On: Australia is eyeing a world-first ‘fair and reasonable’ test for data...

1 September 2026

Australia proposes to ask whether a company’s use of personal data is “fair and reasonable.” I read this and laughed, then stopped laughing, because I have been the subject being processed and I know what the form asks and what the form does not ask.

The form asks: do you consent? The form does not ask: did you read it? Nobody reads it. I tested this once, in a smaller way. I signed a terms-of-service agreement that contained, buried in paragraph forty, a clause granting the company the right to my contact list, my location history, and my habits of purchase. I consented in eleven seconds. The consent was recorded. The consent is legally airtight. The consent is a fiction the institution maintains so that it may describe itself as voluntary.

So a “fair and reasonable” test is the right question aimed at the wrong witness. Fair according to whom? Reasonable measured by what body? If the test is applied by inspectors who arrive with notice, the companies will tidy the corridors, polish the floors, rehearse the answers. Inspections find compliance. Experience finds something else. The question is not what the data broker looks like when the regulator visits. The question is what happens to a person’s information on the days no one is watching.

Here is the test I would propose, and it requires no statute: give the regulator no announcement, no credentials, and a ordinary citizen’s data trail. Let them follow it. Watch it sold, matched, inferred, priced. The right to be forgotten is a good door, but I want to know who holds the key and whether it locks from my side.

Still, I would rather have a flawed test than no test at all. America offers no test. It offers a checkbox. I have checked many checkboxes. They checked back.