On 16 February 2023, the Attorney General released the Privacy Act Review Report (the Report) which contains 116 proposals for the reform of the Privacy Act.
While no draft legislation has been released the proposals provide a guide as to the future direction of privacy protection laws in Australia.
It is proposed that there be a new definition of personal information. The new definition will replace the word “about“ in the definition with the words “relates to”. The definition will now read “information or an opinion that relates to an identified individual.” This will capture more information and be consistent with other Australian legislation that deals with privacy as well as the European General Data Protection Regulation (GDPR).
It is proposed to supplement an individual’s right to complain to the OAIC with a right of action to enforce privacy rights.
It is proposed that the time frame to report a Notifiable Data Breach be reduced to 72 hours. In addition, any report of a breach must set out what is proposed be done in respect to the breach.
The Report proposes mandatory Privacy Impact Assessments (PIA) for any “high privacy risk activity”. Guidelines are to be published giving guidelines as to high risk activities and when a PIA will be required.
Targeted advertising, including the use of de-identified information , will be prohibited. Individuals will have the right to opt out of targeted advertising, and any or permitted targeted advertising must be “fair and reasonable”. These proposals follow laws introduced last year in Europe.
Proposals 16 and 17 relate to the protection of children and vulnerable individuals. Entities must have regard to the best interest of the child. In the case of vulnerable individuals a PIA must be performed if an activity may have a significant impact.
It is proposed that a statutory tort for serious invasion of privacy that is intentional or reckless be introduced. It will be enough to suffer emotional distress, proof of actual damage will not be required.
Anyone who wishes to provide feedback to the government on the report must do so by 31 March 2023.
To discuss your organisation’s privacy policy and adherence to Australia Privacy laws please contact Peter Jackson at FCW Lawyers.
