First Round of Major Changes to Australian Privacy Law

As of 11 October 2024

Although Australia was once considered an early adopter of privacy law when we enacted the Privacy Act 1988 (Cth) (the “Act”) back in the eighties, overseas jurisdictions have since taken the front foot in protecting privacy rights. The European Union’s (“EU”) adoption of the General Data Protection Regulation (“GDPR”) in 2018 is a prime example.  As such, large-scale reform to the Australian Act has become overdue.

In 2023, the Australian Government provided its official response to the Attorney-General’s Department 2022 Privacy Act Review Report. The Government stated that it either ‘agreed’ or ‘agreed in-principle’ with 106 of the 116 recommended reforms in the Review Report.

The Privacy and Other Legislation Amendment Bill 2024 (Cth) (the “Bill”) introduced into Parliament on 12 September 2024 now provides a first tranche of reforms based on the agreed recommendations from the Review Report. The Bill addresses nearly 25 agreed reforms. Here is our summary of the big-ticket changes and what they might mean for you and/or your business:

Children’s privacy

The Office of the Australian Information Commissioner has been tasked with developing a Children’s Online Privacy Code within the next 2 years. This will be done in consultation with the eSafety Commissioner and National Children’s Commissioner.

The new Code will apply to providers of social media and internet services which are likely to be accessed by children. The draft Code will then be made publicly available for submissions.

Given the recent media coverage and public debate about social media accounts for minors, the arrival of a Code for the protection of children’s privacy is timely.

Overseas data flows

It is necessary for many businesses in today’s globalised world to send data overseas when contracting with international third parties. However, guidance on the privacy standards of these third parties has been lacking and Australian businesses have previously been left to determine themselves whether these third parties’ privacy measures are adequate.

The Governor-General now has the authority to designate countries with data privacy laws that are substantially similar to those in Australia. This should give businesses greater confidence in entering contracts with overseas entities, knowing that these entities are officially recognised as having comparable data privacy laws and protections.

Data breaches

The Government may now make eligible data breach declarations. Such a declaration would permit the limited sharing of personal information following a notifiable data breach, for the purpose of preventing or reducing the risk of harm to individuals.

This new power is particularly relevant in light of recent widespread and high-profile data breaches such as those at Optus and Medibank, where many consumers reported feeling left in the dark or that businesses were not taking action soon enough.

With greater information powers following a data breach, businesses and agencies should now be able to take a more efficient and coordinated approach to redressing damage.

Automated decision-making

Entities which use computer programs to make decisions based on individuals’ personal information must now update their privacy policies where such decisions are reasonably expected to significantly affect the rights or interests of an individual, or to do something substantially and directly related to making that decision.

These could be decisions that:

• Grant or withhold benefits under a law;
• Affect rights under a contract, agreement or arrangement; or
• Affect access to a significant service or support.

Examples include:

• Determining admission to education institutions e.g. uni admission
• Educational results e.g. automated marking of tests
• Security systems e.g. facial recognition
• Aptitude tests e.g. for work applications
• AI systems used to determine access and types of services to be provided to individuals e.g. healthcare, Centrelink and other government assistance eligibility
• AI systems that affect finance e.g. whether you are eligible for a loan or financial assistance based on a set of pre-determined criteria

Privacy policies should be updated to include the following:

• The kinds of personal information used in these computer programs;
• The kinds of decisions that are solely made by these programs; and
• The kinds of decisions for which the programs do something substantially and directly related to the decision.

Serious invasions of privacy

There is now finally a statutory tort for serious invasions of privacy. The cause of action will arise if:

• a party has invaded the individual’s privacy by intruding upon their seclusion or misusing information relating to them;
• the person whose privacy has been invaded would have had a reasonable expectation of privacy in the circumstances;
• the invasion of privacy was intentional or reckless; and
• the invasion of privacy was serious.

A defendant will have a defence to this tort if:

• There was a satisfactory public interest in the invasion of privacy, such that it outweighed the plaintiff’s right to privacy;
• The invasion of privacy was required or authorised by law;
• The plaintiff expressly or impliedly consented to the invasion of privacy;
• The defendant reasonably believed the invasion of privacy was necessary to prevent or less a serious threat to life, health or safety or a person;
• The invasion of privacy was incidental to the exercise of a lawful right of defence of persons or property and was proportionate, necessary and reasonable; or
• A defence to defamation applies.

Journalists, enforcement bodies, intelligence agencies (including those disclosing to intelligence agencies or using information disclosed by an intelligence agency) and persons under the age of 18 will be exempt from the tort in certain circumstances.

Courts will be empowered to grant interim injunctions to prevent further invasions of privacy.

Doxxing

The Bill also amends the Criminal Code Act 1995 (Cth) by introducing a new criminal offence of doxxing in s 474.17C.

It is now offence to use a carriage service to make available, publish or otherwise distribute information if:

• The information is personal data of one or more individuals, where personal data could include information such as:
• Name;
• Photograph or images;
• Phone numbers;
• Email addresses;
• Online accounts;
• Residential, work or business addresses;
• Places of education;
• Places of worship; and
• The person doing the doxxing engages in conduct that reasonable persons would consider, in all of the circumstances, to be menacing or harassing towards the doxxed individuals.

The new offence carries a maximum penalty of six (6) years’ imprisonment.

Section 474.17D will also make it illegal to dox someone because of their race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin.  This offence will carry a higher maximum penalty of seven (7) years’ imprisonment.  

What do I need to do next?

Depending on your business’ activities, some of these reforms may be more relevant to you than others, but we’d suggest the following as a start:

• Consider whether your business or goods and services are likely to be used by children: If so, keep an eye out for any news regarding the upcoming Children’s Online Privacy Code and familiarize yourself with pre-existing principles set out by the Office of the Australian Information Commissioner and best practice guides such as the AANA’s Children’s Advertising Code; 
• Review whether you currently contract with overseas entities and send data to these third parties: If so, make sure you are familiar with the privacy regimes applicable in these jurisdictions and keep an eye out for the Government’s updates on which countries are deemed to have similar privacy laws to ours. The EU’s GDPR is currently considered to be the gold standard in international privacy law, so many are predicting EU jurisdictions to be first on the list;
• Review your data breach obligations: Make sure you are still familiar with the data breach notification regime and if applicable to you, review and revise your post-breach plan of action.
• Determine whether automateddecision-making is used in your business: If so, consider what sorts of information is used to make those automatic decisions and which kinds of decisions are made automatically. If they are decisions of the kind described above, update your privacy policy accordingly.
• Be aware: Make sure you, both in your individual capacity and/or through your business if applicable, do not commit serious invasions of privacy or engage in doxxing!

How do I find out more?

As the above is only a short summary of all of these Tranche 1 reforms, you can find the full text of the Bill here.

At Digby Law, we’re here to help you with your privacy law matters. If you have any queries or concerns about these changes, please don’t hesitate to get in touch.

Liability limited by a scheme approved under Professional Standards Legislation.