Australian Human Rights Commission Human Rights in the Digital Age: Additional Material Submitted to the UN Global Digital Compact, 30 April 2023 3 Protection of data 14. One of the key issues which must be addressed in protecting data is the consideration of how government and organisations can best protect individual users’ data. 3.1 Informed consent model 15. Although there is always a need to improve digital literacy skills to empower people to make informed decisions about how their data is used, this in isolation is insufficient in protecting data. Relying too heavily on digital literacy training places too great an onus on users to protect their data. Models of data protection which seek to place the onus on individuals, and not the organisations that seek to utilise that data, are problematic. 16. Australia has adopted a regulatory model which primarily places the onus on individuals to protect their data. For example, users are often asked to accept the terms and conditions of long and complicated collection notices and privacy policies, in exchange for a product or service.1 Collection notices are often difficult to understand, making it challenging for users to appreciate what information is being collected and how it may be used. This is supported by the Australian Competition and Consumer Commission’s (ACCC) Digital Platforms Inquiry – Final Report, which highlighted how lengthy and complex documents were exacerbating issues surrounding transparency.2 17. Research has also shown the emergence of ‘dark patterns’ which confirms that the use of manipulative and deceptive designs can cause significant harm.3 This can lead to individuals losing control of their data or being manipulated into making choices which are not in their interests.4 18. However, even where an individual understands how their data may be used, they are often ill-equipped, in practice, to do anything about it due to the immense power imbalance between ‘lonely individuals’ and monolithic organisations. There is a very limited ability for individuals to negotiate how their data is used, as such terms are provided on a ‘take-it-or-leave-it’ basis. 19. This ‘take-it-or-leave-it’ approach by organisations can lead to excessive data collection inconsistent with the wishes of the individual.5 It also requires individuals to either accept the terms or not engage with the provided service. In the modern era, where online engagement has become integral to everyday living for many, this is no real ‘choice’ and doesn’t offer meaningful protection of data.6 5