A recent report on privacy law led to changes in the privacy legislation from 2014. Thirteen legally binding Australian Privacy Principles apply to personal information held by Australian government agencies and most Australian companies. There are further credit provider provisions apart from small business, with some exemptions including journalism and politics. Breaches attract heavy penalties. Privacy codes can be approved and registered.
The Privacy Act 1988 (Cth) (“PA 1988”) sets minimum standards for how personal information (see definition in “Personal information”) can be collected, used, held and disclosed. It gives individuals certain rights in respect of their personal information, including the right to access the information an entity holds about them, and the right to seek the correction of this information.
Major changes to the PA 1988 commenced on 12 March 2014. These changes, introduced by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth), gave effect to more than half the recommendations in the Australian Law Reform Commission’s report on Australia’s privacy law, For your information: Australian privacy law and practice (ALRC report 108/2008).
Two key features of the PA 1988 are:
• the 13 Australian Privacy Principles (APPs): these legally binding principles apply to the handling of personal information by the Australian Government (generally only federal agencies) and most Australian businesses and not-for-profit organisations (although most small businesses are exempt; see “Exemptions from the Privacy Act”);
• obligations on credit providers and credit-reporting bodies: credit providers and credit-reporting bodies engaged in a credit-reporting business (as defined in ss 6G, 6P PA 1988) must comply with the credit-reporting provisions in part IIIA of the PA 1988 and with the legally binding Privacy (Credit Reporting) Code 2014 (Version 2) registered under the PA 1988 by the Information Commissioner.
Both the APPs and the obligations on credit providers and credit-reporting bodies are products of the March 2014 changes. The APPs replaced the Information Privacy Principles (IPPs) and the National Privacy Principles (NPPs). Previous obligations on credit providers and credit-reporting bodies were replaced with a new credit-reporting regime (see Privacy and credit reporting).
The APP guidelines, which are advisory guidelines that outline the requirements of the APPs and provide advice on how best to comply with them, are available at www.oaic.gov.au.
Under the PA 1988, “personal information” is defined as information, or an opinion, about an identified individual, or an individual who is reasonably identifiable:
• whether the information or opinion is true or not;
• whether the information or opinion is in material form or not.
Whether an individual is “reasonably identifiable” depends on the circumstances, including the nature of the information and any other available facts. The test of whether a person is reasonably identifiable is an objective test that considers the context in which the issue arises. An individual might not be reasonably identifiable if the steps required to do so are excessively time-consuming or costly.
The PA 1988 applies to federal government agencies (including federal ministers, the Australian Federal Police, a federal court, and a Norfolk Island agency) and to most private sector organisations, including:
• individuals who collect, use or disclose personal information in the course of running a business;
• bodies corporate; and
• partnerships, unincorporated associations and trusts.
Some of the APPs apply differently to Australian Government agencies and private sector organisations. The term “APP entity” is used where the APPs apply to both private sector organisations and government agencies.
The APPs apply to acts and practices engaged in inside and outside Australia by organisations and small business operators that have an Australian link, as defined in the PA 1988.
The APPs replace the Information Privacy Principles (IPPs) and the National Privacy Principles (NPPs), which, before 12 March 2014, provided separate obligations for government and private sector organisations. The APPs broadly cover the same areas as the IPPs and NPPs, although the standards required by the APPs are higher in some respects.
Exemption for individuals acting in a non-business capacity
The PA 1988 does not apply to personal information that individuals collect, hold, use or disclose for the purposes of their personal, family or household affairs. In other words, the PA 1988 does not apply to an individual’s handling of personal information unless it is done in the course of running a business.
Most small business operators do not have to comply with the PA 1988. A small business is an organisation with an annual turnover of $3 million or less.
Some small businesses are not exempt from the PA 1988, including those that:
• provide a health service and hold any health information;
• trade in personal information, either:
– disclosing personal information for a benefit, service or advantage, or
– providing a benefit, service or advantage to collect an individual’s personal information from anyone else (unless the individual consents, or the disclosure or collection is required or authorised by law);
• are service providers contracted by the Commonwealth Government; or
• are a “reporting entity” under the Anti-money Laundering and Counter-terrorism Financing Act 2006 (Cth);
• have opted in to the PA 1988.
Acts and practices that directly relate to:
• a current or former employment relationship; and
• an employee record,
are exempt from the PA 1988. An “employee record” is a register of personal information relating to the employment of a person, such as information about the employee’s:
• engagement, training, disciplining or resignation;
• terms and conditions of employment;
• personal and emergency contact details;
• performance or conduct;
• taxation, banking or superannuation affairs.
Note that the exemption does not apply to information about people who are applying for employment.
Journalistic activities and practices of media organisations are exempt from the PA 1988. A “media organisation” is an organisation whose activities consist of the collection, preparation and dissemination of news, current affairs, information or documentaries. The media organisation must be publicly committed to observing published industry standards that deal with privacy. Examples of such published industry standards include industry codes regulated by the Australian Communications and Media Authority and the Australian Press Council.
The political activities of registered political parties, members of parliament, and local government councillors are exempt from the PA 1988. For the purposes of the exemption, the political activities must have some connection with an election under electoral law, a referendum or some other aspect of the political process. The political activities of contractors and volunteers of registered political parties are also exempt.
Where an entity breaches an Australian Privacy Principle (APP), this is “an interference with the privacy of an individual” under section 13(1) of the PA 1988. Part V of the PA 1988 gives the Information Commissioner the power to investigate possible interferences with privacy, on the commissioner’s own initiative or in response to a complaint.
If an entity engages in serious or repeated breaches of the APPs or a registered Privacy Code, the commissioner may apply to the Federal Court or the Federal Circuit Court for an order that the entity pay a civil penalty of up to $1.7 million (for corporations) or up to $340,000 (for individuals).
The Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth) requires APP entities to notify the Information Commissioner, and the individuals affected, of any data breach that is likely to result in serious harm to any individuals whose personal information is involved. The notification to individuals must include recommendations about steps individuals should take to respond to the breach. Failure to notify the Information Commissioner of a data breach is deemed to be an interference with privacy and triggers the Information Commissioner’s existing enforcement powers (see above). The scheme commenced on 22 February 2018.
Under section 35A of the PA 1988, the Information Commissioner can “recognise” external dispute resolution (EDR) schemes to handle particular privacy related complaints. The Information Commissioner has issued guidelines for recognising EDRs. For a list of EDR schemes recognised by the Information Commissioner, see “Contacts”. See also “Privacy and credit reporting” and “Making a complaint”.
The Information Commissioner has the power to approve and register enforceable codes for certain entities (e.g. entities in a particular industry). The commissioner has issued guidelines for developing privacy codes (available at www.oaic.gov.au).
The Privacy (Credit Reporting) Code 2014 (Version 2) (“2014 code”) was registered on 24 April 2014) (see “Privacy and credit reporting”). On 29 May 2018, the Acting Information Commissioner approved a variation to the 2014 code. The varied code commenced on 1 July 2018 and the 2014 code was repealed.
The Privacy (Market and Social Research) Code 2014 was registered on 28 November 2014.
The Australian Government Agencies Privacy Code (“2017 code”) was registered on 27 October 2017 and commenced 1 July 2018. The 2017 code sets out specific requirements and steps that agencies must take as part of complying with APP 1.2. APP 1.2 requires an APP entity to take reasonable steps to implement practices, procedures and systems that will ensure the entity complies with the APPs, and any binding registered APP code, and is able to deal with related enquiries and complaints.
The Office of the Australian Information Commissioner (OAIC) is the independent statutory agency that was created by the Australian Information Commissioner Act 2010 (Cth) (“AICA 2010”) to administer the PA 1988 and the Freedom of Information Act 1982 (Cth) (“FoI Act (Cth)”).
The AICA 2010 (s 6) created three information officers: the Information Commissioner, the Freedom of Information Commissioner, and the Privacy Commissioner.
The Privacy Commissioner has the privacy functions, but certain actions can only be undertaken with the Information Commissioner’s approval. The Information Commissioner has all the functions under the PA 1988 and the FoI Act (Cth).
The Information Commissioner can delegate all his or her functions under the PA 1988, apart from the power to issue rules under section 17 and making a determination for the purposes of section 52 (s 25 AICA 2010).