My reply below covers a lot of it.
Other points:
There should be standard data sets for basic personal information which is provided to consumers in a standard format they can become familiar with.
There should be a requirement on businesses to obtain a defined minimum amount of information to confirm someone’s identity. Name and birth date is not enough because it is possible to have coincidences with identical names and birth dates. Unique identifiers won’t work, because there isn’t one. Not everyone has a tax file number, or a driver’s licence, or a passport, or phone number, etc. Therefore businesses must take care to ensure they have their data against the correct person.
When requesting disclosure to third parties, the information presented to consumers must easy to read and digest. Preferably standard information is given to consumers in a standard format they can become familiar with. Tick boxes with dot point would work well. There should be a maximum amount of data so there aren’t reams of fine print to read which could hide all sorts of nasties. (An example of this volume of information is the conditions of use for software.)
Finally, any review body should be external not internal as I outlined in my response to the human-rights-and-technology-submission-to-the-hrc.
