Navigating the New Privacy Landscape in Australian Staffing & Recruitment

Lately, I’ve observed a tendency on the part of many organisations to attempt give their privacy policies contractual effect. That is to say they go beyond merely articulating the organisation’s policy on privacy and attempt to impose contractually enforceable obligations upon individuals whose personal information they collect. Typically, terms of use that may appear on a website will refer to a separate privacy policy and say something like: Our privacy policy forms part of these terms of use. Does this serve any purpose; or is it merely a dangerous nonsense adding unnecessary layers of complexity and ambiguity? If the attempt to give contractual effect to the privacy policy is buried in separate terms of service, does it meet privacy openness and transparency requirements? The Dual Nature of Privacy Policies Historically, privacy policies have been informational. Their primary aim is to inform individuals about how their data is collected, stored, and used. However, a rising trend sees organisations imbuing these documents with contractual undertones, presenting potential legal complexities and challenging the primary essence of such policies. Consent and Contract While permission and consent might sound synonymous, their implications in the realm of contract law differ significantly. Genuine consent to enter into a contractual relationship entails informed agreement, without any semblance of coercion. In many data protection frameworks, individuals have the right to withdraw their consent at any time, and it should be as easy to withdraw as it was to give. But in contract law, once parties have provided consent to a contract, they can't simply withdraw it without potential legal consequences unless the contract has provisions for termination or there's a breach. By juxtaposing informational transparency with contractual obligations, are we truly achieving informed and voluntary consent? Are we fettering the ability to withdraw consent? Might we be misleading individuals about their right to withdraw consent, depriving them of important aspects of control over their personal information? Limitations of Liability And what should we say about contractual limitations on liability. Let us say that that website terms of use, which import the organisation’s privacy policy as though it were a set of additional clauses also says something like: We're not responsible for any harm or loss you might face from using our website, including any information on it or if someone accesses it without permission. Where does that leave an individual who does suffer harm or loss as a result of a data breach or other misuse of their personal information? Might the “no responsibility” statement be a misrepresentation regarding the existence of legal rights and remedies established under privacy law? Overreach and Australian Consumer Law The move to bestow contractual weight upon privacy policies can inadvertently infringe on established Australian Consumer Law, particularly when it comes to unfair terms in standard form contracts. The intertwining of these broad limitation clauses with statutory privacy provisions not only muddies the waters but raises important questions about "unfairness" and hence, enforceability. Conclusion & Call to Action As we advance into the digital age, the distinction between privacy policies as informational guides versus contractual tools may prove to be critical – especially in the shadow of a developing common law or statutory cause of action for breach of privacy. Perhaps it’s time regulators, legal experts, data protection officers, and industry professionals engage in a dialogue to navigate this complex terrain. Do you have thoughts on the matter? Are informational policies being weaponised as contractual tools? Is it just a case of lazy, thoughtless or sloppy drafting? I hope you’ll Join the conversation and help steer the future of data privacy in the right direction . Endnote To the regulators, professionals, and privacy enthusiasts reading this – your insights and expertise are invaluable. We urge you to share, comment, and contribute to ensuring a transparent, ethical, and legally sound digital landscape. Andrew C Wood in collaboration with Open AI's ChatGPT