and its impact on digital policy and strategy, should always be considered broadly and not through a narrow national security lens. 

Stronger cyber security is an essential element in improving the digital lives of Australians. If it is pursued with appropriate balance alongside needs for innovation and ongoing investment, the outcome will be a continued development of new products and services that contribute to Australia’s digital economy and society. 

Our ongoing advocacy shares this perspective, as our operational work contributes to stronger cyber security by minimising DNS abuse and investing in a strong and resilient .au.

Australians share vast amount of data via the internet. auDA’s Digital Lives of Australians 2024 research report reveals that 64 per cent of consumers and 55 per cent of small businesses surveyed avoid online activity altogether due to concerns about data breaches. In addition, the Consumer Policy Research Centre’s and UNSW’s research highlights that 70 per cent of Australian feel they have mediocre control over their data disclosures. These concerns illustrate why privacy, anchored in a robust legal framework, is foundational to protecting Australians’ rights and freedoms in the digital world.

Following the Privacy Act Review report of February 2023, the Australian Government released its response on 28 September 2023. Substantial changes to the Privacy Act 1988 are expected to be released in late 2024. It is expected that the legislation will be updated to accommodate technological changes (specifically around how Australian’s data is collected and shared in the modern world), increase protections and enforcement while enhancing clarity, simplicity and control for consumers over their personal information and data. As of the time of writing this agenda, the legislation is still to be released.

auDA believes that privacy principles and laws should encourage organisations to minimise the collection, retention, and utilisation of individuals’ personal and sensitive information. Breaches of such obligations should attract meaningful penalties.

By giving Australians more control over their data and who their data is shared with, and minimising data breaches, their trust and confidence in the online world can be enhanced. Law and policy should lessen needless instances of the collection, retention, and use of personal information, thereby reducing the negative consequences associated with data breaches.

As the online world becomes more immersive and personalised, the role of the digital identities of Australians grows in importance. This requires a robust digital identity system that sees continual improvements to the security and useability of Australians’ digital identities while protecting data and ensuring that requests for access to data are appropriate.

In a modern digital world, digital identities are critical enablers to express who we are online. That is why the design and adoption of digital identity systems must take a human-centric approach.

auDA views a trusted Digital ID system as a critical component of a trusted internet. We welcome the Digital ID Bill 2024 and the Digital ID (Consequential Provision) Act 2024. This legislation will come into force in late 2024. During the consultation phase of these Bills (2023), auDA lodged a submission to the Department of Finance. Recently, the government announced the Trust Exchange (tEX), a new investment project to digital identity infrastructure that utilise the current myGov and MyGovID systems to give Australians more control over data sharing. These laws and development will see Australia’s approach to Digital Identity be potentially class leading once they are fully operational. This development in Australia is in the context with the European Union’s eIDAS 2.0 regulation that establishes EU-wide Digital Identity wallets, which came into force in May 2024.

auDA believes that trust in the security of one's own sensitive data, in addition to a user-friendly design, are prerequisites for a successful implementation of the digital identity system and the greatest possible acceptance among individuals and businesses. Thus, the voluntary-use nature of the forthcoming Digital ID system for individuals and its phased implementation, along with the human-centric approach to privacy, accessibility and usability of the laws are welcomed by auDA.  

As noted, auDA supports the voluntary nature of Australia's system. Alternative options for access to services must remain available to people who cannot or decide not to register and use a Digital ID. We note that a multi-stakeholder approach, led by the Digital ID regulator, could help maximise the acceptance and use of Digital ID among Australians and minimise fragmentation and obstacles to uptake as well.

We reiterate our support for ongoing development of a national Digital ID system that will assist in improving the privacy of personal information and the security of identity information. By embodying fundamental privacy protection principles in digital identity technology, such systems can help mitigate cyber threats and identity fraud. Offering secure and easy-to-use services with verified identity information helps minimise the collection and storage of personal data as individuals interact online.