Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022


Bills Digest No. 30, 2022–23

PDF Version [565KB]

Bernie Lai
Foreign Affairs, Defence and Security Section
4 November 2022

Key points

  • The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 increases penalties for serious or repeated interferences with privacy under the Privacy Act 1988.
  • The Bill falls short of amending the ‘serious or repeated interference with privacy’ threshold that triggers the civil penalty provision in section 13G of the Privacy Act, as proposed by submitters to the Privacy Act review.
  • For the increased penalty regime to have a real and sufficient deterrent effect, it will need to be matched by further reforms to the Privacy Act and adequate funding for the under‑resourced Office of the Australian Information Commissioner.
  • The Bill provides the Australian Information Commissioner with greater enforcement and information sharing powers under the Privacy Act and the Australian Information Commissioner Act 2010.
  • Stakeholders, especially entities covered by the Privacy Act, have expressed concerns about the proposed enforcement and information sharing powers of the Commissioner.

Contents

The Bills Digest at a glance
Purpose of the Bill
Background
Committee consideration
Policy position of non-government parties/independents
Position of major interest groups
Financial implications
Statement of Compatibility with Human Rights
Key issues and provisions

 

Date introduced: 26 October 2022
House: House of Representatives
Portfolio: Attorney-General
Commencement: The day after Royal Assent

Links: The links to the Bill, its Explanatory Memorandum and second reading speech can be found on the Bill’s home page, or through the Australian Parliament website.

When Bills have been passed and have received Royal Assent, they become Acts, which can be found at the Federal Register of Legislation website.

All hyperlinks in this Bills Digest are correct as at November 2022.

 

The Bills Digest at a glance

Purpose

The purpose of the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (the Bill) is to:

Background

Recent data breaches, especially the Optus data breach, affecting numerous Australians have prompted a series of immediate actions by the Australian Government, including the introduction of the Bill.

The Bill is a result of the Australian Government expediting some aspects of the ongoing Privacy Act review conducted by the Attorney-General’s Department. The Bill also includes provisions similar to various elements of the Exposure Draft of the Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021 (Online Privacy Bill Exposure Draft) released for discussion and consultation by the previous Government.

Key issues and provisions

  • The Bill increases the maximum civil penalty for serious or repeated interferences with privacy from the current $2.22 million to an amount that is the greater of $50 million, three times the value of any benefit obtained from the conduct constituting the serious or repeated interference with privacy, or 30% of an entity’s adjusted turnover in the relevant period.
  • The Bill falls short of amending the ‘serious or repeated interference with privacy’ threshold that triggers the civil penalty provision in section 13G of the Privacy Act, as proposed by submitters to the Privacy Act review.
  • For the increased penalty regime to have a real and sufficient deterrent effect, it cannot rely solely on the perceived deterrent effect of the penalty quantum. It will need to be matched by further reforms to the broader enforcement framework for interferences with privacy under the Privacy Act. The Office of the Australian Information Commissioner’s (OAIC) privacy functions relevant to proactive investigation and enforcement activity will also need to be adequately resourced.
  • The Bill lowers the threshold for a foreign organisation to be covered by the Privacy Act.
  • The Bill provides enhanced enforcement and information sharing powers for the Commissioner and the OAIC, which may attract opposition from regulated entities who have expressed concerns on largely similar amendments in the Online Privacy Bill Exposure Draft.

Purpose of the Bill

The purpose of the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (the Bill) is to:

Background

Recent data breaches

September–October 2022 saw various high-profile and large-scale data breaches affecting Australia. Data breaches involving Optus, Medibank Private, MyDeal and others have resulted in the personal information about millions of Australians being compromised. These data breaches may have direct and long-lasting impacts on affected Australians, including financial harm through identity theft or fraud, psychological harm and reputational harm.

The recent Optus data breach has been singled out as the largest data breach in Australia’s history due to the sheer number of affected Australians and the extensive kinds of personal information involved.[2] With nearly 10 million affected Australian customers,[3] Optus has advised that the data breach may have exposed its ‘customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver’s licence or passport numbers’, as well as Medicare card numbers for a subset of customers.[4]

The Optus data breach has prompted a series of immediate actions by the Australian Government, including:

Privacy Act review

In light of the Optus data breach, Attorney-General Mark Dreyfus has criticised the ‘very outdated piece of legislation in the Privacy Act’ and undertaken to have the ongoing review of the Privacy Act finalised by his department by the end of 2022.[7]

In December 2019, the Morrison Government announced that it would conduct a review of the Privacy Act as part of its response to the Australian Competition and Consumer Commission’s (ACCC) Digital Platforms Inquiry.[8] The Privacy Act review was opened for public consultation and submissions on its issues paper published in October 2020 and discussion paper published in October 2021.

The review covers areas including:

  • the scope and application of the Privacy Act
  • whether the Privacy Act effectively protects personal information and provides a practical and proportionate framework for promoting good privacy practices
  • whether individuals should have direct rights of action to enforce privacy obligations under the Privacy Act
  • whether a statutory tort for serious invasions of privacy should be introduced into Australian law
  • the impact of the Notifiable Data Breaches (NDB) scheme and its effectiveness in meeting its objectives
  • the effectiveness of enforcement powers and mechanisms under the Privacy Act and how they interact with other Commonwealth regulatory frameworks
  • the desirability and feasibility of an independent certification scheme to monitor and demonstrate compliance with Australian privacy laws.[9]

Despite the progress of the review, on 12 October 2022, Attorney-General Mark Dreyfus stated that the Government was considering expediting ‘some urgent reforms that [they] can make quickly to the Privacy Act’ in response to the Optus data breach. The result of this expedition is the present Bill. According to the Attorney-General, the Bill is ‘in addition to’ the Privacy Act review ‘with recommendations expected for further reform’.[10]

Online Privacy Bill Exposure Draft

The Morrison Government also announced a parallel reform separate to the Privacy Act review – the proposed introduction of the Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021 (Online Privacy Bill). The Online Privacy Bill aimed to address the pressing privacy challenges posed by social media and other online platforms.

In October 2021, the Attorney-General’s Department (AGD) released an Exposure Draft of, an explanatory paper to and a regulatory impact statement on the Online Privacy Bill for public consultation (which was closed in December 2021). However, the Online Privacy Bill was never formally introduced by the Morrison Government during the 46th Parliament. This Bill contains various elements of the Online Privacy Bill, as discussed below.

Committee consideration

Senate Legal and Constitutional Affairs Committee

The Bill has been referred to the Senate Legal and Constitutional Affairs Committee for inquiry and report by 22 November 2022.

Senate Standing Committee for the Scrutiny of Bills

At the time of writing, the Senate Standing Committee for the Scrutiny of Bills had not reported on the Bill.

Policy position of non-government parties/independents

The Australian Greens described the Bill as ‘a step forward’ but expressed its concern that ‘[i]t’s not much use beefing up the Information Commissioner’s powers if they don’t get matching funding so they can actually use those powers.’[11]

At the time of writing, other non-government parties and the independents do not appear to have commented publicly on the Bill.

Position of major interest groups

Major interest groups, especially entities covered by the Privacy Act, have previously provided submissions on the Online Privacy Bill Exposure Draft, which, as already noted, contained some amendments that are equivalent to those in the present Bill. The proposed amendments relating to the Commissioner’s enforcement and information gathering powers in the Exposure Draft were met with opposition from some of those entities, as discussed below.

Financial implications

The Explanatory Memorandum to the Bill states that the Bill may increase Commonwealth revenue due to increased penalties, depending on the number and quantum of successful civil penalty orders sought by the Commissioner.[12]

Statement of Compatibility with Human Rights

As required under Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011, the Government has assessed the Bill’s compatibility with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of that Act. The Government considers that the Bill is compatible.[13]

Parliamentary Joint Committee on Human Rights

At the time of writing, the Parliamentary Joint Committee on Human Rights has not reported on the Bill.

Key issues and provisions

Increased penalties for serious and repeated interferences with privacy

Currently section 13G of the Privacy Act gives rise to a civil penalty if:

  • an entity does an act, or engages in a practice, that is a serious interference with the privacy of an individual
  • an entity repeatedly does an act, or engages in a practice, that is an interference with the privacy of one or more individuals.

Item 14 of the Bill inserts proposed subsection 13G(3) into the Privacy Act to set out the penalty for a serious or repeated interference with privacy by a body corporate. This increases the maximum civil penalty from 10,000 penalty units, which currently equate to $2.22 million,[14] to an amount that is the greater of:

  • $50 million (proposed paragraph 13G(3)(a))
  • 3 times the value of the benefit the body corporate and any related body corporate obtained from the conduct constituting the serious or repeated interference with privacy if the court can determine this value (proposed paragraph 13G(3)(b))
  • 30% of the adjusted turnover of the body corporate during the breach turnover period for the contravention if the court cannot determine the value of the benefit under paragraph 13G(3)(b) (proposed paragraph 13G(3)(c)).[15]

Proposed subsection 13G(2) of the Privacy Act sets out the penalty for a serious or repeated interference with privacy by a person other than a body corporate (such as a sole trader or a partnership). This increases the penalty from a maximum of 2,000 penalty units, which currently equate to $444,000, to a maximum of $2.5 million.

The ‘serious or repeated interference with privacy’ threshold

An ‘interference with privacy’ is defined in section 13 of the Privacy Act, and is a breach of the Privacy Act or of a privacy-related provision in certain other legislation. However, the phrases ‘serious interference with privacy’ and ‘repeated interference with privacy’ are not defined in the Privacy Act and there have been no decided cases under this provision. At the time of introduction of these terms, the relevant Explanatory Memorandum stated that the ordinary meaning of the terms ‘serious’ and ‘repeated’ would apply.[16] The Bill does not propose any change to this threshold.

In its Guide to privacy regulatory action, which is merely an administrative guidance, the OAIC states that the question of whether an interference with privacy is serious is an objective one that will reflect the opinion of a reasonable person.[17] It provides a list of factors that it considers ‘are relevant in considering whether a particular interference with privacy is serious’:

  • the number of individuals potentially affected
  • whether it involved ‘sensitive information’ or other information of a sensitive nature
  • whether significant adverse consequences were caused or are likely to be caused to one or more individuals from the interference
  • whether vulnerable or disadvantaged people may have been or may be particularly adversely affected or targeted
  • whether it involved deliberate or reckless conduct
  • whether senior or experienced personnel were responsible for the conduct.[18]

The OAIC also administratively defines ‘repeated interference with privacy’ to mean that an entity has interfered with the privacy of an individual or individuals on two or more separate occasions, which could arise from:

  • the same act or practice done on two or more occasions
  • different acts or practices done on two or more occasions.[19]

A proposal in the ongoing Privacy Act review is to clarify what constitutes a ‘serious’ or ‘repeated’ interference with privacy. In its October 2021 Privacy Act review – discussion paper, AGD acknowledges that there could be a benefit in more clearly identifying the type of conduct captured by the ‘serious or repeated interference with privacy’, which is that it would increase clarity for the OAIC, APP entities (regulated by the Privacy Act) and the courts.[20]

In its submission to the Privacy Act review – discussion paper, the OAIC supports the proposal to clarify the phrase, but recommends removing the ‘repeated’ threshold. This is because the OAIC considers that ‘a repeated act or practice that interferes with the privacy of individuals would fall within the natural meaning of a “serious” privacy incident, rather than existing as a separate legal construct’.[21] Nevertheless, the OAIC indicates that it supports the proposal to clarify the ‘serious or repeated interference with privacy’ threshold only if its preferred recommendation of repealing the threshold altogether, as discussed below, is not adopted.[22]

It is unclear if the Government has made a conscious decision against clarifying those terms in the Bill or decided to defer settling on this proposed amendment issue when the ongoing review of the Privacy Act is completed. Either way, the Bill appears a missed opportunity for those terms to be afforded the legislative clarity that it is said to need.

Comparison with other existing or proposed penalty regimes

The proposed maximum penalties in this Bill are identical to those proposed under the Australian Consumer Law (ACL) in the Treasury Laws Amendment (More Competition, Better Prices) Bill 2022, which had passed both Houses by 27 October 2022.[23] In this way, the Government has adopted Recommendation 16(f) in the ACCC’s July 2019 Digital Platforms Inquiry – final report that the maximum penalties for serious or repeated interferences of privacy under the Privacy Act be increased to mirror the penalties for breaches of the ACL to achieve effective deterrence.[24]

The proposed maximum penalties in the Bill exceed what was proposed in the Online Privacy Bill Exposure Draft for privacy breaches by social media services, data brokerage services and large online platforms: $10 million, three times the value of any benefit obtained from the conduct constituting the serious or repeated interference with privacy, 10% of an entity’s annual Australian turnover.[25]

In terms of comparisons with equivalent legislation in overseas jurisdictions, the proposed maximum penalty of $50 million in the Bill is significantly higher than the maximum penalty of $20 million EURO (approximately $31 million AUD) under the European Union General Data Protection Regulation (GDPR).[26] However, the proposed penalty of 30% of a body corporate’s annual Australian turnover in the Bill may not be directly comparable with the penalty of 4% of an entity’s global annual turnover under the GDPR.

How would the strengthened penalty regime protect Australians’ information privacy?

Before introducing the Bill, Attorney-General Mark Dreyfus pointed out that the reputational harm suffered by entities from data breaches ‘clearly isn’t enough’.[27] In his second reading speech on the Bill, he was unequivocal that tougher penalties were intended to have deterrent effects to incentivise entities to have stronger safeguards to protect Australians’ personal information:

… This bill sends a clear message that the Albanese government takes privacy, security and data protection seriously.

As the Optus, Medibank and MyDeal cyberattacks have recently highlighted, data breaches have the potential to cause serious financial and emotional harm to Australians, and this is unacceptable.

Governments, businesses and other organisations have an obligation to protect Australians’ personal data, not to treat it as a commercial asset. The law must reflect this.

…

Increased penalties …

Setting these penalties at a higher level will accord with Australian community expectations about the importance of protecting their personal data.

Further, penalties for privacy breaches cannot be seen as simply the cost of doing business. Entities must be incentivised to have strong cyber and data security safeguards in place to protect Australians …[28]

Emphasis on the consequences of data breaches

The stated purpose of the increased penalty regime focuses on the consequences for an entity’s failure to protect personal information it holds from unauthorised access, as regulated by Australian Privacy Principle (APP) 11.1 of Schedule 1 to the Privacy Act.[29] It would unlikely address the root-cause issues of potential over-collection of personal information (APP 3) at one of the earliest stages of the information lifecycle and of data retention (APP 11.2). The Optus data breach has raised a question about whether it is reasonably necessary for a telecommunication company to collect information relating to a customer’s identification documents into its record after their identity has been verified. It has also raised the issue of whether a telecommunication company needs to retain or destroy a customer’s personal information once it is no longer needed for the purpose for which it was collected (for example, in the case of former customers).

These issues point to the data minimisation principle advocated by Australia’s privacy regulators and ombudsmen that ‘the collection of personal information … should always be limited to the minimum information reasonably necessary to achieve a legitimate purpose’.[30] An obvious benefit of data minimisation is that the fewer data are collected, the fewer data will be subject to unauthorised access in the event of a data breach. However, an entity’s efforts to actualise this ideal privacy practice are often limited by their statutory obligations to collect and retain personal information for national security and crime prevention reasons.

For example, the Telecommunications (Interception and Access) Act 1979 requires a telecommunication company to collect and retain various kinds of personal information about a customer, including their contact information and ‘information for identification purposes’ – even beyond their time as a customer.[31] Such a legislative requirement absolves the company of its normal obligation under APP 11.2 to take reasonable steps to destroy or de-identify the customer’s relevant personal information that it no longer needs for any purpose for which the personal information may be used or disclosed under the APPs.[32]

Therefore, the increased penalty regime may be seen as a band-aid solution that would not directly address the root-cause issues of over-collection and data retention underlying the Optus data breach. These issues will likely persist without appropriate reforms to relevant data retention legislation in addition to imminent reforms to the Privacy Act, including the proposed introduction of a right to erasure of personal information.[33] Any reforms to relevant data retention legislation will need to involve striking a delicate balance between safeguarding Australia’s national security and protecting Australians’ information privacy.

Deterrent effect of the increased penalties

The Government appears hopeful that the quantum of the increased penalties will have a general deterrent effect for entities that have obligations to protect Australians’ personal information from data breaches under the Privacy Act. However, the OAIC’s very limited track record of using the existing penalty regime as a regulatory tool to date may cast doubt on whether the intended deterrent effect can be achieved. Since section 13G of the Privacy Act (the civil penalty provision for serious or repeated interferences with privacy) commenced in March 2014,[34] the OAIC’s litigation against Facebook Inc and Facebook Ireland currently before the Federal Court of Australia (which concerns the Facebook–Cambridge Analytica data scandal that occurred in the 2010s) is the first and only instance of civil penalty proceedings by the OAIC.

Indeed, the current process of having a civil penalty order imposed on an entity can be lengthy and complex. The Commissioner does not have power under the Privacy Act to directly impose a penalty on a regulated entity. Rather, it must apply to the Federal Court of Australia or the Federal Circuit and Family Court of Australia for a civil penalty order against an entity for a serious or repeated interference with privacy.[35] The OAIC has expressed criticism of the current provision, arguing that the ‘serious’ and ‘repeated’ thresholds in section 13G – which the Commissioner must demonstrate before civil penalty orders can be made by the courts – are ‘unnecessary’ because:

these factors are more appropriate considerations after breach has been established when the Federal Court determines civil penalties using well-established legal principles. The nature and extent of any contravention is also explicitly required for consideration under s 82(6) of the Regulatory Powers (Standard Provisions) Act 2014 (Cth) (Regulatory Powers Act) when determining pecuniary penalties. Requiring the Commissioner to adduce evidence of these matters to demonstrate a breach of s 13G creates unnecessary duplication which may not be an efficient use of public resources

…

[Section 13G] imposes legal concepts of seriousness and repeated conduct that distract from the proper focus on whether the Privacy Act itself has been breached. These concepts are more appropriately addressed after a breach has been established when determining pecuniary penalties.[36]

In response to the Privacy Act review – discussion paper, the OAIC recommended that section 13G (and, therefore, the ‘serious’ and ‘repeated’ thresholds) be repealed and a single civil penalty provision for any interferences with privacy (rather than only the serious and repeated ones) be introduced to create a simpler civil penalty framework.[37] It also recommended the creation of a series of low-level civil penalty provisions under certain APPs for administrative breaches of the APPs with attached infringement notice powers for the Commissioner.[38]

Further, the OAIC’s longstanding resourcing constraints amid its growing workloads may have also contributed to its very limited track record of using the existing civil penalty regime as a regulatory tool.[39] As acknowledged by the OAIC, the contemporary approach to regulation expected by Australians is that government regulators use the full range of compliance and enforcement tools available in the law.[40] The OAIC’s FOI disclosure log indicates that following the 2022 Federal Election in June 2022, Angelene Falk, Australian Information Commissioner and Privacy Commissioner, provided Attorney-General Mark Dreyfus a brief titled Overview of OAIC strategic priorities.[41] In the brief, before noting the ‘[s]ignificant funding pressure’ faced by her office, Commissioner Falk, stated:

The complexity of personal information flows in the digital economy and the significant information asymmetry between digital platforms and individuals necessitates less reliance on the traditional individual complaint-based mechanisms for addressing privacy risks and harms, requiring increased proactive investigation and enforcement activity … The changed enforcement posture and focus on global, digital and significant privacy risks and harms is more expensive than the traditional complaint-handling dispute resolution approach of the office …[42]

However, any shift in the OAIC’s regulatory posture from its historical focus on resolving privacy complaints to more use of regulatory ‘sticks’ would also need to be reflected in future funding arrangements for the national privacy regulator. In the Budget October 2022–23, the OAIC has been allocated $5.5 million over 2 years from 2022–23 to support its response to the Optus incident.[43] In the Budget March 2022–23, the OAIC was allocated $8.71 million in 2022–23 and $8.24 million in 2023–24 to process privacy complaints and enhance its capacity to take regulatory action for breaches of privacy, such as litigation against social media platforms. These funding allocations from March 2022 have also been confirmed.[44] However, it remains to be seen whether these budget measures will be adequate to meet the OAIC’s existing workload and the expanding scope of the OAIC’s jurisdiction proposed by the Bill and envisaged in the ongoing Privacy Act review.

Therefore, for the increased penalty regime to have a real and sufficient deterrent effect, it cannot rely solely on the perceived deterrent effect of the penalty quantum. The increased penalty regime will need to be matched by further reforms to the broader enforcement framework for interferences with privacy under the Privacy Act. The OAIC’s privacy functions relevant to proactive investigation and enforcement activity, as enhanced by the greater enforcement powers proposed in the Bill, will also need to be adequately resourced for the OAIC to be an agile regulator taken seriously by the regulated.

Enhanced enforcement powers for the OAIC

Expanded extra-territorial jurisdiction of the Privacy Act

Currently, the Privacy Act has extra-territorial reach to any foreign organisation that has an ‘Australian link’, which is enlivened by satisfying two criteria:

  • The organisation carries on business in Australia or an external Territory (existing paragraph 5B(3)(b)).
  • The organisation collected or held personal information in Australia or an external Territory, either before or at the time of the act or practice (existing paragraph 5B(3)(c)).

Item 10 of the Bill repeals existing paragraph 5B(3)(c), which would leave ‘carrying on business’ in existing paragraph 5B(3)(b) effectively the only requirement for a foreign organisation to have an Australian link.

The Explanatory Memorandum to the Bill provides the rationale behind this proposed amendment:

  1. Currently, foreign organisations must meet obligations under the Privacy Act if the entity has an Australian link. A foreign organisation will have an Australian link if the organisation or operator carries on business in Australia and collects or holds information from a source inside Australia. However, when a breach of the Privacy Act occurs, it may be difficult to establish that these foreign organisations collect or hold personal information from a source in Australia. For example, foreign organisations may collect personal information about Australians but do not collect Australians’ information directly from Australia, and instead collect the information from a digital platform that does not have servers in Australia and may therefore not be considered ‘in Australia’.
  2. The purpose of this item is to update the provision to reflect that in the digital era, organisations can use technology such that they do not collect or store information directly from Australia. However, these organisations will often still otherwise be carrying on a business in Australia, and should be required to meet the obligations under the Privacy Act.
  3. This mirrors similar provisions in the Australian Consumer Law (ACL). Subsection 5(1) of the Competition and Consumer Act 2010 extends the application of the relevant ACL provisions to conduct by Australian incorporated bodies or those carrying on business in Australia, and Australian citizens or people ordinarily resident within Australia.[45]

Further, the second reading speech on the Bill provides that this proposed amendment aims ‘[t]o ensure Australia’s privacy laws remain fit for purpose in a globalised world and to ensure the Privacy Act can be enforced against global technology companies who may process Australians’ information on servers offshore’.[46]

The proposed amendment may have come amid the OAIC’s ongoing litigation against Facebook Inc and Facebook Ireland before the Federal Court of Australia, which has raised issues about the extra-territorial provisions of the Privacy Act. One of these issues concerns whether Facebook Inc was collecting or holding in Australia the personal information that is the subject of the claim. The Full Court of the Federal Court of Australia upheld the primary judge’s conclusion (which had been disputed by Facebook Inc) that an inference was open that Facebook Inc collected relevant personal information in Australia by means of cookies which it installed on the devices of Australian users.[47]

This proposed amendment is identical to an amendment in the Online Privacy Bill Exposure Draft.[48] Given its own legal battles in relation to the extra-territoriality of the Privacy Act, it is relevant to note Meta’s (formerly Facebook Inc) concerns about the proposed lower threshold of the ‘Australian link’ test (in response to the Online Privacy Bill Exposure Draft):

… [T]he proposed change to the “Australian link” test means that any foreign corporation that carries on business in Australia will be bound to comply with the Australian Privacy Act even in relation to personal information that they collect from individuals who are not in Australia.

For example, if a US corporation carries on business in Australia through providing services to Australian end users, then the updated “Australian link” test would mean that the Privacy Act would also apply to that corporation’s handling of information about users in the US or in any other jurisdiction where that corporation makes its services available. This appears to be an unintentional consequence of the proposed drafting changes. In principle, we see no reason for Australian laws to seek to regulate management of personal information that has no direct connection with Australia or with Australians.[49]

Law firm, Herbert Smith Freehills, also observed that as ‘a (presumably unintentional) consequence of the proposed drafting change’, the reduced threshold in the present Bill could be interpreted as that:

foreign companies carrying on business in Australia would be subject to the Act even in respect of their activities that do not relate to their business in Australia, or to Australian individuals. We note that the EU’s General Data Protection Regulation includes extra-territoriality tests based on individuals in the EU, and the California Consumer Privacy Act includes a test based on Californian residents.[50]

In its submission to the Online Privacy Bill Exposure Draft, Communications Alliance noted a similar concern but suggested that:

If the concern is that an organisation may indirectly collect or hold information that is derived from another source within Australia that directly collects or holds the information, section 5B could be amended to bring such indirect collection and holding within the definition. Otherwise, the change would create broad, uncertain and unconstrained extraterritoriality that is not consistent with good legislative practice and comity between national laws.[51]

Strengthened Notifiable Data Breaches scheme

More detailed notification to the Commissioner

Under the NDB scheme of Part IIIC of the Privacy Act, any organisation or agency covered by that Act must notify the OAIC and take reasonable steps to notify affected individuals when a data breach is likely to result in serious harm to the affected individuals (which is known as an ‘eligible data breach’).

If an entity is aware that there are reasonable grounds to believe that there has been an eligible data breach of the entity, one of its notification obligations under the NDB scheme is to prepare a statement for the Commissioner under section 26WK of the Privacy Act (before notifying the contents of this statement to affected individuals under section 26WL). One of the pieces of information that must be included in that statement is ‘the kind or kinds of information concerned’ in the eligible data breach (paragraph 26WK(3)(c)).

Item 17 of the Bill amends paragraph 26WK(3)(c) of the Privacy Act such that a reporting entity must include information about the particular kind(s) of personal information involved in an eligible data breach, as opposed to just the kind(s) of personal information.

In practice, this may mean, for example, instead of notifying that ‘contact information’ has been involved in an eligible data breach (which is one of the ‘categories’ of personal information in the OAIC’s online Notifiable data breach form), the reporting entity must state the specific kinds of contact information (which may be, for example, home address, phone number or email address).

The Explanatory Memorandum to the Bill states that this proposed amendment:

… is necessary to ensure the Commissioner has a comprehensive knowledge of the information compromised in an eligible data breach in order to assess the particular risk of harm to individuals, and whether the recommendations about the steps that individuals should take in response to the eligible data breach outlined in a notification are sufficient.[52]

This proposed amendment would ultimately benefit affected individuals, as a reporting entity also has an obligation to take reasonable steps to notify the contents of the section 26WK statement (which has been provided to the Commissioner) to the affected individuals under section 26WL.

New information gathering powers relating to eligible data breaches

Currently, information available to the Commissioner and their office about an eligible data breach under the NDB scheme is limited to information that an entity voluntarily discloses in its section 26WK statement. To obtain more detailed information about the data breach, the Commissioner or their delegates may make preliminary inquiries to the entity or a third party under subsection 42(2) of the Privacy Act. However, there appears to be no obligations for the entity or the third party to respond to or cooperate with those preliminary inquiries. It is only after the Commissioner has opened a formal investigation against the entity under subsection 40(2) that the Commissioner’s information gathering power under subsection 44(1) may be enlivened.

Proposed section 26WU of the Bill (inserted by item 18 of the Bill) addresses this gap. It provides the Commissioner with a power to require a person or an entity by written notice to give information, produce a document or answer questions of kind specified in the notice (proposed subsection 26WU(3)) if the Commissioner has reason to believe that they have information or documents, or can answer questions, that are relevant to either or both of the following matters (the relevant matters):

  • an actual or suspected eligible data breach of an entity (proposed paragraph 26WU(1)(a))
  • an entity’s compliance with the requirements in Part IIIC, Division 3 (proposed paragraph 26WU(1)(b)).

Proposed subsection 26WU(2) provides a non-exhaustive list of factors that the Commissioner may consider to be the relevant matters.

Proposed subsection 26WU(4) provides that in a subsection 26WU(3) notice, the Commissioner must state the place and time which the information, document or answers must be provided.

Proposed subsection 26WU(5) outlines how the Commissioner may or must handle documents produced in response to the subsection 26WU(3) notice.

Proposed subsection 26WU(6) provides that the Commissioner must not exercise their power under proposed section 26WU where the Attorney-General has furnished to the Commissioner a certificate under section 70 certifying that the giving to the Commissioner of information concerning a specified matter, or the production to the Commissioner of a specified document or other record, would be contrary to the public interest.

Proposed subsection 26WU(7) ensures that a person or entity is not liable to a penalty under the provisions of any other Commonwealth law because they have given information, produced a document or answered a question to comply with a subsection 26WU(3) notice.

New powers to conduct assessments on compliance with the NBD scheme

Under section 33C of the Privacy Act, the Commissioner currently has a power to conduct an assessment of an entity’s compliance relating to various aspects of the Act, even in the absence of a breach of the Act or a privacy complaint having been made.[53] However, the Commissioner does not have a power to assess an entity’s compliance with the NDB scheme.

Proposed subparagraph 33C(1)(ca) (inserted by item 21 of the Bill) addresses this gap and provides the Commissioner a new power to conduct an assessment of an entity’s ability to comply with the NDB scheme in Part IIIC of the Privacy Act. This proposed amendment has adopted a similar amendment in the Online Privacy Bill Exposure Draft.[54]

Proposed paragraphs 33C(3)–(8) (inserted by item 22 of the Bill) provides information gathering powers and limitations on those powers similar to those in proposed sections 26WU discussed above.

New infringement notice powers to penalise failure to provide information

Item 38 of the Bill repeals the criminal penalty in existing subsection 66(1) of the Privacy Act and substitutes it with a civil penalty for a basic contravention which arises where a person is required to give information, answer a question, or produce a document or record under the Act, and refuses or fails to do so (for example, under proposed subsection 26WU(3), proposed paragraph 33C(3) or existing subsection 44(1) discussed above). The penalty is 60 penalty units for a person and 300 penalty units for a body corporate.

Item 44 of the Bill inserts proposed section 80UB. This allows the Commissioner or an SES employee of the OAIC (or equivalent) as an ‘infringement officer’ (pursuant to Part 5 of the Regulatory Powers (Standard Provisions) Act 2014) to issue an infringement notice instead of seeking a civil penalty for contraventions of proposed subsection 66(1).

The Explanatory Memorandum to the Bill posits that:

… Infringement notices will provide the Commissioner with a timely, cost-efficient enforcement outcome in relation to minor contraventions of section 66. The infringement notice provision will provide an alternative to litigation of a civil matter. This will enable the Commissioner to resolve privacy complaints and investigations more efficiently.[55]

Further, item 39 of the Bill inserts proposed subsection 66(1AA) to the Privacy Act. This creates a new offence for a corporation of engaging in conduct that constitutes a system of conduct or a pattern of behaviour that results in two or more contraventions of proposed subsection 66(1). This would enable the OAIC to refer matters to the Commonwealth Director of Public Prosecutions for more serious and systemic conduct of failing to provide information.[56] However, items 40 and 41 of the Bill amend subsection 66(1B) of the Privacy Act so that proposed subsection 66(1AA) is subject to the ‘reasonable excuse’ safeguard in existing subsection 66(1B).

These proposed new infringement notice powers to penalise failure to provide information also adopt similar amendments in the Online Privacy Bill Exposure Draft.[57]

Enhanced information sharing powers for the Commissioner

Power to share information with authorities

Proposed section 33A of the Privacy Act (inserted by item 20 of the Bill) provides the Commissioner the power to share information or documents with a receiving body for the purpose of the Commissioner or the receiving body exercising powers, or performing functions or duties (proposed subsection 33A(1)). The Explanatory Memorandum states that proposed section 33A is an authorisation by law for the purposes of APP 6.2(b).

Proposed subsection 33A(2) states that a receiving body may be:

  • an enforcement body (as defined in subsection 6(1))
  • an alternative complaint body (as defined in subsection 50(1))
  • a state or territory authority (as defined in subsection 6C(1)) or an authority of the government of a foreign country that has privacy functions.

Proposed subsection 33A(3) provides that the Commissioner may only share information or documents with a receiving body if:

  • the information or documents were acquired by the Commissioner in the course of exercising powers, or performing functions or duties under the Privacy Act and
  • the Commissioner is satisfied on reasonable grounds that the receiving body has satisfactory arrangements in place for protecting the information or documents.

Proposed subsection 33A(4) provides that if the Commissioner acquired the information or documents from an Australian Government agency (as defined in subsection 6(1)), the Commissioner may only share the information or documents with a receiving body that is also an Australian Government agency (and not a state or territory authority, or foreign body).

Proposed subsection 33A(5) provides that a receiving body may only use the information for the purposes for which it was shared.

Proposed subsection 33A(6) clarifies that the Commissioner is not required to transfer a complaint or part of a complaint to share information or documents with a receiving body.

These proposed amendments are in similar terms to those in the Online Privacy Bill Exposure Draft, although the present Bill inserts an additional safeguard that a receiving body may only use the information for the purposes for which it was shared (proposed subsection 33A(5)).[58]

In response to the Online Privacy Bill Exposure Draft (but not the present Bill), the Law Council of Australia raised concern that the Commissioner’s new information sharing power under proposed subsection 33A(1) of that Bill (which is identical to proposed subsection 33A(1) of the present Bill) may be too broad when used in conjunction with:

  • the Commissioner’s current power under existing section 33C of the Privacy Act to assess an entity’s compliance with certain parts of the Act in the absence of any breach of the Act or any complaint having been made
  • the Commissioner’s new information gathering power to issue a notice to produce information or a document relevant to an assessment under proposed paragraph 33C(3) of the Privacy Act (in the Online Privacy Bill).[59]

The Law Council of Australia’s concern appears to be centred on the prospect that information or documents which an entity is compelled to produce to the Information Commissioner (when exercising a compulsory information-gathering power) could then be disclosed by the Information Commissioner under proposed subsection 33A(1) of the Online Privacy Bill Exposure Draft (which is identical to proposed subsection 33A(1) of the present Bill) to a receiving body – even without the entity’s knowledge or consent, or having to consult the entity.

Further, it is unclear how the safeguard in proposed subsection 33A(5) of the present Bill, which requires that ‘a receiving body may only use the information for the purposes for which it was shared’ would have any practical significance in relation to a receiving body that is ‘an authority of the government of a foreign country that has privacy functions’ (proposed subparagraph 33A(2)(c)). For example, the Commissioner might be ‘satisfised on reasonable grounds’ that a foreign privacy regulator ‘has satisfactory arrangements in place for protecting the information or documents’ shared’ (proposed subparagraph 33A(3)(b)) before sharing the information or documents. However, once the information or documents is/are shared, the ‘safeguard’ in proposed subsection 33A(5) may not be operative if the foreign privacy regulator then proceeds to disclose or is compelled to disclose the information or documents to other government or law enforcement bodies in its jurisdiction for any secondary purposes (under the laws of its own jurisdiction or otherwise).

Powers to disclose certain information if in the public interest

Proposed subsection 33B(1) sets out the Commissioner’s power to disclose certain information acquired in the course of the Commissioner exercising powers or performing functions or duties under the Privacy Act if the Commissioner is satisfied the disclosure is in the public interest. The Explanatory Memorandum to the Bill provides that:

The purpose of subsection 33B(1) is to empower the Commissioner to disclose or publish information relating to privacy and personal information, for example information about an ongoing investigation on the OAIC’s website. This will ensure Australians are informed about privacy issues and to reassure the community that the OAIC is discharging its duties. Section 33B is an authorisation by law for the purposes of APP 6.2(b).

Proposed paragraph 33B(2)(a) sets out a list of public interest considerations that the Commissioner must consider before exercising their discretion under proposed subsection 33B(1):

  • the rights and interests of any complainant or respondent
  • whether the disclosure will or is likely to prejudice any investigation the Commissioner is undertaking
  • whether the disclosure will or is likely to disclose the personal information of any person
  • whether the disclosure will or is likely to disclose any confidential commercial information
  • whether the Commissioner reasonably believes that the disclosure would be likely to prejudice one or more enforcement related activities conducted by or on behalf of an enforcement body.

Proposed paragraph 33B(2)(b) sets out that the Commissioner may also have regard to any other matter the Commissioner considers relevant when determining if a disclosure is in the public interest.

Proposed subsection 33B(3) clarifies that section 33B does not limit the Commissioner’s other powers under the Privacy Act or any other Commonwealth laws to disclose information.

These proposed amendments adopt similar amendments in the Online Privacy Bill Exposure Draft, although that Bill proposes a general prohibition (with a few exceptions) on the Commissioner disclosing information about an eligible data breach.[60] However, that prohibition is not contained in the present Bill, which is likely a result of the recent high-profile data breaches. As the Explanatory Memorandum notes:

The purpose of subsection 33B(1) is to empower the Commissioner to disclose or publish information relating to privacy and personal information, for example information about an ongoing investigation on the OAIC’s website. This will ensure Australians are informed about privacy issues and to reassure the community that the OAIC is discharging its duties.[61]

The Commissioner’s proposed power to publish information about privacy issues or data breaches would likely be met with opposition from the regulated entity for reasons related to reputation and confidentiality. Speaking from the perspective as an entity that may be covered the Privacy Act in response to similar amendments in the Online Privacy Bill Exposure Draft, Meta noted:

We suggest that before exercising the right to share information in the public interest, the Information Commissioner should consult with any potentially affected parties and allow them to make submissions as to why all or some of the information should not be disclosed and to seek review of the Information Commissioner’s decision if necessary. Without this type of protection it will be much harder for regulated entities to be comfortable sharing information with the Information Commissioner on a voluntary basis, as there would be a heightened underlying risk of that information being shared outside an entity’s control.[62]

Both the Business Council of Australia and the Communications Alliance expressed concerns that information published by the Commissioner might include information supplied by regulated entities that is contestable in terms of accuracy, completeness or relevance. They recommended the similar proposed subsection 33B in the Online Privacy Bill Exposure Draft be amended to include a requirement for prior consultation with the person or entity that provided the relevant information or to whom the information relates, among other things.[63]

Enhanced determination powers for the Commissioner

Under the Privacy Act, the Commissioner has the power to make a determination after investigating a complaint, to dismiss the complaint or find that the complaint is substantiated (existing subsection 52(1)), or after conducting an investigation on the Commissioner’s own initiative (existing subsection 52(1A)).

Proposed subparagraph 52(1)(b)(iia) (inserted by item 29 of the Bill) sets out that after investigating a complaint, the Commissioner may find the complaint substantiated and make a determination that includes a declaration that the respondent must prepare and publish, or otherwise communicate, a statement about the conduct. The relevant requirements and processes are set out in proposed section 52A (inserted by item 33 of the Bill). Proposed paragraph 52(1A)(ba) (inserted by item 30 of the Bill) provides a similar power for the Commissioner’s determinations on Commissioner-initiated investigations.

Under existing subparagraph 52(1)(b)(ia) or existing paragraph 52(1A)(b), the Commissioner may make a determination that includes a declaration that a respondent must take specified steps within a specified period to ensure conduct (in relation to complaints), or an act or practice (in relation to Commissioner-initiated investigations) constituting an interference with an individual’s privacy is not repeated or continued.

Proposed subsection 52(1AAA) (inserted by item 31 of the Bill) specifically allows the Commissioner to make a determination that includes a requirement for the respondent to engage, in consultation with the Commissioner, a suitably independent and qualified adviser to assist this process. The adviser is to review the acts or practices engaged in by the respondent that were the subject of the complaint, the steps (if any) taken by the respondent to ensure that the conduct referred to in the determination is not repeated or continued, and any other matter specified in the declaration that is relevant to those acts or practices, or that complaint (proposed paragraph 52(1AAA)(a)). It appears this amendment formalises the legal basis for a practice that the Commissioner has already used in some of her recent determinations.[64]

These proposed amendments to the Commissioner’s determinations powers adopt similar amendments in the Online Privacy Bill Exposure Draft.[65]

[1].       Explanatory Memorandum, Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022, 2.

[2].       ‘Optus data breach shows need for stronger privacy laws’, Digital Rights Watch, 26 September 2022.

[3].       Josh Taylor, ‘Optus Could Face Millions in Fines as Two New Data Breach Investigations Launched’, Guardian, 11 October 2022.

[4].       Singtel Optus, ‘Optus Notifies Customers of Cyberattack Compromising Customer Information’, media release, 22 September 2022; ‘Medicare card number information’, Singtel Optus.

[5].       Clare O’Neil, (Minister for Home Affairs and Minister for Cyber Security), ‘Statement on Optus Data Breach’, 27 September 2022.

[6].       Jim Chalmers (Treasurer) and Michelle Rowland (Minister for Communications), ‘Changes to Protect Consumers Following Optus Data Breach’, joint media release, 6 October 2022.

[7].       Mark Dreyfus (Attorney-General), ‘Transcript of Q and A: National Press Club, Canberra’, media release, 12 October 2022.

[8].       Scott Morrison (Prime Minister), Josh Frydenberg (Treasurer), Christian Porter (Attorney-General and Minister for Industrial Relations), Paul Fletcher (Minister for Communications, Cyber Safety and the Arts), ‘Response to Digital Platforms Inquiry’, joint media release, 12 December 2019.

[9].       ‘Review of the Privacy Act 1988’, Attorney-General’s Department (AGD).

[10].    Mark Dreyfus (Attorney-General), ‘Tougher Penalties for Serious Data Breaches’, media release, 22 October 2022.

[11].    David Shoebridge (Senator for New South Wales), ‘Greens Win Senate Inquiry into Proposed Privacy Laws’, media release, 27 October 2022.

[12].    Explanatory Memorandum, 3.

[13].    Explanatory Memorandum, 4–9.

[14].    A penalty unit is currently $222: Crimes Act 1914, subsection 4AA(1); Christian Porter (Attorney-General), ‘Notice of Indexation of the Penalty Unit Amount’, 14 May 2020. The maximum penalty for a body corporate is 5 times the maximum penalty for an individual: Crimes Act 1914, subsection 4B(3).

[15].    The term ‘adjusted turnover’ is defined in proposed subsections 13G(5)–(6) and ‘breach turnover period’ in proposed subsection 13G(7).

[16].    Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, 226.

[17].    Office of the Australian Information Commissioner (OAIC), Guide to Privacy Regulatory Action, (Sydney: OAIC, 2020), paragraph 6.28.

[18].    OAIC, Guide to Privacy Regulatory Action, paragraph 6.29.

[19].    OAIC, Guide to Privacy Regulatory Action, paragraph 6.33.

[20].    AGD, Privacy Act Review – Discussion Paper, 175–176.

[21].    OAIC, Submission to AGD, Privacy Act Review – Discussion Paper, 194–196.

[22].    OAIC, Submission to AGD, Privacy Act Review – Discussion Paper, 194–196.

[23].    Treasury Laws Amendment (More Competition, Better Prices) Bill 2022, Schedule 1, item 25.

[24].    Australian Competition and Consumer Commission (ACCC), Digital Platforms Inquiry – Final Report, (Canberra: ACCC, 2019), 475–476.

[25].    Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021, Exposure Draft, Schedule 2, item 5.

[26].    General Data Protection Regulation, article 83(5).

[27].    Henry Belot, ‘Optus and Medibank hacks prompt $50m data breach fines’, ABC News, 22 October 2022.

[28].    Mark Dreyfus, Second Reading Speech: Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022, House of Representatives, Debates, (proof), 26 October 2022, 7–8.

[29].    Schedule 1 to the Privacy Act contains 13 Australian Privacy Principles (APPs), which apply to Australian Government agencies and private sector organisations covered by the Privacy Act – collectively referred to as ‘APP entities’. The APPs are principles-based law. An APP entity has an obligation to not do an act, or engage in a practice, that breaches an APP (section 15). An act or practice of an APP entity is an interference with the privacy of an individual if the act or practice breaches an APP in relation to personal information about the individual, which can lead to regulatory action and penalties (paragraph 13(1)(a)).

[30].    ‘National COVID-19 Privacy Principles’, OAIC.

[31].    Telecommunications (Interception and Access) Act 1979, sections 187A, 187AA and 187C.

[32].    Privacy Act 1988, Schedule 1, paragraph 11.2(d).

[33].    AGD, Privacy Act Review – Discussion Paper, 115–123.

[34].    Privacy Amendment (Enhancing Privacy Protection) Act 2012, section 2; Schedule 4, item 50.

[35].    Privacy Act 1988, section 80U.

[36].    OAIC, Submission to AGD, Privacy Act Review – Discussion Paper, 190–194.

[37].    OAIC, Submission to AGD, Privacy Act Review – Discussion Paper, 190–192.

[38].    OAIC, Submission to AGD, Privacy Act Review – Discussion Paper, 190–194.

[39].    OAIC, FOIREQ22/00293, (Sydney: OAIC, 2022).

[40].    OAIC, Office of the Australian Information Commissioner Corporate Plan 2020–21, (Sydney: OAIC, 2020), 11.

[41].    OAIC, FOIREQ22/00209, (Sydney: OAIC, 2022).

[42].    OAIC, FOIREQ22/00209, 10.

[43].    ‘OAIC welcomes additional Budget funding’, OAIC.

[44].    ‘OAIC welcomes additional Budget funding’, OAIC.

[45].    Explanatory Memorandum, Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022, 12–13.

[46].    Dreyfus, Second Reading Speech: Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022, 7–8.

[47].    Facebook Inc v Australian Information Commissioner [2022] FCAFC 9, paragraphs 135–143.

[48].    Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Exposure Draft, Schedule 2, item 1; AGD, Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Explanatory Paper, (Canberra: AGD, October 2021), 22–23.

[49].    Meta, Submission to AGD, Online Privacy Bill Exposure Draft, 14 December 2021, 28.

[50].    Marine Giral, Christina Knezevich, Kaman Tsoi, Phillip Magness, Christine Wong and Julian Lincoln, ‘$50m Penalties, More Regulatory Powers and Expanded Global Reach – Part One of Australia’s Privacy Act Reforms’, Latest Thinking (blog), Herbert Smith Freehills, 28 October 2022.

[51].    Communications Alliance, Submission to AGD, Online Privacy Bill Exposure Draft, 13 December 2021, 20–21.

[52].    Explanatory Memorandum, 15.

[53].    Explanatory Memorandum, 18.

[54].    Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Exposure Draft, Schedule 2, item 7; AGD, Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Explanatory Paper, 22–23.

[55].    Explanatory Memorandum, 22.

[56].    Explanatory Memorandum, 22.

[57].    Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Exposure Draft, Schedule 2, items 17–21; AGD, Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Explanatory Paper, 19 –20.

[58].    Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Exposure Draft, Schedule 3, item 5; AGD, Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Explanatory Paper, 21–22.

[59].    Law Council of Australia, Submission to Attorney-General’s Department, Online Privacy Bill Exposure Draft, [Response no. 191156553], 14 December 2021. Note that proposed paragraph 33C(3) of the Privacy Act in the Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Exposure Draft is identical to proposed paragraph 33C(3) of the Act in the present Bill.

[60].    Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Exposure Draft, Schedule 3, item 5, proposed section 33B; AGD, Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Explanatory Paper, 22.

[61].    Explanatory Memorandum, 17.

[62].    Meta, Submission to Attorney-General’s Department, Online Privacy Bill Exposure Draft, 14 December 2021, 27.

[63].    Business Council of Australia, Submission to Attorney-General’s Department, Online Privacy Bill Exposure Draft, December 2021, 7; Communications Alliance, Submission to Attorney-General’s Department, Online Privacy Bill Exposure Draft, 13 December 2021, 22.

[64].    AGD, Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Explanatory Paper, 20. See, for example, ‘AAQ’ and Redimed Pty Ltd (Privacy) (Corrigendum dated 1 March 2022) [2022] AICmr 7, (17 February 2022); Commissioner Initiated Investigation into the Australian Federal Police (Privacy) [2021] AICmr 74, (26 November 2021); 'WZ' and CEO of Services Australia (Privacy) [2021] AICmr 12, (13 April 2021).

[65].    Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Exposure Draft, Schedule 2, items 11–12; AGD, Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021: Explanatory Paper, 20.

 

For copyright reasons some linked items are only available to members of Parliament.

© Commonwealth of Australia

Creative commons logo

Creative Commons

With the exception of the Commonwealth Coat of Arms, and to the extent that copyright subsists in a third party, this publication, its logo and front page design are licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Australia licence.

In essence, you are free to copy and communicate this work in its current form for all non-commercial purposes, as long as you attribute the work to the author and abide by the other licence terms. The work cannot be adapted or modified in any way. Content from this publication should be attributed in the following way: Author(s), Title of publication, Series Name and No, Publisher, Date.

To the extent that copyright subsists in third party quotes it remains with the original owner and permission may be required to reuse the material.

Inquiries regarding the licence and any use of the publication are welcome to webmanager@aph.gov.au.

Disclaimer: Bills Digests are prepared to support the work of the Australian Parliament. They are produced under time and resource constraints and aim to be available in time for debate in the Chambers. The views expressed in Bills Digests do not reflect an official position of the Australian Parliamentary Library, nor do they constitute professional legal opinion. Bills Digests reflect the relevant legislation as introduced and do not canvass subsequent amendments or developments. Other sources should be consulted to determine the official status of the Bill.

Any concerns or complaints should be directed to the Parliamentary Librarian. Parliamentary Library staff are available to discuss the contents of publications with Senators and Members and their staff. To access this service, clients may contact the author or the Library‘s Central Enquiry Point for referral.