Emerging technologies and the Privacy Amendment (Personal Data Protection) Bill 2026: my submission
The Attorney-General’s Department released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026, with submissions closing on 18 September. The package contains around 40 proposals. Alongside the Bill, the department asked a separate set of questions about emerging technologies, including wearable surveillance devices such as smart glasses. Those measures have not been drafted yet, and there is still time to influence them.
My submission responds to the questions on consent and on remedies, and is published here in full, as lodged on 18 September 2026.
Why file a submission?
In August I published an analysis of camera glasses and the statutory tort of serious invasion of privacy, followed by a short FAQ answering questions and comments readers had posted. It’s fair to say I didn’t expect the level of response the article received - the questions and comments did not stop. They came from in-house counsel, business owners and members of the public, and many reduced to this: I don’t want to be filmed without my agreement, but what can I actually do about it?
I haven’t been able to give a satisfactory answer, and the submission explains why.
The short version
The department asks how the reforms can make consent meaningful for people captured by wearable devices. My answer is that unfortunately the legal concept of consent under the Privacy Act has no role to play in this scenario at all, and that treating it as the protection is a fallacy.
Consider where consent could possibly operate. The person wearing the device is an individual acting in a personal capacity, so the Privacy Act does not apply to them.[1] The supplier that is covered by the Act does not claim to obtain consent, and does not try to. Meta’s own material asks wearers to be considerate and to stop recording if someone indicates they would rather they did not. That is an issue of etiquette only. A capture light is notice at most, and Meta describes it as exactly that. Being physically present when a capture light operates is not put forward as consent, because it neither is nor can be.
So at no point in the chain is consent sought, given, refused or recorded. This is not weak consent or poorly informed consent, it is an absence of consent.
Nor is there anything useful for the individual to do with the notice they are given. When a light comes on, what am I expected to do? Challenge someone who may be belligerent or physically larger? Change my route, leave the gym, stop talking? The signal tells me something is happening and offers me nothing to do about it. A camera notice at the entrance to a hardware store informs without enabling any meaningful response, but at least gives the reader an option of shopping somewhere else. A light that flashes when a stalker walks past a victim only signals that a photo has already been captured.
That has two consequences for the Bill.
First, the fair and reasonable test is the only lever that reaches the entity that actually collects, retains and processes the material. It should not be capable of being satisfied by a signal, or by responsible use guidance, aimed at the wearer rather than at the person recorded.
Secondly, the statutory tort retains a defence of implied consent. Because of the way Schedule 2 is drafted, the reformed definition of consent does not flow through to the provisions governing the statutory tort. A wearer could argue that a person saw the light, carried on walking, and impliedly agreed. Resolving that argument would be expensive and slow. It is also the one inference that should not be available without something more.
The submission makes seven recommendations. All but one are directed to the explanatory material and to guidance. The issue concerning the consent defence in the statutory tort cannot be fixed that way and requires an amendment to the Bill.
I consented to publication of the submission and would be glad to discuss any part of it.
Simone Herbert-Lowe,
Principal, Law & Cyber
[1] An individual acting in the course of an employer’s business is a different case. The collection is then made by the employer, which may have its own obligations under the Act, if it is an APP entity.