Australia does not need less digital life. It needs less data hoarding

When the Office of the Australian Information Commissioner received 1,205 data breach notifications for 2025, the highest annual total since mandatory reporting began in 2018, retreat started to sound rational. If putting information online creates exposure, why not put less of life online, or even return some records to paper?

That tension surfaced in an SBS News feature published on 26 September. Associate Professor Mihai Lazarescu suggested that some businesses consider paper records, while Dr Rahat Masood argued that a broad retreat from digital systems was impractical and that people should disclose less while companies collect less.

The second position points towards the more useful answer, but responsibility must not stop with individuals. Australia does not face a binary choice between abandoning digital services and accepting unlimited accumulation of personal information. The Australian Signals Directorate describes digital technology as supporting public services, productivity and innovation. The practical task is to preserve those benefits while making unnecessary collection and indefinite retention unacceptable.

The law already says collection should be limited

Calls for data minimisation can sound like demands for a new principle. They are not. Australian Privacy Principle 3 already limits covered entities to collecting personal information that is reasonably necessary for their functions or activities. OAIC guidance makes the boundary clear: convenience or general usefulness is not enough.

APP 11.2 addresses the other end of the data lifecycle. Subject to exceptions, covered entities must take reasonable steps to destroy or de-identify personal information they no longer need. The OAIC warns that excessive retention can amplify harm and says deletion duties can extend to archived and backup copies.

The problem, then, is not that Australian privacy law contains no minimisation rules. The harder questions concern how organisations translate those rules into daily decisions, whether those decisions can be examined, and what an individual can do when information appears to have outlived its purpose.

This distinction matters because Australia does not currently provide a general individual right to erasure equivalent to the European Union right. An organisation may have a duty to dispose of information it no longer needs, yet an individual lacks a broad corresponding power to demand that outcome. That leaves a gap between an entity’s responsibility and a person’s practical control.

Retention is a security decision

Data minimisation is often filed under privacy, as though it were principally about personal preference or administrative tidiness. It is also a way to limit potential cyber harm. Of the 1,205 breach notifications received by the OAIC for 2025, 716 were attributed to malicious or criminal activity. Health service providers accounted for 225 notifications, or 19 per cent of the total.

Those figures do not mean deletion can prevent intrusion. Nor do they prove that every notified breach caused the same harm. They show why the amount and sensitivity of retained information matter. If an organisation no longer possesses an unnecessary record, that record cannot be exposed through a later incident affecting the organisation. Information that must legitimately remain can still be accessed or misused, but reducing the stockpile reduces what is available to lose.

This is why retention should cease to be an open-ended default. Organisations should assign a documented purpose and retention period to each category of personal information. Expiry should trigger deletion or effective de-identification across active systems, archives and backups, unless a defined legal or operational reason requires continued retention. Those decisions should be auditable rather than buried inside vague policy language.

Implementing that model would not be effortless. Complex organisations may struggle to locate every copy held in live systems, archives, backups or by third parties. Robust de-identification can also be difficult in context. But implementation difficulty is not an argument for keeping everything. It is an argument for treating information inventories, retention controls and deletion processes as essential infrastructure rather than optional housekeeping.

The proposed right is promising, but narrow

The federal government’s draft second-tranche privacy reforms, released for consultation on 31 August 2026, create an opportunity to shift the balance. Announced measures included a fair and reasonable test, stronger consent standards, controls on trading personal information without clear permission and an erasure right aimed at large digital and search platforms. The stated deadline for submissions was 18 September.

These measures were still proposals on 26 September 2026, not rights Australians could already exercise. The ministerial announcement alone does not settle the final scope, exceptions, remedies or commencement dates. It therefore cannot support clause-level judgements, particularly when the draft may change after consultation.

If Parliament enacts reforms materially consistent with the announcement, and if platforms provide usable request mechanisms backed by adequate regulatory capacity, Australians could gain more meaningful control over information held by some of the largest digital services. Yet a platform-focused erasure right may still leave gaps elsewhere. Sensitive information is also held in health, government and professional-service settings, even though covered organisations in those fields may already have duties under APP 11. A partial right should not obscure the need for consistent retention governance across the wider economy.

Nor should erasure be absolute. Records can remain necessary for legal compliance, public administration, fraud prevention, contracts or continuing service delivery. Privacy reform should therefore demand defined purposes and defensible exceptions, not indiscriminate deletion. The central question is not whether every record must vanish on request. It is whether an organisation can explain why each retained category remains necessary, for how long, and under whose authority.

Rights must work outside a legal textbook

Australia already has substantial formal consequences for serious privacy interference. Parliament passed the Privacy and Other Legislation Amendment Act 2024 on 29 November 2024, and a statutory tort for serious invasions of privacy commenced on 10 June 2025. For a serious interference with privacy, the maximum corporate civil penalty is the greatest of AUD 50 million, three times the attributable benefit or 30 per cent of adjusted turnover during the relevant breach period.

A reasonable counterargument is that Australia needs better compliance with existing duties more than another layer of rights. That view has force. APP 3 and APP 11 already provide a basis for challenging unnecessary collection and retention, while the penalty framework is substantial. The available evidence here does not establish whether enforcement is frequent enough or deterrence strong enough.

But organisational duties and individual rights solve different problems. A rule directed at an entity does not necessarily give a person a simple way to find out what remains, challenge its retention and obtain deletion. A useful erasure right therefore needs more than legal wording. Requests must be understandable, accessible and capable of producing an accountable decision. Regulators, in turn, need a way to inspect data inventories, retention schedules, exceptions and deletion outcomes.

Individuals can still reduce voluntary disclosure, and that advice remains sensible. It cannot, however, carry the main burden. When useful or essential services depend on digital participation, telling people to share less offers only partial control over systems designed and operated by others.

Australia should not romanticise paper or pretend that digital systems can operate without legitimate records. It should instead make personal information temporary by default: collected only when reasonably necessary, retained for a stated purpose, deleted when that purpose ends and preserved longer only under a documented exception. The route out of cyber fatalism is not to log off society. It is to stop treating every piece of personal information as something worth keeping forever.

An expiry rule joins privacy governance to the practical question of how systems store and handle information. Make the technical foundations your next step with The Hack Academy’s online cybersecurity training programme, where self-paced learning includes cybersecurity fundamentals, networking and practical exercises alongside theory.