As Australia’s privacy framework continues to evolve, shopping centres are navigating an increasingly complex intersection of digital services, community safety, and children’s privacy. Oliver Everett examines what the proposed Children’s Online Privacy Code means for the sector, and why achieving the right balance between stronger protections and practical implementation will be critical.
Privacy rights and legislative frameworks are not a new issue for the shopping centre industry, nor are issues relating to children and the way in which these issues intersect with other policies, laws and operational issues.
We remain alert to and engaged on all material issues, and, in fact, privacy is one of the most consistent policy issues the Shopping Centre Council of Australia (SCCA) has engaged on over many years, spanning both state and federal jurisdictions, intersecting with everything from CCTV and community safety issues, to data security, digital services including gift cards, e-commerce, cyber resilience and, increasingly, children’s privacy, particularly in online environments.
Children’s privacy issues have been front and centre of privacy and online safety reform in recent years.
The Federal Government conducted a comprehensive review of the Privacy Act 1988 in recent years, introducing several new principles and provisions. The current Government has also, of course, introduced the new social media ban for children aged under 16.
When former Attorney-General the Hon Mark Dreyfus KC, MP introduced the amendments to the Privacy Act 1988 to Parliament in 2024, he noted that “while all Australians face privacy risks in the online environment, children are particularly vulnerable”. Current Attorney-General, the Hon Michelle Rowland MP, noted, as the then Minister for Communications, when introducing the social media ban legislation that the Government is “focused on positive solutions to issues of national concern, and the issue of harms to children and young people from social media is right up the top of that list.”
As readers would be aware, Australia has an Information Commissioner, a Privacy Commissioner, an eSafety Commissioner, and a National Children’s Commissioner.
In addition to the importance of privacy issues to governments and regulators, privacy issues are often featured prominently in the media and broader public debate. No doubt all readers will recall the widespread media coverage of Bunnings’ use of facial recognition technology, which was ultimately ruled to be permissible by the Administrative Review Tribunal (ART).
The importance of privacy is reflected at the highest levels of our organisation; for example, our Board maintains a standing agenda item on privacy matters, recognising not only the complexity of the regulatory environment but also the responsibility that shopping centres carry.
The safety and protection of children and families are, of course, a fundamental part of that story.
Shopping centres are community spaces and spaces for children. They are places where children visit, unaccompanied or accompanied by parents and carers, meet friends after school, work in their first jobs, attend events, use public transport connections and participate in community life. Specific children’s activities, including activations and annual Santa photos, are also critical. The retail sector remains Australia’s largest employer of people under 18, and shopping centres are often among the first workplaces young Australians experience.
Protecting children, including their privacy, has always been an important responsibility for our industry, and one that continues to evolve alongside community expectations and technological change.
That is why the development of the proposed Privacy (Children’s Online Privacy) Code 2026 (the Code) deserves close attention. Note that the 2024 amendments to the Privacy Act 1988 referred to above required the development of this new Code.
The Code, which is expected to be finalised later this year, represents another chapter in Australia’s broader privacy reform agenda and seeks to strengthen protections for children in online environments.
The objective is an important one, and the industry supports the broader goal of ensuring children are appropriately protected in the digital world.
As with many policy reforms, however, the challenge lies in ensuring that regulation is appropriately targeted, workable in practice, and capable of recognising the diversity of services and environments that exist across the economy.
A long history of privacy engagement
The SCCA’s engagement on privacy issues is extensive and longstanding.
At the federal level, the industry has participated in successive reviews of the Privacy Act, including in recent times the original 2020 Privacy Act Review Issues Paper, through subsequent consultation processes and more recent legislative reforms. We have continued to engage constructively with governments and regulators as privacy frameworks have evolved to address new technologies and changing community expectations.
Equally, privacy discussions increasingly intersect with other areas of regulation, including cyber-security, online safety, consumer protection and anti-money laundering frameworks.
Queensland’s recent introduction of Child Safe Standards, which the SCCA has been engaged on, provides one example of how jurisdictions are continuing to strengthen expectations around the protection and wellbeing of children in both physical and online environments. Other jurisdictions have examined related questions through reviews of surveillance technologies, public safety measures, and digital service delivery.
For shopping centres operating nationally, this creates an increasingly complex regulatory landscape that requires careful co-ordination and ongoing engagement with regulators – rather than top-down, ad-hoc and siloed consultation on specific measures from regulators that may not consider how one measure may interact from a practical perspective with other policies, procedures and practices.
The industry’s approach has consistently been to support sensible, risk-based reforms while ensuring that practical implementation issues are properly understood.
That balance matters.
Sometimes discussions about privacy occur in highly abstract or purely digital contexts; however, shopping centres operate in a very different environment. They are physical places that increasingly incorporate digital services to improve customer experiences, support operations, and enhance community safety.
Modern centres provide free wifi, digital platforms, online gift card systems, e-commerce channels, customer engagement tools and sophisticated security systems. As I noted earlier, shopping centres also host community events, children’s activities, and seasonal experiences that bring families together.
At the same time, centres carry significant obligations as public places.
Community safety remains a critical responsibility.
CCTV systems, security personnel and other technologies play important roles in preventing crime, responding to incidents, and assisting law enforcement when necessary. These systems also contribute to broader national initiatives designed to protect crowded places and maintain public confidence in shared spaces.
Children benefit enormously from these arrangements.
Parents and the broader community expect shopping centres to be safe, welcoming and family-friendly environments. Effective security measures, clear operational processes and appropriate privacy protections all form part of delivering on those expectations.
Sadly, in addition to instances of youth offending, children can also be harmed as a result of antisocial behaviour and violent incidents, highlighting the importance of strong and effective security mechanisms to prevent, monitor and respond to such incidents.
The challenge for policymakers is ensuring that privacy reforms strengthen protections without inadvertently creating barriers to important community services or safety outcomes.
The Children’s Online Privacy Code
The proposed Children’s Online Privacy Code represents one of the most significant developments in privacy policy in recent years.
It’s worth noting that the UK already has a Code of Practice for Online Services.
Broadly speaking, the Code would seek to establish enhanced protections for children’s personal information when interacting with designated online services that children are likely to access or that primarily concern the activities of children. It reflects a broader international trend, with governments around the world increasingly examining how digital services collect, use and manage information relating to children.
The policy direction itself is understandable.
Children engage with technology in ways that previous generations did not, and ensuring that privacy settings, consent arrangements and information handling practices are appropriate for younger users is a legitimate and important objective.
What remains particularly important, however, is clarity.
As with many new regulatory frameworks, the practical application of requirements is sometimes less straightforward than the policy intent.
This is especially true where technologies or services are not specifically designed for children but may nevertheless be accessed or used by them as part of ordinary community life.
That distinction matters greatly in retail environments.
The importance of guidance for practical implementation
One lesson from previous privacy reforms – and other regulatory reform – is that guidance and engagement from regulators can be just as important as legislative requirements.
That is particularly important in areas involving children’s privacy, where community expectations are understandably high and organisations want confidence that they are meeting both legal obligations and broader social responsibilities.
Shopping centres engage with numerous third-party service providers, technology platforms and operational systems. Many services that customers take for granted involve complex contractual arrangements, external providers and established compliance frameworks.
Changes to privacy requirements can, therefore, have implications far beyond a single organisation.
Examples, case studies, and practical explanations help organisations understand how principles should operate in specific circumstances.
This is particularly relevant where concepts such as “reasonable steps” or risk-based approaches are involved.
Different services present different risks.
What may be appropriate for a social media platform, for example, may not necessarily translate directly to other contexts where the collection of information is limited, incidental or already subject to established privacy frameworks.
The more clarity that can be provided upfront, the greater the likelihood of consistent implementation and positive outcomes for everyone involved.
Constructive engagement between regulators and industry remains essential in achieving that objective. A case in point for the importance of guidance and engagement from regulators is Bunnings’ use of facial recognition technology.
In this case, the ART overturned the Privacy Commissioner’s determination that Bunnings’ use of facial recognition technology was not justified or permitted, with the ART agreeing with Bunnings that, in its specific circumstances, the use of facial recognition technology was suitable, effective and proportionate.
Instead of compliance and enforcement action, the Bunnings case highlights, more in-depth guidance and engagement from regulators around the use of facial recognition technology and other privacy issues would lead to better outcomes for industry, communities and regulators.
An evolving policy environment
The Code is also being developed against the backdrop of broader changes across Australia’s privacy landscape.
Recent reforms have increased penalties for privacy breaches, strengthened regulatory powers and heightened expectations regarding organisational accountability.
The Privacy Commissioner has demonstrated a willingness to take an active role in assessing compliance, reflecting the growing importance of privacy issues within the Australian community.
Consumers are likewise becoming more conscious of how personal information is collected, stored and used.
Parents and carers, in particular, rightly expect strong protections for their children.
These developments are reshaping expectations across every sector of the economy, including retail property and shopping centres.
For our industry, that means continuing to invest in good governance, robust systems and proactive engagement with policymakers.
It also means recognising that privacy is not simply a compliance issue but an important component of maintaining community trust.
Looking ahead
The Code is expected to be finalised later this year, with commencement arrangements to follow.
As the process continues, the SCCA will remain constructively engaged with our members, the government, regulators and other industry stakeholders to ensure the final framework achieves its objectives while remaining practical and workable for the diverse services that operate within shopping centres.
Our industry has a strong record of supporting measures that enhance community safety, protect children, and build public confidence.
Privacy forms an important part of that commitment.
The challenge, as always, is getting the balance right: Protecting children in an increasingly digital world while preserving the community services, safety measures, and customer experiences that families rely upon every day.
That is a conversation worth having, and one that will undoubtedly continue to evolve in the years ahead.
- This article prepared by Oliver Everett, Senior Adviser at the Shopping Centre Council of Australia was first published in SCN magazine.
Add comment