Data protection is a mental health issue for young people

Australia’s leading use of digital technologies in youth mental health services could help inform Australia’s Privacy Act review, with lessons for mental health services along the way

Dr Piers Gooding, University of Melbourne; Dr Rys Farthing, Reset Australia, and Emily Painter

Dr Piers GoodingDr Rys FarthingEmily Painter

Published 25 October 2021

In 2018, a Melbourne high school mistakenly released the personal digital records of hundreds of students.

Among the records were details of students’ “mental health conditions, medications, learning and behavioural difficulties”. This was bad enough but globally breaches of privacy like this can be much worse.

Data concerning mental health is being increasingly monetised. Picture: Getty Images

Last year, in Finland the counselling records of around 30,000 people were hacked. The hacker(s) attempted to extort victims with the threat that the records would be publicly released. The records included details of family abuse, sexuality that was hidden from others, and suicide attempts.

‘Accidents’ like leaking and hacking aren’t the only issues.

Data concerning mental health is being increasingly monetised. Privacy International recently analysed 136 popular mental health websites and apps (all of which are accessible to young people) and found that 76 per cent of them included trackers or third-party code that enable data to be sold to advertisers.

These ‘data harms’ require urgent attention to ensure young people and their families can access high-quality crisis support online in a safe and secure way.

One key to creating trustworthy online support is robust legal regulation to govern data use and privacy. Australia is often positioned as a global leader in mental health service provision, particularly for young people.

This expertise could be leveraged as part of the Privacy Act review, and an upcoming Bill on ‘Enhancing Online Privacy’, to ensure that Australia has fit-for-purpose privacy and data protection regulations to safeguard children and young people’s lives online.

Likewise, the mental health sector could benefit by being better equipped to address its own emerging issues of data governance.

Facebook Australia was found to be boasting about its ability to use data to target children who were feeling “worthless” and “insecure”. Picture: Shutterstock

Getting protection right for the next generations

Children have the right to privacy and adequate data protection. The newly minted UN General Comment on children’s rights in relation to the digital environment explicitly outlines how the reckless use of children’s data can ‘result in violations or abuses of children’s rights’.

Harms concerning big commercial social media platforms, for example, include pushing children towards extreme content, automated notifications that interrupt sleep, and children being targeted with ‘potentially harmful commercially driven content’.

Not all these risks are confined to data concerning distress or health, but such data are particularly sensitive. For example, in 2017 Facebook Australia was found to be boasting to advertisers about its ability to use children’s personal data to identify and target children who were feeling “worthless” and “insecure”.

Again, in April this year, Facebook was found using data to target children interested in extreme weight loss, alcohol or gambling. And just last month, the explosive ‘Facebook Files’ revealed that the company’s internal research indicated its Instagram platform contributes to eating disorders and suicidal thoughts in teenage girls.

These troubling forms of data production require attention by lawmakers, not least given their impact on children’s health and development.

For this reason, the upcoming Privacy Act review relates directly to the interests of young Australians, their families, and the youth mental health sector. The Privacy Act is the principal piece of Australian legislation protecting the handling of personal information about individuals.

Industry codes alone are not enough to address the risks of data harm in the rapidly changing digital ecosystem. Picture: Shutterstock

The Attorney General’s Office, in response to ACCC recommendations, has announced an industry-drafted Code for social media and online platforms that will provide guidelines around processing children’s data.

But industry codes alone will never be enough. Robust legal and regulatory frameworks, including amendments to the Privacy Act, are required to address the risks of data harm in the rapidly changing digital ecosystem.

This might seem outside the remit of youth mental health organisations and service user and family advocacy bodies, but these groups have a unique role to play in ensuring data concerning mental health, and more broadly children and young people’s experiences online, are protected in line with community standards and social expectations.

Data concerning mental health - more sensitive than most

Mental health-related data is a highly sensitive subset of data concerning health, which itself is already sensitive. It’s one thing for a childhood diagnosis of bronchitis to be entered onto an electronic record, and quite another for a diagnosis of childhood mental illness to be held in digital perpetuity.

In Australia, efforts to digitise and virtualise mental health services have been ramping up for several years and have accelerated under pandemic conditions. The recent Royal Commission into Victorian Mental Health Services embraced online options for mental health-related support, which is likely to set the direction of national reform.

The Privacy Act review, and an upcoming Bill on ‘Enhancing Online Privacy’, provides an opportunity for a much needed data regulatory framework. Picture: Getty Images

Some efforts to digitise mental health services raise ethical challenges that must be carefully considered. For example, up to 20,000 Australian high school students will have their phone data monitored – with their consent – for up to five years in an attempt to track how mental health issues develop in adolescence.

The study aims to test whether smartphones can help deliver preventive interventions on a large scale. This includes using movement and location tracking to identify triggers for the development of mental health symptoms.

Navigating the ethical and legal challenges raised by these developments – like the way biometric monitoring engages privacy and other human rights – is harder when privacy and data protection laws haven’t kept pace with technological developments.

The Australian Human Rights Commission’s recent report into new and emerging technologies explored these issues and made the case for comprehensive reform to Australia’s privacy laws.

Others have suggested that human rights approaches tend to be overly individualistic, with the attention needed instead on the use of behavioural data as a democratic resource, which would challenge the ability of Big Tech companies hoarding and commercialising population data.

A unique opportunity for dialogue

Regardless, the Privacy Act review, and an upcoming Bill on ‘Enhancing Online Privacy’, provides an opportunity for data governance and youth mental health experts, and children and young people themselves, to come together and contribute to a much needed regulatory framework.

Putting children’s best interest at the heart is vital to protect young people in the digital age. Picture: Getty Images

Australia’s prominent role in applying digital technologies in the mental health context, and particularly in youth mental health services, could be leveraged to inform regulatory approaches to children and young people’s data.

The contribution could go both ways, with data governance expertise informing trends to digitise health and social services.

A revamped Privacy Act and a strong Code that puts children’s best interest at the heart of data production, processing and digital innovation is a vital step in protecting children and young people in the digital age and improving national data governance for all.

Banner: Getty Images

Find out more about research in this faculty

Law

Content Card Slider


Content Card Slider


Subscribe for your weekly email digest

By subscribing, you agree to our

Acknowledgement of country

We acknowledge Aboriginal and Torres Strait Islander people as the Traditional Owners of the unceded lands on which we work, learn and live. We pay respect to Elders past, present and future, and acknowledge the importance of Indigenous knowledge in the Academy.

Read about our Indigenous priorities
Phone: 13 MELB (13 6352) | International: +61 3 9035 5511The University of Melbourne ABN: 84 002 705 224CRICOS Provider Code: 00116K (visa information)