5. What are the principles related to the general processing of personal data or PII. For example, must a covered entity establish a legal basis for processing personal data or PII in your jurisdiction, or must personal data or PII only be kept for a certain period? Please outline any such principles or “fair information practice principles” in detail.

The following are key Australian Privacy Principles:

6. Are there any circumstances where consent is required or typically used in connection with the general processing of personal data or PII?

There is no general requirement to obtain consent for the collection of most types of personal information, or for its processing. However, consent may operate as an exception to certain prohibitions under the Privacy Act or a qualification to certain obligations.

Under APP 3.3, APP Entities are prohibited from collecting sensitive information (defined above) unless the consent of the relevant individual has been obtained. Some narrow exceptions apply.

Under APP 3.6 there is a general expectation that Personal Information will be collected from the individual to which it relates. However, an exception applies which permits government agencies to collect personal information from another source if the individual has given consent.

APP 6 requires Personal Information to only be used or disclosed for the purpose for which it was collected. However, there are some exceptions to this, one being where the individual has consented to its use or disclosure for another secondary purpose.

Under APP 7, direct marketing is prohibited unless an exception applies, and one such exception is where the organisation has obtained the individual’s consent. Further, consent is the only permitted circumstance where Sensitive Information can be used for the purpose of direct marketing. The Spam Act also prohibits commercial electronic communications without consent (which may be inferred) and requires entities to allow individuals to easily withdraw consent (or “unsubscribe”).

APP 8, which generally restricts the offshore disclosure of Personal Information, allows it to occur where there is consent of the relevant individual (but note this consent has separate requirements under the Privacy Act).

7. What are the rules relating to the form, content and administration of such consent? For instance, can consent be implied, incorporated into a broader document (such as a terms of service) or bundled with other matters (such as consents for multiple processing operations)?

Where consent is applicable, under the Privacy Act, it may be express or implied. Express consent can be provided orally or in writing, although best practice requires written consent (which can be electronic). Implied consent is consent which can reasonably be inferred from the conduct.

The Privacy Commissioner’s guidance suggests that consent can only be implied in clear circumstances. For example, it will not be sufficient to merely establish that the collection, use or disclosure will be advantageous to the individual or that they didn’t object at the time of collection. The Privacy Commissioner also advises against the use of opt-out mechanisms.

The Privacy Commissioner has identified 4 elements of consent:

• (informed) the individual must be adequately informed of the implications of providing or withholding consent for it to be considered informed.
• (voluntary) the individual must have a genuine opportunity to provide or withhold consent. This may require an assessment of the alternatives available to the individual if they do not consent and the seriousness of the consequences. Bundling consent may also be problematic for assessing whether consent is voluntary, as the broader consequences of a refusal need to be considered.
• (current and specific) consent for collection and proposed uses/disclosures should be typically be obtained at the time personal information is collected. If such consent is being sought later, it should be at the time of the proposed use or disclosure requiring consent. Consent should be as directed as possible, and not a broad consent for various activities.
• (capacity) APP Entities need to consider whether the individual has capacity to give consent. Ordinarily, this can be presumed, however, the following factors may indicate that further inquiries are required: age, physical or mental disability, temporary incapacity or limited understanding of English.

One of the reforms currently being considered as part of a broader review of the Privacy Act (see item 2 for further details) is to incorporate these elements into the legislation.

8. What special requirements, if any, are required for processing sensitive PII? Are there any categories of personal data or PII that are prohibited from collection or disclosure?

There are a number of instances where the APPs impose additional restrictions in respect of sensitive information.

APP 3 requires that an individual’s consent is always required for the collection of sensitive information under the Privacy Act (unless an exception applies). This differs from other types of personal information where consent is not strictly required.

APP 6 addresses the purpose for which information may be used or disclosed. It provides that where consent has not been obtained, sensitive information can only be used for a secondary purpose if that secondary purpose is directly related to the primary purpose (that is, the purpose for which it was collected). This contrasts with other personal information which can be used for any secondary purpose which is related to the primary purpose. The term “directly related” is not expressly defined, however, it is likely to require a secondary purpose which is closely related to the primary purpose.

Under APP 7, the only circumstance in which sensitive information can only be used for the purpose of direct marketing is if the individual has consented. This is narrower than the circumstances for which other types of personal information can be used in this way (for example, where the individual would reasonably expect the information to use the non-sensitive personal information for that purpose and provides a simple means to request that the entity cease marketing).

In addition, there are special rules which apply to recipients of tax file numbers.

There are no categories of personal information that are prohibited from being collected under the Privacy Act.

9. How do the laws in your jurisdiction address children’s personal data?

The Privacy Act itself does not contain additional or special obligations relating to the use or disclosure of children’s personal information.

That said, the provisions relating to consent are likely to require an assessment of the relevant capacity of the individual, and guardian consent to be obtained where necessary. The Privacy Commissioner has provided guidance that where an individual is under the age of 18, an assessment of their capacity is required. If it is not practical to assess the capacity of an individual, the Privacy Commissioner has said that, as a general rule, APP Entities should assume that an individual over the age of 15 has capacity, unless there is evidence to the contrary.

The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) proposed reform in this area.

10. How do the laws in your jurisdiction address health data?

Under the Privacy Act, the definition of ‘sensitive information’ includes health data about an individual so the rules applying to sensitive information must be observed in respect of health data.

Some individual states also have specific laws relating to health data, for example the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic). In the Victorian and NSW examples, these apply to health services providers (in the private sector as well as applicable state government entities) operating in respective states and oblige such providers to comply with “health privacy principles” which are enumerated in the legislation. In each applicable state, these principles are similar, although not the same, as the APPs.

11. Do the laws include any derogations, exclusions or limitations other than those already described? Please describe the relevant provisions.

Questions related to the operation of the law in practice

12. Does your jurisdiction impose requirements of ‘data protection by design’ or ‘data protection by default’ or similar? If so, please describe the requirement and how businesses typically meet the requirement.

There is no express or equivalent requirement in the Privacy Act for ‘data protection by design’; however, APP 1 requires APP Entities to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and enable the entity to deal with enquiries or complaints about privacy. The Privacy Commissioner considers that this amounts to a requirement of privacy by design.

Some of the measures the Privacy Commissioner recommends entities take to address this requirement include:

• procedures for identifying and managing privacy risks at each stage of data processing, including collection, use, disclosure, storage, destruction and de-identification;
• security systems for protecting personal information from misuse, interference, loss and unauthorised access, modification or disclosure;
• a commitment to conduct privacy impact assessments in respect of new projects;
• procedures for identifying and responding to privacy breaches, access and correction requests and receiving and responding to complaints or inquiries;
• aiming to give individuals the option to remain anonymous or use a pseudonym when dealing with the organisation;
• governance mechanisms to ensure compliance with the Privacy Act;
• regular staff training;
• appropriate supervision of staff who regularly handle personal information;
• appropriate mechanisms to ensure that agents and contractors handle personal information consistently with law and the organisations practices and procedures; and
• a program of proactive review and audit of privacy processes and systems.

As mentioned, the obligation under APP 1 is limited to reasonable steps. What is reasonable will depend on the circumstances, in particular the nature of the possible information to be processed, the adverse consequences to individuals of improper use, the nature of the organisation handling the information and the cost and practicality of the steps being considered.

This is another area which may be subject to reforms as part of the Privacy Act review. For example, one of the recommendations has been to require privacy impact assessments be conducted for projects or uses of Personal Information considered high risk. The details of those reforms, and whether this proposal is adopted, remain to be seen.

13. Are owners/controllers or processors of personal data or PII required to maintain any internal records of their data processing activities or to establish internal processes or written documentation? If so, please describe how businesses typically meet these requirements. 

APP 1 expressly requires entities to maintain an up-to-date privacy policy which documents the personal information they collect and how they use and disclose it. Beyond this, there are no express record keeping obligations. However, the broader requirements of APP 1 with respect to the implementation of practices, procedures and systems to ensure compliance with the APPs may necessitate internal compliance policies and processes, including to understand what data is collected, where it is stored, how long it is to be retained, who can access it and what risks it is exposed to. This is often managed by establishing internal privacy and data use and retention policies, requirements for privacy or data impact assessments and data mapping and classification exercises, including with assistance from cyber security teams.

14. Do the laws in your jurisdiction require or recommend having defined data retention and data disposal policies and procedures? If so, please describe these data retention and disposal requirements.

There are no prescriptive requirements in this regard. Under APP 11.2, APP Entities which hold Personal Information which is no longer needed and is not required by law to be retained must take such steps as are reasonable to destroy it or ensure it is de-identified. There are no express timeframes specified for disposal.

The obligation under APP 11.2 is limited to the taking of reasonable steps. What is reasonable will depend on the circumstances, and the following factors may be relevant:

1. the amount and sensitivity of the information;
2. the nature of the organisation;
3. the possible adverse consequences to individuals if the information is mis-handled;
4. the organisation’s information handling practices (such as where handling is outsourced); and
5. the time and cost involved in complying.

Certain types of information, such as Tax File Numbers and some health information, have further retention and deletion requirements. There are also industry specific requirements, for example in the telecommunications and banking sectors.

15. When are you required to, or when is it recommended that you, consult with data privacy regulators in your jurisdiction?

The Privacy Commissioner typically acts in response to complaints from individuals or self-reporting from organisations, including under the mandatory data breach notification regime. There is not a formal process for private entities to seek pre-screening or consultation with the Privacy Commissioner in the way there may be in other jurisdictions or with other regulators in Australia. 

The situation is similar for federal agencies, although they may be required to provide their privacy impact assessments to the Privacy Commissioner. 

16. Do the laws in your jurisdiction require or recommend conducting risk assessments regarding data processing activities and, if so, in what circumstances? How are these risk assessments typically carried out?

Only Federal Government Agencies are subject to an express obligation under the Privacy (Australian Government Agencies – Governance) APP Code 2017 (Agency Code) to undertake privacy impact assessments. They must do this for all ‘high privacy risk projects’. A project may be a high privacy risk project if the agency reasonably considers that the project involves new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals. Agencies are also required to carry out privacy impact assessments where they are directed to do so by the Privacy Commissioner under section 33D of the Privacy Act.

Private sector organisations do not currently have an express obligation to conduct a privacy impact assessment, however, many choose to in order to address the obligation under APP 1 to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs. Completion of a privacy impact assessment can be used to establish that such reasonable steps have been taken, as well as identify other measures to be implemented.

The Privacy Commissioner sets out a 10-step process for conducting a privacy impact assessment. These steps are:

1. conduct a threshold assessment;
2. plan the PIA;
3. describe the project;
4. identify and consult with stakeholders;
5. map information flows;
6. prepare a privacy impact analysis and compliance check;
7. privacy management — addressing risks;
8. consider and prepare recommendations;
9. produce a report; and
10. respond and review.

One of the reforms proposed by the Attorney-General’s Privacy Act Review Report in February 2023 (see item 2 above) was the introduction of a requirement for all APP entities to conduct privacy impact assessments for activities likely to have a significant impact on the privacy of individuals.

17. Do the laws in your jurisdiction require appointment of a data protection officer or a chief information security officer (or other person to be in charge of privacy or data protection at the organization), and what are their legal responsibilities?

Only federal Government agencies are required to have a privacy officer in connection with their Privacy obligations. This is pursuant to the Agency Code applicable to them. Other larger organisations sometimes appoint a privacy officer despite not having a strict obligation to do so. 
The Privacy Officer functions required under the Agency Code include:

1. providing privacy advice internally such as:
   • the development of new initiatives that have a potential privacy impact;
   • the general application of privacy law to the agency’s activities;
   • what to consider when deciding whether or not to carry out a Privacy Impact Assessment; and
   • what safeguards to apply to mitigate any risks to the privacy of individuals;
2.  liaising with the OAIC;
3. co-ordinating the handling of internal and external privacy enquiries, privacy complaints, and requests for access to, and correction of, personal information;
4. maintaining a record of your agency's personal information holdings;
5. assisting with the preparation of Privacy Impact Assessments; and
6. measuring and documenting your agency’s performance against its privacy management plan.

18. Do the laws in your jurisdiction require or recommend employee training? If so, please describe these training requirements.

There are no express requirements, although many choose to in order to address the obligation under APP 1 to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs. The Privacy Commissioner provides a number of training resources on its website.

Further, many regulators consider training in respect of cyber security part of general risk management obligation under various laws. 

8.    Do the laws in your jurisdiction require businesses to provide notice to data subjects of their processing activities? If so, please describe these notice requirements (e.g., posting an online privacy notice). 

APP 1 requires organisations to have a Privacy Policy setting out the types of information the organisation collects, and how it is used or disclosed. Privacy policies are required to be clearly expressed and made available free of charge. Organisations typically publish their privacy policies on their public-facing website.

A privacy policy must contain:

• the kinds of information that the entity collects and holds;
• how it collects and holds information;
• the purposes for which the entity collects, holds, uses and discloses information;
• how an individual may access their information and seek correction;
• how an individual can make a complaint, and how the organisation will deal with the complaint; and
• whether the organisation will disclose the personal information to an overseas recipient, and if so the countries in which such recipients are likely to be located.

Further, APP 5 requires organisations to take reasonable steps to provide a collection notice to individuals at or before the time they are collecting personal information (or as soon as practicable after). This notice must include:

• the identity and contact details of the organisation;
• the fact that information is being collected (this is particularly important where the collection is from a third party or the collection is not obvious);
• where the collection is required by law, that fact and the details of the law requiring collection;
• the purpose for which the information is being collected;
• the main consequences for the individual if the information is not collected;
• any other entities to which the information will be provided;
• references to the organisation’s privacy policy (including a hyperlink if possible); and
• whether the organisation will disclose the personal information to an overseas recipient, and if so the countries in which such recipients are likely to be located.

The obligation under APP 5 is one of reasonable steps only. What is reasonable will depend on the circumstances.

20. Do the laws in your jurisdiction draw any distinction between the owners/controllers and the processors of personal data, and, if so, what are they? (For example, are obligations placed on processors by operation of law, or do they typically only apply through flow-down contractual requirements from the owners/controller?)

Organisations and government agencies that collect, use or disclose personal information are regulated in relation to those activities. Terms such as ‘Controller’, ‘Owner’ and ‘Processor’ are not used in the Privacy Act or state and territory privacy acts. Organisations and federal government agencies that collect, use or disclose personal information are called ‘APP Entities’ and must comply with the Privacy Act and the APPs contained in the Privacy Act. 

In practice, an important and difficult distinction is between APP Entities that collect, use or disclose personal information and organisations that as service providers to those APP Entities may handle personal information for those entities: for example, operations of data warehouses or data centres and cloud as-a-service providers. 

Where personal information is entrusted by an APP Entity that collects that personal information to another party for storage and processing, the Commissioner looks to whether the second party has ‘control’ of that information. If the second party can fully access and edit that information, the provision of that personal information to the second party is a ‘disclosure’ subject to relevant notice and consent requirements and the second party is an entity that ‘collects’ this information. However, the Commissioner has expressed the view that in limited circumstances, an APP Entity might retain such a degree of control over the information that the APP Entity is considered to be ‘using’ that information and not disclosing the information to the second party. For example, where an APP Entity provides personal information to a cloud service provider located overseas, this may be a ‘use’ if the information is provided for the limited purpose of performing the services of storing and ensuring the APP Entity may access the personal information, and a binding contract between the parties:

• requires the provider only to handle the personal information for these limited purposes;
• requires any subcontractors to agree to the same obligations; and
• gives the entity effective control of how the personal information is handled by the provider. Issues to consider include whether the entity retains the right or power to access, change or retrieve the personal information, who else will be able to access the personal information and for what purposes, what type of security measures will be used for the storage and management of the personal information and whether the personal information can be retrieved or permanently deleted by the entity when no longer required or at the end of the contract.

Whether or not other examples are considered a ‘use’ or a ‘disclosure’ will depend on the circumstances of each individual case, having regard to the degree of control held by the APP Entity.

21. Do the laws in your jurisdiction require minimum contract terms with processors of personal data or PII, or are there any other restrictions relating to the appointment of processors (e.g., due diligence or privacy and security assessments)? 

No, this is not prescribed. For instance, there is no equivalent to the model clauses required under the EU General Data Protection Regulation 2016/679.

APP Entities may in some circumstances be potentially held liable for the acts and omissions of third party suppliers of services which involve the use, storage or disclosure of personal information collected by the APP Entity. Accordingly, it is common for contracts with such suppliers to include detailed privacy provisions contractually obliging the supplier to comply with the Privacy Act and imposing other limitations and restrictions on the supplier in relation to their use and disclosure of the personal information (even though, we note, such a supplier is likely itself to be directly subject to the Privacy Act from a regulatory point of view).

More specifically, under APP 8.1, where an APP entity in Australia discloses personal information to an overseas recipient, the entity disclosing the information must take reasonable steps to ensure that the overseas recipient does not breach the APPs. One typical step taken to comply with APP 8.1 is to put in place an appropriate contractual regime with the overseas recipient of information.

Specific processing activities

22. Please describe any restrictions on monitoring, automated decision-making or profiling in your jurisdiction, including the use of tracking technologies such as cookies. How are these terms defined, and what restrictions are imposed, if any? 

These issues are not specifically addressed under Australian law. 

However, to the extent that the use of cookies involves the collection, use or disclosure or transfer of personal information, the APPs will apply. The concept of ‘collection’ of personal information applies broadly, and includes information associated with web browsing, such as personal information collected by cookies. Consequently, collection of personal information using cookies can occur provided that the notice and consent requirements are followed.

The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) has proposed reform in this area.

23. Please describe any restrictions on targeted advertising and cross-contextual behavioral advertising. How are these terms or related terms defined? 

This is not specifically addressed under Australian law. However, similar to the above comment in item 22 above, to the extent this involves use of personal information (including via cookies) the APPs will apply and need to be complied with. 

The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) has proposed reform in this area.

24. Please describe any laws in your jurisdiction addressing the sale of personal data. How is “sale” or related terms defined, and what restrictions are imposed, if any?

There are no provisions in the Privacy Act expressly controlling or prohibiting the sale or other trading of Personal Information. That said, any such sale must comply with the APPs and other obligations under the Privacy Act. For example, a sale would constitute a disclosure of Personal Information, so the requirements of APP 6 must be met.

Further, an organisation will be an APP entity (i.e., subject to the requirements of the Privacy Act) if it is in the business of selling personal information. This is so even if the organisation would otherwise be exempt as a small business.

25. Please describe any laws in your jurisdiction addressing telephone calls, text messaging, email communication or direct marketing. How are these terms defined, and what restrictions are imposed, if any?

Electronic marketing is partly regulated through subject matter-specific federal laws such as the Spam Act, which governs most forms of electronic marketing, and the DNCR Act, which regulates unsolicited telemarketing calls. 

APP 7 of the Privacy Act also regulates use or disclosure of personal information for the purpose of direct marketing activities.

Generally, organisations may only use or disclose personal information for direct marketing purposes where the individual has either consented (expressly or impliedly) to their personal information being used for direct marketing, or has a reasonable expectation that their personal information will be used for this purpose, and conditions relating to provision by the organisation of an opt-out mechanism are met.

The Spam Act prohibits ‘unsolicited commercial electronic messages’ with an ‘Australian link’ from being sent or caused to be sent. Commercial electronic messages may only be sent with an individual’s consent (express or inferred in certain circumstances), and the message contains accurate sender identification and a functional unsubscribe facility. The burden of proving consent lies with the sender of the message.

Voice calls, including synthetic or recorded calls (such as robocalls), are separately regulated under a ‘do not call’ regulatory framework established under the DNCR Act and associated legislation and instruments, including the Telecommunications Act 1997 (Cth) (Telecommunications Act), under which individuals may complain about potential breaches of the Spam Act and the DNCR Act, and the Telecommunications (Do Not Call Register) (Telemarketing and Research Calls) Industry Standard 2007. Marketing faxes are also regulated. A telemarketing call or marketing fax is broadly defined as a voice call or fax made to a number to offer, supply, provide, advertise or solicit goods or services, land or an interest in land, a business/investment opportunity and donations. Certain calls are not considered to be telemarketing or fax marketing, including product recall, fault verification, appointment rescheduling, appointment reminder, payments and solicited calls/faxes about orders, requests or customer enquiries.

The DNCR Act provides an ‘opt-out’ option, allowing Australians who do not wish to receive telemarketing calls or marketing faxes to list their private-use fixed and mobile telephone numbers and fax numbers on the DNCR. As of June 2021, total DNCR registrations exceed 10.35 million. The quantity of numbers that telemarketers and fax marketers submit for checking (or ‘washing’) against the DNCR was 620 million during the 2020-21 financial year. 

Unsolicited telemarketing calls or faxes must not be made to an Australian number registered on the DNCR without the consent (implied or express) of the relevant account holder or their nominee.

26. Please describe any laws in your jurisdiction addressing biometrics such as facial recognition. How are these terms defined, and what restrictions are imposed, if any?

The definition of ‘sensitive information’ includes: (i) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; and (ii) biometric templates, so the obligations applicable to sensitive information will apply. These are set out in the answer to item 8 above. Besides this, there are no specific requirements under the Privacy Act.

Transfers of personal data outside the jurisdiction

16. Is the transfer of personal data or PII outside the jurisdiction restricted? If so, please describe these restrictions and how businesses typically comply with them (e.g., does a cross-border transfer of personal data require a specified mechanism? Does a cross-border transfer of personal data or PII require notification to or authorisation from a regulator?)

Before an APP Entity discloses personal information to an overseas recipient, the entity must take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information (APP 8.1). Reasonable steps typically requires that the APP Entity enter into an enforceable contract with the overseas recipient which includes obligations consistent with the APPs. Alternatively, disclosure is also permissible where the APP Entity reasonably believes that the overseas entity is subject to laws or a binding scheme which is at least substantially similar to the APPs and the individual has mechanisms available to them to enforce that protection. 

An APP Entity that discloses personal information to an overseas recipient is generally accountable for any acts or practices of the overseas recipient in relation to the information that would breach the APPs (section 16C).

However, there are exceptions to the requirement in APP 8.1 to take reasonable steps and to the accountability provision in section 16C. These include obtaining the consent of the relevant individual to the overseas disclosure (after an express statement informing the individual that APP 8 will not apply), or where the APP Entity reasonably believes that the recipient is subject to an equivalent regime in its local jurisdiction and that there are mechanisms that the individual can access to take action to enforce that regime.

Data breach and security obligations

28. What security obligations are imposed on personal data or PII owners/controllers and on processors, if any, in your jurisdiction? 

APP 11 requires an APP Entity to take active measures to ensure the security of personal information it holds, and to actively consider whether it is permitted to retain personal information. An APP Entity that holds personal information must take reasonable steps to protect the information from misuse, interference and loss, as well as unauthorised access, modification or disclosure (APP 11.1). Unauthorised access includes both access by an employee of the entity or independent contractor and unauthorised access by an external third party (such as by hacking).

Reasonable steps should include, where relevant, taking steps and implementing strategies in relation to governance, culture and training, internal practices, procedures and systems, ICT security, access security, third party providers (including cloud computing), data breaches, physical security, destruction and de-identification and compliance with applicable standards.

The Commissioner not infrequently determined that internal or external data breaches are reasonably attributable to a failure by an APP Entity to take reasonable steps to protect information security or to take reasonable steps to destroy personal information or ensure it is de-identified if it no longer needs the information for any purpose for which it may be used or disclosed under the APPs.

In addition, certain types of information (such as tax file numbers) and certain sectors (such as the financial services sector) are subject to additional cyber security requirements, including under Prudential Standard CPS 234 and the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act), as referred to below, and also via general risk management obligations, including under section 912A of the Corporations Act 2001 (Cth). 

29. Do the data protection, privacy and cybersecurity laws in your jurisdiction address security breaches, and, if so, how does the law define “security breach”?

Part IIIC of the Privacy Act sets out a regime for the notification of ‘Eligible Data Breaches’. The specifics of the regime are set out in the answer to item 31.

An Eligible Data Breach occurs where:

1. there is unauthorised access to, or unauthorised disclosure of personal information or personal information is lost in circumstances where unauthorised access to, or unauthorised disclosure of the information is likely to occur; and
2. a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates.

The potential harm contemplated in this definition includes physical, psychological, emotional, economic and financial harm, as well as harm to reputation. An assessment as to whether an individual is likely to suffer ‘serious harm’ as a result of an Eligible Data Breach depends on, among any other relevant matters:

• the kind and sensitivity of the information subject to the breach;
• whether the information is protected and the likelihood of overcoming that protection;
• if a security technology or methodology is used in relation to the information to make it unintelligible or meaningless to persons not authorised to obtain it - the information or knowledge required to circumvent the security technology or methodology;
• the persons, or the kinds of persons, who have obtained, or could obtain, the information; and
• the nature of the harm that may result from the data breach.

30. Does your jurisdiction impose specific security requirements on certain sectors, industries or technologies (e.g., telecoms, infrastructure, artificial intelligence)?  

The SOCI Act was amended in 2021 and again in 2022 to ensure the strengthened resiliency of and protection of Australian businesses in critical sectors from sophisticated cyber threats. The SOCI Act imposes obligations on businesses in the following sectors which are considered ‘critical infrastructure sectors’:

• the communications sector;
• the financial services and markets sector;
• the data storage or processing sector;
• the defence industry sector;
• the higher education and research sector;
• the energy sector;
• the food and grocery sector;
• the health care and medical sector;
• the space technology sector;
• the transport sector; and
• the water and sewerage sector.

Certain businesses in these sectors may be required to (among other things):

• provide information regarding the assets it uses in the conduct of its business (including regarding the ownership and operation of those assets) for inclusion in the federal government’s register of critical infrastructure assets;
• adopt and maintain an all-hazards critical infrastructure risk management program to address, among other things, cyber risks;
• notify the Australian Signals Directorate of cyber incidents affecting an entity’s critical infrastructure assets, with (verbal) notification required within 12 hours if the cyber incident is likely to have a significant impact on the availability of the asset; and
• where assets are declared to be systems of national significance, comply with additional security obligations, including development of a cyber incident response plan, conduct of cyber security rehearsal exercises, and vulnerability assessments.

In addition, the SOCI Act provides the federal government with various access and intervention powers to address security vulnerabilities in critical assets and managing response to cyber incidents.

Entities that fail to comply with obligations under the SOCI Act are liable for fines, with maximum penalties ranging up to AUD343,750 (1,250 penalty units). The SOCI Act also includes criminal offences.

Outside of the SOCI Act, regulated entities in the financial services sector (for example, banks, insurers and superannuation providers) must comply with cyber security standards as part of their prudential regulation. Prudential Standard CPS 234 aims to bolster the cybersecurity readiness of regulated entities and minimising the likelihood and impact of incidents on confidentiality, integrity or availability of information and information systems.

CPS 234 places obligations on these regulated financial services entities with respect to how they manage their ‘information assets’. Information assets are defined to mean both data and the IT systems used to operate the business. These obligations cover cyber risk management, implementation of security controls, testing and audit of those security controls and cyber incident response.

If a cyber incident occurs which has the potential to materially affect (whether financially or otherwise) the interests of depositors, policyholders, beneficiaries or customers, then the entity is required to notify the Australian Prudential Regulation Authority (APRA) within 72 hours. Entities must also notify APRA of any incidents which it has had to notify to another regulator (for example an Eligible Data Breach notification to the Privacy Commissioner under the Privacy Act). 

The Telecommunications sector is another which has specific cybersecurity requirements. The telecommunication sector security reforms (TSSR) were introduced in 2017 as amendments to the Telecommunications Act 1997 (Cth) to establish a regulatory framework to better manage the national security risks of espionage, sabotage and foreign interference to Australia’s telecommunications networks and facilities. The TSSR contain the following key elements:

• Security obligation: all carriers, carriage service providers and carriage service intermediaries will be required to do their best to protect networks and facilities from unauthorised access and interference – including a requirement to maintain ‘competent supervision’ and ‘effective control’ over telecommunications networks and facilities owned or operated by them.
• Notification obligation: carriers and nominated carriage service providers will be required to notify government of planned changes to their systems and services that could compromise their capacity to comply with the security obligation.
• Information gathering power: the Secretary of the Department of Home Affairs has the power to obtain information and documents from carriers, carriage service providers and carriage service intermediaries, to monitor and investigate their compliance with the security obligation.

Directions power: the Home Affairs Minister has a new directions power, to direct a carrier, carriage service provider or carriage service intermediary to do, or not do, a specified thing that is reasonably necessary to protect networks and facilities from national security risks.

31. Under what circumstances must a business report security breaches to regulators, to individuals or to other persons or entities? If breach notification is not required by law, is it recommended by the regulator, and what is the typical custom or practice in your jurisdiction? 

Where an APP Entity is aware that there are reasonable grounds to believe that there has been an Eligible Data Breach (whether it forms such an awareness following an assessment of a reasonable suspicion that an Eligible Data Breach may have occurred (which such assessment must take no more than 30 days), or otherwise), the entity must as soon as practicable:

1. prepare a statement that, at a minimum, contains:
   • the entity’s contact details. If relevant, the identity and contact details of any entity that jointly or simultaneously holds the same information in respect of which the eligible data breach has occurred, for example, due to outsourcing, joint venture or shared services arrangements may also be provided. If this information is included in the statement, that other entity will not need to separately report the eligible data breach;
   • a description of the data breach;
   • the kinds of information concerned; and
   • the steps it recommends individuals take to mitigate the harm that may arise from the breach. (While the entity is expected to make reasonable efforts to identify and include recommendations, it is not expected to identify every possible recommendation that could be made following a breach);
2. provide a copy of this statement to the OAIC; and
3. take such steps as are reasonable in the circumstances to notify affected or at risk individuals of the contents of the statement. Individuals may be notified by the mode of communication normally used by the entity, or if there is no normal mode of communication, by email, telephone or post. If direct notification is not practicable, the entity must publish the statement on its website and take reasonable steps to publicise its contents.

The OAIC provides a standard form which may be used to notify, found here. 

What constitutes a ‘practicable’ timeframe will vary depending on the time, effort or cost required to comply with the above requirements. The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) has proposed reform in this area, including the introduction of a 72-hour

notification requirement.
Additional reporting requirements may apply based on the sector as described in item 30 above, including under both the SOCI Act and CPS 234. 

32. Does your jurisdiction have any specific legal requirement or guidance regarding dealing with cybercrime, such as the payment of ransoms in ransomware attacks? 

The stated policy of the Australian Government is that ransoms should never be paid, however, payment of ransoms is not expressly outlawed, subject to compliance with sanctions law and laws relating to funding of criminal or terrorist organisations.

As described above, there are a number of sector specific laws which require reporting of cyber incidents. This includes the SOCI Act, which requires certain incidents to be notified within 12 hours. 

33. Does your jurisdiction have a separate cybersecurity regulator? If so, please provide details.

As Australian law dealing with cybersecurity is still piecemeal, there are a number of regulators with responsibilities. Some such regulators are set out below.

• The Privacy Commissioner which has responsibility for security related aspects of privacy law.
• The Department of Home Affairs which administers the SOCI Act.
• A number of industry specific regulators in sectors for which there are cyber specific obligations (for example, APRA in respect of financial services). 
• The Australian Cyber Security Centre (ASCS) which is part of the Australian Signals Directorate and is tasked with leading the federal government’s operational response to cyber issues, but which has minimal regulatory powers at present.

Individual rights

34.  Do the laws in your jurisdiction provide individual data privacy rights such as the right to access and the right to deletion? If so, please provide a general description of the rights, how they are exercised, what exceptions exist and any other relevant details. 

35. Are individual data privacy rights exercisable through the judicial system or enforced by a regulator or both?  

Individual data privacy rights are only exercisable through the regulator, which is the Privacy Commissioner. Affected individuals can lodge complaints with the Privacy Commissioner which has a formal investigation and conciliation, or determination process prescribed in the Privacy Act.

The Attorney-General’s Privacy Act Review Report in February 2023 (see item 2) has proposed reform in this area, including a direct right of action for individuals.

36. Does the law in your jurisdiction provide for a private right of action and, if so, in what circumstances? 

The Privacy Act does not currently provide a private right to claim damages, only a right to enforce a declaration by the Privacy Commissioner for compensation or to seek an injunction. The private right to seek injunctive relief has been used very infrequently.

There are current proposals for law reform being considered at the moment which would introduce a private right of action and/or a statutory tort for invasion of privacy which could be enforced by individuals. These reforms are discussed further in item 2.

We note that privacy breaches may arise in circumstances which also constitute a breach of confidentiality. Where this is the case, individuals may have rights under a contract with the entity or an equitable duty of confidentiality may also apply under common law.

37. Are individuals entitled to monetary damages or compensation if they are affected by breaches of data protection, privacy and/or cybersecurity laws? Is actual damage required, or is injury of feelings sufficient?

The Privacy Commissioner has power to award compensation to individuals affected by breaches of the Privacy Act. This is available both for financial loss as well as for non-economic losses, such as emotional harm, humiliation or inconvenience.

The Privacy Commissioner has applied the following principles in awarding compensation:

The Privacy Commissioner has applied the following principles in awarding compensation:

• principles of damages applied in tort law will assist in measuring compensation;
• compensation should be assessed having regard to the complainant’s reaction (not a ‘reasonable person’ test);
• there must be a good reason not to award compensation once loss is established; and
• aggravated damages may be awarded in appropriate cases.

While aggravated damages are seldom awarded, it is open to the Privacy Commissioner to do so, particularly if:

• an entity’s conduct is considered to be ‘high-handed, malicious, insulting or oppressive’; or
• the entity has acted in a way that exacerbates the complainant’s injury or hurt feelings.

Regulatory enforcement

38. How are data protection, privacy and cybersecurity laws enforced?  

Privacy enforcement

The Privacy Commissioner has a range of regulatory powers including powers to: 

• conduct an assessment of whether an entity is maintaining and handling personal information in accordance with relevant provisions (such as the APPs);
• direct a government agency (but not private sector organisations) to give the Privacy Commissioner a privacy impact assessment;
• request entities to develop an APP code or impose one where appropriate;
• investigate an entity following a complaint;
• investigate an entity on its own initiative, that is, without someone making a complaint (Commissioner initiated investigation);
• accept an enforceable undertaking from an entity. An enforceable undertaking is a promise by an entity that it will take specified action or refrain from taking specified action in order to comply with relevant privacy provisions, or to ensure it does not do an act or engage in a practice that interferes with an individual’s privacy;
• make a determination on a privacy complaint. The Privacy Commissioner can also make a determination after conducting a Commissioner initiated investigation; and
• apply to the courts for an injunction to restrain a person from engaging in conduct that would constitute a breach of relevant privacy provisions or for an order that an entity pay the civil penalty.

The Privacy Act provides several complaints paths for individuals where there has been (or is suspected to have been) a breach of an APP. The primary complaints process is through a complaint to the Privacy Commissioner, initiating an investigation by the Privacy Commissioner (sections 36 and 40). This process typically requires that the individual has first complained to the relevant APP Entity. 

An investigation may result in a determination by the Privacy Commissioner, containing a declaration that: 

• the respondent’s conduct constituted an interference with the privacy of an individual and must not be repeated or continued;
• the respondent must take specified steps within a specified period to ensure that such conduct is not repeated or continued;
• the respondent must perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;
• the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint; or
• that no further action is needed (section 52(1)).

A complainant may apply to the Federal Court of Australia or the Federal Circuit and Family Court of Australia to enforce a determination of the Commissioner (section 55A). An individual may also apply to the Federal Court or Federal Circuit and Family Court of Australia for an injunction where a person has, is, or is proposing to engage in conduct that was or would be a breach of the Privacy Act (section 98). 

There is not a private right to claim damages, only a right to enforce a declaration by the Privacy Commissioner for compensation or to seek an injunction. The private right to seek injunctive relief has been used very infrequently.

Section 80W of the Privacy Act empowers the Privacy Commissioner to apply to the Federal Court or Federal Circuit and Family Court of Australia for an order that an entity, that is alleged to have contravened a civil penalty provision, pay a civil penalty. A civil penalty order financially penalises an entity, but does not compensate individuals adversely affected by the contravention (although, as noted above, the Privacy Commissioner also has these powers). 

The ‘civil penalty provisions’ in the Privacy Act include: 

• for serious or repeated interferences with privacy (section 13G) – with maximum penalties for companies of the greater of: (a) AUD50 million; (b) 3 times the benefit gained from the ‘interference’ or contravention (if that is able to be ascertained); or (c) 30% of the company’s annual turnover (if the benefit gained is not able to be ascertained), and
• various civil penalty provisions set out in Part IIIA – which are only applicable to credit reporting bodies and credit providers – with maximum penalties of either AUD687,500, AUD1,375,000 or AUD2,750,000 depending on the offence (500, 1000 or 2000 penalty units, and multiplied by 5 in the case of companies, respectively).

It is important to note that while other enforcement actions (such as the making of determinations and the award of compensation) can be made by the Privacy Commissioner, liability for civil penalties only arises where it is ordered by the Federal Court.

Where an APP Entity experiences an Eligible Data Breach, the occurrence of that data breach in and of itself is unlikely to result in the entity facing penalties. However, a failure to (amongst other things): 

• if an entity has a reasonable suspicion that there may have been an eligible data breach, carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe that an eligible data breach occurred and to take all reasonable steps to ensure that that assessment is completed within 30 days after the entity becomes suspicious; and
• report an eligible data breach,

will be considered an “interference with the privacy of an individual” affected by the Eligible Data Breach (section 13(4A)). 

Cybersecurity enforcement

As mentioned, cybersecurity regulation is still piecemeal in Australia with most regulation being sector-based. 

In relation to the SOCI Act, it contains both civil penalty provisions which are dealt with by way of fines, and two criminal offences, which are punishable with fines or potentially imprisonment.  The civil penalty provisions range up to AUD343,750 (1,250 penalty units) for corporations.

The criminal offences under the SOCI Act are: 

• failure to comply with an action direction given by the Home Affairs Secretary under section 35AQ - this only applies to the responsible entity for a critical infrastructure asset; and 
• the use or disclosure of protected information (which is information pertaining to an entity’s SOCI Act obligations) except in permitted circumstances - this applies to all individuals and organisations. 

The offences are punishable by fines of up to AUD165,000 (600 penalty units) for corporations or AUD33,000 (120 penalty units) or 2 years imprisonment for individuals. 

39. What is the range of sanctions (including fines and penalties) for violation of data protection, privacy and cybersecurity laws? 

Civil penalties may be imposed for a serious or repeated interference with privacy. The maximum civil penalty that may be imposed was recently increased and is now the greater of:

• AUD50 million;
• 3 times the benefit gained by the interference (if that number is able to be ascertained); or
• 30% of the annual turnover of the company.

There are also a number of civil penalty provisions which are applicable to credit reporting bodies and credit providers who use or disclose information in contravention of the Privacy Act. The current maximum civil penalty that may be imposed is AUD2,750,000 (10,000 penalty units) for corporate entities.

40. Are there any guidelines or rules published regarding the calculation of fines or thresholds for the imposition of sanctions?

No, civil penalties are a matter for Court discretion and there are no guidelines in the Privacy Act (other than the maximum penalty).

41. Can personal data or PII owners/controllers appeal to the courts against orders of the regulators? 

Yes, as described above, privacy enforcement in Australia occurs through the Federal Court and Federal Circuit and Family Court of Australia. Where the Privacy Commissioner is seeking injunctions or penalties, it must do so through a court process. Similarly, if the Privacy Commissioner (or an individual) is seeking to enforce a determination of the Privacy Commissioner, or an entity (or Federal Government agency) is seeking to appeal a determination, this must be done through court proceedings, generally comprising the Commonwealth administrative appeals process in Australia (either a merit review through the Administrative Appeals Tribunal or a judicial review by the Federal Court of Australia or Federal Circuit and Family Court of Australia).

42. Are there any identifiable trends in enforcement activity in your jurisdiction?

Prior to 2014 the Privacy Commissioner seldom exercised the power to make determinations as to an alleged breach of privacy. In the period between 2014 and 2023, the Commissioner has made 55 determinations (with 11 determinations made in 2021 and 2022 respectively) and an upward trend in formal enforcement activity appears to be continuing. 

Between 2014 and 2016, the Commissioner sought to conciliate complaints between the relevant parties, with an apology to the complainant the most common remedy achieved through conciliation, followed by compensation as the next most common. Since 2017, however, compensation has been the most common remedy applied. The amount of compensation paid to an individual  complainant between 2014 and 2023 has varied between AUD2,000 to AUD20,000. For instance, in January 2021, the Commissioner made findings against the Commonwealth Department of Home Affairs, holding that it had interfered with the privacy of 9,258 individuals breaching IPP 11 and failed to protect personal information from loss, unauthorised access, use, modification or disclosure or other misuse, breaching IPP 4. The Commissioner’s determination awarded a class of 1,297 members compensation ranging between $0 to more than $20,000. The Commissioner held that the quantum of compensation was to be calculated based on the nature of the loss and damage experienced by the individual as a result of the breach. We understand this determination is subject to an ongoing appeal by one of the potential complainants.

As at February 2023, the Commissioner has accepted 11 enforceable undertakings. An enforcement undertaking may impose a significant administrative and operational load upon the party giving the undertaking. The following are two examples of enforceable undertakings accepted by the Commissioner, one in 2014 and the other in 2023.

Following two information security breaches by Singtel Optus, in July 2014, the Commissioner initiated an investigation which concluded with the Commissioner agreeing to accept an enforceable undertaking from Singtel Optus. Optus undertook to:
engage an independent auditor to conduct reviews and provide audit certifications, including as to whether Optus’s practices, procedures and systems are reasonable to protect the personal information Optus holds from misuse, interference or loss, or unauthorised access, modification or disclosure; and whether enhancements to Optus’s monitoring program of change management that has the potential to affect the security of its customers’ personal and sensitive information and as to Optus’s penetration testing for fixed and mobile services were effective;

• conduct on an ongoing basis an audit review of new procedures for review of all major IT projects as part of Optus’s Security Risk Assessment process and as part of its annual monitoring program; and
• conduct a review of Optus’s vulnerability detection processes across the organisation; certifications of a privacy incident review, a service level security posture assessment, an architecture review of Optus’s principal IT systems (top 20 applying a risk-based approach), and a review of Optus’ new voicemail platform.

Following an information security breach involving Marriott International, in February 2023, the Commissioner accepted an enforceable undertaking from Marriott International requiring it to:

• monitor the effectiveness of the privacy and security risk management strategy set by Marriott’s privacy and information security leadership and policies;
• monitor the effectiveness of Marriott’s Global Information Security & Privacy Incident Response Plan (Incident Response Plan) on no less than an annual basis and evaluate and revise if necessary;
• engage independent third parties to assess Marriott’s information security controls and audit Marriott’s security compliance with the Payment Card Industry Data Security Standard for its reservations system; and
• monitor, through engagement of security firms, for evidence of public disclosure or unauthorised use of personal information of individuals covered by the Privacy Act which were disclosed as a result of Marriott data breach and notify the Commissioner and affected individuals if evidence of such disclosure or use is discovered.

Reform

43. Are there any proposals for reforming data protection, privacy and/or cybersecurity laws currently under review? Please provide an overview of any proposed changes and how far such proposals are through the legislative process.

As described in item 2.