Privacy law

Could companies be doing, uh, doing more? Uh, where, where do we sit from a regulation point of view?

Um, we have the Information Privacy Code, which has some reasonable safeguards, but, you know, as with the Privacy Act, there's not a lot of, um, stick involved in this kind of thing.

And also, countries like UK and Australia demonstrate that you can have higher healthcare-specific cybersecurity obligations, and that could be stronger minimum standards, things like, uh, using multi-factor authentication, patching, monitoring.

And then there's the question of whether it's self-regulation or whether it's self-assessment or actually some sort of orders of policy.

So the approach would vary depending on what it is that you're there for, but I think those things are really key, is how you involve them and the language that you wrap around it, doing with people rather than doing to them, tends to help soften the blow sometimes.

So how do you approach a situation in your organisation where you can be observing someone doing their work and you can see that they that they're using ai either they're putting identifiable case notes or client medical records, or they're doing something that would breach the Privacy Act.

And you can actually see it there and then.

Have you seen that? And what's been your response when you have seen that?

Yep.

i read some research by melbourne business school 2025 60 percent of people employees in the survey admitted to using shadow ai 48 admitted to doing it knowing it was breaching a company policy so that's almost half of people were using it but knowing what they were doing was in a situation of the what the company told them not to do So one of the challenges that I find with working with organisations is, and it's a bit like your IT strategy, it's about when you first start working, like how big is the problem? Where does it start and where does it finish? And where's shadow AI being used? What real AI is being used? What are the use cases for it? What does that look like from a quality perspective?

It's, look, the Privacy Act, clearly requires and that the Australian privacy principles that fall under it.

There to be both governance and technical securities in place.

But the problem was there was a separate lawsuit that had already been filed before that settlement with the League of Women Voters that said in the D.C.

Circuit and the D.C. District Court, no, no, no, giving this database for voting purposes violates the Privacy Act that governs Social Security and other privacy information.

And so that's the debate we're having here.

In June, that D.C. federal judge you referenced found administration officials haphazardly combined and repurposed the private information of millions of Americans, including citizenship data that they knew to be unreliable.

Well, there's two different issues.

So the first issue is that it violates the privacy of people because this data was compiled not for this purpose.

So the point is that whenever under the Privacy Act, the government uses your data for information that was not for the purpose that it was originally intended.

basically designated for, then it violates the Privacy Act.

I'm doing good, thank you.

Um, yeah, I just wanna comment on one thing you briefly said there about the Privacy Act.

You've, you made a good point, like it's just the family, but it's being publicly made in the school system.

All the other students are made aware of it-

I mean, while New Jersey state courts have consistently blocked parental notification, the federal courts are shifting away from that, which is creating, um, the openings for these lawsuits that are coming.

I mean, this past spring in March, the, the case I was talking about earlier, Mirabelli versus Bonta, um, you have the Su- US Supreme Court intervening in a California case, um, and indicating that parents are highly like- likely to succeed on their First and 14th Amendment claims, uh, regarding notification.

While California tried to, right, to kill parental notifica- uh, parental notification, the US Supreme Court got involved and said, "Yeah, no, rethink that." And then there was also a case earlier this year where the federal government found that state policies that instruct schools to h- uh, hide gender support plans from parents were in direct violation of the Family Educational Rights and Privacy Act, FERPA.

Um, the, the DOJ and the nationwide US Department of Education ruled that parents have an absolute statutory right to inspect all educational records of their minor children.

Four, proposed provisions specifying that the USPS shall provide each state with a list of individuals mail-in and absentee participation lists who are enrolled with the USPS pursuant to a process specified in the rulemaking directed by this subsection for mail-in or absentee ballots provided by such state, along with unique ballot envelope identifiers, such as barcodes for mail-in or absentee ballots provided to such individuals.

Pre- preparation and transmission of each state-specific mail-in/absentee participation list shall comply with the private- Privacy Act and all applicable use agreements.

[clears throat] Five, proposed procedures enabling each state to routinely supplement and provide suggested modifications or amendments to the state's mail-in and absentee participation list in advance of any federal election consistent with applicable state law.

The U- C, the USPS shall coordinate with the USPS Office of Inspector General and the Department of Justice for investigation of suspected unlawful use of the mail involving federal election materials.

D, the Attorney General shall enforce compliance with the applicable federal stat- referenced herein and provide guidance to election officials, including any instrumentalities, their contractors, individuals involved in the administration of federal elections, or public or private entities engaged in the printing, production, shipment, or distribution of ballots.

C, the Secretary of Homeland Security shall, within 90 days of the date of this order, establish the infrastructure necessary to comply, maintain, and transmit the state citizenship list described in Section 2A of this order and shall designate a point of contact within DHS to receive and process requests from individuals and state election officials regarding the relevant state citizenship list.

The Commissioner of SSA shall provide all necessary citizenship and identity data to the Secretary of Homeland Security in support of this requirement, consistent with applicable law, Privacy Act, and all applicable use agreements.

[sighs] And that is that.

In the United States, if investigators really believe that there's some urgency that a search of the computer will run in the event of a killing again, they might obtain an emergency warrant, which can be easily obtained through a formal assembly.

The United States Electric Communications and Privacy Act has a provision that allows internet service providers to disclose describing information to law enforcement in distinguished circumstances.

So, why won't they get in this? 'Cause everyone has Wi-Fi, they can get that information.

This, this stuff wasn't even done.