We have previously provided updates on the Privacy Act review, including our comments on the Discussion Paper and a Discussion Paper Update, as well penalty increases. 16 key takeaways from the Privacy Report include as follows:

1. Expansion of what constitutes “personal information” and “sensitive information”. Consequently, an expansion of obligations, including regarding IP addresses, device IDs, genomic information, location data, financial and transaction data
2. Reducing or removing the $3 million threshold, meaning more (smaller) businesses and more sole traders will become “APP Entities” and be required to comply with the Privacy Act and Australian Privacy Principles (APPs)
3. Standardisation of privacy policies (or parts of them) and collection notices. This is a strategy to require the use of familiar, consistent terminology and to create efficiencies
4. Expressly requiring APP Entities to appoint or designate a senior employee responsible for privacy
5. Enhanced requirements to obtain consent, meaning a clear affirmative act, that is voluntary, informed, unambiguous, specific and current
6. Enhanced collection obligations, including to expand collection to include information obtained from any source and by any means including inferred or generated information
7. Legislated factors relevant to whether a collection, use or disclosure of personal information is fair and reasonable in the circumstances
8. The employee records exemption to be amended to provide enhanced protections for employees. This means greater obligations on employers as to how employee information is managed
9. Privacy by design – increased requirements to facilitate “opt in” instead of “opt out”, increased rights to objection, erasure, correction and de-indexing online search results
10. Strengthening transparency requirements for cross border disclosures
11. Undertaking Privacy Impact Assessments (PIAs) for activities with high privacy risks (for example implementing new processes, software that accesses personal and sensitive information), and to provide those PIAs to the Information Commissioner (OAIC) on request
12. Notifiable/ Eligible data breaches to be notified to the OAIC within 72 hours, instead of 30 days
13. Expanded enforcement powers for the OAIC, similar to ACCC and ASIC
14. Broader powers for the Federal Court to impose penalties
15. Creating direct rights of action for privacy breaches. This will facilitate class actions against APP Entities, including for widespread data breaches
16. Creating a statutory tort of invasion of privacy, covering the misuse of private information, and which is not in the public interest. This is broad and potentially covers the sharing and publication of intimate images, doxxing, and unwarranted surveillance. It would have broad and general application (and would not be limited to APP Entities)

Conclusion

The Attorney-General’s Department is seeking feedback to inform the government response to the Privacy Report. The deadline for feedback is 31 March 2023.

Should you wish to discuss the Privacy Report, your privacy rights and obligations, please do not hesitate to contact Bill Fragos, Special Counsel or your usual contact at Moray & Agnew. We also deliver presentations and training to our clients on privacy laws and the implications of the Privacy Report.