The Australian Small Business and Family Enterprise Ombudsman, Bruce Billson, supports the decision announced by Attorney-General Mark Dreyfus to remove the privacy exemption for small businesses. Mr. Billson acknowledges that protecting personal information collected and stored by businesses, regardless of their size, is an expectation of the public. He emphasizes the importance of finding a balanced approach to ensure that small businesses can implement appropriate data protection measures without overwhelming them with complex regulations.
Key Points
End of Privacy Exemption: The decision to remove the privacy exemption for small businesses is aimed at ensuring that personal information is adequately protected. Mr. Billson believes that it is not credible for small businesses to have a blanket exemption from these responsibilities.
Right-Sized Regulations: While the exemption is being removed, there is an understanding that small businesses cannot be burdened with the same comprehensive privacy principles as large corporations and government agencies. Mr. Billson emphasizes the need for right-sized and appropriate requirements that are easy for small businesses to implement.
Support and Transition: Small businesses will not face an immediate removal of the exemption. Instead, the change will follow an impact analysis, consultation with the small business community, and consideration of a support package. A transition period will be provided to give small businesses time to prepare.
Clear Guidance: Small businesses will require clear guidance on the steps they can take to protect personal information. This may include procedural templates, information guides, and checklists to help them fulfill their privacy obligations.
Integration with Other Reforms: Mr. Billson suggests integrating privacy protections with other reforms related to cyber risk management, Digital ID, payment times, digital engagement, and the responsible use of artificial intelligence. This holistic approach can enhance data security for small businesses.
Importance of Data Protection: Data breaches, cyberattacks, or unauthorized information releases can harm small businesses significantly. It can damage their reputation, operations, and relationships with customers, employees, suppliers, and partners.
Conclusion
The removal of the privacy exemption for small businesses aims to ensure the protection of personal information while recognizing the unique challenges and limited resources of small enterprises. Mr. Billson emphasizes the need for practical and right-sized regulations, clear guidance, and a supportive transition period to help small businesses meet their privacy obligations effectively. Protecting personal information is crucial for maintaining customer trust and business sustainability.