Privacy is everyone’s business – and a shared responsibility across an entire organisation. 

Privacy Awareness Week (PAW) is an annual event run by the Office of the Australian Information Commissioner (OAIC) to raise awareness of privacy issues and the importance of protecting personal information.

This year’s theme – ‘Privacy – it’s everyone’s business’ is closely tied to key reforms to the Privacy Act which came into force late last year.

The theme highlights the critical importance that all personnel in an organisation’s privacy compliance journey. PAW takes place in a more complex regulatory environment following key updates to the Privacy Act which are now in force. 

It’s not just your IT department - ‘everyone’ must play a role in keeping personal information safe and secure.

One of the key reforms to the Privacy Act were changes to APP 11. 

APP 11 requires an organisation to take ‘such steps as are reasonable in the circumstances’ to: 

• protect personal information it holds from ‘misuse, interference, loss and unauthorised access, disclosure and modification’; and
• destroy and de-identify personal information it no longer needs. 

In December 2024, Tranche 1 of the Privacy Act reforms introduced a new APP 11.3, which specifies that both technical and organisational measures should be implemented to meet the ‘reasonable steps’ criteria in protecting, de-identifying and destroying personal information. 

This means that in addition to encrypting data and implementing access controls (technical processes), securing personal information now requires ‘organisational’ (people-centric) measures such as: 

• governance and culture – which the OAIC expects to include appropriate training, resourcing and a focus from management to foster a ‘privacy and security aware culture’. The OAIC has made clear in guidance that ‘insufficient interest in personal information security from staff, in particular senior management including the board (or equivalent decision making body), can lead to threats to the security of personal information being ignored and not properly attended to’;
• effective policies and procedures – to ensure that there is ‘oversight, accountability and lines of authority for decisions regarding personal information security’; and
• personnel security and training – all staff need to be aware of their responsibilities and avoid practices that would breach privacy obligations, and be able to recognise an eligible data breach. 

A key driver for these reforms was an overemphasis on technical measures. PAW provides an opportunity for critical reflection regarding the people-centric measures in place to protect personal information and comply with obligations under the Privacy Act.

What are the other key changes to the Privacy Act now in force? 

Changes to penalty regime for contraventions of the Privacy Act

• The Privacy Act now contains three tiers of civil penalties that can be imposed for ‘serious’ or ‘repeated’ interferences with privacy. The Amendment Act introduces a new mid-tier civil penalty for interference with privacy that do not reach the threshold of ‘serious’. The maximum penalty would be $626,000 for an individual and $3.3 million for a body corporate.
• It also proposes new powers to the Office of the Australian Information Commissioner (OAIC) to issue infringement notices (imposing civil penalties of up to $62,600) for prescribed breaches of the APPs. The provision largely focuses on breaches relating to privacy policy requirements, processes around direct marketing and correction of information.
• These amendments increase the tool kit available to the OAIC and follow significant increased penalties and powers under the Act. On the ground, advising clients we have seen a distinct change in Regulator’s approach. The OAIC has advanced in maturity as a Regulator. Scrutiny is greater in respect of data breaches, complaints and breaches. The Regulator is showing an increased willingness to exercise its enforcement powers. 

New statutory tort for serious invasions of privacy 

• The Amendment Act introduces a new cause of action in tort for intentionally or recklessly intruding upon a person’s seclusion, or misusing information that relates to them, in circumstances where a reasonable expectation of privacy exists. The invasion of privacy must be ‘serious’ and is actionable without proof of damage.
• The new statutory tort considers the ‘countervailing public interest’ and prescribes specific matters which may constitute a countervailing public interest, such as national security, public health, and the detection of, and prevention of crime and fraud. This aims to ensure that the public interest is considered as part of the cause of action in every case, rather than only in those cases where the defendant has cited evidence of a public interest in the invasion of privacy.
• While it may take some time to see how the tort of privacy is applied, what is clear from our experience on the ground is the increased awareness of individuals of privacy as an issue and heighted consumer frustration when things go wrong. We are seeing an increase in complaints, access requests and individuals looking to hold organisations to account for breaches of the Privacy Act. If Australia follows the lead of UK and EU we predict that actions and expectations of individuals is only set to increase and organisations should be planning for this increased exposure.   

Compliance notice regime 

• The Amendment Act introduces a new compliance notice regime, building upon introduction of civil penalty provisions for interferences of privacy that do not reach the threshold of ‘serious’.
• Under this regime, the OAIC may issue a compliance notice to an APP entity if there is a reasonable belief that the APP entity has contravened certain APPs. This provision continues to focus on breaches relating to privacy policy requirements (APP 1), processes around direct marketing (APP 7) and access to/correction of information (APPs 12 and 13). Failure to comply with a compliance notice is a civil penalty (of up to $62,600 for corporations). By complying with the notice, the APP entity effectively admits to the contravention and is deemed to have contravened the relevant APP.
• Our prediction is that the OAIC will be keen to follow in the footsteps of the ACMA (who regulates the Spam Act) and issue these “speeding tickets” for non-compliance.

What can we expect from Tranche 2? 

Tranche 2 will likely cover a broad spectrum of issues including: 

1. expanding the definition of ‘personal information’ to potentially include information that relates to an individual ‘even if the identity of the individual is unknown’;
2. changing key exemptions, including small business and employee exemptions;
3. changing the definition of ‘consent’; and
4. alignment with the European General Data Protection Regulation to include:
   • a 72 hour notice requirement for eligible data breaches, meaning organisations are to be put under greater pressure to notify the OIAC before full details of the breach are known;
   • distinction between controllers and processors to help allocate responsibilities between organisations and service providers; and
   • a right of erasure – data may be de-identified rather than deleted. 

Take action now

The Privacy Bill was assented to on 10 December 2024. Most provisions have come into effect immediately however, other notable timeframes include: 

What you should be doing now

With the amendments to the Privacy Act in force now, there are a number of key practical steps organisations can take to prepare for the ongoing reforms.