Have you reviewed since 2023?
In 2023, significant changes were proposed to Australia’s Privacy Act to address emerging data privacy concerns and enhance protections. Key updates include:
- Removal of Small Business Exemption: The government has indicated it will remove the exemption that previously excluded small businesses (those earning under $3 million annually) from privacy law obligations. This change is intended to ensure comprehensive coverage across businesses.
- Statutory Tort for Privacy: A new tort will allow individuals to sue for serious privacy invasions. This covers misuse of personal data and invasions of personal space, with remedies such as compensation for non-economic damages and punitive measures.
- Children’s Privacy Protections: Enhanced safeguards for children’s data are planned, including a specific online privacy code to regulate how data from minors is collected and used, especially in digital services likely to attract younger audiences.
- Tighter Security Obligations: Organisations will need to implement technical (e.g., multi-factor authentication) and organisational measures to prevent data misuse or interference.
- Stricter Data Breach Notifications: Notifications of data breaches will need to occur within 72 hours to affected individuals and the regulator.
- Enhanced Accountability: Larger businesses must appoint dedicated privacy officers and conduct risk assessments related to their data handling practices.
- Automated Decision Transparency: Entities using automated decision-making that significantly affects individuals must disclose this in their privacy policies.
- Overseas Data Transfers: To simplify compliance, the Privacy Commissioner will establish a list of approved countries with equivalent data protection standards.
These reforms follow significant data breaches in 2022 and aim to restore public trust in how personal information is managed. The government has introduced increased penalties for serious breaches and continues to refine the proposed updates, with some aspects still under consultation​