Productivity Commission releases final report into Harnessing Data and Digital Technologies

Tell me in 30 seconds

On 19 December 2025, the Productivity Commission released its final report into Harnessing Data and Digital Technologies, recommending that:

• The Privacy Act 1988 (Cth) should be amended to embed an outcomes-based fair and reasonable test, and that the existing Australian Privacy Principles be phased out;
• Regulation of AI be undertaken within existing regulatory frameworks and that AI specific regulation should be a last resort;
• Government monitors the development of AI and its interaction with copyright holders over the next 3 years, and if key issues discussed further below are not resolved by then, to establish an independent review of Australian copyright settings and the impact of AI;
• The Consumer Data Right (CDR) be simplified and ‘rightsized’ to support high value uses while minimising compliance costs; and
• Digital annual and half‑yearly financial reporting be made mandatory for disclosing entities under the Corporations Act.

Privacy Act Reform

The Commission has accepted the argument that the emphasis in the Privacy Act around controls, such as consent and disclosure procedures, and the requirement to have privacy policies, are ineffective and does not guarantee positive privacy outcomes because they place the onus on the individual to manage and protect their own data.

The Commission considers that embedding an overarching ‘fair and reasonable in the circumstances’ duty in the Privacy Act is the best way to achieve the objectives of outcomes-based privacy regulation. It would operate both proactively and reactively and would apply irrespective of consent to effectively shift responsibility for protecting personal information clearly onto regulated entities. To guide implementation, this duty should be further scaffolded in the Privacy Act by non-exhaustive principles-based factors including transparency, proportionality and necessity:

• proportionality would balance interests between the benefit obtained against the burden imposed. Was the outcome for the regulated entity proportionate to the privacy impacts on the individual?
• necessity would consider how the dealing with personal information is necessary to the functions and activities of the regulated entity.
• transparency would consider whether the individual was provided with clear, current and understandable advice about the dealing with their personal information.

It also proposes implementation of the duty be further assisted through comprehensive supporting documentation such as regulatory guidance, industry codes, templates and guidelines.

Importantly, the Commission disagrees with the proposal in the Privacy Act Review to integrate a ‘fair and reasonable’ test within some of the existing APPs that would simply impose additional requirements on the collection, use and disclosure of information. Instead, the Commission recommends creating this standard to replace the existing APPs (with a 3 year transition period) to reduce complexity and cumulative regulatory burden.

Regulation of AI

The Commission thought it likely that AI would significantly raise Australian productivity, but there is ongoing debate about the magnitude of this effect. While the magnitude of the effect was uncertain, it thought that multifactor productivity gains above 2.3% are likely over the next decade which would imply about an extra $116 billion of GDP over the next decade.

In light of this, and economic evidence that the European General Data Protection Regulation (GDPR) has been costly to implement, dampened economic activity and reduced innovation, the Commission warned that unnecessarily burdensome regulation risks forfeiting AI’s benefits and can stifle innovation.

It supported the Government’s National AI Plan that has moved away from the previously proposed whole of economy, technology-specific AI regulation, to an approach that leverages Australia’s existing legal frameworks to mitigate the risk of AI related harm, recommending that:

• the Government should undertake a comprehensive set of ‘gap analyses’ to understand the risks stemming from AI and whether these risks can be dealt with under existing legal and regulatory frameworks;
• where possible, the Government consider if any gaps in legal and regulatory frameworks created by the increased use of AI could be covered by existing regulatory frameworks with improved guidance and enforcement; and if not, how to modify existing regulatory frameworks to mitigate the additional risks;
• only where the risk of harm cannot be adequately mitigated by changes to existing legal frameworks, should new laws be considered. New laws should be technology neutral, create a net benefit compared to the status quo, and (where possible) minimise divergences between Australian and overseas regulatory structures.

Finally, the Commission recognised that overall, most forecasts expect AI to increase the net number of jobs but could potentially displace some workers. If AI does displace a significant number of workers, the Australian Government may need to consider specific supports for retraining them, in addition to existing unemployment assistance.

Copyright and AI

Acknowledging the Government’s decision to rule out the introduction of a text and data mining exception to the Copyright Act, the Commission recognised that Australia’s copyright settings make it difficult for AI developers to train their models in Australia.

However, it was not convinced that reforming copyright settings would necessarily incentivise AI training in Australia as there were other factors relevant to that decision, including the cost of electricity and availability of skilled labour. It considered that reform of copyright settings would only be justified if it did not greatly reduce the incentive to create new Australian works.

Ultimately the Commission considered that there was uncertainty in three key areas that made it difficult to design an effective policy response to the use of copyright material for AI training:

• the scope and feasibility of AI related copyright exceptions overseas, and whether the laws in other countries did in fact allow unrestricted and unremunerated use of copyrighted material for AI training;
• whether permitting unrestricted and unremunerated use of copyrighted material for AI training would reduce the incentive to create new Australian content; and
• recognising the current impracticability of licensing open web material (which is a large part of what AI models are trained on), whether licensing markets for that material will emerge in the future without intervention.

Because of the uncertainties, the Commission recommended that the Government should wait and monitor them for three years. If, after three years, these issues have not resolved, the Government could (not ‘should’) establish an independent review of Australian copyright settings and the impact of AI.  

CDR Reform

The Commission recognised the importance of the data economy to improving productivity but acknowledged concerns that the CDR, which was intended to improve data access and sharing in Australia was not currently operating optimally. It considered that overspecification of the CDR framework is preventing it from operating as intended.

Accordingly, the Commission recommended that the Government work to optimise existing data sharing initiatives, with the immediate goal of making the CDR work better for businesses and consumers in the banking and energy sectors (where it already operates). Some of the major optimisation proposals the Commission recommended are:

• reducing duplication between the CDR framework’s bespoke privacy safeguards and the privacy protections under the Privacy Act which requires CDR participants to maintain two separate privacy systems for CDR and non CDR data. Importantly, this proposal is supported by the OAIC, which suggests the adoption of the Privacy Act as the sole regulatory regime;
• consultation on introduction of a third party disclosure consent that would enable consumers to direct the disclosure of their CDR data to any third party of their choosing;
• enabling government held datasets to be accessed through the CDR - for example, including Australian Tax Office (ATO) data to help improve access to credit, or integrating government data to speed up loan applications by reducing the need for manual documentation and verification; and
• in the longer term, making the accreditation process accreditation model, technical standards and designation process less onerous.

While the Commission’s interim report suggested the introduction of simplified data access pathways for low risk data use cases, its final report acknowledges that this could add to existing regulatory complexity and data policy fragmentation without providing a net improvement in productivity outcomes for the economy.

Instead, the Commission supports rightsizing the existing CDR framework so that it has the potential, where necessary, to be used for a broader range of sectors and productive uses. What this means is that for designated use cases, the CDR framework could simply define which firms need to share data, what they need to share, and how. Additional blanket requirements should be kept to a minimum, and the Government should also avoid setting requirements that go above and beyond existing legislation, such as the Privacy Act.

Mandating digital financial reporting

The Commission notes that Australia is one of only a few large, high-income economies where it is mandatory to submit financial reports in a non-digital form, such as in hard copy or as a PDF file. While the option to voluntarily submit digital financial reports has been available in Australia since 2010, but as of June 2025, no digital financial reports have been submitted.

Digital financial reporting would generate significant benefits:

• Deloitte Access Economics has estimated that introducing a digital financial reporting mandate could add $7.7 billion per year to the Australian economy after five years.
• Information in digital, machine-readable financial reports can be processed more efficiently and accurately which increases productivity by both saving workers’ time and improving the quality of their work.
• It would assist bodies such as ASIC and the ATO in undertaking their functions and activities. For example, the US Securities and Exchange Commission has used digital financial reports to analyse its entire collection of submitted reports, including conducting automatic checks for missing disclosures and making aggregate queries relating to specific disclosures (such as gathering all reported research and development expenditures).
• It could enable a number of innovative practices seen overseas, including the conduct of ‘big data’ research and analysis with the large volumes of data generated by digital financial reporting.

The Commission therefore recommended that:

• digital financial reporting be made mandatory and should initially cover disclosing entities as defined in the Corporations Act; and
• the transition to mandatory digital financial reporting should be phased and the appropriate thresholds for phased implementation be determined by the Treasury after consultation.

Comparison with Recommendations in Interim Report

The Commission’s interim report on data and digital technologies was issued on 5 August 2025. It received 75 questionnaire responses, 46 pre-interim submissions, and 728 post-interim submissions to that report.

We set out below the key recommendations of the Commission’s final report and how they changed from the interim report.

Now what?

It remains to be seen whether the Government will adopt the Commission’s key recommendations on privacy reform – we will wait with bated breath to see whether they will appear in the long anticipated Tranche 2 Privacy changes.