Individuals should have more control over the data collected about them, a draft report from the Productivity Commission has recommended.
If the recommendations contained in the draft report are implemented, consumers will be more easily able to transfer data that has been collected about them from one organisation to another, as well as opt out of some forms of data collection.
The government in March revealed it had commissioned an inquiry into the use of public and private sector data by individuals and organisations.
The draft report, published today, recommends that individuals “should have a Comprehensive Right to access digitally held data about themselves”.
This would entitle an individual to:
• continuing shared access with the data holder
• access the data provided directly by the individual, collected in the course of other actions (and including administrative datasets), or created by others, for example through re-identification
• request edits or corrections for reasons of accuracy
• be informed about the intention to disclose or sell data about them to third parties
• appeal automated decisions
• direct data holders to copy data in machine-readable form, either to the individual or to a nominated third party.
The report says individuals should also be able to opt out of a data collection process subject to a number of exceptions, such as data collected as a condition of continued delivery of a product or service to the individual; data collection that is necessary to satisfy legal obligations or legal claims; or data collection necessary for a specific public interest purpose.
“Surprising though it may be to many, individuals have no rights to ownership of the data that is collected about them. Data is increasingly an asset, and when you create an asset you should have the ability to use it, or not, at your choice,” Productivity Commission chair, Peter Harris, said in a statement.
“We are proposing the creation of a Comprehensive Right to data control for consumers that would give people the right to access their data, and direct that it be sent to another party, such as a new doctor, insurance company or bank. Plus an expanded right for people to opt out of data-collecting activities. And existing privacy laws would all remain in place.”