The Privacy Law Reforms: What You Need to Know

Australia is in the midst of significant reforms to its privacy laws with the introduction of the Privacy and Other Legislation Amendment Bill 2024. These changes reflect the growing importance of data protection and privacy in an increasingly digital world. This article provides a breakdown of the key aspects of the privacy law reforms and what they mean for businesses and individuals alike.

The Privacy Law Reforms aim to better protect personal information in the digital age. Key changes include:

A statutory tort allowing individuals to sue for serious invasions of privacy, like unauthorised surveillance or misuse of personal data
Stronger powers for regulators like the OAIC, enabling quicker investigations and penalties for privacy breaches.
New penalties for serious privacy breaches, with fines up to A$50 million or 30% of annual turnover.
Automated decision making processes to be included in privacy policies
Protection against doxxing—making it a criminal offense to maliciously release someone’s personal information online.
Children’s Online Privacy Code (COP Code) enforcing stricter data protections for minors.
Tighter rules for overseas data transfers, allowing data to be sent to countries offering comparable privacy protections.
Requirement to take reasonable ‘technical and organisational measures’ to protect individuals’ privacy

1 .Statutory Tort for Serious Invasions of Privacy

One of the most talked-about aspects of the reforms is the introduction of a statutory tort for serious invasions of privacy. This means individuals can take legal action if their privacy is seriously invaded. The tort includes:

Intrusion upon seclusion (e.g., eavesdropping or surveillance).
Misuse of private information (e.g., unauthorized sharing of personal data).

Notably, plaintiffs do not need to prove they suffered actual damage—just that their privacy was invaded. However, defendants can argue that there was a public interest in the invasion, which the courts will weigh against the individual’s right to privacy. The Bill provides an exemption for journalists and media outlets and for law enforcement and intelligence.

2. Expanded Powers for the OAIC

The Office of the Australian Information Commissioner (OAIC) will be granted broader investigative and enforcement powers under the new law. This includes the ability to issue infringement notices for breaches of the Australian Privacy Principles (APPs) and impose administrative fines directly, which could speed up enforcement and encourage better compliance from businesses.

3. New Penalties for Privacy Breaches

The reforms introduce a three-tiered system of penalties for privacy breaches:

Serious interferences with privacy can result in penalties up to A$50 million, three times the value of any benefit obtained from the interference, or 30% of annual turnover.
Less severe breaches still attract fines, with a maximum penalty of A$3.13 million.
Minor breaches may result in administrative fines issued directly by the Office of the Australian Information Commissioner, with a maximum fine of A$313,000 for corporations

These penalties underscore the government’s commitment to ensuring businesses take privacy seriously and implement proper safeguards for personal data.

4. Automated decision making processes to be included in privacy policies

The Bill requires that entities must include in their privacy policies, details relating to their use of automated decision making processes that could reasonably be expected to significantly affect the rights or interests of individuals.

5. Protection against doxxing

The Privacy Law Reforms make doxxing—the malicious release of someone’s personal information online—a criminal offense. This targets harmful activities such as exposing someone’s private details, like their address or contact information, with the intent to harass, embarrass, or endanger them. Penalties include serious consequences to deter individuals from engaging in such conduct, aiming to protect victims from online harassment, threats, and other related harms

6. Children’s Online Privacy Code

A major addition is a requirement for the OAIC to develop and register a Children’s Online Privacy Code within two years. It is intended to place stricter obligations on businesses collecting data from children and aims to ensure that companies offer extra protections for minors, especially given the risks associated with digital platforms and social media.

7. Overseas Data Transfers

The reforms also tighten rules around overseas data transfers. Australian companies will be allowed to transfer data to countries on a newly established “whitelist” of jurisdictions that offer comparable privacy protections without having to put contractual protections in place. This aligns with global standards, such as those in the EU and UK, reducing the risk of misuse of data in international transactions.

8. Requirement to take reasonable ‘technical and organizational measures’ to protect individuals’ privacy

Australian Privacy Principal 11 already requires organisations to take reasonable steps to protect personal information. The Bill expands this to include taking reasonable ‘technical and organisational measures’. ‘Organisational measures’ may include implementing policies and processes and providing appropriate training to employees.}

Impact on Businesses

For businesses, these changes mean more robust privacy compliance frameworks will be required. Companies will need to:

Review and possibly overhaul their privacy policies, especially those that rely on automated decision-making.
Ensure they have appropriate measures in place to meet the data security and handling requirements to better protect themselves in the proposed environment of significantly increased penalties and administrative fines without the need for court proceedings.

Final Thoughts

The Privacy and Other Legislation Amendment Bill 2024 marks a significant shift in how privacy is protected in Australia. With tougher penalties, expanded regulatory powers, and the introduction of a statutory tort, businesses must take action to ensure compliance and protect individuals’ rights. These reforms reflect Australia’s commitment to keeping pace with global privacy trends, ensuring that the rights of individuals are upheld in an increasingly connected world.

.It does not include several of the reforms proposed in Attorney-General’s review of the Privacy Act, such as the removal of the employee records and small business exemptions, or the requirement to report a data breach to the OAIC within 72 hours, or the right for individuals to be forgotten.

For more information on how these changes might affect you or your business, consider seeking legal advice from Louise Wolf at MST Lawyers, or reviewing your privacy practices to ensure they meet the new standards.