Thinking about doubling down on digital transformation? The legal landscape in Australia which may impact your program

Post COVID-19, agility, flexibility and pace will be necessary to survive. Embracing digital transformation will be key to the success of many businesses in light of the new era of collaboration and remote working. Forbes notes that 70% of companies either have a digital transformation strategy in place or are working towards one, and 21% think they’ve already completed a digital transformation.^[1] Thee signs are there that many companies will double down on digital transformation efforts.

Digital channels cross all sectors and industries and the impact of digital transformation on business models can be significant. Many Australian companies are now indicating anecdotally that they will increase their capital expenditure on digital transformation projects, knowing that the companies that will survive and thrive will be those that can most efficiently and effectively adapt to the expectations of the digital customer (whether a consumer or another business). 

Australia does not have specific laws regulating online business – online businesses are instead subject to the same written and common laws which apply to all businesses generally. Therefore, businesses must take into account the other factors in the Australian legal landscape that either support or hinder a digital transformation program.

In this article, Dentons Australia Limited technology lead, Robyn Chatwood, surveys the state of play in Australia and scans the horizon for businesses embarking on or already undergoing digital transformation. We cover the top ten influences which are likely to have the greatest impact.

What is digital transformation anyway?

Before we get started, it is worth setting out what is meant by the expression “digital transformation”. Digital transformation (often called DT or DX)^[2] has been defined as “the use of new, fast and frequently changing digital technology to solve problems”.^[3] DX often focuses on technologies associated with analytics, big data, cloud computing, blockchain, drones, the internet of things (IoT) quantum computing, mobility and tracking solutions, social media, or other innovation accelerators such as artificial intelligence and machine learning (AI), robotics, 3D printing, next-generation security, and virtual or augmented reality (AR and VR). In other words, technologies designed to provide new services or ways of operating are those most commonly deployed in a digital transformation. The aim is to get you up to speed on some of the issues which will be at the forefront when an Australian business transforms into a social or digital enterprise.

Why undergo a digital transformation?

Before we get started, the question needs to be asked as to what motivates a company to undergo a digital transformation in the first place.

Often digital transformation is associated with initiatives to improve connectivity between people and places or productivity. Increasingly, digital transformation has focused on the substantial value which can be extracted from data assets.

A recent study by Harvard Business School^[4] found that most often businesses in the financial services, retail, and manufacturing industries adopted digital technologies which involved analytics, artificial intelligence, big data, cloud computing, digitisation and machine learning. Their study demonstrated that investors rewarded early movers even in absence of short term performance benefits.

The researchers noted that valuations of firms that underwent a digital transformation were 7% to 21% higher than their peers, with price earnings ratios being 3% to 9% higher.^[5] The study highlighted however that the valuation benefits of going digital continued to increase over time as investors can trade profitably on announcements by companies of a digital transformation activity because investors do not expect that it will be successfully implemented.

The evidence shows that the pace of digital transformation is increasing. In 2010, only 4% of traditional companies in the United States were reported as having made announcements about transformative technologies. By 2020, this had increased to 22%.^[6]

The researcher, Flexera, noted in its 2020 Digital Transformation Planning Report, “An in-depth look at how IT leaders are approaching digital transformation”,^[7] that around half of the surveyed organisations indicated that digital transformation is their top priority, and other priorities included cybersecurity, cloud-first/cloud migration and improving the customer experience.

The priorities of CIO expenditures are nicely illustrated in a chart published by Flexera, which is reproduced below:

Although often customer experience is often reported as the driver for most digital transformation projects,^[9] Flexera’s results indicate that analytics (including expenditure on big data projects), governance and automation were lower on the list of CIO priorities despite their importance to understanding customer preferences. Governance expenditures were generally aimed at minimising the risk of security and non-compliance. Automation spends were generally designed to deliver operational and cost efficiencies.

What industries are the focus of the Australian Government’s digital transformation efforts?

Given that digital transformation appears inevitable for many businesses in Australia, the legal landscape and response of Australia’s political leaders will be important.

Australia’s Federal Government released in late 2018 an updated national digital strategy – aimed at coordinating efforts to achieve the potential economic benefits presented by new technology. The strategy was named “Australia’s Tech Future”.^[10] The context is that Australia has historically been behind other advanced economies in its adoption of digital transformation.^[11] The University of Sydney concluded in a 2019 study that Australia’s digital transformation is suffering from uncoordinated initiatives.^[12]

Nine key sectors in Australia were cited in the report to greatly benefit from DT initiatives:

• Agriculture: through self‑steering, GPS‑guided tractors and other high‑tech farming equipment, satellite technologies, drones and better use of data as well as blockchain to transform supply chain management and biosecurity outcomes.

• Manufacturing: through robotics and artificial intelligence, advanced modelling software and 3D printing, for rapid prototyping, and collaboration using cloud based tools on component design and production. Also cited were sensors connected using IoT technology to monitor production processes and use of data to anticipate demand and inform new product development.

• Mining: through driverless trains and trucks in mine operations and 3D printing to quickly deliver critical spare parts in remote locations reducing delays in production. Other technology referred to included drones and sensors to collect real time data in dangerous or inaccessible locations to support better planning and management of mining operations.

• Tourism: through the use of virtual reality and 360 degree mobile technologies to attract tourists and technology which facilitates booking and rating travel online as well as use of data combined with machine learning to predict when and where travellers may want to travel allowing them to better target travel experiences and to generate personalised offers.

• Services: where the report anticipated that artificial intelligence, data, analytics, machine learning and robotics would drive competitiveness and productivity. The report noted that digital commerce would grow with technology that enabled frontline engagement with customers in stores and online and improved data to detect frAUSulent transactions, and make services more accessible and predictable.

• Health: the report highlighted that digital technologies would improve health outcomes through software to better manage patient flows, reduce waiting times and allow remote communities access to specialised services via digital channels. Also featured were robotics to improve surgery outcomes, computers that are trained to recognise patterns in images to identify irregularities in scans and empowering consumers to better manage their own health through accessing health information online, devices that monitor blood pressure and heart rates and which track activity and enable tailored healthcare solutions.

• Education: using digital tools to access information and educational resources and complete qualifications largely online – which assists access in regional and remote locations.

• Emergency services: through the use of digital technologies to improve data collection and sharing of intelligence in complex situations and which allow alerts of situations.

• Transport: to use data to manage transport systems and traffic flows as well as increased automation of vehicles to support independent mobility and safety.

Despite the positive statistics about adoption of digital technologies, a recent survey of directors, CEOs and senior executives found that most digital transformations do not in fact achieve their goals.^[13] The survey cited that, of the USD$1.3 trillion that was spent on digital transformation in 2018, nearly USD$900 billion went to waste. So there is reason for any business contemplating its own digital transformation to scan the horizon ahead and understand what things may influence the outcome.

When planning a digital transformation in Australia, what are the key regulatory issues supporting or hindering a DT program?

When planning a digital transformation in Australia, it is imperative to know about the key issues that may impact the project. Is the Australian Government putting its money where its mouth is and facilitating DT, or are there potential risks and blockages?

Our top ten list of issues in the legal landscape which need to be kept in mind are set out below.

Issue 1: Digital businesses will face more tax

Tax will be an increasingly significant issue for digital businesses.

In 2017, Australia amended its tax system to impose and 10% goods and services tax (GST) on the sale of electronic/digital services by non-resident providers to its consumers.^[14] Digital services liable to Australian GST included online web and cloud and storage services, e-books, streaming or downloads of music, films, apps and games and other online professional services. Additionally, Australia requires a GST registration for non-resident providers of digital services which are electronic services where the service provider has annual sales over AUS$75,000. Platforms (such as the Apple App Store and Amazon Kindle) acting as the provider of the services to the consumer on behalf of content creators are liable for declaring any GST due. The Australian Government continues to explore options to address the way that digital technology and businesses should be taxed.^[15]

Apart from GST, corporate income tax for digital businesses is becoming a regulatory risk issue.

With the digital age and globalisation, businesses can develop a market without necessarily investing in that market’s local infrastructure and operations resulting in the profits being attributable to the physical home base (which is generally in lower tax jurisdictions) of that business and not reflective of the engagement in the overseas (potentially higher taxing) market.

The countries where the users are based do not generally subject the overseas digital business to corporate income tax. Under current international tax rules, companies operating across borders – as many digital businesses do – generally pay corporate income tax where their production occurs rather than tax where the consumers or users are based and from where they may derive their income without a physical presence. These multinational companies may be deriving income by selling products or services or providing services to users or by soliciting and collecting data or content contributions from them in countries outside their home base.

The Organisation for Economic Co-operation and Development (OECD) has hosted negotiations with over 130 countries and floated proposals to adapt the international tax system so that multinational digital businesses would pay some income tax where their consumers or users were based.^[16] The OECD has contemplated an approach encompassing various types of taxable profit that may be “allocated” to income derived from a user’s jurisdiction – for example:

• A share of residual profit allocated to the jurisdictions using a formulaic approach reflecting profits associated with the active and sustained participation of a business in the economy of that jurisdiction through activities in or remotely directed at that jurisdiction.
  
• A fixed remuneration based on distribution and marketing functions that take place in the overseas jurisdiction and an additional profit where in-country functions exceed the baseline activity.

According to the OECD, an agreement is expected in 2020.

The Australian Treasury, in a 2018 discussion paper on this topic, additionally noted that the current international tax framework is not sustainable and does not “… properly capture the value to digitalised businesses of the participation of users, the provision of personal data or user‑created content”.^[17] The Australian Government has noted that countries with large numbers of users but few highly digitalised domestic businesses face the increasing prospect of tax revenues diminishing as foreign, highly digitalised businesses replace traditional business activities. Australia’s Treasurer has responded to the paper that Australia, before introducing any measures, intends to wait for the multilateral plan for taxing the digital economy being led by the OECD and the G20.^[18]

In the meantime, India and Hungary have implemented a digital services tax (DST). France recently became the first major European economy to enact a DST. The French DST is a 3% cash flow tax on French revenue of large multinationals that provide digital advertising and digital platform services, such as Google, Amazon, Uber and Facebook.

The United States is strongly opposed to any form of DST however other European countries have indicated their intention to introduce something similar.^[19] The UK, for example, released in March 2020 its policy^[20] that, from 1 April 2020, a new 2% tax on the revenues of search engines, social media services and online marketplaces which derive value from UK users would be introduced with the aim being to address “… a misalignment between the place where profits are taxed and the place where value is created”^[21] and to “… ensure the large multinational businesses in-scope make a fair contribution to supporting vital public services.”^[22]

Issue 2: Digital businesses will face more regulations to curb their market power

The market power of digital businesses will be an increasingly significant issue. For some digital businesses, Australia is becoming an increasingly problematic jurisdiction.

• In 2018, the Australian Competition and Consumer Commission (ACCC) conducted an inquiry on request of the then Treasurer (now Prime Minister, Scott Morrison) into digital platforms. The inquiry looked at the effect that digital search engines, social media platforms and other digital content aggregation platforms have on competition in media and advertising services markets. In particular, the inquiry looked at the impact of digital platforms on the supply of news and journalistic content and the implications of this for media content creators, advertisers and consumers. In June 2019, the ACCC released its final report for the inquiry.
  
• The ACCC recognised the significant benefits provided by digital platforms but also noted potentially adverse consequences of their growth that needed to be considered. The inquiry’s focus was on three user groups and competition in the advertising and media markets:
  
  • Advertisers (the largest category of business users of the platforms)
    
  • Media content creators
    
  • Consumers
    
• The ACCC’s final report noted that there were overlapping issues in data protection, competition and consumer protection arising from “information asymmetries” and “bargaining power imbalances” which may be addressed by strengthened privacy and data protection laws.^[23]

In December 2019, the ACCC was directed by the government to facilitate the development of voluntary codes to address bargaining power imbalances between digital platforms and news media businesses. The government indicated at the time that, if an agreement was not forthcoming, the government would develop alternative options to address concerns raised, which may include the creation of a mandatory code. Subsequently, the government has decided that the original timeframe set out in its response requires acceleration in light of the sharp decline in advertising revenue earned by the traditional media outlets driven by coronavirus.

The ACCC had publicly stated, when negotiating the proposed voluntary agreements between traditional media outlets and the digital platforms (negotiations which were ultimately unsuccessful), that a key issue was payment for content to the traditional media by the digital platforms.

On 20 April 2020, Australia’s Treasurer announced^[24] that the Federal Government agreed with one of the ACCC’s recommendations in its report – and instructed the ACCC to develop a mandatory code of conduct to “… address commercial arrangements between digital platforms and news media businesses” and to cover the sharing of data, ranking and display of news content and the monetisation and the sharing of revenue generated from news. The mandatory code will also establish appropriate enforcement, penalty and binding dispute resolution mechanisms.

A draft mandatory code is expected to be released for consultation by the ACCC before the end of July 2020. Key issue will be the requirement of digital companies to negotiate in good faith on how to pay news media for use of their content, advise news media in advance of algorithm changes that would affect content rankings, favour original source news content in search page results, and share data with media companies. The code is expected to define the news content that would be covered by it and cover a broad range of digital services.

At present the focus is on the very large global digital players – but the response to the digital platforms inquiry suggests that there is appetite in Australia for regulation to curb the market power of dominant digital businesses.

Issue 3: Australia has relatively slow broadband communications infrastructure

Every digital transformation will rely on computing power – much of it over the internet. So it is vital to understand whether Australia’s network will be an obstacle to growth and digital transformation plans.

By way of background, NBN Co Limited (nbn) is an Australian Government-owned corporation which was established in 2009 to provide a wholesale data network. By 2019 it had grown to oversee AUS$2.8 billion in revenue and had assets under its control of around AUS$33 billion. Nbn has spent the past 11 years designing, building and operating Australia’s National Broadband Network as a monopoly wholesale broadband provider. The Australian National Broadband Network (NBN) is expected to complete its build by end of June 2020 with the aim to connect Australian premises to a national broadband network via fibre to the node, wired, satellite and radio communication components. The infrastructure project aimed to replace much of the existing copper cable telephony network in Australia.

But, companies intending to use the Australian networks need to be aware that, since it was initially proposed in 2009 that nbn would deliver wired connections with a speed of up to 100 Mbit/s (later increased to 1000 Mbit/s), the target was subsequently decreased to a minimum of 25 Mbit/s in 2013^[25] –indicating that Australia has a depressing lack of ambition.

The expected final cost of the NBN is, at present, AUS$51 billion and the current plan of nbn^[26] notes that in mid-2019, around 86% of Australian premises had been declared ready to connect, and that around 5.5 million premises were connected. Nbn now expects to complete deployment and activation by 30 June 2021 – later than scheduled.

So, if a digital transformation initiative relies on super-fast broadband speeds, then it needs to be borne in mind that, despite the efforts of nbn, Australia is 68th in global internet speed rankings and the fourth slowest country in the OECD.^[27]

On the upside is that in 2020 the Australian Government introduced a new Universal Service Guarantee (USG) to ensure access to voice and broadband services. The USG requires telecommunications providers to meet certain minimum standards and provide all Australian homes and businesses with access to both broadband and voice services, regardless of their location. The USG will use the NBN to deliver broadband services and will continue to use Telstra’s existing copper and wireless networks in rural and remote Australia for the provision of voice services in NBN fixed wireless and satellite areas. The government has also been consulting on new arrangements to improve the reliability of services generally in Part B of its Consumer Safeguards Review. While USG will retain payphone services, there will be careful examination of payphone locations, as the uptake of mobile services has grown.

Another plus is that Australia has a competitive and open mobile market and Australia’s main mobile network operators (Optus, Telstra and Vodafone) provide more than 99% of Australians with access to mobile coverage. The importance of mobile coverage is illustrated by Australia’s top ranking (amongst 165 countries) in a 2018 measure of performance of key enablers of mobile internet adoption.^[28]

Issue 4: Mobile black spots are improving

The Federal Government has also committed AUS$380 million to the Mobile Black Spot Program to invest in telecommunications infrastructure to improve mobile coverage and competition across Australia. This has enabled the switching on of an additional 750 mobile base stations. The Program also involved a review of the general Telecommunications Consumer Safeguards that apply to all services, to assess what safeguards may be needed in the future.

Issue 5: 5G infrastructure roll out is still in its infancy

5G refers to the fifth generation of mobile technology, in line with the International Mobile Telecommunications-2020 (IMT-2020) Standard of the International Telecommunications Union and the associated releases of the 3rd Generation Partnership Project (3GPP). The Australian Government released in 2018 a report detailing its actions to support the timely rollout of 5G in Australia (5G – Enabling the future economy report). That same year, the government allocated 5G spectrum in the 3.6 GHz band to four major telecoms, raising nearly AUS$853 million after selling 350 available spectrum lots. Telstra won 143 lots, Mobile JV (a joint venture of TPG Telecom and Vodafone Hutchison Australia) won 131 lots, Optus won 47 lots and Dense Air Australia won 29 lots.

In August 2019, the Federal Government decided to ban the use of equipment from China’s Huawei Technologies in Australia’s 5G networks. On 13 September 2019 the Minister for Communications requested The House of Representatives Standing Committee on Communications and the Arts to inquire into and report on the deployment, adoption and application of 5G in Australia. No report has yet been released relating to this inquiry.

In an analysis conducted by OpenSignal of device-based data collected between April 1 and June 30 2019 from eight countries, Australia was the only country where 4G user experiences of speed was higher than 5G speeds – an indication that 5G rollout is still in its infancy.

Issue 6: Better GPS infrastructure is coming

The Federal Government allocated in the 2018-19 budget AUS$160.9 million over four years to develop and operate a satellite-based augmentation system (SBAS) which is capable of more accurately determining position than standard GPS so as to support emerging technologies. The aim is to provide better GPS for regional Australia with an accuracy of ten centimeters and a network of ground stations to provide GPS data with an accuracy of three to five centimeters in major population centres. Geoscience Australia had oversight of the SBAS Test-bed service in 2017. The SBAS Test-bed included 27 demonstrator projects across ten industry sectors including agriculture, aviation, construction, consumer, resources, road, rail, maritime, mining and water utilities.^[29] Greater accuracy will be crucial to vehicle automation which has requirements for positioning on the road within lanes. Aviation and maritime sectors are also poised to take advantage. The SBAS test transmission services that were part of the SBAS Test-bed project are currently set to be discontinued after 31 July 2020, and plans are that a similar test transmission service will resume in 2021 which will be developed to become a fully operational SBAS for the Australasian region by 2023. The new system will be called the Southern Positioning Augmentation Network.

This timetable will be important for though DTs which rely on the effectiveness, accuracy and reliability of positioning as well as wider coverage and signal integrity.

Issue 7: Tariffs are coming down for imports of IT products into Australia

Australia is a signatory to the World Trade Organization’s Information Technology Agreement (ITA) which aims to liberalise tariffs and import duties on IT products. IT products account for approximately 10% of global merchandise exports.^[30] The products covered by the Information Technology Agreement were expanded to an additional list of 201 products which represent annual trade valued at over AUS$1.3 trillion per year (or 7% of total global trade today). The expanded list covers new generation semi-conductors, semi-conductor manufacturing equipment, optical lenses, GPS navigation equipment, and medical equipment such as magnetic resonance imaging products and ultra-sonic scanning apparatus.

Under the terms of the ITA, most tariffs will be reduced or eliminated by 2020 by 82 participants representing about 97% of world trade in IT products. Australia has committed to phasing out tariffs on the expanded list of products by 2021^[31] – a decision which is expected to impact the around AUS$19 billion worth of goods covered under the expanded ITA. The ITA also contains a commitment to tackle non-tariff barriers in the IT sector.

Issue 8: There is a lack of funding for big data and data science initiatives

In 2016, the Australian Government established Data61 – a data innovation group within The Commonwealth Scientific and Industrial Research Organisation (CSIRO which is Australia’s Federal agency responsible for scientific research). Data61 was asked to lead and concentrate Australia’s data-driven research and technology capability.

The government also added funding to its Cooperative Research Centres (CRC) program to support projects that use artificial intelligence and machine learning capabilities to solve problems identified by industry.

Data61 and the CSIRO have delivered on some heavy hitting projects to date – using a collection of artificial Intelligence technologies able to solve problems and perform tasks without explicit human guidance, such as machine learning, computer vision, natural language processing, robotics and deep learning. Initially, projects have focussed on areas such as food security and quality (e.g. gene crop sequencing) or using machine learning to collate and display spatial data from Australian Government agencies.^[32]

A wrinkle however is that many of the initiatives are reliant on partnering with Australian private organisations and, generally, there is an inadequacy of funding in this area. The CSIRO noted in its 2016 report on the megatrends expected to impact Australia over the next 20 years^[33] that Australian venture capital (VC) funding is declining and the VC sector is “exceptionally specialised and high risk”^[34] but not well established in Australia. Venture capital funding accounts for only 0.02% of Australian gross domestic product (GDP) with healthcare, life sciences, energy and environment sectors the most targeted ventures funded by VC investors. These are the same areas initially targeted by Data61 which is good news for companies operating in those sectors.

Data scientists are in demand worldwide and Australia is no different. We are expecting that big data applications will explode across a variety of industries following the pandemic – as big data, artificial intelligence, and machine learning will assist companies to make sense of large global data sets for setting strategy.

Most of Data61’s work is in nationally important applications^[35] including:

• Biosecurity risk and surveillance
• Genomic selection in plant and animal breeding
• Environmental monitoring
• Transport analytics
• Data-driven social insights
• Natural hazards and infrastructure
• Industrial automation and optimisation
• Design optimisation and decision support
• Financial risk

Good news for those sectors. Elsewhere, reliance on VC will be crucial.

Issue 9: RegTech (that is, digital legislation) is coming

Another initiative of the Australian Government through the Digital Transformation Agency (DTA) is digital legislation, policy and rules.

This initiative involves legislation, policy and rules being made available in order for them to be “consumed or interpreted by a machine”^[36] where software can understand and interact with them. This initiative is inspired by countries such as Denmark (who has created principles for their legislative drafting process to facilitate digital ready legislation)^[37] and New Zealand (who has explored this through a Better Rules for Government Discovery initiative).^[38] On 7 January 2020, the Bank of England (BoE) published a discussion paper^[39] aiming to introduce machine readable rules to improve the timeliness and effectiveness of data collection from companies across the financial system. On the same date, the UK’s Financial Conduct Authority (FCA) “refreshed”^[40] its Data Strategy setting out a transformation plan to become a highly data-driven regulator.

To the same end:

• The Australian Securities and Investments Commission (ASIC – the primary regulator of companies in Australia) has initiated machine learning monitoring of responsible lending obligations by credit providers, digital record-keeping of financial services and tested a prototype licensing guidance chatbot^[41]
  
• CSIRO’s Data61 has an ongoing RegTech program to digitise legislation into machine interpretable rules and make them traceable to original legal texts^[42]

Data61 notes that compliance has become Australia’s fastest growing sector at an estimated cost of AUS$250 billion a year and has pushed on with regulation based on an open platform which is founded on digital logic as part of Australia’s National Innovation and Science Agenda: Platforms for Open Data framework.

The thinking is that “regulation as a platform” will maximise the value of regulation as the “key data set of government”.^[43] Current Data61 is working through the transformation of rules into machine-readable logic that capture’s the intent and operation of regulation as a first step to enabling access to the regulation data via an open platform and free API. Data61 had foreshadowed it will then allow tools to be developed to automate compliance processes.

This will be a welcome initiative to though whose DT programs are designed to reduce compliance costs.

Issue 10: Australia’s anti-encryption laws adversely impact the tech industry and cyber-security measures

In 2016, the government released Australia’s Cyber Security Strategy setting out proposed investments of more than AUS$230 million for the period up to 2020.

Despite such encouragement of cybersecurity, less than two years later, Australia hurriedly (with little consultation) passed a controversial law (in a world first) which compel companies with a website accessed by Australians to grant security agencies access to encrypted messages on their request. The justification given by the Australian Government at the time was that the laws were necessary to help combat immediate threats of terrorism and crime as terrorists and criminals use end to end encryption (which allows only the sender and recipient to view a message) to avoid surveillance.

However critics (and there are many of them) have a number of concerns – particularly the concern that the laws could undermine overall security and privacy of users.

The new law is called the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (Cth) (TOLA). The legislation regulates “designated communications providers” where they provide an electronic service that has one or more end users in Australia. An electronic service includes a website and so the definition is broad enough to capture a provider’s internal network and intranet. Providers include telecommunication companies and OTT providers (such as WhatsApp messaging services) but the definition is so broad it captures most Australian businesses as most operate websites or other electronic services.

Anyone disclosing information to another person (who is not authorised to know) that an organisation has been requested to provide assistance to a security agency under the TOLA is at risk of imprisonment for up to five years.

There are many queries as to the effectiveness of TOLA in light of the fact that criminals and terrorists can get around it by using apps that are outside the jurisdiction of the Australian Government or through using a Virtual Private Network (VPN) service that ensures point-to-point encrypted connections without logging or through a browser enabling anonymous communication.

The consequences of TOLA are primarily two-fold:

• Australia is a global backdoor for security agencies and law enforcement to access data: TOLA means that Australia is a global weak point for digital companies and such companies face the unenviable choice of complying with TOLA (and so perhaps breaching other data privacy laws or contractual obligations around the world) or not complying (due to such other laws and commitments) and risk fines or imprisonment for people who reuse to comply.

TOLA incentivises people to shun Australia (such as criminals or terrorists, but also other organisations) as they consider Australia now to be the weak point facilitating decryption of global networks. Such people and companies can use other methods and tools outside Australia for communications. This might have the effect of making it harder for Australia’s law enforcement bodies to achieve the primary objective of TOLA. As terrorists and criminals deploy methods to circumvent the law, so will legitimate businesses take action to drive their business outside of Australia.

• The laws are stifling Australia’s tech industry: There is an adverse effect of TOLA on Australia’s tech industry. At the time TOLA was enacted, Australia was described as making itself a “… global guinea pig in testing a regime to crack encrypted communication”.^[44] Within three months after TOLA was enacted, the tech sector in Australia was blaming it for a downturn in the sector.^[45]

To date, there is little public data available as to how TOLA is working^[46] however the Opposition to the federal government has proposed amendments to it in 2019^[47] to address a number of flaws^[48]. At the time of proposing amendments the Opposition noted that the legislation “… hurts the Australian tech industry… ” as customers are “… less likely to seek out contracts with Australian companies due to the potential that they would be forced to introduce systemic weaknesses into their systems… ” and that the “… encryption laws are holding the tech sector back from achieving that potential.”^[49]

The Opposition also stated that the legislation, as it currently stands, may prevent Australia from reaching a bilateral CLOUD Act agreement (that is, a Clarifying Lawful Overseas Use of Data agreement with the United States of America). The Opposition’s amendments are not expected to be considered by the Australian Parliament until later in 2020.

Australia’s approach somewhat differs from some other encryption laws, such as those in China^[50], Russia^[51] and Turkey,^[52] which license (and control) services offering end-to-end encryption. TOLA instead creates a broad framework for authorised government agencies to request or order a range of assistance from online service providers. Under TOLA, security agencies can request companies to create a technical function that would provide them with access to encrypted messages without the user’s knowledge. The legislation has a few restrictions on the government security agencies but, in short, a company with an Australian website may be required to introduce new secret capabilities into its services in order to facilitate the work of the security agencies. If the company doesn’t comply with the request, it risks fines.

Conclusion

Digital transformation is expected to be a top priority for many companies in Australia as we emerge from the first half of 2020. But there are challenges in navigating the complex legal and regulatory obligations that come along with it.

In this article, we explain some of the key enablers and potential obstacles to consider and take into account when planning a digital transformation in Australia. Digital channels cross all sectors and industries and it also helps to bear in mind where the sectors and industries most likely to attract Australian Government support.

If you require further information or assistance with your Australian digital transformation, please contact Robyn Chatwood or your usual technology contact at Dentons.

---

1. See “100 Stats On Digital Transformation And Customer Experience” by Blake Morgan dated 16 December 2019, Forbes Magazine at https://www.forbes.com/sites/blakemorgan/2019/12/16/100-stats-on-digital-transformation-and-customer-experience/#636b13b73bf3
2. For example, at “IDC says get on board with the DX economy or be left behind” by Jim O’Donnell dated 10 March 2017 at https://searcherp.techtarget.com/news/450414723/IDC-says-get-on-board-with-the-DX-economy-or-be-left-behind
3. According to Wikipedia at https://en.wikipedia.org/wiki/Digital_transformation
4. See “Research: Investors Reward Companies That Talk Up Their Digital Initiatives” by Suraj Srinivasan and Wilbur Chen dated 18 June 2019, Harvard Business Review at https://hbr.org/2019/06/research-investors-reward-companies-that-talk-up-their-digital-initiatives
5. See 2 above.
6. See “Q&A: Digital Transformation Leads to Improved Valuations, Performance” by Bob Keaveney dated 11 March 2020, Biz Tech Magazine at https://biztechmagazine.com/article/2020/03/qa-digital-transformation-leads-improved-valuations-performance
7. At www.flexera.com
8. “2020 Digital Transformation Planning Report – An in-depth look at how IT leaders are approaching digital transformation”, Flexera at page3, Figure 1.
9. See, for example, “CIOs Have a Lot to Worry About in the Digital Age” by Sohini Bagchi dated 13 March 2020, CXO Today.com at https://www.cxotoday.com/news-analysis/cios-have-a-lot-to-worry-about-in-the-digital-age/ citing a global study titled 2020 CIO Priorities Report by Flexera based on a survey of over 302 enterprise CIOs which examined how their companies were digitally transforming.
10. “Australia’s Tech Future” dated December 2018 published by the Department of Industry, Science and Technology at https://www.industry.gov.au/data-and-publications/australias-tech-future
11. See “Why Australia is falling behind on productivity” dated 20 June 2019 by John Kehoe, The Australian Financial Review at https://www.afr.com/technology/wages-hurt-by-low-tech-adoption-and-less-job-switching-20190619-p51zbc
12. See “Australia’s digital transformation is suffering from uncoordinated initiatives” dated 4 November 2019 at https://www.sydney.edu.au/business/news-and-events/news/2019/11/04/australia-s-digital-transformation-is-suffering-from-uncoordinat.html
13. According to “Businesses Predict Digital Transformation to Be Biggest Risk Factor in 2019” by Mengqi Sun dated 5 December 2018, The Wall Street Journal at https://blogs.wsj.com/riskandcompliance/2018/12/05/businesses-predict-digital-transformation-to-be-biggest-risk-factors-in-2019/ citing research conducted by North Carolina State University’s Enterprise Risk Management Initiative and management consulting firm Protiviti Inc.
14. Tax and Superannuation Laws Amendment (2016 Measures No1) Act 2016
15. As mentioned in https://www.industry.gov.au/data-and-publications/australias-tech-future/regulation/what-is-the-government-doing-in-regulation
16. See OECD (2020), Statement by the OECD/G20 Inclusive Framework on BEPS on the Two-Pillar Approach to Address the Tax Challenges Arising from the Digitalisation of the Economy – January 2020, OECD/G20 Inclusive Framework on BEPS, OECD, Paris at www.oecd.org/tax/beps/statement-by-the-oecd-g20-inclusive-framework-on-beps-january-2020.pdf which also refers to “Public consultation document – Secretariat Proposal for a “Unified Approach” under Pillar One” dated 9 October 2019 – 12 November 2019, OECD.
17. See the discussion paper published by the Australian Government on the matter at “The digital economy and Australia’s corporate tax system – Treasury Discussion Paper” dated October 2018, Commonwealth Government of Australia, page 13 at https://treasury.gov.au/consultation/c2018-t306182.
18. See “Amazon, Facebook and Google hit back at tax on digital companies’ sales, warn of trade wars” by Nassim Khadem dated 3 Sep 2019, ABC News at https://www.abc.net.au/news/2019-09-03/french-tax-on-tech-giants-sales-could-spark-a-new-trade-war-and/11471756
19. Such as Austria, the Czech Republic, Italy, Poland, Spain and the UK.
20. “Policy paper Digital Services Tax”  Published 11 March 2020 at https://www.gov.uk/government/publications/introduction-of-the-digital-services-tax/digital-services-tax
21. As above.
22. See item 23 above.
23. Digital Platforms Inquiry June 2019 Final Report Executive Summary at https://www.accc.gov.au/publications/digital-platforms-inquiry-executive-summary at page 5.
24. See “ACCC mandatory code of conduct to govern the commercial relationship between digital platforms and media companies” 20 April 2020 Joint media release of The Hon Josh Frydenberg MP with The Hon Paul Fletcher MP Minister for Communications, Cyber Safety and the Arts at https://ministers.treasury.gov.au/ministers/josh-frydenberg-2018/media-releases/accc-mandatory-code-conduct-govern-commercial
25. That depressing lack of ambition still exists today – see “NBN boss dumps top speed of 100mbps for hundreds of thousands of fixed wireless customers” dated 25 May 2018 by Dan Conifer, ABC News at https://www.abc.net.au/news/2018-05-25/nbn-boss-dumps-top-speed-for-fixed-wireless-customers/9797772 which note Turkish users in 2012 will fare better.
26. Corporate Plan 2020-23 dated 2019 at https://www.nbnco.com.au/corporate-information/about-nbn-co/corporate-plan/corporate-plan
27. See “‘Embarrassingly slow’: Australia’s broadband internet ranked fourth slowest in OECD” by Isabelle Lane dated 28 January 2020 at https://thenewdaily.com.au/life/tech/2020/01/28/broadband-speeds-australia-oecd/
28. GSMA’s Mobile Connectivity Index at http://www.mobileconnectivityindex.com/
29. See https://www.ga.gov.au/scientific-topics/positioning-navigation/positioning-australia/trial-of-accurate-positioning
30. According to the World Trade Organization at https://www.wto.org/english/tratop_e/inftec_e/itaintro_e.htm
31. As noted in https://www.dfat.gov.au/trade/organisations/wto/Pages/information-technology-agreement
32. See examples at https://www.csiro.au/showcase/ai%20 and https://data61.csiro.au/en/Our-Research/Focus-Areas/AI-and-Machine-Learning
33. “Tomorrow’s Digitally Enabled Workforce: Megatrends and scenarios for jobs and employment in Australia over the coming twenty years” by SA Hajkowicz, A Reeson, L Rudd, A Bratanova, L Hodgers, C Mason and N Boughen, 2016, CSIRO.
34. As above at page 43.
35. As noted at https://data61.csiro.au/en/Our-Research/Programs-and-Facilities/Analytics-and-decision-sciences
36. As described by the DTA at https://www.dta.gov.au/blogs/exploring-opportunities-digital-legislation-policy-and-rules
37. See the Danish Ministry of Finance’s Agency for Digitisation’s webpage at https://en.digst.dk/policy-and-strategy/digital-ready-legislation/
38. See “LabPlus: Better Rules for Government Discovery Report” dated 7 April 2018 at https://www.digital.govt.nz/blog/labplus-better-rules-for-government-discovery-report/
39. “Transforming data collection from the UK financial sector” dated 7 January 2020 by Bank of England at https://www.bankofengland.co.uk/paper/2020/transforming-data-collection-from-the-uk-financial-sector
40. As described by the FCA and BoE at https://www.fca.org.uk/news/press-releases/fca-and-boe-announce-proposals-data-reforms-across-uk-financial-sector
41. As noted by ASIC at https://asic.gov.au/for-business/innovation-hub/asic-and-regtech/asic-regtech-initiative-series-2018-19/regtech-approach-and-next-steps/
42. See Data61’s page on this topic at https://data61.csiro.au/en/Our-Research/Our-Work/Future-Cities/Optimising-service-delivery/RaaP
43. As per above.
44. As described in “Australia’s war on encryption: the sweeping new powers rushed into law” dated 8 December 2019 by Paul Karp, The Guardian at https://www.theguardian.com/technology/2018/dec/08/australias-war-on-encryption-the-sweeping-new-powers-rushed-into-law
45. See “Why we need to fix encryption laws the tech sector says threaten Australian jobs” by Damien Manuel dated 29 March 2019 at https://theconversation.com/why-we-need-to-fix-encryption-laws-the-tech-sector-says-threaten-australian-jobs-110435?gclid=CjwKCAjwkPX0BRBKEiwA7THxiOpV8OFHmawv8ppc_atP1CM_LfoVL1gG7zLHHX3CbBjv2F6KKgcRGBoCxDkQAvD_BwE
46. There is scant information published by The Parliamentary Joint Committee on Intelligence and Security which conducted a review of TOLA in 2019 at https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Intelligence_and_Security/AmendmentsTOLAAct2018.  The Independent National Security Legislation Monitor is due to report by 30 June 2020 on its findings to inform the Committee’s review.
47. Telecommunications Amendment (Repairing Assistance and Access) Bill 2019 at https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=s1247
48. As described by Senator Anne Urquhart in second reading speeches 4 December 2019 in Senate Hansard.
49. As above, at page 5080.
50. See 2019 China Data Protection and Cybersecurity Annual Report published 31 March 2020 by Dentons China at https://www.dentons.com/en/insights/guides-reports-and-whitepapers/2020/march/31/2019-china-data-protection-cybersecurity-annual-report.  The Cryptography Law passed by the PRC National People’s Congress 26 October 2019 which came into effect 1 January 2020 which requires companies to provide access to certain government agencies to the companies’ encrypted servers, decryption keys and passwords.
51. See “Russia passes law forcing manufacturers to install Russian-made software” dated 3 December 2019 by Jon Porter outlining that Russia’s legislation to come into effect on 1 July 2020 requires manufacturers of smartphones, computers, and smart TVs to pre-install Russian-made software on their devices at https://www.theverge.com/2019/12/3/20977459/russian-law-pre-installed-domestic-software-tvs-smartphones-laptops.   Also, the Global Partners Digital World Map of encryption laws and policies at https://www.gp-digital.org/world-map-of-encryption/ also notes that Federal Law No. 128-FZ “On Licensing Specific Types of Activity” provides that “a licence is required for distributing encryption facilities, maintaining encryption facilities, providing encryption services, and developing and manufacturing encryption facilities protected by means of encryption” and that Federal Law No. 149-FZ “On Information, Information Technologies and Protection of Information” “requires “organisers of information distribution” that add “additional coding” to transmitted electronic messages to provide the Federal Security Service with any information necessary to decrypt those messages”.
52. The Regulation on the Procedures and Principles for Encoded or Encrypted Communication between Public Authorities and Organisations and Real and Legal Persons in Electronic Communication Services (the Encryption Regulation) sets out principles and procedures for encrypted communication systems.  Operators who intend to provide encoded or encrypted communication services must apply to the Information and Communication Technologies Authority (ICTA) for authorisation.