Non-compliance of Australian Privacy Principles
Non-compliance with the Australian Privacy Principles (APPs), which are part of the Privacy Act 1988, can lead to serious legal and financial consequences for organizations. The APPs outline obligations for how personal information must be collected, used, stored, and disclosed, and apply to Australian Government agencies, private sector organizations with annual revenues exceeding $3 million, and some smaller entities.
Consequences of Non-Compliance
- Regulatory Enforcement Actions:
- The Office of the Australian Information Commissioner (OAIC) investigates complaints and conducts audits.
- Non-compliance can result in enforceable undertakings, directions to change practices, or public reprimands.
- Civil Penalties:
- Following amendments to the Privacy Act in 2022, organizations can face penalties of up to $50 million, three times the value of any benefit obtained through the breach, or 30% of the company’s adjusted annual turnover during the breach period, whichever is greater.
- Legal Liability:
- Individuals can initiate legal action for serious breaches of their privacy under tort laws proposed in the Privacy Act amendments.
- Reputational Damage:
- Data breaches or privacy violations can result in a loss of consumer trust and harm to a company’s reputation, impacting its business operations and customer retention.
- Mandatory Data Breach Notifications:
- Organizations must notify affected individuals and the OAIC of eligible data breaches under the Notifiable Data Breaches (NDB) scheme. Failure to comply with notification requirements can attract additional penalties.