Running with Tony Buti: Commissioner Annelies Moens embraces tension between privacy and data sharing

Annelies Moens is the Western Australian Information Commissioner. We caught up at Salter Point. Tony Buti: What does the role of Information Commissioner for WA entail? Annelies Moens: It’s a brand new role. Previously the Information Commissioner only looked after freedom of information. The new office, established on July 1 2025 looks after both freedom of information and privacy. WA has new privacy laws that became operational on July 1 this year. It’s the most advanced privacy law in Australia. TB: How is it the most advanced? AM: We have leapfrogged a lot of the work that the Federal Government has done in terms of privacy, so there are new provisions in our laws that don’t exist elsewhere, and it’s quite robust. It also has the strongest enforcement powers of any State or Territory privacy regulator. TB: What are some of those enforcement provisions? AM: There is a provision that allows compensation up to $75,000 for people that might be harmed by a privacy breach. There’s also determination-making powers, so we can request agencies to change practices or behaviour. There are also compliance notices that can be issued requiring a government agency to change their behaviour or practice. TB: Do you only have jurisdiction over government agencies? AM: Mostly. IPP entities are covered — they include WA State Government agencies, local government, ministers acting in their executive capacity, not parliamentary capacity. It also covers contractors and service providers. For example, if a government agency has an arrangement with a third party, which is undertaking a particular service for government, and in that contract, it says that the Privacy Responsible Information Sharing Act (PRIS Act) applies, the contracted service provider must comply with WA privacy laws. TB: Before your current role what were you doing? AM: Before this job, I was running my own privacy risk management consulting company. I worked with government agencies on the east coast and private sector companies in Australia and overseas to uplift their privacy practices. TB: What took you down the route of privacy work? AM: It’s a great question, because when I started in privacy, there was no such thing as a career in privacy. I studied privacy during my university studies in technology, computer science, and law, which was an unusual combination. My second job out of Uni was with the Office of the Federal Privacy Commissioner, the forerunner of the Office of the Australian Information Commissioner, the privacy regulator at the Federal level. I have not been able to escape since, co-founding the International Association of Privacy Professionals and consulting on privacy practices and risk since I left the Federal regulator. Working in this area is exciting and challenging because you have to deal with evolving technology and the law. It changes all the time, you are never on top of it, so you are constantly learning and innovating. TB: It also has a political dimension because people hold a range of views on privacy. AM: Yes, that’s the beauty of it. There is a spectrum of views. Some people have a view that we should share everything, and other people have the opposite view, but that is the entire point. It is giving the individual control about which way they want to go. But there are also broader societal issues we need to deal with because we have platforms and technologies that impact whole groups of people. TB: And we have tension between privacy and information sharing for security reasons. AM: And that tension is necessary and will always be there. For example, the debate around encryption. There are some companies that have very strong encryption. Should there be backdoor access to that encryption? And so that tension is normal and will always exist, and that’s why it is again one of those challenging areas. TB: With technology changing at a rapid pace, are policy makers, regulators and government always going to be chasing their tails? AM: Laws and regulations tend to be responsive. We certainly need our policy makers and government to understand technology so that we can achieve outcomes that benefit the broader community. Privacy laws, and in particular the PRIS Act is designed with technology neutral privacy principles. This means that as technology changes, the privacy principles can adapt to those new technology contexts. TB: Privacy and other regulations are sometimes perceived as a blocker or red tape to innovation, do you agree? AM: Sometimes there is a view that privacy stops innovation, when in fact it can facilitate innovation if implemented appropriately. The example that I usually use is when the first motor vehicles were invented, they did not come with brakes, and so the only reason we can drive fast today is because we have brakes. If we didn’t have brakes on vehicles, we would still be driving 5km an hour. Trust enables technology adoption. Privacy plays an important part in building that trust. The new tagline for the office is “the independent regulator fostering trust and accountability in WA through privacy and FOI”. TB: Final question. You were born in Sydney to Belgian parents and lived, studied and worked on the east coast and overseas. How are you finding living and working in Perth? AM: Perth is famous for being the most isolated city in the world, but it also makes us one of the least polluted cities in the world. Every time I get off the plane in Perth I can tell the air quality difference. I really like that. Interestingly, many people living here have a closer connection to the Asia-Pacific region than the east coast. That can be exciting.