a reasonable person would believe that such data breach is likely to result in serious harm to any of the individuals to whom the information relates. The Commonwealth Government is in the implementation phases of the Consumer Data Right (CDR) following a number of policy reviews including the Productivity Commission's "Data Availability and Use" report and the "Review into Open Banking in Australia". In addition to the security obligations noted above, the Privacy Act/APPs require that APP entities delete or de-identify all personal information in their possession once all legal requirements to keep it in an identified form have passed, it is not required for threatened or current litigation and it has been used for the notified purpose(s) for which it was collected (APP 11.2). 1.9 million) turnover threshold and not otherwise subject to the Privacy Act/APPs) engaged under a Commonwealth contract and by media organisations, if done in the course of journalism. Generally, the Privacy Commissioner prefers mediated outcomes between the complainant and the relevant organization. 1.3 million) fine in relation to each of the individuals impacted by the alleged serious invasion of privacy resulting from the Cambridge Analytica activities. For example, the following all impact privacy and data protection for specific types of data or activities: the Telecommunications Act 1997 (Cth), the Criminal Code Act 1995 (Cth), the National Health Act 1953 (Cth), the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic) and the Workplace Surveillance Act 2005 (NSW). The Privacy Commissioner is charged with enforcing the Privacy Act/APPs, including receiving and resolving complaints, undertaking own motion investigations and, as a result of any relevant determination, seeking an enforceable undertaking, publishing determinations/decisions, and issuing guidance in respect of the interpretation and enforcement of the Privacy Act/APPs. Further, organizations may have additional obligations to notify other regulators of data breaches in certain circumstances including under the Prudential Standard CPS 234 Information Security ("CPS 234") which aims to strengthen APRA-regulated entities' resilience against information security incidents (including cyberattacks), and their ability to respond swiftly and effectively in the event of a breach. There can be no reliance on contractual provisions requiring the overseas entity to comply with the APPs to avoid ongoing liability (although the use of appropriate contractual provisions is a step towards ensuring compliance with the 'reasonable steps' requirement). While there used to be some ambiguity, the recent Uber decision has made it clear that having (and implementing) an appropriate data breach response plan that details at least certain key issues is required in order to comply with APP 1.2. The Privacy Act applies to most private sector organizations operating in Australia and sets a national standard for the collection, use and disclosure, quality and security of Personal Information. That is, up to AUD 1.2 million (approx. The guidance and recommendations of the OAIC are that a PIA should be used for any new, changed/varied or altered process, method, or technology used that processes any personal information. The individual has consented to the collection and the collection of the sensitive information is reasonably necessary for one or more of the entity's functions or activities. We adhere to the Australian Privacy Principles for all personal information that we collect from our customers (i.e., the companies that utilize and pay for our service) and from any other individuals that we may receive or collect personal information from. At or before the time organizations collect personal information, or as soon as practicable afterwards, they must take reasonable steps to provide individuals with notice of: Why it is collecting (or how it will use the) information about the individual, The entities or types of entities to which it might give the personal information, The main consequences (if any) for the individual if all or part of the information is not provided, Whether the organization is likely to disclose their personal information to overseas recipients and, if so, the countries in which such recipients are likely to be located. For example, the obligation to take reasonable steps to secure personal information against unauthorised disclosure, use, and/or loss are more rigorously applied in respect of holdings of 'sensitive information'. The most significant of the APPs are summarized below: APP 1 (open and transparent management of personal information) provides that entities must take reasonable steps to implement practices, procedures and systems that ensure compliance with the APPs and publish their privacy policy; The Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (Cth) (AA Act) provides law enforcement agencies with access to encrypted data for serious crime investigation and imposes obligations on "Designated Communications Providers". Those in charge of storing the information have obligations to ensure such information is neither lost nor exploited. The CDR allows a consumer to obtain certain data held about that consumer by a third party and require data to be given to accredited third parties for certain purposes. For further information about these entities and DLA Piper's structure, please refer to our Legal Notices. AUD 1.4 million (approx. You have out of 5 free articles left for the month. In other words, APP entities should not assume that collecting personal information is always required to meet their requirements; at or before the time or, if that is not practicable, as soon as practicable after an APP entity collects personal information about an individual, take such steps as are reasonable in the circumstances to notify the individual of the matters in APP 5.2, or otherwise ensure that the individual is aware of such matters (APP 5.1); only use the personal information collected for the notified purpose(s) for collection, unless a secondary purpose is permitted by the APPs (but exercise extra caution with secondary purposes) or consented to by the individual (APP 6.1); to take reasonable steps to ensure that the personal information that the APP entity collects, uses, or discloses is accurate, up-to-date, and complete (APP 10); to take reasonable steps in the circumstances to protect the personal information held by the APP entity from misuse, interference, and loss and from unauthorised access, modification, or disclosure (APP 11.1); take reasonable steps to delete or de-identify personal information when it is no longer required for the notified purposes for which it was collected; to notify all eligible data breaches as soon as practicable to the OAIC and all affected individuals; and. In addition to the Privacy Act/APPs, there is a Privacy Regulation 2013, legally binding Privacy (Credit Reporting) Code and rules and guidelines, for example, in relation to privacy in the conduct of medical research and Tax File Numbers ('TFNs') which have the force of law and apply in specific areas/to specific types of information. Most States and Territories in Australia (except Western Australia and South Australia) have their own data protection legislation applicable to relevant State or Territory government agencies, and private businesses that interact with State and Territory government agencies. All of the following conditions are satisfied: Prevention of the risk of serious harm through remedial action has not been successful. Discover what topics are trending at the moment. This notification requirement applies in addition to the requirement for organisations to maintain a broader privacy policy, which details the general personal information handling processes of the organisation. As noted above, the main precondition to (or 'legal basis' for) collecting any personal information (including sensitive/health information) is to ensure that the information collected is reasonably necessary for one or more of the entity's functions or activities. measures that need to be taken to satisfy the obligations). The current OAIC case against Facebook seeking to levy fines under the Privacy Act is the first such 'enforcement' action taken in the court by the OAIC in respect of penalties that can be sought to be imposed by the OAIC for a serious invasion or repeated invasions of privacy (i.e. In this way, the CDR provides a mechanism for accessing a broader range of information within designated sectors than is provided for by APP 12 in the Privacy Act, given it applies not only to data about individual consumers but also to business consumers and related products. If the cookies or other similar technologies collect personal information of a user the organization must comply with the Privacy Act in respect of collection, use, disclosure and storage of such personal information. The energy sector is the next to be added to the CDR, with the telecommunications sector currently scheduled to follow. Additionally, individuals have a right to correct inaccurate, out-of-date, and irrelevant personal information held by an organization. Further information regarding the APPs are set out on the Australian Government website www.oaic.gov.au. [1], The Privacy Act was amended in 2000 to cover the private sector. We only use personal information for the purposes set out in our Privacy Policy and we only disclose such personal information to third party vendors to whom customers link from our service; and. If a complaint is taken to the Federal Court of Australia, in certain circumstances others may receive legal assistance. APP 7 (direct marketing) restricts the use or disclosure of personal information for direct marketing unless an exception applies; and Information can only be collected if it is relevant to the agencies' functions. If not practicable, the APP entity must consider other means by which to notify the eligible data breach but, simply because it is impracticable to notify each individual personally, this does not obviate the need for notification and other appropriate means must be devised to notify the affected persons. 1.8 million) (ACCC v HealthEngine Pty Ltd [2020] FCA 1203). The effect is that, even where an offshore entity (e.g. Unless a specific limited exemption applies, all eligible data breaches must be notified to the OAIC and all affected individuals as soon as practicable after the entity: To assist with assessing what a reasonable person might think, a non-exhaustive list of relevant matters to be considered has been included in the Privacy Act (Section 26WG). The right to seek correction of the personal information held by the APP entity about that individual is covered by APP 13.1 and the right to have any correction notified to third parties to whom the personal information was provided by the APP entity is covered by APP 13.2. Following the release of the Australian Competition and Consumer Commissions Digital Platforms Inquiry report in December 2019, the Australian Government accepted the need for proposed reforms to the Privacy Act. The disclosure is required or authorized by law or a court/tribunal order. App developers must also ensure that the collection of customers' personal information complies with the Privacy Act and the Privacy Commissioner has released detailed guidance on this. Where a law or court order expressly requires an entity to collect the specified information then that will be sufficient to establish that the precondition has been met. The sending of electronic marketing (referred to as 'commercial electronic messages' in Australia) is regulated under the Spam Act 2003 (Cth) (Spam Act) and enforced by the Australian Communications and Media Authority. That is, rather than just one fine of up to AUD 2.1 million (approx. You can update your preferences or unsubscribe at any time. Please include your full name, contact details and a detailed description of your complaint. There are a number of key criteria to examine when determining if "serious" harm is likely to result from a breach which should be assessed holistically and take into account: the kinds of information, sensitivity, security measures protecting the information, the nature of the harm (ie, physical, psychological, emotional, financial or reputational harm) and the kind(s) of person(s) who may obtain the information. All rights reserved. However, under the Privacy Act the organization must, prior to receiving consent, expressly inform the individual that if he or she consents to the overseas disclosure of the information the organization will not be required to take reasonable steps to ensure the overseas recipient does not breach the APPs. ), By submitting my personal information, I consent to Zendesk collecting, processing, and storing my information in accordance with the, By submitting my personal information, I understand and agree that Zendesk may collect, process, and retain my data pursuant to the. [2], The Australian Privacy Principles (APPs) replaced the National Privacy Principles and Information Privacy Principles on 12 March 2014 via the Privacy Amendment (Enhancing Privacy Protection) Act 2012, which amended the Privacy Act 1988.[3]. We acknowledge the traditional custodians of Australia and their continuing connection to land, sea and community. under the AUD 3 million (approx. Read our Privacy Act review submission and statements, Changes to the Privacy Act 1988 since it began, in brief, A list of recent investigations opened by the OAIC, Regulations issued under the Privacy Act 1988, Consumer credit reporting under the Privacy Act 1988, Rules and guidelines for health and medical research, Privacy (Tax File Number) Rule 2015 and other obligations, We audit privacy practices to help ensure personal information is protected, How to access Australian Government information, Ting by agreement), especially where the processor is outside Australia, and should include purpose limitations, compliance with the Privacy Act/APPs (for offshore providers in particular) and provisions relating to the notification of and responsibility for notifiable data breaches. Requests to unsubscribe must be processed within 5 business days. These principles extend to the transfer of personal information out of Australia. There is no specific 'right to erasure' currently given to individuals under Australian privacy law. Again, even with consent the sensitive information can only be collected if it is also reasonably necessary for one or more of the entity's functions or activities. However, where the law or court order only permits the collection of such information then, arguably, in some cases meeting the precondition must be established before the entity is entitled to collect that information. APP entities may use the usual means by which they communicate with the relevant affected individuals, if practicable, to notify all affected individuals of the eligible data breach. no matter how many people were affected) as had been previously expected. That is, more information security measures are expected as reasonable where one holds sensitive information. The key legislation in Australia affecting private-sector organisations (and Federal Government agencies) Australia-wide is the Privacy Act and its Australian Privacy Principles ('APPs'). Other sectors across the economy will be added to the CDR over time. Where it is reasonably practicable, we will give our customers access to their personal information, delete the personal information if requested, and retain it only as necessary to provide our services to our customers.

In addition, each electronic message (which the recipient has consented to receive) must identify the sender and contain a functional unsubscribe facility to enable the recipient to opt out of receiving future electronic marketing. (You can unsubscribe at any time. There is no appeal to a Court or Tribunal against decisions of the Commissioner except in very limited circumstances. Specific regulators have also expressed an expectation that regulated entities should have specified data protection practices in place.

An "eligible data breach" occurs when the following conditions are satisfied in relation to personal information, credit reporting information, credit eligibility information or tax file information: There is unauthorized access to, or unauthorized disclosure of, or loss of the information, A reasonable person would conclude that the access or disclosure, or loss would be likely to result in serious harm to any of the individuals to which the information relates. 6.3 million), three times any benefit obtained from the invasion breach (whichever the greater) and 10% of Australian annual revenue.This expected minimum five-fold increase in the available fine under the Privacy Act and the increased budget given to the Office of the Australian Information Commissioner ('OAIC') has led to greater own-motion investigations (and levying of fines) by the OAIC in the past 12-18 months. The right to access the personal information held by the APP entity about that individual is covered by APP 12.1. Section 45 of the Privacy Act allows the Commissioner to interview the people themselves, and the people might have to swear an oath to tell the truth. However, the processing of de-identified or anonymous data (if it cannot be reasonably re-identified) is not covered by the Privacy Act/APPs. The CDR will be extended to at least the retail energy and telecommunications sectors and the expectation is that it will then progressively be rolled out across all sectors of the Australian economy. Prevailing 'wisdom' was that the fine would be applied to the activity as a whole (i.e. These are collectively referred to as APP entities. Biometric data:'Biometric data' is not a term used or defined in Australian privacy law but the equivalent 'biometric information' (undefined) is included in the definition of 'sensitive information' (see 'sensitive data' above). Learn how to use Zendesk and prove your expertise, Connect, learn, and engage with Zendesk users, Get hands-on help, dedicated support or expert guidance, How to locate or become a Zendesk partner, Compliance With The Australian Privacy Act 1988 (Commonwealth) and the Australia Privacy Principles. 1.3 million) in total, not up to AUD 2.1 million x 300,000. The Privacy Act 1988 (Privacy Act) was introduced to promote and protect the privacy of individuals and to regulate how Australian Government agencies and organisations with an annual turnover of more than $3 million, and some other organisations, handle personal information. In addition, the ACCChas been significantly more active in the 'consumer privacy' space. That is, personal information cannot be kept indefinitely and all document/records/data retention policies must include appropriate provisions requiring deletion/de-identification of personal information in accordance with APP 11.2. These principles apply to Australian Government and Australian Capital Territory agencies or private sector organizations contracted to these governments, organizations and small businesses who provide a health service, as well as to private organisations with an annual turnover exceeding AUD$3M (with some specific exceptions). Under the Privacy Act, organizations are not required to notify the Privacy Commissioner of any processing of personal information. Personal Information is defined as any information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and The personal information was collected for that purpose (the primary purpose) or a different (secondary) purpose which is related to (and, in the case of sensitive information, directly related to) the primary purpose of collection and the individual would reasonably expect the organization to use or disclose the information for that secondary purpose. Consent for the collection of sensitive information may also be dispensed with by the entity collecting it where such is reasonably necessary to lessen or prevent a serious threat to public health or safety, find a missing person, where the unlawful activity or misconduct of a serious nature is suspected, or it is reasonably necessary for an entity's diplomatic or consular functions or activities. However, this provision should not be used to automatically get 30 days to determine what to do in the case of an eligible data breach. 2022 DLA Piper. The right to not identify oneself when dealing with an APP entity (i.e. Data controller:Unlike European law, there is no concept of data 'controller' under Australian privacy law. All processing (i.e. Under section 64 of the Privacy Act, the Commissioner is also given immunity against any lawsuits that he or she might be subjected to for the carrying out of their duties. the requirement or authorisation by or under Australian law or a court/tribunal order) are exceptions from the requirement to obtain consent to collect relevant sensitive information. Personal data (referred to as 'personal information' in Australia) means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in material form or not. This is, in effect, Australian privacy law's 'right to be informed', APP 5.2 provides the prescribed matters that must be notified and these include who is collecting, the purpose(s) for the collection, what use will be made of the information, and to whom it may be disclosed (and whether any of those disclosures are to recipients outside of Australia). There is no registration requirement in Australia for data controllers or data processing activities. Similarly, the ACCC succeeded in a Federal Court regulatory action against Google for misleading presentation of geolocation tracking settings in a version of Android (Australian Competition and Consumer Commission v Google LLC (No 2) [2021] FCA 367). 1.3 million) levied on the serious and/or repeated invasions of privacy as a whole (i.e. There is currently no right provided under Australian privacy law to request not be subject to automatic decision-making, unless such results in discrimination in which case there are possible actions under legislation other than privacy legislation. Even where an exception permits the collection of sensitive information without consent, the entity is still obliged to meet this precondition to the collection. Organizations should comply with these notification requirements by preparing a collection statement or privacy notice for each significant collection of personal information, and providing this to individuals prior to collecting their personal information. For example, the Australian Prudential and Regulatory Authority (APRA), which regulates financial services institutions requires regulated entities to comply with Prudential Standards, including Prudential Standard CPS 234 Information Security (CPS 234), and the Australian Securities and Investment Commission regulates corporations more generally. The Attorney-General must consult with the communications provider prior to issuing the notice, and must be satisfied that the notice is reasonable, proportionate, practicable and technically feasible, Make "technical assistance requests", to give foreign and domestic communications providers and device manufacturers a legal basis to provide voluntary assistance to various Australian intelligence organizations and interception agencies relating to issues of national interest, national security and law enforcement, The Organizations identity and contact information, Anylaw requiring the collection of personal information, The fact that the organizations privacy policy contains information about how the individual may access and seek correction of their personal information, how they may make a complaint about a breach of the APPs and how the organization will deal with such complaint.