APF chair David Vaile and deputy chair Dr Juanita Fernando [below, right] said in the letter, which was released on the organisation's website on Wednesday, that forcing users to log in to use a service which contained content they had paid for was creating "a non-voluntary online identification scheme of the kind typically justified as supporting the sale of mass psychographic profiling ‘insights’ to a platform’s advertisers".
The ABC announced the compulsory logins in a statement on 17 February, claiming that it would collect user data but would not sell the same. However, the data will be shared with both Google and Facebook.
iview is a service that allows viewers to see programs that have already been broadcast, or, in some cases, which are yet to go to air.
"This 'opt-out' process is, in our view, unusable, rather than a credible or respectful mitigation measure for the privacy intrusion the Corporation is proposing," they added.
The very notion of opt-out settings sounded like an oxymoron, Vaile and Fernando said, noting that this still meant that mandatory collection of data would take place.
"It is reminiscent of commercial 'opt out' online tracking schemes, which require users not wanting to be tracked by cookies to accept a tracking cookie to mark their choice to opt out, with a user-opaque backend and no way to tell what happened to the retained personal information thereafter," they explained.
They also highlighted the fact that privacy impact assessment of the new measure had been conducted in-house, rather than by an independent expert in an open and consultative manner.
"This flawed approach lacks independence and transparency, compromising the process’s rigour," they said. "The usual explanation for this sort of PIA is a prior commitment to implement the plan [a mandatory registration system] anyway, regardless of issues like intrusiveness, threats to privacy, potential to undermine trust, or lack of justification – at worst, a PIA as a box-ticking compliance exercise, rather than as a credible, open investigation of potential impacts and an opportunity to explore alternative ways to achieve necessary effects."
The APF officials questioned why users were not given a choice between creating an optional voluntary account and mandatory involuntary registration.
"It is not essential for audience members to be required to register with the ABC for the broadcaster to analyse usage figures to understand the content, features and kinds of programmes people like. The ABC’s usage figures illustrate this already," Vaile and Fernando pointed out.
Further, the data that was collected through an iview account did not necessarily enable analysis of who within a house was watching a specific program, but only that _someone_ was watching, the two APF officials said.
"So the ABC’s claim that account-holder information collected and used by these mandatory accounts is necessary to provide a granular view of watcher engagement for programming analysis is not persuasive, and does not demonstrate this intrusion is necessity for improving ABC services for all Australians," they said.
Vaile and Fernando said the registration scheme was a violation of the Commonwealth Privacy Act of 1988, which specified that "individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with an APP [Australian Privacy Principle] entity [such as the ABC] in relation to a particular matter".
There were only two exceptions:
APP 2.2(a): where "the APP entity is required or authorised by or under an Australian law, or a court/tribunal order, to deal with individuals who have identified themselves", or
APP 2.2(b): where "it is impracticable for the APP entity to deal with individuals who have not identified themselves or used a pseudonym".
The APF officials said neither exception was applicable to the ABC’s mandatory registration proposal, which amounted to mandatory identification.
"This thus contravenes every Australian’s right to choose not to identify themselves except in limited, exceptional circumstances," they added.
Vaile and Fernando questioned what would happen when someone who had no functioning ABC account attempted to access the broadcaster’s services asking whether such people would be excluded.
In response to the ABC's claim that it had carried out Video On Demand research in 2021 with a sample of 1500 people, and the responses justified the move to mandatory logins, the APF asked for the research methodology, the questions and the responses to be made publicly available.
With regard to privacy and information security, Vaile and Fernando asked whether there was any specific guarantee offered by the ABC that information and metadata collected from users who registered using anonymous or spurious information would not be linked to their account.
"For instance, will Google, Amazon, Facebook/Meta or other foreign commercial online surveillance operators be able to exploit ABC account information or behavioural data traces to add to their own existing psychographic profiling information about users of online services?" they asked.
"We would appreciate any technical details on work done to investigate or address this risk."
The two APF officials concluded by saying, "Taken together these issues suggest the mandatory registration scheme, having been prototyped and considered, should now be set aside."
Contacted for comment, an ABC spokesman said: "Viewers will still be able to watch all the ABC’s live broadcast streams on ABC iview web including ABC TV, ABC News, ABC Kids and ABC ME without needing to log in.
"All other ABC television and radio services, and the broader suite of ABC apps, are available without creating an account and logging in."