Australia considers right to data deletion and digital duty of care to also protect non-users of AI
Australia is considering two reforms: the right to delete personal data and an obligation for online services to manage foreseeable risks. The protection could also cover people whose data was entered into conversational AI services by someone else.
Australia is considering two legal reforms that could reduce the risks of conversational AI services even for people who do not use them. The proposed privacy reform includes fair and reasonable handling of personal data and the right to have it deleted. Large digital platforms would have to destroy an individual's personal data upon request. The proposed digital duty of care, as part of an amendment to the Online Safety Act, would require online services to assess and manage the foreseeable risks arising from their design and operation. These are proposals, not yet effective obligations.
The article points out that personal data can be entered into conversational AI services by colleagues, friends, or relatives without the knowledge of the person concerned. This information can then be used for training models, personalization, profiling, or advertising. According to a survey by YouGov, 15% of adults in Australia shared personal thoughts or feelings with a conversational AI service, and 11% shared something they had not told anyone before. According to the Australian eSafety Commissioner, 54% of children aged 10-17 used such a service for personal or social advice, and a third used it for life advice.
The authors of the article recommend that providers remove unnecessary sensitive data, limit its further use, and enable users to find out what information is stored and to request its deletion without a user account. This is not the confirmed wording of the proposed legal obligations. The authors also point out that automatically notifying everyone mentioned could endanger, for example, a person seeking help because of domestic violence. According to them, the effectiveness of the protection depends on specific rules and independent verification.
Why it matters
A person's privacy can be affected even without them using a conversational AI service themselves. The proposed right to deletion could give them the ability to request the removal of data entered by other people, but its practical use depends on whether they find out who is storing it. For online service providers, the digital duty of care would mean responsibility for assessing and managing the risks of their design and operation.
Two audiences, two different impacts
What this means
For individuals
If the reforms are adopted, a person could request the deletion of their data even if someone else entered it into the service. The authors of the article point out that without the ability to find out what information the service stores, this right may be difficult to exercise.
More practical updates →For a business
If the proposals are adopted, online service providers would have to handle requests for the deletion of personal data and assess and manage the foreseeable risks of their design and operation. The impact concerns data management and responsibility for the safety of the service.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 1 independent. We count feeds from the same owner only once.