By Anna Johnston and Alex Kotova -
Snapshot
- The Privacy Act 1988 (Cth) is currently under review. The Final Report into the review of the Privacy Act was released on 16 February 2023.
- Legal professionals advising private sector entities and Australian Government agencies will need to be familiar with the proposed reforms. In particular, businesses relying on current exemptions to the Privacy Act should be mindful of potential changes.
- The proposals involve strengthening existing rules, introducing new concepts into privacy law, including a statutory tort of privacy, rights to erasure and de-indexing, a ‘fair and reasonable’ test, mandatory Privacy Impact Assessment for high-risk activities, and additional regulation of marketing, targeting and trading in data.
On 16 February 2023, the Attorney-General publicly released the Privacy Act Review Report (‘the Report’). The Report forms part of an ongoing review of Australia’s privacy laws (‘the Review’), triggered by the Australian Competition and Consumer Commission’s Digital Platforms Inquiry Final Report (June 2019) which, amongst other recommendations, suggested that the Australian Government conduct a review into whether the Privacy Act remains fit for purpose in this digital age. The Report is informed by feedback received in response to an Issues Paper (released October 2020) and a Discussion Paper (released October 2021), and contains 116 proposals aimed at strengthening and modernising Australian privacy law.
Key proposals:
Exemptions to the Privacy Act
Currently, the Privacy Act regulates federal government agencies and many types of private sector organisations (Privacy Act 1988 (Cth), s 6C). To fall within the territorial scope of the Privacy Act, entities must also be located or incorporated in Australia, or carry on business in Australia or an external Territory (s 5B). Many entities with an annual turnover of less than $3 million are covered by what is known as the ‘small business exemption’ and are largely exempt from the Privacy Act (ss 6D and 6E). Additional exemptions exist for political parties, some activities of media organisations and employee records held by private sector employers (ss 7B and 7C). The Review is considering whether to abolish these exemptions.
