Privacy Law set to change in early 2025  

ADIA Regulatory Update

Following a four-year review of the Privacy Act, the Privacy and Other Legislation Amendment Bill (the Bill) was tabled in the Federal Parliament on September 12, 2024.

The reforms aim to strengthen the protection of personal information and the control individuals have over their information. While some of the proposed changes haven’t made it through (mainly due to the upcoming federal election), a handful of reforms in the Bill will potentially change how we do business. 

To keep things simple, we’ve identified the three key areas that should be on business leaders radar for now:

1. New Civil Penalties and right to sue for damages

The Bill introduces new civil penalties, as well as a new statutory cause of action, for serious invasions of privacy:

A new civil penalties system – new fines (for corporate entities) have been introduced to further promote the right to privacy by strengthening the protection of the law against severe and unlawful interferences with privacy:

• A mid-tier penalty for general privacy interference, with a maximum $3 million fine.
• Infringement policies for various violations – including non-compliant privacy policies, with a maximum fine exceeding $300,000.

A statutory cause of action for serious invasions of privacy – the Bill includes a new statutory right for an individual (as opposed to a corporation) to sue in court for damages arising from serious invasions of their privacy in certain circumstances. This statutory right (called an action in ‘tort’) provides for a range of remedies, including compensation. It also imposes a cap on damages, ensures that summary (judge not jury) judgment can be issued in all jurisdictions, and ensures a role for the Information Commissioner to intervene with the leave of the court.  The proposed monetary cap on exemplary or punitive damages and damages for non-economic loss is $478,550, or the maximum amount of damages available for non-economic loss in defamation law, whichever is greater.

A ‘serious invasion of privacy’ is where a person or entity has ‘invaded’ an individual’s privacy in a manner that can be described as ‘intruding upon their seclusion (physically intruding into their space or watching or recording their activities) or misusing information that relates to that person, where that individual has a reasonable expectation of privacy in all circumstances’.

2. Security, retention and destruction of information (Australian Privacy Principle /APP 11)

The Bill will clarify that the reasonable steps required under APP 11 – include technical and organisational measures.

The ADIA Privacy Code (11.1) states – If a Research Organisation holds identifiable research information, the Research Organisation must take such steps as are reasonable in the circumstances to protect the information:

(a) from misuse, interference and loss, and

(b) from unauthorised access, modification or disclosure.

The Bill’s Explanatory Memorandum explains that technical measures may include ‘physical measures’ and software and hardware—for example, by securing access to premises, encrypting data, using anti-virus software, and using strong passwords; and organisational measures may include ‘training employees on data protection, and developing standard operating procedures and policies for securing personal information’.

This means that employers are responsible for creating a culture of continuous improvement and ensuring that staff are kept informed and aware of privacy obligations and information security procedures.

3. Automated decision making

The Bill introduces new transparency requirements for automated decision-making. The transparency requirements will apply where an APP entity (a business) has arranged for a computer program to make or do something that is substantially and directly related to making a decision using personal information and could reasonably be expected to significantly affect an individual’s rights or interests.

If a business uses automated decision-making (such as AI), its privacy policies must be transparent and include specific, detailed information about the types of personal information used and the kinds of decisions made using automated decision-making processes.

Additional changes include:

• Overseas disclosures of personal information (APP 8), which sees a binding scheme and whitelist of prescribed countries that allows the disclosure of PI without complying with the current requirements of APP 8
• The introduction of an Online Children’s Code (with the OAIC responsible for developing the new code)
• Stronger OAIC monitoring and investigative powers.

While this first tranche of reforms is unlikely to take effect until early 2025 – with a two-year transition period – ADIA recommends members remain diligent and stay updated with privacy law and our Privacy Code with regular training via the ADIA Academy.

————

On a related note, only two weeks before the Privacy Bill entered the House of Representatives, the Department of Science and Industry Resources released its new Voluntary AI Safety Standard and the ten guardrails for organisations working with AI.

Please take a look here for details.

ADIA will continue to review the privacy legislation changes and keep members updated. Should you require additional support or information, please contact Sarah Campbell, CEO and Privacy Officer, ADIA, at 0460 012 092 or Andrew Maher, Partner CIE Legal, on the member hotline at 0403 399 237.

Sources:

https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r7249

Privacy Amendment Bill: a new risk landscape | Gilbert + Tobin Lawyers: Law Firm in Sydney, Melbourne & Perth (gtlaw.com.au)

https://www.kwm.com/au/en/insights/latest-thinking/breaking-down-the-privacy-amendment-bill.html

https://www.oaic.gov.au