Samantha Floreani's email is on her local member of parliament's mailing list.
But Floreani didn't sign up — it was added after she emailed her representative.
"I think a lot of people have been persuaded to get in touch with their representatives about all kinds of issues that they care about," she said.
"That's a normal part of democratic participation."
Despite several attempts to unsubscribe, the digital rights advocate still receives the emails.
Unlike businesses or other organisations, your local member isn't required to include an option to unsubscribe in their emails and can continue emailing you because of an exception in the Spam Act.
A similar rule also exists in the laws that govern privacy (The Privacy Act) and the Do Not Call Register.
The exemption applies to political parties, politicians and candidates, as well as contractors and volunteers for acts and practices in the political process.
The Privacy Act governs the collection and use of Australian's personal information.
Nearly three-quarters of Australians incorrectly believed that political parties and political representatives had to comply with the Privacy Act, according to the Office of the Australian Information Commissioner's latest community attitudes study, conducted in 2023.
Eighty-two per cent of respondents said they should be included.
Floreani said it is "very clear" that the community expects more.
"There's a lot of people out there who expect better from political parties and think that they are subject to these rules when they're just not."
The importance of voter privacy
Dr Tegan Cohen said there is a strong link between privacy and free and informed voting.
The postdoctoral research fellow at the Queensland University of Technology has studied voter privacy in the age of data-driven political campaigning.
"We don't have to look very far or very hard for examples of how invasions of privacy, surveillance, is used as a tool to suppress political dissent and chill political speech," she said.
She said applying the Privacy Act to political parties and candidates would allow more transparency around the use of voter data.
According to Cohen, there is a misunderstanding about what removing the exemption would do, based on an overestimation of the current scope and limits of the Act.
"It would make sure that when they collect it, they use it for the purpose that they originally collected it for or the purpose that's related, not purposes that are way outside the scope of our expectations," she said.
Floreani said politicians could still collect and use data if they were subject to the Act.
Cohen said there is hope for the introduction of a 'fair and reasonable' test to be applied to the collection and use of data.
She said the test is "really important because they can't contract out of that obligation".
"[It means] they can't get our consent to use or disclose data unfairly. And it sort of puts the onus on them to think about whether or not their uses are proportionate, if the benefits outweigh the risks, the harms that they might do, the sensitivity of the information."
The test was recommended in the 2023 Privacy Act review, but has been left to a second stage of reforms.
Attorney-General Mark Dreyfus said the application of the recent privacy review would occur over two tranches of reform. Source: AAP / Mick Tsikas
Collecting more information raises risk in a breach
Cohen said it is "very likely" that political parties have "quite a bit of sensitive information about us, about their constituents, about their prospective voters".
She said the lack of legislative obligations to ensure the security of voter data is "pretty troubling".
The more information an organisation collects, Floreani said, the greater the potential consequences if the data was to be released in a breach.
"If they are collecting and storing not just ... your contact details, for example, but also things like your interest in particular political topics or your political beliefs, then that is extremely valuable and rich data that would be pretty devastating if it was to end up in the wrong hands," she said.
LISTEN TO
Politicians, Privacy, and You
SBS News
08:09
The sensitive data can also be used to target messages to small groups, or even individual voters.
Cohen says this takes political messaging out of the public sphere, making it harder to scrutinise its content.
"The lack of visibility about exactly what that data is is something which makes the risk even harder to assess," she said.
Floreani said: "It is easier than ever to harvest immense amounts of personal information and other data" that can be used to personalise content or "generate content using AI and target people".
"In this context, where we exist in an information ecosystem that allows this kind of surveillance and targeting, more than ever, our political parties should be demonstrating best practices and making sure that they're handling people's information transparently and with respect and in a fair and reasonable way."
Calls for reform in 'an entirely different' environment
The political exemption to the Privacy Act came into force in 2001.
"At that time political parties did have voter databases, but a lot of messaging to voters was done through TV, through letterboxing. I think email might've been sort of on the up and coming," Cohen said.
She said we are now holding elections in "an entirely different technological environment".
When the Privacy Act was first introduced in 1988, it only applied to government agencies before being extended to the private sector 12 years later.
Australian Democrats senator Natasha Stott Despoja attempted to have the exception removed. Source: AAP / Alan Porritt
Her bill lapsed at the end of the parliamentary term in 2008, before being restored and later lapsing again.
In their 2007 and 2010 reviews of Australian privacy law, the Australian Law Reform Commission recommended its removal.
More recently the Attorney-General's department reviewed the act in 2023.
The department recommended ensuring "risks to privacy resulting from the small business, employee records, political and journalism exemptions are addressed in a proportionate and practical way."
Will changes be made?
The 2023 privacy recommended the political exemption be removed, with the federal government noting the recommendation in its response.
Floreani said the issue "always ends up being pushed aside".
"It just hasn't gotten through and I have no confidence that it will, because it ultimately does serve their interests to be able to have a bit of a free-for-all all with our personal information," she said.
Despite its 24-year long persistence, Cohen isn't convinced the political exemption isn't a necessary intrusion on the public's privacy.
"I don't think the political exemption was ever really justified, and I think the case for removal gets stronger every election cycle."
