Budget update: priorities for privacy, cyber and digital

Key takeaways from the Budget 7 min read

On Tuesday night, the Federal Government released its FY2023-24 Budget (Budget), which brings with it cost-of-living relief, housing, healthcare and clean energy measures. Notably, the Budget also provides insight into the Government's priorities concerning privacy, eSafety, Consumer Data Right (CDR), cyber, digital, AI, quantum computing and startups.

In this Insight, we summarise the key takeaways and look at what it means for the industry.

Privacy and eSafety

• The Government is increasing the funding and staffing of the OAIC. Specifically, the Government will provide:
  • $44.3 million over the next four years to support a standalone Privacy Commissioner role (the role was previously incorporated into the Information Commissioner's role), progress investigations and enforcement action in response to privacy and data breaches, and enhance the Agency's data and analytics capability; and
  • $9.2 million over the next two years to continue to regulate privacy aspects of the Consumer Data Right, My Health Record and Digital Identity.

  The OAIC's staffing level is projected to increase from 145 to 192 next financial year. It should be noted however that the OAIC's overall funding is still projected to nearly halve over the forward estimates, from $46.5 million FY23-24 to $24.7 million in FY 26-27 (not adjusting for future inflation).

  While the increase for the OAIC over the next two years is welcome, and will go some way to assisting the OAIC in uplifting its response and timeliness in investigations, enforcement action and responses to data breaches, given the increasing volume and complexity of cyber attacks impacting Australian organisations it remains to be seen whether this will be sufficient – particularly in the longer term as OAIC funding decreases. The Privacy Act reforms will also require significant time and effort from the OAIC – particularly to support organisations and agencies as the reforms progress – including developing and updating guidance and training materials. It is not clear how much of this funding will assist the OAIC in these activities.

• The budget also provides $0.9 million over two years from 2023‐24 for the Attorney-General’s Department to progress the Government’s response to the recent review of the Privacy Act. These funds will also support the separate independent statutory review of Part IIIA of the Act regarding credit reporting, a report which the Attorney-General is required to receive before 1 October 2024.
• The Budget greatly increases funding for the eSafety Commissioner, providing an additional $134.1 million over four years, to enable the Commissioner to continue supporting Australians online, including through enhanced educational, outreach and investigatory activities. This includes assistance to meet increasing demand for its takedown schemes.

Consumer Data Right

• The Government has committed $88.8 million to support the CDR in banking, energy and the non-bank lending sectors progress the design of action initiation and undertake a cyber security uplift. Funding will be divided between the ACCC and OAIC, with the former (being the body that enforces the Competition and Consumer Act 2010) anticipated to receive the majority of the Budget's CDR allocation.
  
  Whilst it appears that the Government is willing to support continued enhancement of the CDR in existing sectors, we understand this funding does not cover the roll out of the CDR to any new sectors. A strategic review of the status of the CDR at the end of 2024 will consider the outcomes of the implementation in existing sectors and make an assessment of the rollout and effectiveness of the regime. As such, pending the outcome of that strategic review, we do not expect to see expansion of the CDR to new sectors in the near term.

• This amount is significantly higher than anticipated in previous years' budgets, indicating the Government's increased focus on supporting CDR rollout throughout existing sectors and compliance obligations continue to be 'turned on' for entities across the existing CDR sectors.
  
  For example, the Morrison Government's pre-election 2022 budget committed to spending $38.4 million over three years from 2022-23 and $12.6 million per year from 2025-2026 to implement the CDR. In the 2021-2022 budget, it committed $111.3 million over two years from 2021-22, particularly to support the roll out in the banking, energy and telecommunications sectors.

Cyber and Digital

• The Government is investing more than $2 billion in 2023-24 in digital and ICT 'to deliver easy, accessible, and secure services for people and businesses'. While we expect a majority of this will go towards improving access to, and security of, government services (and associated digital platforms and infrastructure), it is clear that SMEs and Medicare are among the big winners in the Budget, which provides the following investments in cyber and digital:
  • Commonwealth cyber security: $46.5 million over four years to establish the Coordinator for Cyber Security 'to ensure that the Commonwealth's cyber security efforts are strategic, coordinated, timely and effective'. With support from the National Office of Cyber Security and dedicated resources from within the Department of Home Affairs (among others), we anticipate this funding will provide the Coordinator with capacity to scale its operations in the event of major cyber incidents.
  • SOCI compliance: $19.5 million in 2023-24 to support responsible entities owning critical infrastructure assets to respond to significant cyber-attacks
  • SME cyber resilience: $23.4 million over the next three years 'to support small business to build resilience to cyber threats'. In particular, the small business Cyber Wardens program (delivered by the Council of Small Business Organisations Australia) is expected to become Australia's first cyber safety workplace certification or micro-credential for the small business sector. Up to 50,000 cyber wardens will be trained over the next three years.
  • Anti-scam and data breaches: $86.5 million to establish a National Anti-Scam Centre, boosting ASIC's work in reducing scam incidents and establishing Australia's first SMS Sender ID Registry to prevent scammers imitating trusted brand names.
  • Digitalisation and expanding DigitalID: $26.9 million in 2023-24 to expand Digital ID to help 'increase efficiency and consumer protection, reduce fraud, and make it easier for people to access services online'.
• The Government is also increasing funding support for strengthening Medicare and Australia's digital health system. In particular, the Budget provides:
  • National agency: $325.7 million to establish the Australian Digital Health Agency as an ongoing entity (originally established in 2015-16), cementing its role as a critical, national digital health infrastructure.
  • My Health Record: $429 million to maintain and enhance the My Health Record system and $69.7 million to related digital health initiatives, which the Government expects to roll out in coordination with the states and territories.
• These funding allocations are consistent with the Government's aspiration, set out in 2023-2030 Australian Cyber Security Strategy Discussion Paper, for Australia to be "the world's most cyber-secure country by 2030" and continues the significant increase in funding for cybersecurity over the last decade.

Critical Industries and Artificial Intelligence

• The Budget provides $116 million over five years to support the development and adoption of critical technologies including artificial intelligence, quantum computing and batteries. This includes:
  • $101.2 million over five years to support businesses to integrate quantum and AI technologies into their operations, through:
    • a Critical Technologies Challenge Program, which will support projects that use critical technologies to solve significant national challenges, and will commence with a focus on projects that use quantum computing;
    • extending the National AI Centre and its role in supporting responsible AI usage through developing governance and industry capabilities;
    • establishing an Australian Centre for Quantum Growth to support ecosystem growth and commercialisation in Australia’s quantum industry; and
    • supporting small and medium enterprises’ adoption of AI technologies to improve business processes and increase trade competitiveness.
  • $14.8 million over four years from 2023-24 to establish the Powering Australia Industry Growth Centre to develop advanced technology and skills as part of the Government’s Australian Made Battery Plan.
• These funds will be offset entirely by redirecting funding from within the Industry, Science and Resources Portfolio.
• This investment follows the release of the Government's first National Quantum Strategy on 3 May 2023 and will support the Government's 2030 vision of being recognised as a leader of the global quantum industry and recognition that quantum technologies are integral for a prosperous, fair and inclusive Australia. It remains to be seen if this will be enough for Australia to meet this goal – it's not insignificant, but quantum computing requires significant financial resources.

Support for Startups

• The Government will provide $392.4 million over four years from 2023–24 to establish the Industry Growth Program to support Australian SMEs and startups to commercialise their ideas and grow their operations. Support will be targeted towards businesses operating in the priority areas of the National Reconstruction Fund.
• Given the tough economic conditions and the difficult fundraising environment for startups, additional funding outside of traditional venture capital channels is always welcome.