Key points

• New legislation (called the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (Cth) (the New Australian Privacy Laws) was introduced into the Australian Federal Parliament on 26 October 2022 and passed both Houses of Parliament on 28 November 2022. The New Australian Privacy Laws enact significant changes to the Australian Privacy Act 1988 (Cth) (the Act). Partner, Robyn Chatwood and solicitor, Malcolm Liu explain the implications below.
• Companies in breach of the Australian Privacy Act now face maximum penalties that are the greater of:

• $50 million AUD;
• Three (3) times the value of the benefit derived by the company from the breach; or
• 30% of the company’s adjusted turnover (if the value of the benefit cannot be derived)

• The Office of the Australian Information Commissioner can require a person or company to provide information or documents and answer questions, and has the power to issue infringement notices on those that fail to comply.
• So long as foreign entities carry on business within Australia, they will be within the ambit of the Privacy Act - there will be no longer be a threshold for foreign entities to hold or collect personal information within Australia before the Australian Privacy Act applies to their activities.

Increased Penalties for breach of the Privacy Act

Under the Act, if a person or a company:

• engages in conduct that is a serious interference with the privacy of an individual; or
• engages in repeated conduct that is an interference with the privacy of one or more individuals;

they were liable for a maximum penalty of $444,000 AUD for an individual or $2.22 million AUD for a company.

Now under the Act, these maximum penalties would be increased:

• for a person, up to a maximum of $2.5 million AUD; and
• for a company, up to a maximum of the greater of:

1.  AUD$50 million;
2. 3 times the value of the benefit derived by the company (or its related entities) either directly or indirectly from the serious or repeated interference of the of the privacy of individuals; or
3. If a court is unable to determine the value of the benefit per (2) above, then 30% of the company's adjusted turnover over the breach turnover period.

The ‘breach turnover period’ has the potential to be a long time (thereby increasing the risk to companies) as it is proposed to be defined as the minimum of 12 months or the period between when the serious or repeated interference first began and when it ended.

For example, if any documents or records were retained beyond their valid retention periods, then the ‘breach turnover period’ could be that period of time between when they were meant to be destroyed (pursuant to the retention period) and when they were in fact destroyed.

Increased investigative powers for the Australian Privacy regulator, the Office of the Australian Information Commissioner

The Act boosts the powers of Australia’s privacy regulator, the Office of the Australian Information Commissioner (OAIC). OAIC will now have greater powers to compel entities to provide it with information.

In summary, the Act has a new section 26WU where, if the OAIC suspects that a person or entity has information or documents, or can answer questions that are relevant to an actual or suspected eligible data breach, OAIC can require that person or entity to:

• give information;
• produce documents; and
• answer its questions.

OAIC can now issue infringement notices under the Regulatory Powers (Standard Provisions) Act 2014 (Cth) - which will allow OAIC to penalise people and companies who refuse or fail to comply with its directions to provide information. This means a quicker format that will circumvent the need to institute court proceedings (which traditionally was needed in order to issue such penalties).

Clear extraterritorial application of the Act

The Act had extra-territorial application, but only where the extra-territorial entity has an ‘Australian link’.

Under section 5B(2) of the Act, this included if, for example, the extra-territorial entity was an Australian citizen, or a partnership formed in Australia or is a company incorporated in Australia.

The less stringent limb of this link was captured under section 5B(3) of the Act which stated:

An organisation or small business operator also has an Australian link if all of the following apply:

1. the organisation or operator is not described in subsection (2);
2. the organisation or operator carries on business in Australia or an external Territory;
3. the personal information was collected or held by the organisation or operator

     in Australia or an external Territory, either before or at the time of the act or practice.

The New Australian Privacy Laws amended section 5B(3) to lower the threshold for an Australian link. Section 5B(3) now states:

An organisation or small business operator also has an Australian link if all of the following apply:

1. the organisation or operator is not described in subsection (2);
2. the organisation or operator carries on business in Australia or an external Territory.

In this way, the New Australian Privacy Laws removed the need for the personal information to have been collected or held in Australia.

Whilst the intention of the proposed amendment can be deduced (to bring within the ambit of the Act any foreign entities that collect personal information of Australians from a foreign server (i.e. internet gambling sites, cryptocurrency trading platforms, etc)), a potential unintended consequence is to bring into the scope of the Act a multinational or global company that carries on a business in Australia where it processes any personal information (not necessarily Australian personal information). Personal information exchanged between group companies of a foreign entity may render the entire group subject to the Act if one of those group companies carries on business in Australia (even though it may not necessarily have an incorporated or physical presence in Australia).

What should companies do?

Any companies that did not currently fall within the scope of the Act or its extra territorial reach should consider if they now do and increase their compliance obligations and prepare for compliance.

Please contact us if you need assistance with privacy compliance.