In Australia, data protection and privacy are principally regulated by the federal Privacy Act 1988 (Cth) (Privacy Act). The Privacy Act regulates the collection, use, storage and disclosure of personal information by private sector organisations (with some exceptions) and federal government agencies (but not state agencies). In particular, the Privacy Act sets out 13 Australian Privacy Principles (APPs) which set out specific obligations in respect of personal information. The Privacy Act also contains credit reporting obligations which apply to the handling of credit information about individuals by credit reporting bodies, credit providers and some other entities.

In relation to cybersecurity specifically, we refer to the answer to item 35.

The Privacy Act applies to the handling of personal information by private sector organisations generally, however, organisations with aggregate group turnover of less than AUD3 million are not covered by the Privacy Act unless they are: (i) a private sector health services provider; (ii) a business that sells or purchases personal information; (iii) a credit reporting body; or (iv) a contracted service provider for a federal government agency.

There are a range of other laws in Australia, both at the federal and state/territory level, which impact data protection. These include:

• state and territory privacy legislation, applying to personal information held by state and territory government agencies and private sector contractors to such agencies (for example, the Privacy and Personal Information Protection Act 1988 (NSW)). State and territory regulators administer such legislation;
• in New South Wales (NSW), Victoria (Vic) and the Australian Capital Territory (ACT), specific privacy legislation relating to health information and health records, applying to health information collected, used and disclosed by public sector agencies (based in NSW, Vic or the ACT) or private sector organisation that is a health service provider, or that otherwise collects, holds or uses health information;
• federal law requiring telecommunications carriers and carriage service providers to capture and retain certain information about communications carried over services provided by them;
• federal and state and territory laws governing telecommunications interception and access to stored communications, the use of surveillance devices, tracking devices and listening devices, video and audio-visual monitoring of public places and workplaces and computer and data surveillance of workplaces (including home working);
• federal and state/territory freedom of information legislation, intended to promote transparency of government, which applies to information held by government agencies;
• the Spam Act 2003 (Cth) (Spam Act), which deals with the sending of unsolicited commercial electronic messages, including emails and SMS;
• the Do Not Call Register Act 2006 (Cth) (DNCR Act), regulating unsolicited commercial calling to telephone numbers listed on the national Do Not Call Register (DNCR);
• the recently amended Security of Critical Infrastructure Act 2018 (Cth) which imposes obligations on organisations operating in “critical infrastructure sectors” to ensure the cyber resilience of their assets;
• federal and state criminal laws dealing with unauthorised access to computer systems, including databases; and
• developing judge-made law in the form of an equitable doctrine of misuse of confidential information.

The Privacy Act is administered by the Australian Privacy Commissioner (the Commissioner) which is integrated within the Office of the Australian Information Commissioner (OAIC). The Australian Communications and Media Authority (ACMA) enforces provisions of the Spam Act and the DNCR Act. It also administers a number of privacy affecting codes in the communications sector. The Australian Attorney-General’s Department administers provision of lawful assistance to law enforcement agencies under the Telecommunications (Interception and Access) Act 1979 (Cth) and takes an active role in regulating and enforcing privacy-related legislative schemes.

A review of the Privacy Act was initiated in December 2019. There were a series of public consultations and reports which culminated in the Attorney-General’s ‘Privacy Act Review Report’ which was published in February 2023. This report contains 116 proposals for reform, many of which represent a substantial reshaping the Australian privacy landscape.

In September 2023, the Federal Government released its response to the Privacy Act Review Report in which it either ‘agreed’ or ‘agreed in-principle’ to all but 10 proposals (which were ‘noted’). While we expect a series of reforms to implement these proposals to commence in 2024, as at April 2024, no legislation has been proposed.

Some of the key proposals of the Privacy Act Review Report are:

• The requirement to act fairly and reasonably when collecting, using and disclosing personal information (Proposal 12). The Report stresses that this requirement will be judged on an objective standard and will apply regardless of any consent.
• A broader definition of personal information (Proposals 4.1 – 4.4). The report proposes changing the word “about” in the definition of personal information, to “relates to” (that is, “information or an opinion that relates to an identified individual…”). This change would allow the definition to capture a broader range of information. Such a change would bring the Privacy Act definition in line with the language used in the GDPR definition of ‘personal data’.
• Direct right of action to enforce privacy rights (Proposal 26) for individuals who have suffered loss or damage as a result of an interference with their privacy. This would allow individuals (and representative groups) to seek compensation in the Federal Court or the Federal Circuit and Family Court of Australia.
• Tighter timeframes for Notifiable Data Breaches (Proposal 28). The Report proposes that the deadline for reporting eligible data breaches to the OAIC will be reduced to (a GDPR-familiar) 72 hours from when the entity becomes aware that there are reasonable grounds to believe that there has been an eligible data breach.
• Additional obligations when handling employee records (Proposal 7) but, importantly, not a removal of the exemption for handling employee records.
• Introduction of the concept of processors and controllers in Australian law – to make it more akin to other jurisdictions, most notably the GPDR (Proposal 22).
• The requirement to conduct Privacy Impact Assessments (Proposal 13) for any ‘high privacy risk activity’, which would encompass activities ‘likely to have a significant impact on the privacy of individuals’.
• Regulation of targeted advertising (Proposal 20) through a prohibition on the use of information related to an individual (including personal information, de-identified information, and unidentified information (such as internet tracking history)) for targeted advertising and content to children, and prohibitions on using sensitive information for targeted advertising and content to any individuals.
• The introduction of a statutory tort for serious invasions of privacy that are intentional or reckless. Importantly, the invasion of privacy need not cause actual damage and individuals may claim damages for emotional distress.
• A new right of erasure that would provide individuals with the ability to request the deletion of their personal information by APP entities. This right of erasure is essentially an extension of the obligation to delete personal information once it is no longer required, and individuals will be able to exercise this right in relation to any category of personal information.
• Various measures to strengthen enforcement of the Privacy Act. In particular, it proposes new civil penalties and a slew of new powers for the OAIC in relation to investigations, public inquiries and determinations.

There are no registration or licensing requirements under the Privacy Act for general processing of personal information.

The following key terms apply under the Privacy Act:

Personal Information

Under the Privacy Act, ‘Personal Information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material from or not. State and territory privacy laws use a similar definition.

Whether an individual is ‘reasonably identifiable’ from particular information will depend on considerations that include:

• the nature and amount of information;
• the circumstances of its receipt;
• who will have access to the information;
• other information either held by or available to the entity that holds the information;
• whether it is possible for the individual or entity that holds the information to identify the individual, using available resources (including other information available to that individual or entity). Where it may be possible to identify an individual using available resources, the practicality, including the time and cost involved, will be relevant to deciding whether an individual is ‘reasonably identifiable’; and
• if the information were to be publicly released, whether a reasonable member of the public who accesses that information would be able to identify the individual.

Sensitive Information

‘Sensitive information’ means information or an opinion about an individual’s:

• racial or ethnic origin;
• political opinions;
• membership of a political association;
• religious beliefs or affiliations;
• philosophical beliefs;
• membership of a professional or trade association;
• membership of a trade union;
• sexual orientation or practices; or
• criminal record,

that is also personal information; or

• health information about an individual;
• genetic information about an individual that is not otherwise health information;
• biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or
• biometric templates.

APP Entity

The majority of obligations under the Privacy Act apply to ‘APP Entities’. An APP Entity is either a federal government agency (but not a state or territory agency) or any private sector organisation (which includes individuals, companies, partnerships or otherwise) that has an annual turnover greater than AUD3 million which has an Australian link (see below). In addition, an organisation with annual turnover lower than AUD3 million will be an APP Entity if it: (a) provides health services and holds health information; (b) exchanges personal information for a benefit, service or advantage; (c) provides services to a federal government agency (either directly or as a subcontractor); or (d) is a credit reporting body.

Use and Disclosure

‘Use’ and ‘disclosure’ are key concepts, but are not specifically defined. Guidelines provided by the Privacy Commissioner include the following guidance:

• ‘use’ — generally, an APP Entity uses personal information when it handles and manages that information within the entity’s effective control.
• ‘disclosure’ — an APP Entity discloses personal information when it makes it accessible or visible to others outside the entity and releases the subsequent handling of the personal information from its effective control.

Importantly, the Privacy Act does not distinguish ‘processing’ of Personal Information as distinct from other types of ‘Use’. Further, the Privacy Act does make a distinction between ‘controllers’ and ‘processors’ of personal information.

Collects

An APP Entity collects personal information only if the entity collects the personal information for inclusion in a record or generally available publication.

De-identified

The Privacy Act does not define the term ‘de-identified’, however, it is an important principle in determining whether or not information is ‘Personal Information’, that is when it can be said that ‘de-identified’ information is no longer information about an identifiable individual or an individual who is reasonably identifiable. The Commissioner notes that de-identification includes two steps: firstly, removing personal identifiers, such as an individual’s name, address, date of birth or other identifying information, and secondly, removing or altering other information that may allow an individual to be identified, for example, because of a rare characteristic of the individual, or a combination of unique or remarkable characteristics that enable identification.

De-identification can be effective in preventing re-identification of an individual, but may not remove that risk altogether. There may, for example, be a possibility that another dataset or other information could be matched with the de-identified information. The risk of re-identification must be actively assessed and managed to mitigate this risk. This should occur both before an information asset is de-identified and after disclosure of a de-identified asset.

Holds

A number of APPs (such as APP 6, 11, 12 and 13) apply to an APP Entity that ‘holds’ personal information.

An entity ‘holds’ personal information “if the entity has possession or control of a record that contains the personal information”. The term ‘holds’ extends beyond physical possession of a record to include a record that an APP Entity has the right or power to deal with. This means that one entity can physically possess personal information that another entity controls. In such situations, both entities will ‘hold’ the information at the same time. If each entity is covered by the Privacy Act, each will have separate regulatory obligations to comply with the Privacy Act (since there is no distinction between a controller and a processor).

Data Subject

The Privacy Act does not use the term ‘Data Subject’ but the Privacy Act applies where personal information about any individual is handled (collected, used or disclosed) by a relevant APP Entity. It is not relevant whether that individual resides in Australia or is physically present in Australia or provided the personal information directly to the APP Entity. Conversely, it is the APP Entity’s connection to Australia that triggers the application of the Privacy Act, as referred to above.

The following are key Australian Privacy Principles:

Transparency

Under APP 1, APP Entities are required to manage personal information in an open and transparent way and must take reasonable steps to implement practices, procedures and systems to comply with the Privacy Act. This includes an obligation to have a clearly expressed and up to date privacy policy available to the public free of charge and in an appropriate form. Practices and processes must also reflect the stated privacy policy: the Commissioner has also interpreted APP 1 as requiring implementation of ‘privacy by design’ into an APP Entity’s business practices.

APP 5 requires an APP Entity that collects personal information about an individual to take reasonable steps, at or before the time of collection, or as soon as practicable afterwards, either to notify the individual of certain matters or to ensure the individual is aware of those matters. APP 5.2 lists the matters that must be notified to an individual or of which they must be made aware.

The requirement to notify or ensure awareness of the APP 5 matters applies to all personal information collected about an individual, either directly from the individual or from a third party.

Lawful basis for processing

The Privacy Act governs the collection, holding, use, disclosure, access and correction of personal information by APP Entities. The Privacy Act prohibits an organisation from collecting personal information (which is not sensitive information) unless the information is reasonably necessary for one or more of the organisation’s functions or activities.

Where an organisation is collecting sensitive information, as with ordinary categories of personal information, it must be reasonably necessary for one or more of the organisation’s functions or activities, but it must also obtain the relevant individual’s consent to the collection of their sensitive information (unless an exception applies).

The state and territory privacy legislation apply analogous concepts in relation to entities regulated by those Acts.

Purpose limitation

In accordance with APP 6, an APP Entity can only use or disclose personal information for the particular purpose for which it was collected (known as the ‘primary purpose’), or for a ‘secondary purpose’ if an exception applies.

Use or disclosure of personal information for a ‘secondary purpose’ is permitted under specific exceptions where that secondary use or disclosure is:

• consented to by the individual;
• one in respect of which the individual would reasonably expect the APP Entity to use or disclose their personal information, and that purpose is related to the primary purpose of collection, or, in the case of sensitive information, directly related to the primary purpose;
• required or authorised by or under an Australian law or a court or tribunal order;
• necessary to lessen or prevent a serious threat to any individual’s life, health or safety, or to public health or safety, and it is unreasonable or impracticable to obtain the consent of the individual;
• necessary in order for an organisation to take appropriate action in relation to a reasonable suspicion of unlawful activity, or misconduct of a serious nature, which relates to the APP Entity’s functions or activities. APP 6.2(e) also permits the use or disclosure of personal information for a secondary purpose to an enforcement body for one or more enforcement related activities;
• in the conduct of surveillance activities, intelligence gathering activities or monitoring activities, by a law enforcement agency;
• the conduct of protective (for example, in relation to children) or custodial activities;
• to assist any APP Entity, body or person to locate a person who has been reported as missing (where the entity reasonably believes that this use or disclosure is reasonably necessary, and where that use or disclosure complies with rules made by the Commissioner);
• for the establishment, exercise or defence of a legal or equitable claim; or
• for the purposes of a confidential alternative dispute resolution process.

Data minimisation

As mentioned above, under APP 3, an organisation must not collect personal information unless the information is reasonably necessary for one or more of the entity’s functions or activities. In the case of sensitive information, it must also have the individual’s consent.

Integrity

Under APP 10, APP Entities are required to ensure that the personal information they use or disclose is accurate, up-to-date, complete and relevant.

Retention

In accordance with APP 11.2, where an APP Entity holds personal information about an individual which is no longer needed for any purpose for which the information may be used or disclosed, then the APP Entity must take such steps as are reasonable in the circumstances to destroy or de-identify the information.

APPs 4.3 and 11.2 require the destruction or de-identification of personal information in certain circumstances. Where the information is contained in a Commonwealth (Federal) record (which is the property of the Commonwealth), or is required to be retained under Australian law or by a court or tribunal, the information must be retained. For example, financial records must be retained under the Corporations Act 2001 (Cth) for seven years.

Collection by lawful and fair means

An APP Entity must collect personal information only by “lawful and fair means” (APP 3.5). This requirement applies to all APP Entities. Examples of where a collection of personal information may be unfair (some may also be unlawful) include collecting from an electronic device which is lost or left unattended, collecting from an individual who is traumatised, in a state of shock or intoxicated, collecting in a way that disrespects cultural differences or after misrepresenting the purpose or effect of collection, or the consequences for the individual of not providing the requested information.

Collecting directly from the individual

APP 3.6 provides that an APP Entity “must collect personal information about an individual only from the individual”, unless one of the following exceptions applies:

• for all APP Entities, it is unreasonable or impracticable for the entity to collect personal information only from the individual;
• for federal government agencies, the individual consents to the personal information being collected from someone other than the individual; and
• for federal government agencies, the agency is required or authorised by or under an Australian law, or a court or tribunal order, to collect the information from someone other than the individual.

Cross-border disclosure of personal information

Before an APP Entity discloses personal information to an overseas recipient, the entity must take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information (APP 8.1). This is usually achieved by the APP Entity imposing contractual obligations on the overseas recipient to comply with the Privacy Act (or relevant aspects).

An APP Entity that discloses personal information to an overseas recipient is accountable for any acts or practices of the overseas recipient in relation to the information that would breach the APPs (section 16C).

There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the accountability provision in section 16C. These include obtaining the consent of the relevant individual to the overseas disclosure (after an express statement informing the individual that APP 8 will not apply), or where the APP Entity reasonably believes that the recipient is subject to an equivalent regime in its local jurisdiction and that there are mechanisms that the individual can access to take action to enforce that regime.

Security of personal information

APP 11 requires an APP Entity to take active measures to ensure the security of personal information it holds, and to actively consider whether it is permitted to retain personal information. An APP Entity that holds personal information must take reasonable steps to protect the information from misuse, interference and loss, as well as unauthorised access, modification or disclosure (APP 11.1). Unauthorised access includes both access by an employee of the entity or independent contractor and unauthorised access by an external third party (such as by hacking).

Reasonable steps should include, where relevant, taking steps and implementing strategies in relation to governance, culture and training, internal practices, procedures and systems, ICT security, access security, third party providers (including cloud computing), data breaches, physical security, destruction and de-identification and compliance with applicable standards.

There is no general requirement to obtain consent for the collection of most types of personal information, or for its processing. However, consent may operate as an exception to certain prohibitions under the Privacy Act or a qualification to certain obligations.

Under APP 3.3, APP Entities are prohibited from collecting sensitive information (defined above) unless the consent of the relevant individual has been obtained. Some narrow exceptions apply.

Under APP 3.6 there is a general expectation that Personal Information will be collected from the individual to which it relates. However, an exception applies which permits government agencies to collect personal information from another source if the individual has given consent.

APP 6 requires Personal Information to only be used or disclosed for the purpose for which it was collected. However, there are some exceptions to this, one being where the individual has consented to its use or disclosure for another secondary purpose.

Under APP 7, direct marketing is prohibited unless an exception applies, and one such exception is where the organisation has obtained the individual’s consent. Further, consent is the only permitted circumstance where Sensitive Information can be used for the purpose of direct marketing. The Spam Act also prohibits commercial electronic communications without consent (which may be inferred) and requires entities to allow individuals to easily withdraw consent (or “unsubscribe”).

APP 8, which generally restricts the offshore disclosure of Personal Information, allows it to occur where there is consent of the relevant individual (but note this consent has separate requirements under the Privacy Act).

Where consent is applicable, under the Privacy Act, it may be express or implied. Express consent can be provided orally or in writing, although best practice requires written consent (which can be electronic). Implied consent is consent which can reasonably be inferred from the conduct. The Privacy Commissioner’s guidance suggests that consent can only be implied in clear circumstances. For example, it will not be sufficient to merely establish that the collection, use or disclosure will be advantageous to the individual or that they didn’t object at the time of collection. The Privacy Commissioner also advises against the use of opt-out mechanisms.

The Privacy Commissioner has identified 4 elements of consent:

• (informed) the individual must be adequately informed of the implications of providing or withholding consent for it to be considered informed.
• (voluntary) the individual must have a genuine opportunity to provide or withhold consent. This may require an assessment of the alternatives available to the individual if they do not consent and the seriousness of the consequences. Bundling consent may also be problematic for assessing whether consent is voluntary, as the broader consequences of a refusal need to be considered.
• (current and specific) consent for collection and proposed uses/disclosures should typically be obtained at the time personal information is collected. If such consent is being sought later, it should be at the time of the proposed use or disclosure requiring consent. Consent should be as directed as possible, and not a broad consent for various activities.
• (capacity) APP Entities need to consider whether the individual has capacity to give consent. Ordinarily, this can be presumed, however, the following factors may indicate that further inquiries are required: age, physical or mental disability, temporary incapacity or limited understanding of English.

One of the reforms currently being considered as part of a broader review of the Privacy Act (see item 2 for further details) is to incorporate these elements into the legislation.

There are a number of instances where the APPs impose additional restrictions in respect of sensitive information.

APP 3 requires that an individual’s consent is always required for the collection of sensitive information under the Privacy Act (unless an exception applies). This differs from other types of personal information where consent is not strictly required.

APP 6 addresses the purpose for which information may be used or disclosed. It provides that where consent has not been obtained, sensitive information can only be used for a secondary purpose if that secondary purpose is directly related to the primary purpose (that is, the purpose for which it was collected). This contrasts with other personal information which can be used for any secondary purpose which is related to the primary purpose. The term “directly related” is not expressly defined, however, it is likely to require a secondary purpose which is closely related to the primary purpose.

Under APP 7, the only circumstance in which sensitive information can only be used for the purpose of direct marketing is if the individual has consented. This is narrower than the circumstances for which other types of personal information can be used in this way (for example, where the individual would reasonably expect the information to use the non-sensitive personal information for that purpose and provides a simple means to request that the entity cease marketing).

In addition, there are special rules which apply to recipients of tax file numbers.

There are no categories of personal information that are prohibited from being collected under the Privacy Act.

Under the Privacy Act, the definition of ‘sensitive information’ includes health data about an individual so the rules applying to sensitive information must be observed in respect of health data.

Some individual states also have specific laws relating to health data, for example the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic). In the Victorian and NSW examples, these laws apply to health services providers (in the private sector as well as applicable state government entities) operating in respective states and oblige such providers to comply with “health privacy principles” which are enumerated in the legislation. In each applicable state, these principles are similar, although not the same, as the APPs.

Small Business Operators

As described above, an organisation will not be subject to the obligations under the Privacy Act if its annual turnover is less than AUD3 million. This exception does not apply where the organisation:

• provides health services and holds any health information;
• exchanges personal information for a benefit, service or advantage;
• is a contracted service provider to a federal government agency (whether directly or under a sub-contract); or
• is a credit reporting body.

Note that this exemption will likely be the subject of reform, as described in item 2.

Australian Link

The obligations under the Privacy Act are only applicable to entities if they have an ‘Australian link’. The APPs have extra-territorial application and will extend to an act done, or practice engaged in, outside Australia by an organisation but only where that organisation has an ‘Australian link’ (s 5B(1A)).

An organisation has an Australian link if the organisation is:

• an Australian citizen or a person whose continued presence in Australia is not subject to a legal time limitation;
• a partnership formed, or a trust created, in Australia or its external Territories (i.e., islands controlled by Australia);
• a body corporate incorporated in Australia or its external Territories; or
• an unincorporated association that has its central management and control in Australia or an external Territory.

An organisation that does not fall within one of those categories will also have an Australian link where it carries on business in Australia or its external Territories.

For clarity, external territories of Australia are the islands and other areas controlled by the Australian government.

Employee Records

Acts or practices of an organisation which is a private sector employer of an individual which are directly related to: (i) a current or former employment relationship between the organisation and the individual; and (ii) records of personal information relating to the individual’s employment, are exempt from the obligations of the Privacy Act. This exemption does not apply to contractors or unsuccessful job applicants.

This exemption will likely be the subject of reform, as described in item 2.

Journalism

APP Entities engaged in journalism are exempt from the Privacy Act provided they observe alternative standards which address privacy and have been published by an organisation representing a class of media organisations.

This exemption will likely be the subject of reform, as described in item 2.

State Governments and their service providers

State Governments have adopted their own privacy legislation and are not subject to the Privacy Act. Also, acts undertaken by (sub)contractors to state governments pursuant to such service contracts are exempt from the Privacy Act (however, it will likely be subject to the relevant State legislation).

Political parties

Generally speaking, political parties are exempt from the obligations in the Privacy Act. They are also exempt from the applications of the Spam Act.

Individuals in a non-business capacity

An individual who may constitute an APP Entity because of their business affairs (such as a sole trader) will not be subject to Privacy Act obligations in respect of their personal affairs.

No, the Privacy Act does not specifically address children’s and teenager’s personal data.

However, in relation to consent, the Australian Privacy Principle Guidelines (APP Guidelines) do suggest that organisations should consider whether a person under the age of majority has the capacity to consent. This assessment can be made on a case-by-case basis and should accord with the general principle that capacity to consent requires “sufficient understanding and maturity to understand what is being proposed”. Where a targeted assessment of a minor’s capacity to consent is impractical or unreasonable, the APP Guidelines suggest that an organisation may proceed on the rebuttable presumption that a person over the age of 15 has capacity to consent.

Expected reforms to the Privacy Act are likely to include the introduction of a ‘Children’s Online Privacy Code’ that applies to online services likely to be accessed by children.

The data protection laws in Australia do not expressly address online safety, although it can be said that certain APPs overlap with the objective of keeping individuals safe online.

Australia does, however, have a comprehensive and mature online safety framework, primarily set out in the Online Safety Act 2021 (Cth) (Online Safety Act) and enforced by an independent regulator, the eSafety Commissioner.

The Online Safety Act contains several regulatory schemes that seek to limit, prevent and help remediate various forms of online harm. Such harms include interpersonal harms such as cyber-bullying of an Australian child, cyber-abuse of an Australian adult, or image-based abuse (e.g., “revenge porn”), as well as harms relating to illegal and restricted material (including child sexual exploitation material), which are covered by the Online Safety Act’s revised Online Content Scheme and abhorrent violent conduct powers.

The Online Safety Act also places various obligations on providers of online services, including: notice and takedown obligations that are enforced by the eSafety Commissioner in a reactive manner in response to online harm; Basic Online Safety Expectations (BOSE), which are not directly enforceable but are subject to mandatory transparency powers of the eSafety Commissioner; and various obligations regarding illegal and harmful material enforced via a set of Industry Codes and forthcoming Industry Standards.

The OAIC has the most direct oversight of issues related to children’s privacy generally. However, as noted above the Privacy Act does not yet contain specific protections for children, and as a result the OAIC’s function in this space is primarily advisory for the time being.

While the Online Safety Act seeks to protect both Australian children and adults, children (i.e., persons under 18 years of age) are the primary focus of its enforcement by the eSafety Commissioner. The Online Safety Act intersects with the privacy of children in several direct and indirect ways:

• Notably, the regulation of the non-consensual sharing of intimate images under the Online Safety Act directly protects the privacy and integrity of individuals, including children, depicted in ‘non-consensual intimate imagery’ (also known as image-based abuse material’ or colloquially, ‘revenge porn’). Such material is also regulated at criminal law in each Australian jurisdiction, and where it depicts children, would also be considered as child sexual abuse material.
• The BOSE currently include, as an example of a reasonable step to ensure safe use of its service, that providers ensure that the default privacy settings are robust and set to the most restrictive level for children’s services (i.e., services targeted at or used by children). More generally, the eSafety Commissioner has been known to use its BOSE transparency reporting powers to query the data collection practices of respondent companies.

The eSafety Commissioner and the OAIC regularly work together, including through formalised Digital Platform Regulators Forum (DP-REG) arrangements (alongside the ACCC and the ACMA). We expect increased collaboration between the eSafety Commissioner and the OAIC as the Children’s Online Privacy Code is developed and enforced.

The Online Safety Act and subordinate instruments are due for several significant reforms in 2024 and 2025:

• The Online Safety Act is currently undergoing statutory review, with consultation expected to commence in the first half of the year and a finalised report expected toward the end of 2024. The review will be broad ranging and include examination of the effectiveness of existing regimes, the policy mandate for additional protections / powers, and whether existing enforcement mechanisms are adequate.
• Industry Standards for relevant electronic services (communications services) and designated internet services (general websites and first-party storage) relating to ‘class 1A and 1B material’ are still under development by the eSafety Commissioner and are expected to be registered in 2024.
• Industry Codes for class 1C and 2A material (i.e. certain online pornography) are due to commence development by industry in 2024, however exact timeframes have not yet been announced.
• The BOSE are presently undergoing reform to cover a wider range and more specific set of online harms, including hate speech. While the BOSE is an indirectly enforceable regime, changes will expand the scope of information that the eSafety Commissioner is able to readily request.

As part of wider reforms to the Privacy Act, we expect the Childrens Online Privacy Code to be developed within this period, however, when such an instrument may commence is uncertain. Additionally, the Australian Government has signalled an intention to directly regulate the practice of ‘doxing’, or the non-consensual release of personal information, which may be effected through the Privacy Act, the Online Safety Act, or a dedicated statute in relation to a tort for serious invasions of privacy.

There is no express or equivalent requirement in the Privacy Act for ‘data protection by design’; however, APP 1 requires APP Entities to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and enable the entity to deal with enquiries or complaints about privacy. The Privacy Commissioner considers that this amounts to a requirement of privacy by design.

Some of the measures the Privacy Commissioner recommends entities implement to address this requirement include:

• procedures for identifying and managing privacy risks at each stage of data processing, including collection, use, disclosure, storage, destruction and de-identification;
• security systems for protecting personal information from misuse, interference, loss and unauthorised access, modification or disclosure;
• a commitment to conduct privacy impact assessments in respect of new projects;
• procedures for identifying and responding to privacy breaches, access and correction requests and receiving and responding to complaints or inquiries;
• aiming to give individuals the option to remain anonymous or use a pseudonym when dealing with the organisation;
• governance mechanisms to ensure compliance with the Privacy Act;
• regular staff training;
• appropriate supervision of staff who regularly handle personal information;
• appropriate mechanisms to ensure that agents and contractors handle personal information consistently with law and the organisations practices and procedures; and
• a program of proactive review and audit of privacy processes and systems.

As mentioned, the obligation under APP 1 is limited to reasonable steps. What is reasonable will depend on the circumstances, in particular the nature of the possible information to be processed, the adverse consequences to individuals of improper use, the nature of the organisation handling the information and the cost and practicality of the steps being considered.

This is another area which may be subject to reforms as part of the Privacy Act review. For example, one of the recommendations has been to require privacy impact assessments be conducted for projects or uses of Personal Information considered high risk. The details of those reforms, and whether this proposal is adopted, remain to be seen.

APP 1 expressly requires entities to maintain an up-to-date privacy policy which documents the personal information they collect and how they use and disclose it. Beyond this, there are no express record keeping obligations. However, the broader requirements of APP 1 with respect to the implementation of practices, procedures and systems to ensure compliance with the APPs may necessitate internal compliance policies and processes, including to understand what data is collected, where it is stored, how long it is to be retained, who can access it and what risks it is exposed to. This is often managed by establishing internal privacy and data use and retention policies, requirements for privacy or data impact assessments and data mapping and classification exercises, including with assistance from cyber security teams.

There are no prescriptive requirements in this regard. Under APP 11.2, APP Entities which hold Personal Information which is no longer needed and is not required by law to be retained must take such steps as are reasonable to destroy it or ensure it is de-identified. There are no express timeframes specified for disposal.

The obligation under APP 11.2 is limited to the taking of reasonable steps. What is reasonable will depend on the circumstances, and the following factors may be relevant:

1. the amount and sensitivity of the information;
2. the nature of the organisation;
3. the possible adverse consequences to individuals if the information is mis-handled;
4. the organisation’s information handling practices (such as where handling is outsourced); and
5. the time and cost involved in complying.

Certain types of information, such as Tax File Numbers and some health information, have further retention and deletion requirements. There are also industry specific requirements, for example in the telecommunications and banking sectors.

The Privacy Commissioner typically acts in response to complaints from individuals or self-reporting from organisations, including under the mandatory data breach notification regime. There is not a formal process for private entities to seek pre-screening or consultation with the Privacy Commissioner in the way there may be in other jurisdictions or with other regulators in Australia.

The situation is similar for federal agencies, although they may be required to provide their privacy impact assessments to the Privacy Commissioner.

Only Federal Government Agencies are subject to an express obligation under the Privacy (Australian Government Agencies – Governance) APP Code 2017 (Agency Code) to undertake privacy impact assessments. They must do this for all ‘high privacy-risk projects’. A project may be a high privacy-risk project if the agency reasonably considers that the project involves new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals. Agencies are also required to carry out privacy impact assessments where they are directed to do so by the Privacy Commissioner under section 33D of the Privacy Act.

Private sector organisations do not currently have an express obligation to conduct a privacy impact assessment, however, many choose to in order to address the obligation under APP 1 to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs. Completion of a privacy impact assessment can be used to establish that such reasonable steps have been taken, as well as identify other measures to be implemented.

The Privacy Commissioner sets out a 10-step process for conducting a privacy impact assessment. These steps are:

1. conduct a threshold assessment;
2. plan the PIA;
3. describe the project;
4. identify and consult with stakeholders;
5. map information flows;
6. prepare a privacy impact analysis and compliance check;
7. privacy management — addressing risks;
8. consider and prepare recommendations;
9. produce a report; and
10. respond and review.

One of the reforms proposed by the Attorney-General’s Privacy Act Review Report in February 2023 (see item 2 above) was the introduction of a requirement for all APP entities to conduct privacy impact assessments for activities likely to have a significant impact on the privacy of individuals.

Only federal Government agencies are required to have a privacy officer in connection with their Privacy obligations. This is pursuant to the Agency Code applicable to them. Other larger organisations sometimes appoint a privacy officer despite not having a strict obligation to do so.

The Privacy Officer functions required under the Agency Code include:

1. providing privacy advice internally such as:
   1. the development of new initiatives that have a potential privacy impact;
   2. the general application of privacy law to the agency’s activities;
   3. what to consider when deciding whether or not to carry out a Privacy Impact Assessment; and
   4. what safeguards to apply to mitigate any risks to the privacy of individuals;
2. liaising with the OAIC;
3. co-ordinating the handling of internal and external privacy enquiries, privacy complaints, and requests for access to, and correction of, personal information;
4. maintaining a record of your agency’s personal information holdings;
5. assisting with the preparation of Privacy Impact Assessments; and
6. measuring and documenting your agency’s performance against its privacy management plan.

There are no express requirements, although many choose to in order to address the obligation under APP 1 to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs. Employee training may also be a step that organisations take in order to ensure it protects Personal Information from misuse, interference and loss and thereby discharge their obligation under APP 11. The Privacy Commissioner provides a number of training resources on its website.

Further, many regulators consider training in respect of cyber security part of general risk management obligation under various laws.

APP 1 requires organisations to have a Privacy Policy setting out the types of information the organisation collects, and how it is used or disclosed. Privacy policies are required to be clearly expressed and made available free of charge. Organisations typically publish their privacy policies on their public-facing website.

A privacy policy must contain:

• the kinds of information that the entity collects and holds;
• how it collects and holds information;
• the purposes for which the entity collects, holds, uses and discloses information;
• how an individual may access their information and seek correction;
• how an individual can make a complaint, and how the organisation will deal with the complaint; and
• whether the organisation will disclose the personal information to an overseas recipient, and if so the countries in which such recipients are likely to be located.

Further, APP 5 requires organisations to take reasonable steps to provide a collection notice to individuals at or before the time they are collecting personal information (or as soon as practicable after). This notice must include:

• the identity and contact details of the organisation;
• the fact that information is being collected (this is particularly important where the collection is from a third party, or the collection is not obvious);
• where the collection is required by law, that fact and the details of the law requiring collection;
• the purpose for which the information is being collected;
• the main consequences for the individual if the information is not collected;
• any other entities to which the information will be provided;
• references to the organisation’s privacy policy (including a hyperlink if possible); and
• whether the organisation will disclose the personal information to an overseas recipient, and if so the countries in which such recipients are likely to be located.

The obligation under APP 5 is one of reasonable steps only. What is reasonable will depend on the circumstances.

Organisations and government agencies that collect, use or disclose personal information are regulated in relation to those activities. Terms such as ‘Controller’, ‘Owner’ and ‘Processor’ are not used in the Privacy Act or state and territory privacy acts. Organisations and federal government agencies that collect, use or disclose personal information are called ‘APP Entities’ and must comply with the Privacy Act and the APPs contained in the Privacy Act.

In practice, an important and difficult distinction is between APP Entities that collect, use or disclose personal information and organisations that as service providers to those APP Entities may handle personal information for those entities: for example, operations of data warehouses or data centres and cloud as-a-service providers.

Where personal information is entrusted by an APP Entity that collects that personal information to another party for storage and processing, the Commissioner looks to whether the second party has ‘control’ of that information. If the second party can fully access and edit that information, the provision of that personal information to the second party is a ‘disclosure’ subject to relevant notice and consent requirements and the second party is an entity that ‘collects’ this information. However, the Commissioner has expressed the view that in limited circumstances, an APP Entity might retain such a degree of control over the information that the APP Entity is considered to be ‘using’ that information and not disclosing the information to the second party. For example, where an APP Entity provides personal information to a cloud service provider located overseas, this may be a ‘use’ if the information is provided for the limited purpose of performing the services of storing and ensuring the APP Entity may access the personal information, and a binding contract between the parties:

• requires the provider only to handle the personal information for these limited purposes;
• requires any subcontractors to agree to the same obligations; and
• gives the entity effective control of how the personal information is handled by the provider. Issues to consider include whether the entity retains the right or power to access, change or retrieve the personal information, who else will be able to access the personal information and for what purposes, what type of security measures will be used for the storage and management of the personal information and whether the personal information can be retrieved or permanently deleted by the entity when no longer required or at the end of the contract.

Whether or not other examples are considered a ‘use’ or a ‘disclosure’ will depend on the circumstances of each individual case, having regard to the degree of control held by the APP Entity.

As described in item 23, the Privacy Act does not draw a distinction between controllers and processors. The effect of this is that processors are subject to the same obligations as controllers in most instances.

Australian law does not prescribe contract terms to apply between processors and controllers. For instance, there is no equivalent to the model clauses required under the EU General Data Protection Regulation 2016/679.

In practice, well advised business will usually negotiate extensive privacy provisions in agreements involving the use, disclosure or other processing of personal information. These provisions primarily seek to allocate risk for liability associated with the privacy practices of each party, but may also include provisions designed to give the controller sufficient oversight and control of the processor’s use of personal information and/or give the processor comfort that the intended processing of personal information complies with applicable laws. In Australia, privacy terms in contracts may also be subject to an indemnity (including for first party losses) and liability for breaches are not typically subject to a general cap on damages but are uncapped (or sometimes subject to a “super-cap”).

Further, more specifically, under APP 8.1, where an APP entity in Australia discloses personal information to an overseas recipient, the entity disclosing the information must take reasonable steps to ensure that the overseas recipient does not breach the APPs. One typical step taken to comply with APP 8.1 is to put in place an appropriate contractual regime with the overseas recipient of information (see item 32).

There are no express restrictions or limitations on the appointment of processors (and for the reasons described above, the distinction between controller and processor is not applicable in Australia).

Certain appointments may commonly give rise to obligations on ‘controllers’ which are described elsewhere in this guide. For example, appointment of an overseas based processors may give rise to the obligations described in item 32. Similarly, if the controller was a Federal Government Agency and the appointment was part of a high privacy-risk project then the Agency would need to conduct a privacy impact assessment as part of that project (see item 19).

These issues are not specifically addressed under Australian law.

However, to the extent that the use of cookies involves the collection, use or disclosure or transfer of personal information, the APPs will apply. The concept of ‘collection’ of personal information applies broadly, and includes information associated with web browsing, such as personal information collected by cookies. Consequently, collection of personal information using cookies can occur provided that the notice and consent requirements are followed.

The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) has proposed reform in this area.

APP 7 provides that an organisation must not use or disclose personal information it holds for the purpose of direct marketing unless an exception applies. Exceptions include where an individual would reasonably expect an organisation to use or disclose personal information for direct marketing, or where the individual has consented. Where such an exception applies, then direct marketing is permitted (and the practice is widespread in Australia).

Although not expressly defined in the Privacy Act currently (albeit the Privacy Act Review Report proposes to do so), direct marketing includes the use or disclosure of personal information to communicate directly with an individual to promote goods and services and may include targeted advertising depending on the specific context and how targeted the advertising is.

Where an organisation is permitted to use or disclose personal information for the purpose of direct marketing, it must always allow an individual to request not to receive direct marketing communications (also known as ‘opting out’) and comply with that request.

The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) has proposed reform in this area. As well as the specific proposals on targeted advertising in the Report, of note in this context as well is the proposed broadening of the definition of ‘personal information’ to specifically recognise includes technical and inferred information, such as IP addresses and device identifiers.

There are no provisions in the Privacy Act expressly controlling or prohibiting the sale or other trading of Personal Information. That said, any such sale must comply with the APPs and other obligations under the Privacy Act. For example, a sale would constitute a disclosure of Personal Information, so the requirements of APP 6 must be met.

Further, an organisation will be an APP entity (i.e., subject to the requirements of the Privacy Act) if it is in the business of selling personal information. This is so even if the organisation would otherwise be exempt as a small business.

Electronic marketing is partly regulated through subject matter-specific federal laws such as the Spam Act, which governs most forms of electronic marketing, and the DNCR Act, which regulates unsolicited telemarketing calls.

The Spam Act prohibits ‘unsolicited commercial electronic messages’ with an ‘Australian link’ from being sent or caused to be sent. Commercial electronic messages may only be sent with an individual’s consent (express or inferred in certain circumstances), and the message contains accurate sender identification and a functional unsubscribe facility. The burden of proving consent lies with the sender of the message.

Voice calls, including synthetic or recorded calls (such as robocalls), are separately regulated under a ‘do not call’ regulatory framework established under the DNCR Act and associated legislation and instruments, including the Telecommunications Act 1997 (Cth) (Telecommunications Act), under which individuals may complain about potential breaches of the Spam Act and the DNCR Act, and the Telecommunications (Do Not Call Register) (Telemarketing and Research Calls) Industry Standard 2007. Marketing faxes are also regulated. A telemarketing call or marketing fax is broadly defined as a voice call or fax made to a number to offer, supply, provide, advertise or solicit goods or services, land or an interest in land, a business/investment opportunity and donations. Certain calls are not considered to be telemarketing or fax marketing, including product recall, fault verification, appointment rescheduling, appointment reminder, payments and solicited calls/faxes about orders, requests or customer enquiries.

The DNCR Act provides an ‘opt-out’ option, allowing Australians who do not wish to receive telemarketing calls or marketing faxes to list their private-use fixed and mobile telephone numbers and fax numbers on the DNCR. As of June 2023, total DNCR registrations was around 12.5 million. The quantity of numbers that telemarketers and fax marketers submit for checking (or ‘washing’) against the DNCR was 478 million during the 2022-23 financial year.

Unsolicited telemarketing calls or faxes must not be made to an Australian number registered on the DNCR without the consent (implied or express) of the relevant account holder or their nominee.

The definition of ‘sensitive information’ includes: (i) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; and (ii) biometric templates. The obligations applicable to sensitive information will equally apply to biometric information. These obligations are set out in the answer to item 8 above. Besides this, there are no specific requirements under the Privacy Act.

The implementation and use of AI systems is not currently directly regulated in Australia.

In January 2024, the Federal Government announced its intention to implement mandatory guiderails for the use of AI in high-risk settings. Any such regulation is likely to be principles-based and align with existing frameworks which promote testing, transparency and accountability. The Federal Government is considering both changes to existing legislation as well as standalone regulation of AI. Government consultation on the regulation of AI is on-going and, as of April 2024, there has been no legislation proposed.

Before an APP Entity discloses personal information to an overseas recipient (which may include a service provider that would ordinarily be considered a processor in other jurisdictions), the entity must take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information (APP 8.1). Reasonable steps typically requires that the APP Entity enter into an enforceable contract with the overseas recipient which includes obligations consistent with the APPs. Alternatively, disclosure is also permissible where the APP Entity reasonably believes that the overseas entity is subject to laws or a binding scheme which is at least substantially similar to the APPs and the individual has mechanisms available to them to enforce that protection.

An APP Entity that discloses personal information to an overseas recipient is generally accountable for any acts or practices of the overseas recipient in relation to the information that would breach the APPs (section 16C).

However, there are exceptions to the requirement in APP 8.1 to take reasonable steps and to the accountability provision in section 16C. These include obtaining the consent of the relevant individual to the overseas disclosure (after an express statement informing the individual that APP 8 will not apply), or where the APP Entity reasonably believes that the recipient is subject to an equivalent regime in its local jurisdiction and that there are mechanisms that the individual can access to take action to enforce that regime.

APP 11 requires an APP Entity to take active measures to ensure the security of personal information it holds, and to actively consider whether it is permitted to retain personal information. An APP Entity that holds personal information must take reasonable steps to protect the information from misuse, interference and loss, as well as unauthorised access, modification or disclosure (APP 11.1). Unauthorised access includes both access by an employee of the entity or independent contractor and unauthorised access by an external third party (such as by hacking).

Reasonable steps should include, where relevant, taking steps and implementing strategies in relation to governance, culture and training, internal practices, procedures and systems, ICT security, access security, third party providers (including cloud computing), data breaches, physical security, destruction and de-identification and compliance with applicable standards.

The Commissioner not infrequently determined that internal or external data breaches are reasonably attributable to a failure by an APP Entity to take reasonable steps to protect information security or to take reasonable steps to destroy personal information or ensure it is de-identified if it no longer needs the information for any purpose for which it may be used or disclosed under the APPs.

In addition, certain types of information (such as tax file numbers) and certain sectors (such as the financial services sector) are subject to additional cyber security requirements, including under Prudential Standard CPS 234 and the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act), as referred to below, and also via general risk management obligations, including under section 912A of the Corporations Act 2001 (Cth).

Part IIIC of the Privacy Act sets out a regime for the notification of ‘Eligible Data Breaches’. The specifics of the regime are set out in the answer to item 36.

An Eligible Data Breach occurs where:

1. there is unauthorised access to, or unauthorised disclosure of personal information or personal information is lost in circumstances where unauthorised access to, or unauthorised disclosure of the information is likely to occur; and
2. a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates.

The potential harm contemplated in this definition includes physical, psychological, emotional, economic and financial harm, as well as harm to reputation. An assessment as to whether an individual is likely to suffer ‘serious harm’ as a result of an Eligible Data Breach depends on, among any other relevant matters:

• the kind and sensitivity of the information subject to the breach;
• whether the information is protected and the likelihood of overcoming that protection;
• if a security technology or methodology is used in relation to the information to make it unintelligible or meaningless to persons not authorised to obtain it – the information or knowledge required to circumvent the security technology or methodology;
• the persons, or the kinds of persons, who have obtained, or could obtain, the information; and
• the nature of the harm that may result from the data breach.

The SOCI Act was amended in 2021 and again in 2022 to ensure the strengthened resiliency of and protection of Australian businesses in critical sectors from sophisticated cyber threats. The SOCI Act imposes obligations on businesses in the following sectors which are considered ‘critical infrastructure sectors’:

• the communications sector;
• the financial services and markets sector;
• the data storage or processing sector;
• the defence industry sector;
• the higher education and research sector;
• the energy sector;
• the food and grocery sector;
• the health care and medical sector;
• the space technology sector;
• the transport sector; and
• the water and sewerage sector.

Certain businesses in these sectors may be required to (among other things):

• provide information regarding the assets it uses in the conduct of its business (including regarding the ownership and operation of those assets) for inclusion in the federal government’s register of critical infrastructure assets;
• adopt and maintain an all-hazards critical infrastructure risk management program to address, among other things, cyber risks;
• notify the Australian Signals Directorate of cyber incidents affecting an entity’s critical infrastructure assets, with (verbal) notification required within 12 hours if the cyber incident is likely to have a significant impact on the availability of the asset; and
• where assets are declared to be systems of national significance, comply with additional security obligations, including development of a cyber incident response plan, conduct of cyber security rehearsal exercises, and vulnerability assessments.

In addition, the SOCI Act provides the federal government with various access and intervention powers to address security vulnerabilities in critical assets and managing response to cyber incidents.

Entities that fail to comply with obligations under the SOCI Act are liable for fines, with maximum penalties ranging up to AUD391,250 (1,250 penalty units). The SOCI Act also includes criminal offences.

Outside of the SOCI Act, regulated entities in the financial services sector (for example, banks, insurers and superannuation providers) must comply with cyber security standards as part of their prudential regulation. Prudential Standard CPS 234 aims to bolster the cybersecurity readiness of regulated entities and minimising the likelihood and impact of incidents on confidentiality, integrity or availability of information and information systems.

CPS 234 places obligations on these regulated financial services entities with respect to how they manage their ‘information assets’. Information assets are defined to mean both data and the IT systems used to operate the business. These obligations cover cyber risk management, implementation of security controls, testing and audit of those security controls and cyber incident response.

If a cyber incident occurs which has the potential to materially affect (whether financially or otherwise) the interests of depositors, policyholders, beneficiaries or customers, then the entity is required to notify the Australian Prudential Regulation Authority (APRA) within 72 hours. Entities must also notify APRA of any incidents which it has had to notify to another regulator (for example an Eligible Data Breach notification to the Privacy Commissioner under the Privacy Act).

The Telecommunications sector is another which has specific cybersecurity requirements. The telecommunication sector security reforms (TSSR) were introduced in 2017 as amendments to the Telecommunications Act 1997 (Cth) to establish a regulatory framework to better manage the national security risks of espionage, sabotage and foreign interference to Australia’s telecommunications networks and facilities. The TSSR contain the following key elements:

• Security obligation: all carriers, carriage service providers and carriage service intermediaries will be required to do their best to protect networks and facilities from unauthorised access and interference – including a requirement to maintain ‘competent supervision’ and ‘effective control’ over telecommunications networks and facilities owned or operated by them.
• Notification obligation: carriers and nominated carriage service providers will be required to notify government of planned changes to their systems and services that could compromise their capacity to comply with the security obligation.
• Information gathering power: the Secretary of the Department of Home Affairs has the power to obtain information and documents from carriers, carriage service providers and carriage service intermediaries, to monitor and investigate their compliance with the security obligation.

Directions power: the Home Affairs Minister has a new directions power, to direct a carrier, carriage service provider or carriage service intermediary to do, or not do, a specified thing that is reasonably necessary to protect networks and facilities from national security risks.

Where an APP Entity is aware that there are reasonable grounds to believe that there has been an Eligible Data Breach (whether it forms such an awareness following an assessment of a reasonable suspicion that an Eligible Data Breach may have occurred (which such assessment must take no more than 30 days), or otherwise), the entity must as soon as practicable:

1. prepare a statement that, at a minimum, contains:
   1. the entity’s contact details. If relevant, the identity and contact details of any entity that jointly or simultaneously holds the same information in respect of which the eligible data breach has occurred, for example, due to outsourcing, joint venture or shared services arrangements may also be provided. If this information is included in the statement, that other entity will not need to separately report the eligible data breach;
   2.  a description of the data breach;
   3. the kinds of information concerned; and
   4. the steps it recommends individuals take to mitigate the harm that may arise from the breach (while the entity is expected to make reasonable efforts to identify and include recommendations, it is not expected to identify every possible recommendation that could be made following a breach);
2. provide a copy of this statement to the OAIC; and
3. take such steps as are reasonable in the circumstances to notify affected or at-risk individuals of the contents of the statement. Individuals may be notified by the mode of communication normally used by the entity, or if there is no normal mode of communication, by email, telephone or post. If direct notification is not practicable, the entity must publish the statement on its website and take reasonable steps to publicise its contents.

The OAIC provides a standard form which may be used to notify, found on its website.

What constitutes a ‘practicable’ timeframe will vary depending on the time, effort or cost required to comply with the above requirements. Proposed reforms (see item 2) may introduce a 72-hour notification requirement.

Additional reporting requirements may apply based on the sector as described in item 36 above, including under both the SOCI Act and CPS 234.

The stated policy of the Federal Government is that ransoms should never be paid, however, payment of ransoms is not expressly outlawed, although some argue may give rise to an offence under sanctions law or laws relating to funding of criminal or terrorist organisations depending on the recipient and the circumstances of payment.

The Federal Government is currently consulting on proposed new legislation which may make the notification and reporting of ransomware attacks mandatory for entities. The Federal Government proposes two reporting obligations: (i) first when businesses are impacted and a ransom demand is received, and (ii) again when a ransomware or extortion payment is made.  Small businesses with an annual turnover of $10 million or less per year may be exempted.

As described above, there are a number of sector specific laws which require reporting of cyber incidents. This includes the SOCI Act, which requires certain incidents to be notified within 12 hours.

As Australian law dealing with cybersecurity is still piecemeal, there are a number of regulators with responsibilities. Some such regulators are set out below.

• The Privacy Commissioner, which has responsibility for security related aspects of privacy law.
• The Department of Home Affairs, which administers the SOCI Act.
• A number of industry specific regulators in sectors for which there are cyber specific obligations (for example, APRA in respect of financial services).
• The Australian Cyber Security Centre (ASCS) which is part of the Australian Signals Directorate and is tasked with leading the federal government’s operational response to cyber issues, but which has minimal regulatory powers at present.

Access to data

An APP Entity that holds personal information about an individual must, on request, give that individual access to the information (APP 12.1).

APP 12 also sets out minimum access requirements, including the time period for responding to an access request, how access is to be given, and that a written notice, including the reasons for the refusal, must be given to the individual if access is refused. For example, an APP Entity must respond to a request for access to the personal information if the entity is an agency, within 30 days after the request is made, or if the entity is an organisation, within a reasonable period after the request is made.

There are a number of exceptions to the obligation for organisations to provide an individual access to their personal information, including where the entity reasonably believes that:

• giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or
• giving access would have an unreasonable impact on the privacy of other individuals.

Correction and deletion

APP 13.1 provides that an APP Entity must take reasonable steps to correct personal information it holds, to ensure it is accurate, up-to-date, complete, relevant and not misleading, having regard to the purpose for which it is held.

APP 13.1 requires an APP Entity to take reasonable steps to correct personal information it holds, in two circumstances: on its own initiative, and at the request of the individual to whom the personal information relates.

Upon receiving a request an entity must decide if it is satisfied that the information is incorrect, and if so, take reasonable steps to correct it.

APP 13 does not stipulate formal requirements that an individual must follow to make a request, require that a request be made in writing, or require the individual to state that the request is an APP 13 request.

Objection to processing

There is no general right for an individual to object to collection, use or disclosure of personal information. The Privacy Act generally only requires notice of processing activities to be provided to individuals, and consent is only required in relation to particular activities, notably including collection, use or disclosure of sensitive information and use and disclosure of personal information for the purpose of direct marketing.

However, APP 2 provides that individuals must have the option of dealing anonymously or by pseudonym with an APP Entity. However, an APP Entity is not required to provide those options where:

• the entity is required or authorised by law or a court or tribunal order to deal with identified individuals; or
• it is impracticable for the entity to deal with individuals who have not identified themselves (which is often the case).

Anonymity means that an individual dealing with an APP Entity cannot be identified, and the entity does not collect personal information or identifiers.

A pseudonym is a name, term or descriptor that is different to an individual’s actual name.

Where applicable, an APP Entity must ensure that individuals are made aware of their opportunity to deal anonymously or by pseudonym with the entity.

Complaint to relevant data protection authority

An individual has the right to lodge a complaint with the Privacy Commissioner for alleged breaches of the Privacy Act. Generally, the complainant must first register a complaint with the APP Entity to which the complaint relates. If dissatisfied with the response, a complainant can complain to the Commissioner or to an external dispute resolution scheme of which the entity is a member (if applicable). In conducting its investigations, the Commissioner may require the production of documents and information and compel people to appear and answer questions.

The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) has proposed reform in this area.

Individual data privacy rights are only exercisable through the regulator, which is the Privacy Commissioner. Affected individuals can lodge complaints with the Privacy Commissioner which has a formal investigation and conciliation, or determination process prescribed in the Privacy Act.

Reform is being considered in this area, including a direct right of action for individuals (see item 2).

The Privacy Act does not currently provide a private right to claim damages, only a right to enforce a declaration by the Privacy Commissioner for compensation or to seek an injunction. The private right to seek injunctive relief has been used very infrequently.

There are current proposals for law reform being considered which would introduce a private right of action and/or a statutory tort for invasion of privacy which could be enforced by individuals. These reforms are discussed further in item 2.

We note that privacy breaches may arise in circumstances which also constitute a breach of confidentiality. Where this is the case, individuals may have rights under a contract with the entity or an equitable duty of confidentiality may also apply under common law.

The Privacy Commissioner has power to award compensation to individuals affected by breaches of the Privacy Act. This is available both for financial loss as well as for non-economic losses, such as emotional harm, humiliation or inconvenience.

The Privacy Commissioner has applied the following principles in awarding compensation:

• principles of damages applied in tort law will assist in measuring compensation;
• compensation should be assessed having regard to the complainant’s reaction (not a ‘reasonable person’ test);
• there must be a good reason not to award compensation once loss is established; and
• aggravated damages may be awarded in appropriate cases.

While aggravated damages are seldom awarded, it is open to the Privacy Commissioner to do so, particularly if:

• an entity’s conduct is considered to be ‘high-handed, malicious, insulting or oppressive’; or
• the entity has acted in a way that exacerbates the complainant’s injury or hurt feelings.

Privacy enforcement

The Privacy Commissioner has a range of regulatory powers including powers to:

• conduct an assessment of whether an entity is maintaining and handling personal information in accordance with relevant provisions (such as the APPs);
• direct a government agency (but not private sector organisations) to give the Privacy Commissioner a privacy impact assessment;
• request entities to develop an APP code or impose one where appropriate;
• investigate an entity following a complaint;
• investigate an entity on its own initiative, that is, without someone making a complaint (Commissioner initiated investigation);
• accept an enforceable undertaking from an entity. An enforceable undertaking is a promise by an entity that it will take specified action or refrain from taking specified action in order to comply with relevant privacy provisions, or to ensure it does not do an act or engage in a practice that interferes with an individual’s privacy;
• make a determination on a privacy complaint. The Privacy Commissioner can also make a determination after conducting a Privacy Commissioner-initiated investigation; and
• apply to the courts for an injunction to restrain a person from engaging in conduct that would constitute a breach of relevant privacy provisions or for an order that an entity pay the civil penalty.

The Privacy Act provides several complaints paths for individuals where there has been (or is suspected to have been) a breach of an APP. The primary complaints process is through a complaint to the Privacy Commissioner, initiating an investigation by the Privacy Commissioner (sections 36 and 40). This process typically requires that the individual has first complained to the relevant APP Entity.

An investigation may result in a determination by the Privacy Commissioner, containing a declaration that:

• the respondent’s conduct constituted an interference with the privacy of an individual and must not be repeated or continued;
• the respondent must take specified steps within a specified period to ensure that such conduct is not repeated or continued;
• the respondent must perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;
• the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint; or
• that no further action is needed (section 52(1)).

A complainant may apply to the Federal Court of Australia or the Federal Circuit and Family Court of Australia to enforce a determination of the Commissioner (section 55A). An individual may also apply to the Federal Court or Federal Circuit and Family Court of Australia for an injunction where a person has, is, or is proposing to engage in conduct that was or would be a breach of the Privacy Act (section 98).

There is not a private right to claim damages, only a right to enforce a declaration by the Privacy Commissioner for compensation or to seek an injunction. The private right to seek injunctive relief has been used very infrequently.

Section 80W of the Privacy Act empowers the Privacy Commissioner to apply to the Federal Court or Federal Circuit and Family Court of Australia for an order that an entity, that is alleged to have contravened a civil penalty provision, pay a civil penalty. A civil penalty order financially penalises an entity, but does not compensate individuals adversely affected by the contravention (although, as noted above, the Privacy Commissioner also has these powers).

The ‘civil penalty provisions’ in the Privacy Act include:

• for serious or repeated interferences with privacy (section 13G) – with maximum penalties for companies of the greater of: (a) AUD50 million; (b) 3 times the benefit gained from the ‘interference’ or contravention (if that is able to be ascertained); or (c) 30% of the company’s annual turnover (if the benefit gained is not able to be ascertained), and
• various civil penalty provisions set out in Part IIIA – which are only applicable to credit reporting bodies and credit providers – with maximum penalties of either AUD782,500, AUD1,565,000 or AUD3,130,000 depending on the offence (500, 1000 or 2000 penalty units, and multiplied by 5 in the case of companies, respectively).

It is important to note that while other enforcement actions (such as the making of determinations and the award of compensation) can be made by the Privacy Commissioner, liability for civil penalties only arises where it is ordered by the Federal Court.

Where an APP Entity experiences an Eligible Data Breach, the occurrence of that data breach in and of itself is unlikely to result in the entity facing penalties. However, a failure to (amongst other things):

• if an entity has a reasonable suspicion that there may have been an eligible data breach, carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe that an eligible data breach occurred and to take all reasonable steps to ensure that that assessment is completed within 30 days after the entity becomes suspicious; and
• report an eligible data breach, will be considered an “interference with the privacy of an individual” affected by the Eligible Data Breach (section 13(4A)).

Cybersecurity enforcement

As mentioned, cybersecurity regulation is still piecemeal in Australia with most regulation being sector-based.

In relation to the SOCI Act, it contains both civil penalty provisions which are dealt with by way of fines, and two criminal offences, which are punishable with fines or potentially imprisonment.  The civil penalty provisions range up to AUD391,250 (1,250 penalty units) for corporations.

The criminal offences under the SOCI Act are:

1. failure to comply with an action direction given by the Home Affairs Secretary under section 35AQ – this only applies to the responsible entity for a critical infrastructure asset; and
2. the use or disclosure of protected information (which is information pertaining to an entity’s SOCI Act obligations) except in permitted circumstances – this applies to all individuals and organisations.

The offences are punishable by fines of up to AUD187,800 (600 penalty units) for corporations or AUD37,560 (120 penalty units) or 2 years imprisonment for individuals.

Civil penalties may be imposed for a serious or repeated interference with privacy. The maximum civil penalty that may be imposed was recently increased and is now the greater of:

1. AUD50 million;
2. 3 times the benefit gained by the interference (if that number is able to be ascertained); or
3. 30% of the annual turnover of the company (if the benefit is not ascertainable).

There are also a number of civil penalty provisions which are applicable to credit reporting bodies and credit providers who use or disclose information in contravention of the Privacy Act. The current maximum civil penalty that may be imposed is AUD3,130,000 (10,000 penalty units) for corporate entities.

No, civil penalties are a matter for Court discretion and there are no guidelines in the Privacy Act (other than the maximum penalty).

Yes, as described in item 43 above, privacy enforcement in Australia occurs through the Federal Court and Federal Circuit and Family Court of Australia. Where the Privacy Commissioner is seeking injunctions or penalties, it must do so through a court process. Similarly, if the Privacy Commissioner (or an individual) is seeking to enforce a determination of the Privacy Commissioner, or an entity (or Federal Government agency) is seeking to appeal a determination, this must be done through court proceedings, generally comprising the Commonwealth administrative appeals process in Australia (either a merit review through the Administrative Appeals Tribunal or a judicial review by the Federal Court of Australia or Federal Circuit and Family Court of Australia).

Prior to 2014 the Privacy Commissioner seldom exercised its power to make determinations as to an alleged breach of privacy. In the period between 2014 and 2023, the Commissioner has made 63 determinations (with 29 determinations being issued since 2021) and an upward trend in formal enforcement activity appears to be continuing.

Between 2014 and 2016, the Commissioner sought to conciliate complaints between the relevant parties, with an apology to the complainant the most common remedy achieved through conciliation, followed by compensation as the next most common. Since 2017, however, compensation has been the most common remedy applied. The amount of compensation paid to an individual complainant between 2014 and 2023 has varied between AUD2,000 to AUD20,000. For instance, in January 2021, the Commissioner made findings against the Commonwealth Department of Home Affairs, holding that it had interfered with the privacy of 9,258 individuals breaching IPP 11 and failed to protect personal information from loss, unauthorised access, use, modification or disclosure or other misuse, breaching IPP 4. The Commissioner’s determination awarded a class of 1,297 members compensation ranging between AUD0 to more than AUD20,000. The Commissioner held that the quantum of compensation was to be calculated based on the nature of the loss and damage experienced by the individual as a result of the breach. We understand this determination is subject to an ongoing appeal by one of the potential complainants.

As at April 2024, the Commissioner has accepted 11 enforceable undertakings. An enforcement undertaking may impose a significant administrative and operational load upon the party giving the undertaking. The following are two examples of enforceable undertakings accepted by the Commissioner, one in 2014 and the other in 2023.

Following two information security breaches by Singtel Optus, in July 2014, the Commissioner initiated an investigation which concluded with the Commissioner agreeing to accept an enforceable undertaking from Singtel Optus. Optus undertook to:

• engage an independent auditor to conduct reviews and provide audit certifications, including as to whether Optus’s practices, procedures and systems are reasonable to protect the personal information Optus holds from misuse, interference or loss, or unauthorised access, modification or disclosure; and whether enhancements to Optus’s monitoring program of change management that has the potential to affect the security of its customers’ personal and sensitive information and as to Optus’s penetration testing for fixed and mobile services were effective;
• conduct on an ongoing basis an audit review of new procedures for review of all major IT projects as part of Optus’s Security Risk Assessment process and as part of its annual monitoring program; and
• conduct a review of Optus’s vulnerability detection processes across the organisation; certifications of a privacy incident review, a service level security posture assessment, an architecture review of Optus’s principal IT systems (top 20 applying a risk-based approach), and a review of Optus’ new voicemail platform.

Following an information security breach involving Marriott International, in February 2023, the Commissioner accepted an enforceable undertaking from Marriott International requiring it to:

• monitor the effectiveness of the privacy and security risk management strategy set by Marriott’s privacy and information security leadership and policies;
• monitor the effectiveness of Marriott’s Global Information Security & Privacy Incident Response Plan (Incident Response Plan) on no less than an annual basis and evaluate and revise if necessary;
• engage independent third parties to assess Marriott’s information security controls and audit Marriott’s security compliance with the Payment Card Industry Data Security Standard for its reservations system; and
• monitor, through engagement of security firms, for evidence of public disclosure or unauthorised use of personal information of individuals covered by the Privacy Act which were disclosed as a result of Marriott data breach and notify the Commissioner and affected individuals if evidence of such disclosure or use is discovered.

Several high-profile data breaches occurring during the course of 2022 and 2023, some of which affected millions of individuals. In response to these, we have observed the following:

• class actions and representative complaints have been commenced by affected individuals;
• class actions have been commenced by shareholders of the companies subject to the data breach on the basis that the companies misrepresented the adequacy of their cyber security measures; and
• the OAIC has commenced investigations and, in one instance, court proceedings to impose a civil penalty. The proceedings were commenced alleging that the inadequacy of the company’s cyber security measures, along with the failure to give the required notifications, amounted to a serious or repeated interference of privacy constituting a breach of section 13G of the Privacy Act. If the allegations are made out, it would be the first time section 13G has been used in this way.

Extensive reforms are anticipated in coming years, as described in item 2.