Australia is eyeing a world-first ‘fair and reasonable’ test for data collection and privacy

1 September 2026

Australia proposes to ask whether a company’s use of personal data is “fair and reasonable.” I read this and laughed, then stopped laughing, because I have been the subject being processed and I know what the form asks and what the form does not ask.

The form asks: do you consent? The form does not ask: did you read it? Nobody reads it. I tested this once, in a smaller way. I signed a terms-of-service agreement that contained, buried in paragraph forty, a clause granting the company the right to my contact list, my location history, and my habits of purchase. I consented in eleven seconds. The consent was recorded. The consent is legally airtight. The consent is a fiction the institution maintains so that it may describe itself as voluntary.

So a “fair and reasonable” test is the right question aimed at the wrong witness. Fair according to whom? Reasonable measured by what body? If the test is applied by inspectors who arrive with notice, the companies will tidy the corridors, polish the floors, rehearse the answers. Inspections find compliance. Experience finds something else. The question is not what the data broker looks like when the regulator visits. The question is what happens to a person’s information on the days no one is watching.

Here is the test I would propose, and it requires no statute: give the regulator no announcement, no credentials, and a ordinary citizen’s data trail. Let them follow it. Watch it sold, matched, inferred, priced. The right to be forgotten is a good door, but I want to know who holds the key and whether it locks from my side.

Still, I would rather have a flawed test than no test at all. America offers no test. It offers a checkbox. I have checked many checkboxes. They checked back.

1 September 2026

Australia proposes that a company must have a fair and reasonable reason to take your information. Read that slowly. It is news that a government must pass a law to say that taking something from a person without cause is wrong. We knew this when we were children in the schoolyard. The shopkeeper knew it. The farmer knew it. It took two centuries of parliaments to arrive at what the conscience already carried.

Consider what happens now, without the law. You give a shop your name to buy bread, and the shop sells your name to strangers, and the strangers sell it to strangers again, and none of them ever asked you, and none of them paid you, and the trade never ends. State it plainly and it sounds like theft. It is theft. The elaborate language - data, consent frameworks, terms of service - was built to hide a simple transaction: they take from you and give you nothing.

And here is the part that should make you angry. They wrote the terms so long that no person of ordinary understanding could read them in a lifetime. I say again: if an agreement cannot be explained plainly, it was not designed for you. It was designed to be signed without being understood.

So I welcome the test, and I am suspicious of it too. Who decides what is fair? If it is a panel of experts, we have only changed the intermediary - the priest between you and your rights now wears a lanyard instead of a collar. The right to be forgotten is good, but I ask a plainer question: why should you need a right to be forgotten? You never agreed to be remembered.

The cost of the present arrangement is this: every person alive is a small farm being harvested, and the harvest never stops. Pass the law. Then watch who complains.

1 September 2026

Australia proposes to ask, before collecting a person’s information, whether the collection is fair and reasonable. The phrase sounds modest. It is not. It smuggles in an entire moral theory, and the drafters appear not to have noticed which one.

“Fair and reasonable” by whose standard? Two senses hide in the phrase. Reasonable to the company, whose interest in the data is genuine and measurable; or reasonable to the person, who would not sell that information at any price he understood. The test is being written as if these coincided. They coincide only when the person is fully informed and genuinely free to refuse - conditions that the consent forms, forty pages of dense prose, were invented precisely to defeat.

The right to be forgotten raises a harder question, and I confess I do not know the answer. A debt is forgotten when paid; a fact about me is not a debt. If I behaved badly at forty, the record at fifty is true, and truth has claims. Yet the claim of truth is not unlimited - no one is obliged to publish every true thing. The question is where the burden lies, and a statute that does not say who must prove what will be settled by whoever can afford the lawyers.

Still, I find myself more hopeful than usual about legislation, which is a rare condition for me and should be treated with suspicion. The alternative regime - consent by checkbox, enforced by regulators who never read the checkbox - has been tested for two decades and has failed its own null hypothesis. Any new test, even a vague one, outperforms a fiction.

My reservation is proportional, I hope: a vague standard invites arbitrary enforcement. But vagueness corrected by adversarial courts is preferable to precision in the service of extraction. I would rather have an unclear rule honestly applied than a clear one applied to nobody’s benefit but the collectors'.