In 2018 the Australian Parliament passed a law that gave authorities new powers to compel technology companies to help them access encrypted communications. Critics warned that it could undermine security for everyone. Supporters said it was necessary to fight terrorism and serious crime. The original version of this article asked a question that applies far beyond Australia: if governments collect more data, can they protect what they gather? This updated look reviews what happened, why the question remains urgent in 2026 and what ordinary people can do wherever they live.
1. What the 2018 law did
The Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 created a framework under which Australian agencies can ask, or in some cases require, designated communications providers to give assistance. The assistance can include providing technical information, helping to install software and building new capabilities to access data.
Several features drew controversy.
- Reach. The law applies to a broad range of providers, including device makers, app developers and service companies.
- Secrecy. Providers can be bound to confidentiality about notices they receive.
- Security concerns. Technologists argued that any mechanism built to give access to one user could be abused or exploited by others.
- Oversight. Critics questioned whether independent review was strong enough.
The government argued that the law was designed to avoid creating systemic weaknesses and was needed because encryption was hampering investigations. The debate over lawful access versus security continues in many countries.
2. The question that matters: can they protect what they collect?
The deeper concern is not just whether authorities can collect data, but whether the data stays safe once collected. Organizations that hold large stores of personal information are attractive targets. History shows that breaches affect governments, hospitals, telecoms and companies alike.
The original article noted that government-related data breaches may be underreported. Whether or not that is true everywhere, the principle holds: the more sensitive data an institution gathers, the greater the damage if it is compromised. A database of communications metadata, identity documents or location histories is worth far more to a thief than a single account.
Our related coverage on whether the government buys private data from data brokers and on government entities that protect private data online explores the same tension in the United States.
3. Australia’s breach reckoning in 2022
Two incidents in 2022 made the stakes clear to Australians. Optus, a major telecommunications provider, disclosed a breach that exposed customer details including names, dates of birth and identification document numbers. Medibank, a large health insurer, disclosed a breach that exposed sensitive customer information, including health claims data, and some of it was published online by the attackers.
The two events led to public anger, regulatory attention and political pressure to strengthen privacy law. Reform followed in stages, including higher penalties for serious or repeated privacy breaches and new rights, with further changes under discussion. The details have changed several times, so anyone affected should check current guidance from the Office of the Australian Information Commissioner.
The lesson for individuals everywhere is practical: even careful people lose data when organizations they trust fail. Identity numbers and health information, once leaked, cannot be reissued like a password. See what is a data breach for how breaches happen and how long data leaks can affect you for what follows.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
4. How this compares with the United States and Europe
Different places have chosen different approaches.
| Region | Approach | Key feature |
|---|---|---|
| Australia | Sector and Privacy Act rules plus lawful-access powers | Assistance and Access framework; breach notification scheme |
| European Union | Comprehensive GDPR | Broad rights and large fines; see what is GDPR |
| United States | Patchwork of federal sector laws and state privacy laws | About twenty state laws; no comprehensive federal statute |
| Canada | Federal and provincial laws | Breach reporting and consent requirements |
For U.S. readers, state laws are expanding. California’s DROP platform opened January 1, 2026, and registered data brokers must start processing deletion requests on August 1, 2026. Our guide to state privacy laws in 2026 covers current rights.
5. Surveillance, encryption and everyday security
Whatever your country’s laws, the technical basics matter.
- Use end-to-end encrypted messaging for sensitive conversations, and keep the apps updated.
- Protect devices with strong passcodes and full-disk encryption, which is standard on modern phones.
- Limit cloud backups of sensitive material. Backups may be accessible under different legal rules than your device.
- Minimize what you store. Delete old messages, documents and photos you do not need. Our article on being wary of old documents and old friends explains the cost of digital clutter.
- Control metadata. Even encrypted services reveal who contacts whom and when. Be aware of the trail.
- Keep software current, because many intrusions use known flaws.
For broader reading on technology and privacy risk, see 5G threatens privacy.
6. Reducing the data that can be taken
Laws determine who may ask for data, but you determine how much exists. Data minimization is the most reliable principle when institutions are unpredictable.
- Give less to begin with. Provide only what a service needs.
- Delete what you can. Close dormant accounts and purge old files.
- Avoid unnecessary identity documents. Do not upload ID images unless required, and ask how long they are kept.
- Use separate emails and phone numbers for different contexts.
- Remove public listings that make you easy to profile, as explained in the data broker cleanup guide.
- Monitor your credit and freeze it where the option exists.
7. What other governments are doing with the same debate
Australia is not alone. Governments in several countries have proposed or passed rules about access to encrypted data, retention of communications records and cooperation from technology providers. In the United States, the debate appears in discussions of warrants for location and communications data, agency purchases from commercial brokers and rules about foreign surveillance authorities. The Federal Trade Commission, the Consumer Financial Protection Bureau and the Cybersecurity and Infrastructure Security Agency each publish practical guidance for individuals at ftc.gov, consumerfinance.gov and cisa.gov. Reading what agencies in your own country recommend is a useful complement to this article, since rules and rights change.
8. A privacy checklist you can apply anywhere
Whatever your location, a short checklist gives you most of the benefit. Keep devices updated and encrypted. Use unique passwords and a password manager. Prefer services that minimize logs and offer clear deletion tools. Review what you share with cloud services and delete what you do not need. Avoid linking every account to a single identity. Check breach notification sites and your own credit file regularly. Finally, keep your name, address and phone number off public listings, because those details connect all your other data into a profile.
9. Three scenarios
Scenario 1: You are an Australian customer of a breached company. Follow the company’s notice, change passwords, watch for phishing and consider requesting replacement identity documents if numbers were exposed. Check official guidance from the privacy regulator.
Scenario 2: You live elsewhere and use a global messaging app. Review the app’s encryption and backup settings. Disable cloud backups of chat history if you do not need them, and set disappearing messages for sensitive conversations.
Scenario 3: You worry about government data purchases. Reduce the supply by removing yourself from commercial data brokers, since agencies sometimes buy from them. See does our government buy our private data.
10. What to expect: a realistic timeline
| Action | Time to complete | Effect |
|---|---|---|
| Encryption and backup review | 30 to 60 minutes | Immediate |
| Account and file cleanup | A few hours | Ongoing reduction in exposure |
| Credit freezes (where available) | About 30 minutes | Immediate |
| Broker opt-outs | A few hours to submit | Days to 4 weeks |
11. Common mistakes
- Assuming laws that apply elsewhere do not affect you.
- Trusting that an organization will keep data safe because it is large or official.
- Keeping years of messages and documents you no longer need.
- Using a single email and phone number for everything.
- Treating encryption as a complete solution when metadata still leaks.
12. How Wiperts helps shrink the target
Surveillance laws and breach headlines are beyond your control. The amount of personal information published about you is not. Wiperts scans more than 100 data brokers and people-search sites for your name, address and phone number, submits removal requests, requests removal of personal results from Google and Bing, blurs your home on maps and monitors 24/7 so relisted data is taken down again. Less published data means less for anyone, whether a criminal or a buyer, to collect.
Check your exposure for free.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
13. Key takeaways
- Australia’s 2018 law and the 2022 breaches illustrate the tension between access and security.
- Institutions that hold more data become bigger targets.
- Use encryption, delete clutter and give less data to start with.
- Remove public listings to reduce the supply that others can gather.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
14. Frequently Asked Questions
What is Australia’s Assistance and Access Act?
It is a 2018 law that allows Australian authorities to request or require technology companies to help give access to communications, including by building certain capabilities. Critics argued it could weaken the security of encrypted services, while the government said it targeted serious crime.
Does government access to data create breach risk?
It can. Any large store of sensitive information, including data obtained by agencies, becomes a target for criminals and hostile states. Security of the holder matters as much as the legal authority to collect.
What were the Optus and Medibank breaches?
In 2022, Optus, a telecommunications company, and Medibank, a health insurer, disclosed major cyber incidents that exposed the personal information of millions of Australians. They prompted calls for stronger penalties and better data protection.
Does this affect people outside Australia?
Indirectly. Many technology companies operate globally, and legal powers in one country can influence product design. The broader lesson about data minimization and encryption applies everywhere.
How can an individual protect privacy under broad surveillance laws?
Collect and share less, use well-vetted end-to-end encrypted tools, keep software updated, limit cloud backups of sensitive material and remove public listings that make you easy to profile.
Is privacy law in the United States similar?
Not exactly. The United States has no comprehensive federal privacy law but a growing set of state laws, and its agencies have their own debates about data purchases and access. Check current rules for your state.
Sources
Related Reading
- Does the Government Buy Your Private Data From Data Brokers?
- Which Government Agencies Protect Your Data Online?
- What Is GDPR? Will It Protect You?
- Does 5G Threaten Your Privacy? Location Data and Smart Devices
- Do Big Fines Prevent Data Leaks? What the Evidence Shows
- State Privacy Laws in 2026: Your Data Rights by State
- The Real Cost of Lost Privacy in the Digital Age
- The Power of Privacy: What Life Looks Like When It Is Gone
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing