plain.txt

In this episode we break down the OAIC's determination against Australia's largest rental technology platform ("RentTech") 2Apply.

After a year-long investigation, Privacy Commissioner Carly Kind found that 2Apply collected personal information far beyond what was reasonably necessary, and via means deemed unfair. The ruling is another example of the Commissioner's more assertive enforcement posture.

Noting the challenges in the housing market facing renters, we unpack how this determination might also matter more broadly to any situation where there's an imbalance of power. We also explore how the ruling applies the concept of "online choice architecture", in which the design of digital platforms can shape the decisions people make.

Australia is one of the world's top per capita users of AI, but outside of large enterprises many businesses aren't using it. In this episode, we speak with Lee Hickin, Executive Director of the National AI Centre (bio below) about what it will take to close the gap between awareness of AI and safe and confident adoption.

We explore current attitudes to AI in Australia, what the NAIC's data says about adoption across different sectors, and where Australia should position itself in the "AI risk vs AI opportunity" narrative.

Lee also shares his view of why getting this moment right matters not just for improving productivity, but to enhance Australia's place in the global economy.

BIO: Lee Hickin, Executive Director, Australian National AI Centre.

Lee has over 30 years’ experience in the technology industry, having been in technical, sales and business development roles. Most recently he was the CTO for Microsoft ANZ and then lead the Asia region for Microsoft’s global Responsible AI team.

Lee has worked across the UK, Asia, and Australia, before joining the Federal Government. In addition to his time at Microsoft, Lee led the Internet of Things team for Amazon Web Services in Asia Pacific, he was a CISSP security architect with RSA Security and worked at both Tivoli and IBM as a software engineer.

During his time in industry, Lee has supported Governments around the world as an independent contributor; having been a member of the Singapore AI-Verify Board and a founding member of the NSW AI Assurance Committee.

Today Lee leads the Australian National AI Centre (NAIC), with a mission to enable and support Australian Industry and society in its adoption of and acceleration through AI technology and services. He has a clear focus on the need for consistent and appropriate responsible safety mechanisms to support AI, balanced with the need to empower Australians with the confidence and trust in the positive and transformative potential of AI.

Lee brings the importance of technical understanding combined with the need for clear and unambiguous language as we help shape a future where AI will be a powerful enabler of productivity, growth and society broadly.

Links

This week we explore a shift in how social media platforms are perceived, which could open the door to them taking greater accountability for potential harms experienced by users.

The trigger is two recent landmark verdicts in the US. In California, a jury found Meta and Google negligent for the design of their platforms while in New Mexico, a jury ordered Meta to pay $375 million after it was argued the company misled the public about the safety of its platforms.

Is AI going to take all our jobs? This week we dig into this question, starting with a report from Anthropic released this year that cuts against the prevailing panic.

We identify some deeper and more nuanced impacts of AI on the labour force beyond the possibility of jobs disappearing - including the re-design of roles, the loss of insight that comes when we handover "mundane" work to AI, and the impact of AI on the next generation of workforce leaders.

We also explore the vested interests that exist to promote the narrative around mass workforce displacement.

Links

This week we take a closer look at the rapid spread of customer‑facing chatbots on websites and explore the growing risks that come with them.
While they often look like a simple website widget, chatbots are increasingly deeply integrated AI agents with access to sensitive systems, personal data and business processes.

We talk about some of the real‑world snafus that have occurred, and then step through the practical risk and governance considerations for privacy, security and AI teams.

Links:

To celebrate Privacy Awareness Week, Jordan sits down with Privacy Commissioner Carly Kind to reflect on the PAW theme, her time in the office so far, and what the future holds.

The Office of the Australian Information Commissioner’s (OAIC) chosen theme for Privacy Awareness Week is Trust is built here. In every privacy complaint. In every resolution.

In a wide-ranging interview, Jordan talks with the Commissioner about why she chose to focus on dispute resolution for this year’s PAW theme, and how the OAIC’s own approach to complaint handling is evolving.

With Commissioner Kind approaching the half-way mark of her five-year term, they also reflect on her time in the office so far, and what she still hopes to achieve.

They go deep on facial recognition and discuss what practitioners should learn from the Administrative Review Tribunal’s decision in Bunnings Group Limited and Privacy Commissioner.

Finally, they talk law reform — the Children’s Online Privacy Code, what to expect from tranche 2 of the Privacy Act reforms (and maybe even when), and the upcoming amendments to the Anti-Money Laundering / Counter-Terrorism Financing (AML/CTF) Act which will introduce new privacy obligations for real estate professionals, dealers in precious metals and stones, and certain professional service providers from 1 July 2026.

Links

This week Jordan is joined by Dr Kate Bower from the Office of the Australian Information Commissioner (OAIC) to discuss the biggest shake-up to online privacy for Australian kids in 25 years, and how you can have your say.The Children’s Online Privacy Code will set out new rules for the handling of children’s personal information by apps games and websites likely to be accessed by children or primarily concerned with the activities of children.

Kate and Jordan break down what’s in the code, where it comes from, and why it looks the way it does. They also revisit what the OAIC learnt from past consultation rounds, and how you (and your kids and your community) can have your say.

This week we unpack the dispute between Anthropic and the US Department of Defense and it what it says about AI governance more broadly.

What began as a contractual disagreement rapidly turned into a political and legal stoush that culminated in the designation of Anthropic as a US national supply‑chainrisk.

We break down the areas of concern - fully autonomous lethal weapons and mass domestic surveillance - and debate whether private tech companies should be allowed to constrain how governments use technologies like AI

Links:

In this episode we explore the implications of an Administrative Review Tribunal ruling that Australian retailer Bunnings was reasonably entitled to use facial recognition technology (FRT) to combat crime and staff abuse in its stores.

The ruling comes after a protracted dispute, with Bunnings appealing a 2024 determination by Privacy Commissioner Carly Kind that it had breached privacy laws in using FRT to scan customers' faces without their consent.

In our first episode for the year we revisit the big themes of 2025, and explore how they're shaping in 2026.

We discuss changing sentiments around AI, its impact on the online information ecosystem, the social media ban and ongoing focus on children's privacy, and how cyber threats are evolving in the AI age.

In this episode we break down the National AI Plan released by the Government in December.The plan broadly sets out how Australia will capture the opportunities of AI, how the benefits will be spread across the economy and how it guide the safe and responsible adoption of AI.
We debate whether the plan strikes the right tone, pursues the right opportunities and whether it does enough to manage the risks of AI.

AI chatbots are becoming increasingly intimate spaces, with people using them for companionship, therapy and as a helpful personal assistant.
While our interactions with chatbots like ChatGPT and Copilot get more personal, we're also seeing logs and transcripts of these interactions increasingly find their way to the public - via FOI requests, court orders and security and privacy breaches.
We explore the convergence of these opposing trends.

This week Arj is joined by elevenM colleague Brett Watson to breakdown the issues surrounding the rollout of facial recognition technology (FRT) across retail settings, stadiums and other venues in Australia.

The Privacy Commissioner recently ruled that the use of FRT by Australian retailers Bunnings and Kmart breached Australians' privacy. Bunnings is appealing the ruling, while Kmart is also considering an appeal - both arguing that their use of FRT is a proportionate response to issues like violence and theft in their stores.

With that as the backdrop, Arj and Brett debate the merits of privacy advocates' arguments against FRT.

**CONTENT WARNING** 
This episode contains discussion of suicide and mental health themes. Please contact Lifeline on 13 11 14 or Beyond Blue on 1300 224 636.

This week we discuss the rise of AI companions.
In the midst of a continued AI acceleration push in Australia, we discuss the emergence of several disturbing stories in which AI chatbots have apparently lead young people and adults alike to self-harm.
In the face of known harms, many of these AI chatbots continue to be designed primarily to increase engagement and - as some have argued - addiction and dependency.

This week we take a deeper look at recent high-profile cyber attacks, which have breached organisations like Qantas and Marks & Spencer.
For all the talk of technical sophistication, especially in the time of AI, hackers like Scattered Spider are relying less on fancy code and more on their ability to exploit gaps in our systems of trust.
We explore how the biggest vulnerabilities in our systems are sometimes found not in software flaws but in how we vouch for ourselves online, and the way we govern relationships between companies and their suppliers.

This week we revisit the conversation around banning under 16s from social media, and the range of technologies being considered to verify the ages of would-be social media users.
We examine the preliminary findings of a government-commissioned trial of age assurance technologies, as well as some independent media reporting on technologies in the trial.
The preliminary results have received mixed reviews, with particular concerns over the accuracy of facial recognition-based age estimation.

This week we explore growing tension between the importance of safeguarding user privacy online, and the public and social value that comes from researchers having access to growing volumes of data on social media platforms.
In recent years, researchers have used platform data to shed useful light on a range of issues including mental health, social and cultural dynamics, the evolution of democracy online ... but also, importantly, how the platforms themselves are managing domains like user privacy, content algorithms and content moderation.
In some cases, the inability to access the data safely has either thwarted research or led to unsavoury data access practices. 
We look at ways researchers could be granted safe and ethical data access, including legislated transparency requirements.

This week we discuss the increasing prevalence of AI generated content online (aka 'AI slop'), on social media and even in books, journalism and academic journals. 

We explore how AI tools are enabling the generation of slop at scale, unleashing a flood of low quality content that is degrading our information ecosystem, making it harder to access high quality, verified information, and even getting in the way of our ability to connect with other humans online.

Links:

This week we discuss the observable global shift in mood away from AI regulation and safety towards acceleration and innovation.

It's a trend we observed several episodes ago, but appears to be gathering further speed with announcements by global political and business leaders of the urgency of re-doubling efforts to enhance AI capability. With Trump setting the tone at a federal level in the US, lawmakers have even gone as far as proposing a 10-year moratorium on ant state-based AI laws.

We explore the implications of this mood shift for Australia, as a re-elected Albanese Government and its new Industry minister plot the way forward for AI in this country.

Links:

This week we're in conversation with Rys Farthing, who is Research Director at Reset.Tech Australia, a Not-for-profit that aims to develop evidence around digital issues so that policy makers can be more informed.

We explore some of the challenges for effective digital policy making in Australia and around the world, and discuss our hopes and expectations for the Children's Online Privacy Code.

If you're a regular listener, you'll know that Reset's work comes up somewhat regularly (both episode #120 about real time bidding and #93 about data brokers were based on research reports published by Reset, for example). We believe that there's a real need for the kind of work that Reset.Tech Australia does, to build an Australian evidence base around tech policy issues and solutions, and how they play out in the Australian context.

Links:

This week we discuss how recent turbulence in geopolitics is translating into impacts on the digital environment.

We explore how the Trump tariffs and general shift towards increased trade protectionism might impact a swathe of tech policy initiatives around the world.

We also look at the increasingly cavalier attitudes to security, privacy, and risk management from the US Government, primarily through the actions of the Department of Government Efficiency, and the extent to which such attitudes might affect Australia as we head to an election.

Links:

This week we discuss increased the scrutiny on how charities and not-for-profits manage the data they collect.
Several breaches in recent years have led the Australian privacy regulator to issue specific guidance on privacy obligations to the NFP sector, particularly warning them against the practice of retaining donor data longer than necessary.
We explore the challenges charities face in getting privacy and cyber security right, including limited knowledge and resourcing, and pressures to make use of data to fundraise more effectively.

Links:

This week Jordan is joined by fellow Victorian elevenM-er and OVIC alumnus Piotr Debowski to explore some of the challenges, trends and quirks of privacy complaints in Victoria and to introduce a new, free, elevenM resource: The Victorian Privacy Case Notes Database.

Piotr led the development of the database, which provides case notes and commentary on Victorian Civil and Administrative Tribunal and Victorian Supreme Court decisions involving the interpretation and application of the Information Privacy Principles (IPPs) from the Privacy and Data Protection Act 2014 (Vic).

This week we explore the how the Australian privacy regulator is transforming itself in an attempt to have a stronger impact - in the face ongoing funding pressures and a reform agenda that hasn't quite met the expectations of privacy advocates.

A year into the tenure of Carly Kind as Australian Privacy Commissioner, we are seeing a more public and vocal regulator, a series of targeted enforcement actions and the issuing of more frequent communications and guidance.

It's all part of a self-described transformation by the OAIC into a "more proactive, harms-focused regulator".

This week we dive into the hype and fear around DeepSeek, the Chinese AI start-up taking the tech world by storm.

We break down the apparent concerns driving the collective freakout over the app, which include bans by various national governments.

We also explore the broader takeaways for Australia's AI capability and ecosystem and the responsible AI movement.

We're back in 2025.

In this episode we break down Meta's decision to cease factchecking and permit dehumanising speech on its platforms.

We explore the likely motivations and impacts of these changes, and the broader takeaways for Australia.

Links:

Article about Meta's factchecking changes (Reuters) https://www.reuters.com/technology/meta-ends-third-party-fact-checking-program-adopts-x-like-community-notes-model-2025-01-07/

Analysis of factchecking changes (Platformer) https://www.platformer.news/meta-trump-pivot-messenger-themes-labor-zuckerberg-wishlist/

Detail on Meta's change to dehumanising speech (Platformer) https://www.platformer.news/meta-new-trans-guidelines-hate-speech/?ref=platformer-newsletter

Oped on factchecking changes (NYT) https://www.nytimes.com/2025/01/14/opinion/meta-fact-checking-policy.html

Article on response to factchecking changes (Guardian) https://www.theguardian.com/australia-news/2025/jan/08/australia-meta-ending-factchecking-facebook-misinformation-sarah-hanson-young

Meta explainer on its factchecking https://transparency.meta.com/en-gb/features/how-fact-checking-works/

For our final episode of 2024, we take an optimistic look at the year that was (after a bit of a throat clearing on the things that bugged us), and what we're looking forward to in 2025.

Our conversation covers developments in AI, privacy reform, social media and the growing digital rights community in Australia.

We'll be taking a break over the summer holidays and will be back in late January.

This week we discuss the Australian Government's plan to make 16 the minimum age to access social media.

The plan has broad political support and resonates with many concerned parents, but there's more to it than meets the eye.

We discuss the specifics of how the ban will be implemented (with key elements not yet solved and potentially problematic), and interrogate the underlying philosophical approach of banning social media for kids rather than seeking to make the platforms less harmful for everyone.

Links:

Awareness is growing that the power of many AI tools derives from the fact that they are trained on our personal information.

We discuss how regulators (like Australia's OAIC) are now stepping up their expectations that privacy obligations be adhered to by developers and deployers of AI.

We also explore the case study of Australian start-up harrison.ai - whose AI tool was trained on hundreds of thousands of medical images - and which recently brought the issue of privacy and AI into the spotlight.

Links:

This week on the podcast, our eyes are opened to a remarkable online advertising practice called "real-time bidding". RTB is where an auction involving the sensitive information of online users is initiated as they load up a web page, with advertisers bidding for the space on the page.

Recent reports from Reset.Tech Australia and the Irish Council of Civil Liberties reveal the practice has led to the exposure of sensitive information about users - from purchasing habits through to real-time location and insights into their mental health - and is also fuelling scams and national security concerns.

We discuss the broader implications of this practice, and the options for managing the risks it poses.

This week on the podcast, we're looking at a promising development in helping Australian organisations manage AI risks.

The Australian Government has released its Voluntary AI Safety Standard, as part of its safe and responsible AI agenda. The Standard features 10 guardrails as a practical blueprint for how Australian organisations can safely and responsibly use and innovate with AI.

We provide our take on the Standard and assessment of the challenges in seeing it adopted across the economy.

Links:

After five years of consultation on privacy reforms, the Federal Government has finally introduced legislation into the parliament. Its been billed by the Attorney General as the "first tranche" and a "first step", with promises of more reforms to come.

In this episode, we share our reaction to the bill and break down what's in and what's been left for a later day.

We also explore why comprehensive privacy reforms seem so hard to legislate, particularly as the Government seeks to introduce a suite of other tech reforms and obligations on topics such as social media, AI and digital identity.

**Correction** - at around 6 minutes in, Jordan says the OAIC's new 'speeding ticket' infringement notices can be up to $62,000. Infringement notices can actually be up to $330,000 for companies.

This week, Arj is joined by elevenM colleague Jonathan Gadir to discuss the small business exemption to the Privacy Act.

The exemption means that businesses with an annual turnover of $3 million or less are generally exempt from complying with the Act.

We explore the pros and cons of the exemption, and whether the government is is likely to remove the exemption as part of current reforms to the Privacy Act (as has been proposed).

Links:

Is there anything about you on the internet you wish you could take down?

This week Arj is joined by Jonathan Gadir to discuss the "right to be forgotten" or "right to erasure" - a provision in data protection regulations overseas that is being considered as part of the reforms to the Australian Privacy Act.

Overseas, the right has enabled individuals to have newspaper articles about them de-indexed from search engines.

We discuss the merits of the right, competing values like freedom of expression, and the prospect of it being implemented in Australia.

This week, Jordan is joined by elevenM colleague Jonathan Gadir to break down the stoush between Elon Musk and Australia's eSafety Commissioner.

In recent weeks, Musk and his platform X have resisted calls to globally remove content related to a stabbing event in Sydney in April. The standoff has opened up a conversation about the merits of regulating so-called harmful online content, and the extent to which doing so impinges on free speech.

Jordan and Jonathan debate the merits of the eSafety Commissioner's actions and its powers, the feasibility of the global takedown requests, and the potential future consequences of these orders.

Links:

In this special episode for Privacy Awareness Week, Jordan sits down with Australia’s Privacy Commissioner Carly Kind.

It's a great chat, covering the Commissioner's first impressions of the role, her professional background and how it shapes her approach, her regulatory priorities and what she hopes to achieve as Privacy Commissioner, and of course the PAW theme - what it's all about and how you can get involved.

Links