What you need to know
- On 30 October 2020, the Attorney General's Department released an issues paper and terms of reference to review the Privacy Act 1988 (Cth) (Privacy Act).
- The review is wide-ranging and will likely result in a significant overhaul to Australia's current privacy regime. It builds upon reforms announced by the Government in March 2019 to increase maximum civil penalties for serious or repeated privacy breaches from $2.1 million to the greater of: 10 per cent of a company's annual domestic turnover; $10 million; or, three times the value of any benefit obtained through the misuse of information.
- The Government is currently accepting public submissions on the issues paper until 29 November 2020.
What you need to do
In light of the announced significantly increased penalties for Privacy Act breaches and the possibility of additional causes of action related to infringements of privacy, businesses should:
- become familiar with the issues paper and the key areas of privacy law subject to the review;
- consider the impacts that potential privacy law reforms could have on your business practices and how your business may need to respond if the reforms became law;
- consider preparing submissions to the issues paper, particularly if your business practices are likely to be impacted by changes to the areas of privacy law that are subject to the review; and
- closely monitor any further Government announcements in this space and lookout for the release of the discussion paper early next year.
What just happened?
On 30 October 2020, the Attorney General's Department released an issues paper and terms of reference for the Government's long awaited review of the Privacy Act 1988 (Cth). The review will consider whether the Privacy Act remains fit for purpose in the digital economy, particularly given that it has not been amended since the introduction of the Australian Privacy Principles in 2014.
What areas of privacy law could be reformed?
The issues paper lists a number of matters which will be considered. These include:
- expanding the scope of information regulated under the Privacy Act;
- obtaining consent to the collection of personal information. Should this be required in nearly all circumstances, and must it be informed consent, which is freely-given and unbundled;
- the extent to which the use and disclosure of personal information should require consent, and how to ensure any such uses and disclosures are fair;
- whether individuals should be given a right to require the deletion of their personal information, and should there only be very limited exceptions to this requirement;
- whether to require notification of the collection of personal information in all circumstances and, if so, how to manage 'notification overload' and collection from third parties;
- whether individuals should have direct rights of action to enforce privacy obligations under the Privacy Act;
- whether a statutory tort for serious invasions of privacy should be introduced into Australian law;
- whether to continue the current exemptions under the Privacy Act, most significantly the employee records exemption;
- the impact of the notifiable data breach scheme and its effectiveness in meeting its objectives;
- the effectiveness of enforcement powers and mechanisms under the Privacy Act and the interaction with other Commonwealth regulatory frameworks; and
- the desirability and feasibility of an independent certification scheme to monitor and demonstrate compliance with Australian privacy laws.
Matters concerning the operation of the Privacy Act in relation to credit reporting and the COVIDSafe app are outside the scope of this review.
Why are we having this review now?
This review forms part of the Government's response to the Australian Competition and Consumer Commission's (ACCC) Digital Platforms Inquiry. This was an 18 month inquiry that examined the market power and impact of digital platforms on media, advertisers and consumers. It also identified a range of privacy issues including a lack of transparency of data handling practices and a need for stronger consumer privacy protections.
Following the inquiry's final report in July 2019, the Government supported most of the ACCC's 23 recommendations in its response. This included a Government commitment to undertake the review of the Privacy Act now underway and, as part of that review, to consult on options for implementing a number of privacy-specific recommendations to better empower consumers, protect their data and best serve the Australian economy. The matters to be considered in this review, as outlined above, are in line with the Government's response to each privacy-related recommendation resulting from the Digital Platforms Inquiry. However, the reference to assessing the feasibility and desirability of an independent certification scheme, as well as the reference to assessing the impact and effectiveness of the notifiable data breach scheme are two further matters included for review that were not outlined in the Government's ACCC response.
This review is separate to the previously announced reforms to Australian privacy laws in March 2019 which are set to introduce:
- increased penalties for privacy breaches including increasing the maximum penalty under the Privacy Act to be in line with the maximum penalties available under the Australian Consumer Law; and
- a binding privacy code to apply to social media platforms and other online platforms that trade in personal information.
What is next?
This issues paper is the first of two papers available for public comment. This paper outlines the current Australian privacy regime and seeks feedback on potential issues relevant to reform. Public submissions in response to this paper should be returned by 29 November 2020. A discussion paper will then be released in early 2021, seeking more specific feedback on preliminary outcomes, including options for reform.
The review of the Privacy Act is expected to be completed in 2021. Watch this space.
Authors: Tim Brookes, Partner; Florence Tan, Lawyer; and Phillip Alphonse, Lawyer.
