A Very Obliging Country.

Late in June, the United States Supreme Court decided that the Federal Trade Commission was not going to be quite as independent as everybody had assumed. The ruling was about presidential removal powers, not privacy, and most Australians will never hear about it. Somewhere in Brussels, though, a great many lawyers put down their coffee, because Europe's arrangement for sending personal data to American companies leans on that independence more than 250 times in the fine print. Within days, a formal challenge was being drafted, on the grounds that the assumption underneath the whole agreement no longer held. This is, by the way, the third such agreement. The first two were struck down for the same reason: not enough distance between European data and the people who might make use of it, governments and companies alike.

Europeans have spent twenty years litigating that distance, all the way to their highest court, twice, because they start from the position that nobody is entitled to their information without a reason, and they are prepared to be tedious about it. We are not. We are not remotely tedious about it. We are, if anything, obliging.

We hand over a passport and three months of bank statements to view a rental property, often before anyone has confirmed it is still available, and we do it without asking why a landlord needs to know our transaction history to judge whether we will pay the rent. We let the pub scan our licence and keep a copy, and we do not ask what happens to it afterwards, because asking feels like the sort of thing that gets you a look. We give the medical app our Medicare number to find the nearest clinic, and we give the bottle shop our phone number so it can email us a receipt we did not want, and at no point in any of this does the thought "why do you need that" arrive early enough to be useful. It usually arrives afterwards, if at all, as a mild unease we then decide not to pursue.

That is the actual gap. Not that Australian organisations collect too much, though they do, but that Australians have quietly agreed not to mind. Europeans built the expectation that information does not move without justification, then spent decades enforcing it in court. We built the expectation that if someone behind a counter asks for your driver's licence, you get it out. Refusing is treated as the strange behaviour. Asking why is treated as slightly rude. Somewhere the burden of proof changed hands, from the organisation doing the asking to the person doing the handing over, and nobody can quite say when we agreed to that, because we never really agreed to it. We just stopped objecting.

It helps to have an Act to point to. Australia has one, along with a regulator and penalties that have grown sharper lately, and this is usually where the reassurance is meant to land. It is also usually where people stop asking further questions, satisfied that somebody official is on the case. What the Act has never asked, and what we have never asked either, is the question that sits underneath European law: does this organisation actually need the information it's requesting. In Europe, absent a good answer, the request doesn't proceed. Here, absent a good answer, we generally hand it over anyway and go back to our phone.

Even the reassurances we accept without checking turn out to be doing less work than we assume. We are told our data is stored on Australian servers, and we take that as settled, when the company running the server is frequently American and remains answerable to American law no matter which country the machine sits in. The US CLOUD Act lets Washington compel a US company to produce whatever it controls, wherever it is stored. Location and jurisdiction were never the same thing. Europe worked that out and made a fuss. We are told the data is local, and leave it there.

Which brings us back to a ruling most of us will never hear about. Europe is currently discovering that even its most argued-over privacy deal with America was thinner than advertised, and Europeans are, characteristically, furious about it. We will not have the equivalent moment, not because our protections are sound, but because we were never invested enough in the idea to notice when it fails.

The next time somebody asks for your licence, your Medicare number, your bank statements, before you've even confirmed you want what they're selling, the useful question isn't whether they'll keep it safe.

It's why they need it at all.