Deloitte Australian Privacy Index 2021

Media releases

Deloitte Australian Privacy Index 2021: Australians demanding more control over their personal information

Concerns with increased tracking online through cookies and use of AI

6 May 2021:  Australian consumers want  greater control over their personal information collected by organisations online more than ever.

The 2021 edition of the Deloitte Australian Privacy Index – the firm’s seventh annual assessment of consumer views on privacy, and the privacy practices of leading Australian consumer brands – finds that the overwhelming majority of consumers think that information used to track them online should be protected by the Privacy Act, bringing that information within scope of individual citizen rights. When made aware of the right to erasure that exists as an individual right in privacy laws in other countries, they expressed a desire to have this right included within Australian law.

They have also expressed concerns over the increased use of AI by businesses, with a lack of trust in AI-made decisions and an inability to challenge, or have control over, decisions they feel have been made through machine learning.

Understanding the balance between consumers’ desire to act on this right, and organisations’ ability to effect it, is key to developing law that protects both consumer and business interests.

The Index report focuses on three key areas:

  • Right to erasure (also known as the right to be forgotten – an an individual’s ability to request a brand to delete all personal information it holds about them, and requires the brand to do so)
    • 79% of consumers would use the right to erasure if it were available, but only 5% would trust all brands to action a right to erasure request
    • Consumer comfort in providing personal information to brands would increase by 15% with a right to erasure option
    • 71% of brands are concerned about the interaction of the right to erasure with existing records retention requirements
  • AI and automated processing
    • 58% of consumers are concerned about the use of AI in society generally, while 79% said being informed about the use of AI would alleviate this concern
    • 71% of brands don’t mention AI in their privacy policy
  • Targeted online advertising (when an organisation matches the advertisments shown to an individual to that individual’s habits and interests as collated from their online activities)
    • 89% of consumers think information used to track them online should be protected under the Privacy Act
    • 85% are concerned about internet cookies that track their activity online to sell to other companies
    • Only 4% of brands provided a cookie banner pop-up that appears on a website letting visitors know their data is being collected
    • 57% of consumers want to set their cookie preferences once and have all brands use those preferences
    • 71% of consumers said they were concerned when seeing online ads for a product or service shortly after discussing the product near their device or searched for the product using their device.

Deloitte National Privacy and Data Protection Lead Partner, Daniella Kafouris, said: “As a resut of COVID, technology has had to move more rapidly than ever to ensure that we have been able to stay functional, connected and productive.

“We have had to adapt, adopt and accept to live in this new world of remote working and this has increased our use of the likes of online shopping, contactless payments, and virtual or digital health care.

“The pandemic, and this associated digital acceleration, has therefore also cast a stronger light on data privacy, accelerated the focus on this as a non-negotiable, essential human right, and put pressure on global privacy laws to adequately protect consumer rights and freedoms.

“Even more than before, our digital habits, health, interests, and curiosities have not only been tracked, but have shaped what is presented back to us. This can be a positive and beneficial experience, but consumers are generally  frustrated when it comes to wanting take back control of their personal information.

“They want brands to be more transparent. They want brands to support, for example, their ‘right to be forgotten’, to not have cookies track their online activities, and to be be able to better undertand a business’s use of AI when it comes to online interactions.

“On the upside, there are also business benefits across these areas. For example, consumers are more comfortable providing additional personal information to brands if this right to erasure exists.

“The digital acceleration that has taken place due to the COVID-19 pandemic puts pressure on global privacy laws to adequately protect consumers’ privacy. Australia is in the privileged position of having our legal review and reform process currently underway, meaning this digital acceleration can be factored into the future legal protections we afford Australian consumers.”

The Deloitte Privacy Index covers 10 industry groups. As it focuses each year on a different privacy element, it should not be treated as a like-for-like comparison year-on-year, and sector rankings have shifted from 2020.

The information technology industry has jumped from third to first position, while retail has fallen from first to fifth. Positions 8, 9 and 10 are taken by financial services, energy & utilities and telecommunications & media respectively.

“These rankings are perhaps unsurprising when focusing on the future of privacy in Australia,” Kafouris said. “These industries that have dominated market share historically, such as financial services and energy, have legacy systems that may present difficulties with any future changes to the Privacy Act, whereas the industry that is largely driving technological advancement across Australia, being IT,  may be better placed to pivot to new individual rights or requirements around AI and online advertising.”

au-risk-previous-rankings-2x1.jpg (965×360)

The report also outlines five key actions brands can take to improve their performance across three areas covered by the Index report:

  1. See the business benefits of the right to erasure – Although the potential of an introduction of the right to erasure is a concern to brands, there are also business benefits of introducing this right, with consumers more comfortable providing additional personal information to brands if the right exists
  2. Be transparent about the uses of AI and automated processing – Clearly indicate to consumers where AI or automated processing is being used. They want to know what personal information is being used in AI decision-making and what, if any, personal information is calculated or discovered about them using AI
  3. Provide human sign-off for material AI-based decisions – Consumers trust decisions made by humans more than those made by a computer. Clearly communicating that all decisions with a material or significant impact on consumers will have human sign-off will help build trust in those decisions
  4. Track the third-party cookies used on your website – Tracking the third-party cookies that are dropped from your website onto consumer browsers will allow a business to understand which third parties are collecting the personal information of its customers and determine whether they have been appropriately informed of this collection
  5. Involve the privacy team in online targeted advertising activities – Include privacy within decisions being made about targeted online advertising to ensure the rights of the individual are protected, as cookies gather more and more information about their habits, interests and values.

About the Deloitte Privacy Index: For the 2021 Index, Roy Morgan Research surveyed more than 1000 Australian consumers. The websites of 50 leading Australian consumer brand websites was also analysed according to a question set developed from topics raised in the federal Attorney General’s Issue Paper for the review of the Privacy Act, and based on responses received in the 2020 consumer survey. Inputs included each brand’s privacy policy and its consumer facing website. A publicly available cookie scanning tool was used to test the brands’ websites for non-essential cookies. The 2021 brand analysis was also broadened to include a survey of some of Deloitte Australia’s most prominent consumer serving clients.

Media contact:

Simon Rushton
Corporate Affairs & Communications
M: +61 450 530 748
T: +61 2 9322 5562

Did you find this useful?