The advice industry’s experience with the disbanded Financial Adviser Standards and Ethics Authority (FASEA) regime should be a harbinger for any possible enhanced responsibilities for the Office of the Australian Information Commissioner (OAIC).
In a submission to the Privacy and Other Legislation Amendment Bill 2024, Financial Advice Association Australia (FAAA) general manager for policy, advocacy and standards Phil Anderson discussed the plans to implement changes to Australian privacy laws.
Agreed proposals include security and destruction of personal information, the personal information used in automated decision-making, a tiered civil penalty system for privacy breaches including for licensees and advisers, and expanded powers for courts to issue a wider range of orders.
This will impact licensees in terms of:
- Enhanced compliance requirements
- Increased regulatory scrutiny
- Operational adjustments
- Employee training and awareness
- Client communication and trust
Another proposal is around a strategic review of the OAIC including its powers and funding as well as the potential for enhanced investigative powers, but Anderson said it should be carefully budgeted for.
He felt it was “unworkable” for the work of OAIC to be funded by an industry levy as it would be another imposition on small businesses. He also gave the example of the FASEA body as a cautionary tale of what happens when organisations fail to be maintained correctly.
FASEA was introduced in 2017 and was responsible for setting the standards for ethical conduct, educational qualifications, and ongoing training of licensed financial advisers in Australia. However, it was later disbanded and its responsibilities were rolled into Treasury and ASIC.
Anderson said: “Financial advice is one of the most tightly regulated professions in Australia. Due to the high existing regulatory burden, the cost impact on financial advisers and the knock-on cost for consumers, we would urge that a cautious approach is taken before additional regulations are imposed.
“The OAIC should have an obligation to engage with industry partners to provide greater clarity and guidance where this is required, and sufficient budget to do this effectively.
“The experience in the financial advice sector with the FASEA – which was budgeted and maintained for only four years, and whose areas of responsibility have to some extent been neglected since its disbanding – is illustrative of the risk in not maintaining responsibility and budgeting on an indefinite basis.”
Impact of AI
Another factor considered by the FAAA was the speed that the Privacy Act could keep up with technology changes, such as artificial intelligence which is becoming more widely used by financial advisers.
Several financial advice professionals have developed AI tools for matters such as documentation, file notes and writing statements of advice. Research by Adviser Ratings found 47 per cent of advice practices are adopting AI for client engagement, such as newsletter production, 43 per cent for marketing, and 41 per cent for statement of advice (SOA) or record of advice (ROA) production.
He said: “Overall, the FAAA is supportive of the direction taken by the updated legislation. However, it should be noted that, such is the pace of technological development in data gathering and processing, we are concerned that the updates proposed do not keep pace with how technology is being used now, and as such do not by itself equip the Commonwealth for perceived future challenges.
“Many financial advisers are adopting technology to assist with day-to-day planning activities, which inevitably involve the handling of client personal and sensitive data. As in many sectors, it is becoming more and more common for AI tools to be used to record client meetings and transcribe these into file notes.
“Given the breadth and often sensitive nature of client data disclosed during client meetings, the use of AI software for this task, while enabling advisers to both deliver a higher quality service and also help more clients, has clear privacy implications – not least being the incidental disclosure of the client’s information to the AI provider.”
