I would say that proposed sections 12, 15 and 18 are critical on the privacy part. I agree that AIDA is a blank slate, and we'll come to that another time—hopefully today.
Proposed section 12 sets out the purpose. Proposed section 15 talks about express consent and then, in proposed subsection 15(5), says that it's okay to use “implied consent”. Then proposed section 18 says that a business has “legitimate interest” to use an individual's data basically however it wants, even if it harms the individual.
To me, it places the emphasis. When you take proposed section 5 and then add proposed sections 12, 15 and 18 to it, it looks like big business and its right to use your data is being protected in this, even if it harms you.
Do you not need to amend all of those proposed sections, not just proposed sections 5 and 12?