Australian Privacy Act reforms and Cyber Security Legislative Package passed: What you need to know

Co-authored by Michael Park, Partner and Roy Leigh, Solicitor

Home
Knowledge
Australian Privacy Act reforms and Cyber Security Legislative Package passed: What you need to know

Australian Privacy Act reforms and Cyber Security Legislative Package passed: What you need to know

Co-authored by Michael Park, Partner and Roy Leigh, Solicitor

{E479EE59-2775-4FD7-B95C-449CF3003D96}

December 2, 2024

Key points

The Cyber Security Legislative Package was passed by Australian Federal Parliament on 25 November 2024. The Package comprises three bills: the Cyber Security Bill 2024, Intelligence Services and Other Legislation Amendment (Cyber Security) Bill 2024 and Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Bill 2024. These bills received Royal Assent on 29 November 2024 and have become Acts of Parliament.
The reforms to the Privacy Act 1988 (Cth) (which we have written about previously) were also passed by Australian Federal Parliament on 29 November 2024 under the Privacy and Other Legislation Amendment Bill 2024.

Cyber Security Legislative Package

In November 2024, the Parliamentary Joint Committee on Intelligence and Security issued its advisory report on the Cyber Security Legislative Package 2024 (Package), ultimately recommending that the Package be passed by the Federal Parliament.

The Package is intended to implement the initiatives proposed under the 2023-2030 Australian Cyber Security Strategy, a document produced by the Australian Federal Government to serve as a roadmap to ensure that Australia becomes a global leader in cyber security.

Accordingly, Federal Parliament passed the Package on 25 November 2024, which comprises three separate bills:

Cyber Security Bill 2024
Intelligence Services and Other Legislation Amendment (Cyber Security) Bill 2024
Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Bill 2024

These bills received Royal Assent on 29 November 2024 and have become Acts of Parliament.

We summarise the key takeaways of each Bill/ Act below.


Bill/Act	Key takeaways
Cyber Security Bill 2024 (Cyber Security Bill)	Security standards for smart devices The Cyber Security Bill allows the Minister to mandate security standards for products that can connect to the internet (i.e. “smart devices”). Manufacturers and suppliers of smart devices will have obligations under the Cyber Security Bill and any applicable security standards mandated by the Minister. Ransomware reporting obligations The Cyber Security Bill imposes reporting obligations on certain Australian businesses impacted by a cyber security incident that have made a ransomware payment. Particular information must be reported, including details of the incident, the demand made by the extorting entity and the ransomware payment. The report must be made to the Australian Signals Directorate (ASD). Cyber Incident Review Board The Cyber Security Bill establishes the Cyber Incident Review Board which reviews certain cyber security incidents and makes recommendations to the government about actions to mitigate similar incidents in the future.
Intelligence Services and Other Legislation Amendment (Cyber Security) Bill 2024 (Intelligence Services Bill)	Limited use of cyber security information The Intelligence Services Bill imposes restrictions on how the ASD can use information voluntarily provided to the ASD as part of a cyber security incident.
Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Bill 2024 (SOCI Amendment Bill)	Data storage systems containing business critical data are now “critical infrastructure assets” Under the SOCI Amendment Bill, if an asset is a critical infrastructure asset under the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act), the data storage system of that asset containing business critical data will also be deemed to be part of that critical infrastructure asset. Additional government powers for “all hazards” incidents For serious incidents relating to critical assets, the SOCI Amendment Bill amends the SOCI Act to give the Minister additional powers to direct the relevant entities in respect of the critical assets. *Alignment with the Telecommunications Act 1997* (Cth)** The SOCI Amendment Bill amends both the SOCI Act and the Telecommunications Act 1997 (Cth) (Telecommunications Act) such that certain obligations under Part 14 of the Telecommunications Act will now be contained in the SOCI Act.

Privacy and Other Legislation Amendment Bill

On 29 November 2024, the Australian Federal Parliament passed the Privacy and Other Legislation Amendment Bill 2024 (Privacy Amendment Bill), which amends the Privacy Act 1988 (Cth) (Privacy Act).

We have previously written on the Privacy Amendment Bill when it was first introduced into the Australian Federal Parliament. As we discussed, the key features of the Privacy Amendment Bill include:

easier mechanisms for overseas data flows, transparency of the use of automated decision making, and clarity that adequate security measures must include technical and organisational measures
bolstering of privacy enforcement powers
the requirement for the Office of the Australian Information Commissioner (OAIC) to develop a Children’s Online Privacy Code within two years
individuals having a statutory tort for serious invasions of privacy within six months
new criminal offences for doxxing with jail time of six or seven years

These features remain in the Privacy Amendment Bill as passed without substantial amendment.

The main amendment made to the Privacy Amendment Bill as passed is the inclusion of a compliance notice regime, which sits alongside the infringement notice regime as initially contemplated by the Privacy Amendment Bill. The infringement notice regime provides the Information Commissioner with the power to issue infringement notices for breaches of section 13K, which is the Privacy Amendment Bill’s new civil penalty provision for minor contraventions of the Privacy Act. The amendment to the Privacy Amendment Bill has now resulted in the introduction of a compliance notice regime which gives the Information Commissioner the power to issue a compliance notice for suspected breaches of section 13K. The notice may require the entity to take certain actions to address the contravention.

The Privacy Amendment Bill will now be assented to, after which it will become an Act of Parliament.

Some key takeaways

Australian businesses and other entities that do business in Australia (especially those that manufacture or supply “smart devices”) should carefully consider the extent to which the Cyber Security Act may apply to their operations.
Owners/ operators of critical infrastructure assets under the SOCI Act should now treat the data storage systems of those assets as critical infrastructure assets as well.
As previously covered by us, the Privacy Amendment Bill is “tranche 1” of at least two proposed tranches of privacy law reforms. The timing of the second tranche is currently unknown.