On 12 September 2024, the long-awaited privacy reforms were introduced into the Australian Federal Parliament in the Privacy and Other Legislation Amendment Bill 2024 (the Bill). The proposed reforms are part of a broad review of the Privacy Act 1988 (Cth) (Privacy Act) by the Attorney-General’s Department, which began under the previous Government in 2020. The review culminated in the Privacy Act Review Report recommending an ambitious overhaul of Australia’s privacy laws (the Report), with 116 proposals for change. 

However, the Bill appears to be more of a soft launch than a hard landing with many of the most impactful proposed changes deferred to a second tranche. While many of the reforms implemented in the Bill commence immediately, some have a delayed implementation of six months or two years.

The Bill implements 23 of the 25 of the Report’s legislative proposals that were ‘agreed’ by the Government (noting that 13 other proposals agreed by the Government were to be actioned by the development of guidance and the like). The remaining proposals in the Report to which the Government 'agreed' or 'agreed in principle' are likely to be introduced in a second tranche of reform. We expect a second bill to amend the Privacy Act to be introduced following further public consultation, although the timing is currently unknown and unlikely before 2025.

Changes at a glance

Here’s what you need to know about the first tranche of reforms. The key features of the Bill if passed would include:

1. easier mechanisms for overseas data flows, transparency of the use of automated decision making, and clarity that adequate security measures must include technical and organisational measures

2. bolstering of privacy enforcement powers

3. the requirement for the Office of the Australian Information Commissioner (OAIC) to develop a Children’s Online Privacy Code within two years

4. individuals having a statutory tort for serious invasions of privacy within six months

5. new criminal offences for doxxing with jail time of six or seven years

However, the wait continues for other significant reforms, including the fair and reasonable use requirement, revisions to the small business and employee record exemptions, expansion of individual rights under the Privacy Act and many others. These are discussed in further detail below.

What should you do now?

Consider bumping privacy compliance higher on your organisation’s priority list. With a raft of new enforcement powers and potential civil penalties applicable to breaches of the Privacy Act which are not serious, all organisations should be looking to assess their compliance level and address any gaps. We expect to see the OAIC exhibit a more aggressive enforcement stance given its broader arsenal of potential tools for enforcement, together with recent public comments from the Privacy Commissioner. Additionally, introduction of new direct rights of action for individuals (including through a statutory tort for serious invasions of privacy) will significantly increase your organisation's exposure to the risk of litigation relating to privacy.

Review and document technical and organisational measures used to protect information. Your organisation will likely need to make changes to your information technology systems and cybersecurity practices to ensure compliance with the new clarification in APP 11. Both technical and organisational measures are required, which may include encrypting data, securing access to systems and premises, undertaking staff training and having appropriate governance procedures and processes in place. A documented record of the measures your organisation implements will help to demonstrate compliance.

Consider what personal information is used in automated decision making. Acting now will help your organisation to ensure that it gathers the information required in order to comply with new transparency requirements if they come into force as drafted. However, this requirement will not take effect until 24 months after the Bill receives Royal Assent. You may wish to take preparatory steps to be able to disclose in your privacy policy the types of personal information that will be used in substantially automated decision making. This is particularly so if your organisation is starting out on its AI implementation journey.

Assess your overseas disclosure of personal information. The Bill includes mechanisms for the Government to prescribe countries and certification schemes that provide substantially similar protections to Australia.  This may remove the need for some existing wording in privacy policies, privacy collection notices or data transfer agreements. We anticipate that this amendment will be welcomed by many Australian organisations, particularly if international countries with well-developed privacy laws (such as the European Union, the UK, Singapore, Japan and New Zealand) are promptly recognised for the purpose of this new option for permitting the overseas transfer of personal information.

Understanding the proposed changes and their impact

Transparency and certainty regarding handling of personal information

1. Easy data transfers to approved countries and schemes

What?

A new pathway will be established for organisations to comply with requirements for transferring personal information outside Australia to approved countries or under binding schemes. In order to be approved:

• the laws of the country or binding scheme must protect personal information in a way that is substantially similar to the Australian Privacy Principles (APPs); and
• individuals must be able to enforce that protection.

This provision implements proposal 23.2 of the Report.

Proposal 23.2: Introduce a mechanism to prescribe countries and certification schemes as providing substantially similar protection to the APPs under APP 8.2(a).

When?

The mechanism for the countries or binding schemes to be approved as adequate will take effect the day after the Royal Assent of the Bill. We will all be hoping for speedy approval of countries to ease the compliance burden on organisations operating in a global economy.

Action item

If the Minister prescribes specific overseas jurisdictions as satisfying the requirements of APP 8.2(a), future overseas data transfers to those jurisdictions may be more readily achieved. This may remove the need for some existing wording in privacy policies, privacy collection notices or data transfer agreements.

2. Privacy policies to set out use of personal information in automated decision making

What?

Organisations will have a new requirement to include information in their privacy policies about their use of personal information in automated decision making. This proposed change reflects the growing concerns about the lack of transparency on organisations’ use of AI.

This change will require organisations to invest in processes to ensure they understand how AI is used in their organisation and are able to give accurate information to individuals about the use of their personal information in automated decisions. This requirement will be triggered when:

• a decision is made wholly or substantially by automated means;
• the decision would significantly affect the rights or interests of the individual; and
• the automated decision involves the use of personal information.

Tokenistic human decision making in an otherwise automated process will also be captured. We expect that determining the boundary between when a decision is made by a human with the help of AI or a decision is substantially automated may be difficult to delineate in practice – especially as our sophistication in the use of AI grows.

Privacy policies will have to set out:

• the kinds of personal information used in automated decision making;
• the kinds of decisions made solely by automated decision making; and
• the kinds of decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of automated means.

Three examples of decisions that would significantly affect the rights or interests of the individual are included in the proposed change to the Privacy Act, namely decisions that:

• are made under a provision of an Act or a legislative instrument to grant, or to refuse to grant, a benefit to the individual;
• affect an individual’s rights under a contract, agreement or arrangement; or
• affect an individual’s access to a significant service or support.

Greater guidance from the OAIC will be needed to support organisations to comply with this obligation.

This provision implements proposals 19.1 and 19.2 of the Report.

Proposal 19.1: Privacy policies should set out the types of personal information that will be used in substantially automated decisions which have a legal or similarly significant effect on an individual’s rights.

Proposal 19.2: High-level indicators of the types of decisions with a legal or similarly significant effect on an individual’s rights should be included in the  Privacy Act. This should be supplemented by OAIC Guidance.

When?

Although this change would have a significant impact on organisations, it will not come into effect until 24 months after the date of Royal Assent of the Bill. This means organisations will have 2 years to ready themselves to comply. Given the rapid development of AI in the past years, it remains to be seen how useful or relevant this requirement will be in another 2 years’ time.

Action item

Audit any existing automated decision making processes in your organisation involving personal information and consider if they significantly affect the rights or interests of individuals. Ensure new projects involving automated decision making processes are documented. Prepare to update privacy policies to include the required information.

3. Technical and organisational measures to protect personal information

What?

The Bill proposes a change to the existing requirement that entities take reasonable steps to protect personal information, to clarify that reasonable steps include technical measures (e.g. information security controls) and organisational measures (e.g. governance, internal practices, processes and systems).

This proposal was not controversial, as most organisations will already be using technical and organisational measures. However, it serves as a good reminder for organisations to document both the technical and organisational measures they have adopted in order to be able to demonstrate compliance with APP 11. 

This provision implements proposal 21.1 of the Report.

Proposal 21.1: Amend APP 11.1 to state that ‘reasonable steps’ include technical and organisational measures.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Review existing measures to ensure they involve both technical and organisational measures. Consider if further measures are required, for example, governance processes and documentation or staff training. Keep a record of measures in place to be able to demonstrate compliance.

Bolstering enforcement against breaches of the Privacy Act

4. Serious interference with privacy

What?

Section 13G currently relates to “serious and repeated interferences with privacy”, under which the Court can impose a penalty of up to:

• AU$2.5 million for contravention by an individual; and
• for a body corporate, the greater of:
  • AU$50 million;
  • three times the value of the benefit gained from the contravention; or
  • if the value of the benefit cannot be determined, 30% of the adjusted turnover of the body corporate during the breach turnover period for the contravention.

The word “repeated” is proposed to be removed from this section. Now these significant penalties will be reserved only for a serious interference with the privacy of the individual.

Helpfully the Privacy Act will include a list of what the Court may consider when determining if an interference is serious. The considerations include:

• the kinds of information involved
• the sensitivity of the information
• the consequences (including potential) for the individual
• the number of individuals affected
• whether children or vulnerable persons are affected
• whether the conduct was repeated or continuous
• failure to take steps to implement practices, procedures and systems to comply with obligations in relation to privacy
• other relevant matters

This provision implements proposal 25.2 of the Report.

Proposal 25.2: Amend section 13G of the  Privacy Act to remove the word ‘repeated’ and clarify the meaning of a ‘serious’ interference with privacy.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Reassess your organisation’s privacy risks, particularly if you undertake activities which may trigger any of the considerations of seriousness such as information of a large number of individuals, sensitive information or the information of children and vulnerable persons.

5. New civil penalty for non-serious interference with privacy

What?

Non-serious breaches of the Privacy Act will no longer fly under the radar. The Bill will create a new civil penalty provision for an interference with the privacy of an individual, regardless of whether the interference is serious.

The maximum penalty will be 2,000 penalty units, which is currently AU$626,000 for an individual or AU$3.13 million for a body corporate.¹ 

This provision implements proposal 25.1 of the Report.

Proposal 25.1: Create tiers of civil penalty provisions to allow for better targeted regulatory responses. Introduce a new mid-tier civil penalty provision to cover interferences with privacy without a ‘serious’ element, excluding the new low-level civil penalty provision.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Now that even a non-serious contravention can incur a financial penalty, organisations should reassess their risk exposure and address any non-compliances.

6. New power to seek civil penalties subject to infringement notices

What?

The Bill creates a civil penalty provision for breach of the following APPs:

• APP 1.3 - requirement to have an APP privacy policy
• APP 1.4 - contents of an APP privacy policy
• APP 2.1 - individuals may choose not to identify themselves in dealing with entities
• APP 6.5 - a requirement to make a written note of certain uses or disclosures
• APP 7.2(c) or 7.3(c) - simple means for individuals to opt out of direct marketing communications
• APP 7.3(d) - requirement to draw attention to the ability to opt out of direct marketing communications
• APP 7.7(a) - giving effect to a request in a reasonable period
• APP 7.7(b) - notification of the source of information
• APP 13.5 - dealing with requests
• any other APP prescribed by the regulations

The Bill also creates a civil penalty provision for non-compliant eligible data breach notifications submitted to the OAIC.

Organisations may face penalties if they submit a statement to the OAIC about a data breach that does not include the information required under section 26WK(3) of the Privacy Act, for example, a description of the eligible data breach that the entity has reasonable grounds to believe has happened.

The maximum penalty will be 200 penalty units, which would currently amount to AU$62,600 for an individual or AU$313,000 for a body corporate.

The OAIC would also be able to issue an infringement notice with set penalties of lower amounts for the above breaches; namely, 12 penalty units for an individual (AU$3,756), 60 penalty units for bodies corporate (AU$18,780) and 200 penalty units for listed corporations (AU$62,600), for each contravention. 

This provision implements proposal 25.1 of the Report.

Proposal 25.1: Introduce a new low-level civil penalty provision for specific administrative breaches of the  Privacy Act and APPs with attached infringement notice powers for the Information Commissioner with set penalties.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Conduct a gap analysis for compliance with matters that can be the subject of an infringement notice (as noted above) and address any non-compliance.

7. Federal courts may make a broader range of orders

What? 

If passed, the Bill will give the Federal Court or the Federal Circuit and Family Court of Australia the power to make an order beyond civil penalties if it has or will determine that there was a contravention of a civil penalty provision of the Privacy Act including directing an entity to:

• perform any reasonable act, or carry out any reasonable course of conduct, to redress the loss or damage suffered, or likely to be suffered, by any individual as a result of the contravention
• pay damages to any individual by way of compensation for any loss or damage suffered, or likely to be suffered, by any individual as a result of the contravention
• engage, or not to engage, in any act or practice to avoid repeating or continuing the contravention
• publish, or otherwise communicate, a statement about the contravention

The Court would not need to make or have made a civil penalty order to make any of the above orders.

Interestingly, the Court may exercise this power on its own initiative or upon application by the OAIC or an individual who has suffered, or is likely to suffer, loss or damage as a result of the contravention. Importantly, the proposed amendment now gives an aggrieved individual the right to take direct action to seek a civil penalty order in these circumstances.

This provision implements proposal 25.6 of the Report.

Proposal 25.6: Give the Federal Court and the Federal Circuit and Family Court of Australia the power to make any order it sees fit after a civil penalty provision relating to an interference with privacy has been established.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Reassess privacy risks to reflect that non-compliance may be subject to a broader range of remedies or higher value of compensation, including the risk of an aggrieved individual seeking a civil penalty order through the Court.

8. OAIC armed with monitoring and investigations, public inquiries and code making powers

What?

Monitoring and investigations. The Bill proposes to give the OAIC a suite of general investigation and monitoring powers including in relation to contraventions of civil penalty provisions under the Regulatory Powers (Standard Provisions) Act 2014 (Cth) to improve successful regulatory outcomes. These powers include entry, search and seizure to gather evidential material, and imposing injunctions and undertakings.

Public Inquiries. The OAIC will be able to undertake public inquiries under the Bill, including powers to obtain information and documents or examine witnesses. After the public inquiry is completed, a report of the public inquiry must be made public.

Codes. Under the Bill, the OAIC must develop an APP code if directed by the relevant Minister. The process for registration of a code will require a code to be published publicly, subject to a minimum 40 day period for public submissions and the OAIC must take submissions into consideration. The OAIC may also make temporary codes for urgent matters. For temporary codes, no public consultation is required but the code must not apply for more than 12 months.

Broader determination. The Bill proposes that OAIC determinations may make declarations for redress and compensation not only in relation to damage actually suffered but now also to prevent or reduce reasonably foreseeable loss or damage that is likely to be suffered.

In theory, this gives the OAIC the tools to become a much more active and aggressive regulator. Of course, the OAIC will need adequate funding and resources to be able to exercise its newfound powers if this Bill is passed in its current form.

These provisions implement proposals 25.3, 25.4, 25.5, 5.1 and 5.2 of the Report.

Proposal 25.3: Amend the Privacy Act to apply the powers in Part 3 of the Regulatory Powers (Standard Provisions) Act 2014 (Cth) to investigations of civil penalty provisions in addition to the Information Commissioner’s current investigation powers.

Proposal 25.4: Amend the Privacy Act to provide the Information Commissioner with the power to undertake public inquiries and reviews into specified matters on the approval or direction of the Attorney-General

Proposal 25.5: Amend subparagraph 52(1)(b)(ii) and paragraph 52(1A)(c) of the Privacy to require an APP entity to identify, mitigate and redress actual or reasonably foreseeable loss.

Proposal 5.1: Amend the Privacy Act to give power to the Information Commissioner to make an APP code where the Attorney General has directed or approved that a code should be made where it is in the public interest for a code to be developed and where there is unlikely to be an appropriate industry representative to develop the code.

Proposal 5.2: Amend the Privacy Act to enable the Information Commissioner to issue a temporary APP code for a maximum 12 month period on the direction or approval of the Attorney-General if it is urgently required and where it is in the public interest to do so.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Do you have a plan for responding to investigations by the OAIC? If not, now is the time to develop one. Monitor announcements of any public inquiries or codes related to your activities or industry. Reassess privacy risks as the scope of compensation that may be payable to individuals may be expanded.

Prioritizing protection of children online

9. A new Children’s Online Privacy Code

What?

Under the Bill, the OAIC must develop a Children’s Online Privacy Code. This is not surprising given the recent Government and media attention on harms children are exposed to online. A child will be defined under the Privacy Act as a person under the age of 18 years.

The Children’s Online Privacy Code must set out how the APPs are to be applied or complied with in relation to the privacy of children. The Code will apply to an entity:

• if each of the following apply:
  • the service is a social media service, relevant electronic service or designated internet service (all within the meaning of the Online Safety Act 2021 (Cth));
  • the service is likely to be accessed by children; and
  • the entity is not providing a health service; or
• if specified in the code.

This provision implements proposals 16.1 and 16.5 of the Report.

Proposal 16.1: Define a child as an individual who has not reached 18 years of age.

Proposal 16.5: Introduce a Children’s Online Privacy Code that applies to online services that are ‘likely to be accessed by children’.

When?

Although this is one of the Bill’s more far-reaching proposed reforms, with AU$3 million in funding to be provided to the OAIC to draft this code, no changes are likely to occur quickly. The OAIC has 24 months to develop and register the Children’s Online Privacy Code from when the Bill receives Royal Assent. The Code will also be required to undergo a public consultation period.

Action item

Prepare for and engage in consultations on the development of the Children’s Online Privacy Code if your organisation is likely to be impacted by it.

A federal statutory tort for serious invasions of privacy

10. Individual right of action

What?

Perhaps one of the most significant reforms proposed by the Bill is the introduction of an individual cause of action in tort for individuals who have suffered a serious invasion of privacy – both intruding upon the seclusion (e.g. physical privacy or surveillance of private activities or affairs) of an individual and misuse of information that relates to a person.

This change could throw open the gates to class actions relating to privacy.

To meet the elements of the proposed tort:

• the affected person must have had a reasonable expectation of privacy in all of the circumstances;
• the invasion of their privacy must be intentional or reckless; and
• the invasion of their privacy of privacy must be serious.

Proof of damage is not required. Exceptions to the tort will apply, including for public interest, journalism and law enforcement.

This provision implements proposal 27.1 of the Report.

Proposal 27.1: Introduce a statutory tort for serious invasions of privacy in the form recommended by the ALRC in Report 123.

When?

If passed, this change will come into effect on the date fixed by proclamation or, in any event, six months after Royal Assent.

Action item

Consider the risk of individual claims and class actions in your privacy risk assessment matrix. Consequences of privacy non-compliance or data breaches will be more significant.

Sharing information in response to a data breach or an emergency

11. Sharing information in response to a data breach

What?

The Bill creates a mechanism to enable the sharing of personal information to prevent or reduce the risk of harm in the event of a data breach. Specifically, the Bill gives the Government powers to permit limited and specific collection, use and disclosure of personal information where a data breach has occurred and doing so is necessary or appropriate to prevent or reduce the risk of harm.

Although certainly a helpful tool to protect individuals from harm, the fact that this power will sit with the responsible Minister rather than the OAIC may mean it will be reserved for only the most serious data breaches.

The Bill specifies that information may be shared with state and territory authorities but not with media organisations. The purpose for which information can be shared and used is limited to preventing and responding to harm. For example, fraud, scam activity, identity theft and consequences of the same and addressing malicious cyber activity.

The Bill also creates an offence for any unauthorised subsequent disclosure of information received under this new information sharing power with a penalty of 60 penalty units (AU$18,780) or imprisonment for 1 year, or both.

This provision implements proposal 28.4 of the Report. 

Proposal 28.4: Introduce a provision in the Privacy Act to enable the Attorney-General to permit the sharing of information with appropriate entities to reduce the risk of harm in them event of an eligible data breach. The provision would contain safeguards to ensure that only limited information could be made available for designated purposes, and for a time limited duration.

When?

This change will have immediate effect on the day after Royal Assent of the Bill. 

Action item

For organisations that will be the likely recipients of this personal information, ensure that your existing privacy practices and systems are able to handle this information in accordance with the Privacy Act and any additional conditions.

12. Sharing of information in response to an emergency

What?

The Bill creates a mechanism to allow government agencies and organisations to disclose personal information to state and territory authorities when an emergency declaration is in place. The purpose of the sharing of information is to prevent and mitigate harm caused by emergencies and disasters. 

This provision implements proposals 5.3 and 5.5 of the Report.

Proposal 5.3: Amend the Privacy Act to enable Emergency Declarations to be more targeted by prescribing their application in relation to entities, or classes of entity; classes of personal information; and acts and practices, or types of acts and practice.

Proposal 5.5: Amend the  Privacy Act to permit organisations to disclose personal information to state and territory authorities under an Emergency Declaration, provided the state or territory has enacted comparable privacy laws to the Commonwealth.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Update your disaster and recovery plans to consider if personal information should be disclosed to state and territory authorities.

13. Criminal offence for doxxing

What?

In response to incidents of doxxing – malicious release of personal information online – earlier this year, the Government delivered on its promise to introduce a criminal offence for doxxing as part of the privacy reforms.

The Bill creates two new offences under the Crimes Act 1914 (Cth):

• The first for using a carriage service to make available, publish or distribute personal data in a menacing or harassing way, which comes with a penalty of up to six years of imprisonment.
• The second, a similar offence with longer imprisonment of seven years, where the data is personal data of one or more members of a group, because of a belief that the group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin.

This change was not a proposal under the Report.

When?

This change will have immediate effect on the day after Royal Assent of the Bill.

Action item

Ensure staff are aware of the new criminal offences for doxxing and internal policies should be uplifted to make it clear that doxxing is not permitted. You may wish to provide training on this issue to personnel.

If you want to discuss the impact of these potential changes on your organisation further, please reach out to one of our privacy experts.

What might remain in the second tranche of reform?

The Government has made it clear that it intends to introduce a further bill with a second tranche of privacy reforms, citing the need for further consultation as a contributing factor as to why the reforms were not introduced together as one package. We expect the remaining proposals in the Report to which the Government 'agreed' or 'agreed in principle' are likely to be introduced in this second tranche of reform.

Many of the proposed reforms that have not been included in the Bill would have a major impact on organisations and require significant resources to implement, likely warranting extensive consultation and consideration. However, in the interim a cloud of uncertainty hangs over organisations with the Government providing little clarity as to when the second tranche will be delivered and how far the proposed changes will go.

Notable absences from the Bill include proposals from the Report to:

• change the word ‘about’ in the definition of personal information to ‘relates to’ (Proposal 4.1);
• remove the small business exemption (Proposal 6.1);
• reform the employee records exemption to extend enhanced privacy protections to private sector employees, including in relation to transparency, employer flexibility, security of employee information and data breach notification obligations (Proposal 7.1);
• clarify that consent must be voluntary, informed, current, specific, and unambiguous (Proposal 11.1);
• require that the collection, use and disclosure of personal information must be fair and reasonable in the circumstances (Proposal 12.1);
• require organisations to determine and record the purposes for which they will collect, use and disclose personal information at or before the time of collection (Proposal 15.1);
• expand individuals’ rights in relation to their personal information including a right to an explanation about personal information held about them, a right to object, a right to erasure, enhanced rights of correction and a right to de-index online search results (Proposals 18.1 to 18.5);
• introduce the concepts of ‘controllers’ and ‘processors’ (Proposal 22.1);
• provide individuals with an unqualified right to opt-out of their personal information being used or disclosed for direct marketing purposes and of receiving targeted advertising (Proposals 20.2 and 20.3);
• require organisations to establish their own maximum and minimum retention periods in relation to the personal information they hold (Proposal 21.7);
• require organisations to notify the OAIC and affected individuals of a data breach not later than 72 hours after becoming aware of the breach (Proposal 28.2); and
• introduce a direct right of action to permit individuals to apply to the courts for relief in relation to an interference with privacy (Proposal 26.1).

We wait with interest to see when consultation on the second tranche of privacy reforms will commence. With the federal election to take place no later than May 2025, it is quite possible that the second tranche of reforms may not be introduced to Parliament until after the election.

1. This reflects the value of a penalty unit as at the date of this article. However, there is currently a bill before Parliament to increase it from AU$313 to AU$330, which was proposed to be effective from 1 July 2024.