Chapter 1Introduction

1.1On 19 September 2024, the Senate referred the provisions of the Privacy and Other Legislation Amendment Bill 2024 (the bill) to the Legal and Constitutional Affairs Legislation Committee (the committee) for inquiry and report by 14November 2024.[1]

1.2The referral followed a recommendation of the Senate Standing Committee for the Selection of Bills. Appendix 4 to that committee's report suggested an inquiry would allow stakeholders to examine the new offences in the bill particularly in relation to doxxing reforms and the effect of regulatory changes on online platforms and social media.[2]

Conduct of the inquiry

1.3In accordance with its usual practice, the committee advertised the inquiry on its website and wrote to relevant organisations and individuals inviting submissions by 11 October 2024. The committee received 75 submissions, which are listed at Appendix 1 and are available on the committee's website.

1.4The committee held a public hearing in Canberra on 22 October 2024. A list of witnesses is provided at Appendix 2.

1.5Answers to questions on notice and other material received by the committee are listed at Appendix 1. Submissions and the Hansard transcript of evidence may be accessed through the committee website.

1.6The committee thanks the organisations and individuals who gave evidence at the public hearing as well as those who made written submissions.

Structure of the report

1.7The report comprises two chapters as follows:

Chapter 1 outlines the administrative details of the inquiry, background to the inquiry and the key provisions of the bill.

Chapter 2 explores the key issues raised in evidence and provides the committee's views and recommendations in relation to the bill.

Note on references

1.8References to Committee Hansard are to proof transcripts. Page numbers may vary between proof and official transcripts.

Purpose of the bill

1.9The bill would enact a first tranche of reforms to the Privacy Act 1988 (Privacy Act) agreed by the government in its Response to the Privacy Act Review. The bill would also introduce a new statutory tort for serious invasions of privacy and targeted criminal offences to respond to doxxing.[3]

Background

1.10On 3 September 2014, the Australian Law Reform Commission (ALRC) released the final report for its inquiry into serious invasions of privacy in the digital era. In that report, the ALRC recommended the establishment of a statutory cause of action for serious invasions of privacy.[4]

1.11In June 2019, the Australian Competition and Consumer Commission (ACCC) released the Digital Platforms Inquiry report (DPI report). That report recommended that the government undertake a review of the Privacy Act.[5]

1.12The DPI report also recommended the introduction of a statutory tort for serious invasions of privacy.

1.13On 16 February 2023, the Hon Mark Dreyfus KC MP, Attorney-General, released the Privacy Act Review Report 2022 (Privacy Act Review). It recognised that technological advancements have had significant implications for the privacy of personal information since the passage of the Privacy Act. Since that time:

Digitalisation and technological innovation have had a significant impact on the ways in which personal information is exchanged and used, as well as the volume of information handled. Our society is increasingly networked:decisions made by one individual about their personal information can impact the privacy of others. At the same time, the community expects that personal information will be protected.[7]

1.14On 28 September 2023, the government released its response to the Privacy Act Review. That response acknowledged the implications that technological advancement has had for the privacy of Australians' information:

The digital economy has led to innovation, advances in productivity and efficiency and a range of other benefits for Australians. However, the vast data flows underpinning digital ecosystems have also created the conditions for recent major data breaches affecting millions of Australians, with their sensitive personal information being exposed to the risk of identity fraud and scams. Strong privacy protections are critical to building the security, confidence and trust necessary to drive innovation and economic growth.[8]

1.15The Privacy Act Review 'concluded that it is necessary to overhaul Australia's privacy laws, as many other countries have done, to ensure they remain fit-‍for-‍purpose in the digital age'.[9]

1.16There is widespread public support for privacy reform. According to the 2023 Office of the Australian Information Commissioner Australian Community Attitudes to Privacy Survey:

Three in five (62%) of Australians surveyed see the protection of their personal information as a major concern in their life, and 75% consider that data breaches are one of the biggest privacy risks they face today (increasing by 13% since 2020). Only 32% feel in control of their data privacy, and 84% want more control and choice over the collection and use of their personal information. 89% would like the Government to provide more legislation in this area.[10]

1.17According to the Explanatory Memorandum (EM), the Privacy Act is not fit-‍for-‍purpose in the digital age. It does not adequately protect Australians' data, particularly as the digital landscape has evolved. Privacy legislation:

…has not kept pace with Australians' widespread adoption and reliance on digital technologies, which increases the risks that personal data will be subject to misuse or mishandling, including through data breaches, fraud and identity theft, unauthorised surveillance and other significant online harms.[11]

1.18The EM defines doxxing as 'the intentional malicious exposure of an individual's personal data online'. The public release of that data may:

…expose victims, including family members and associates of the individual whose data is released, to a wide range of harms including harassment and threats to their lives or physical safety, public embarrassment, humiliation or shaming, discrimination, stalking, identity theft and financial fraud.[12]

1.19It further states that, once the data becomes publicly available, the risk of harm may be enduring. To address that risk:

Victims of doxxing may be required to take significant steps, and incur significant cost and hardship…Doxxing can also cause psychological harms, both directly and as a result of the occurrence, or the fear of the occurrence, of the previously-mentioned harms.[13]

1.20The victims of doxxing are exposed:

…to physical threats, public embarrassment, humiliation or shaming, discrimination, identity theft and financial fraud, and other serious harms. These risks are magnified where the release of personal information involves women and children in the context of domestic and family violence.[14]

1.21The Attorney-General's Department (AGD) reported that it:

…received approximately 100 submissions through the public consultation process on doxxing. That was a process that we held between 11 to 20March2024. In addition to that, we convened a roundtable on doxxing and privacy reforms alongside the eSafety Commissioner.[15]

1.22The government agreed that an overhaul of the Privacy Act is required for multiple reasons, including to safeguard personal information and the competitiveness of Australian businesses:

Australia can no longer afford to have inadequate privacy protections. Privacy uplift is needed to guard against identity fraud, scams and the risk to businesses of failing to manage personal information appropriately. Business sustainability relies on the ability to protect personal information. A failure to uplift Australia's privacy standards to more closely align with global standards also has the potential to adversely impact the international competitiveness of Australian businesses.[16]

1.23The Privacy Act Review proposed 89 legislative changes. Of those proposed changes, the government 'agreed to 25 proposals, agreed in-principle to 56 and noted eight'. If it is passed, '[t]he bill would implement 23 of the 25 legislative proposals that were agreed in the Government Response to the Privacy Act Review'.[17]

1.24In introducing the bill to the House of Representatives, the Attorney-General outlined its main provisions:

Schedule 1 of the bill will amend the Privacy Act to enhance its effectiveness, strengthen the enforcement tools available to the privacy regulator and better facilitate safe overseas data flows. It will require the development of a children's online privacy code, streamline information-sharing in emergencies and following eligible data breaches, and increase transparency when entities are automating significant decisions which use personal information.

Schedule 2 of the bill will introduce a new statutory tort to provide redress for serious invasions of privacy.

Schedule 3 of the bill will amend the Criminal Code Act 1995 to introduce new criminal offences to target the harmful practice of doxxing.[18]

Key provisions of the bill

1.25The bill comprises the following three schedules:

Schedule 1—Privacy reforms;

Schedule 2—Serious invasions of privacy; and

Schedule 3—Doxxing offences.

Schedule 1—Privacy reforms

1.26The privacy reforms contained in Schedule 1 of the bill are divided into 15 parts. The key provisions of Schedule 1 raised by submitters are contained in the following parts:

Part 2—Australian Privacy Principle (APP) codes;

Part 3­—Emergency declarations;

Part 4—Children's privacy;

Part 6­—Overseas data flows;

Part 8—Penalties for interference with privacy; and

Part 15—Automated decisions and privacy policies.

Part 2—Australian Privacy Principle codes

1.27The bill would amend the Privacy Act to allow the minister to direct the Information Commissioner to develop an APP code.[19] Before registering that code, the Information Commissioner would be required to make a draft of it publicly available and invite the public to make submissions about the draft over a period of at least 40 days.[20]

1.28An APP code is:

…a written code of practice for the handling of personal information…[that] sets out how one or more of the APPs are to be applied or complied with, and the APP entities that are bound by the code.[21]

1.29The bill would also amend the Privacy Act to allow the minister to direct the Information Commissioner to develop a temporary APP code if there is an urgent need for such a code to be made.[22] A temporary APP code would not be able to operate for a period longer than 12 months.[23]

1.30According to the EM:

APP codes provide greater clarity and specificity about how the principles-‍based [APPs] are to be applied and complied with. The Bill enhances the right to privacy by promoting greater compliance and providing confidence to members of the community that their personal information will be handled appropriately. This is particularly important given the growing calls for APP codes to be developed in response to the privacy risks arising from new and emerging technologies.[24]

1.31The establishment of temporary APP codes 'would promote the right to privacy by providing greater flexibility and efficiency to the APP code-making process'.[25] For example, during a pandemic emergency temporary APP codes could be developed:

…to instruct APP entities on how to comply with APPs while collecting contact-tracing information, and give greater transparency to the community on how their personal information is being handled.[26]

1.32Temporary APP codes are intended to only be in force during urgent situations:

If it was proposed that the enforceable requirements within a temporary APP code would be extended beyond a 12-month period, these should be subject to the usual provisions for developing an APP code, including mandatory consultation on the code and tabling in Parliament.[27]

Part 3—Emergency declarations

1.33The bill would amend the Privacy Act to require an emergency declaration to specify the kinds of personal information,[28] types of entities permitted to share personal information,[29] and the purposes for which that information may be shared.[30]

1.34The permitted purposes for sharing that information would be required to relate to the Commonwealth's response to the emergency or disaster for which an emergency declaration is in force.[31]

1.35During declared emergencies or disasters, those purposes may include:

identifying individuals involved, or at risk of being involved;[32]

assisting individuals affected, or at risk of being affected, to gain access to services;

assisting law enforcement;

coordinating or managing the response;

ensuring that other persons responsible for those individuals affected, or at risk of being affected, are informed of matters related to those individuals.[33]

1.36The emergency declarations provisions of the bill would 'authorise more targeted handling of personal information to assist individuals in emergency and disaster situations'.[34]

1.37The Attorney-General explained that the bill would allow the sharing of personal information by permitted entities following disasters or emergencies. The sharing of that information would 'support response efforts, including to assist affected individuals'.[35]

Part 4—Children's privacy

1.38The bill would require the Information Commissioner to develop an APP code about online privacy for children. That APP code would be known as the Children's Online Privacy Code (COP Code).[36]

1.39According to the EM, '[t]he COP Code would be an enforceable APP code that sets out how one or more of the APPs are to be applied or complied with in relation to the privacy of children'.[37]

1.40An APP entity would be bound by the COP Code if:

it provides a social media service, relevant electronic service or designated internet service within the meaning of the Online Safety Act 2021;

children are likely to access the service; and

it does not provide a health service;[38] or

it is an APP entity, or is included in a class of APP entities, specified in the COP Code.[39]

1.41The Information Commissioner must develop and register the COP Code within two years of the bill receiving Royal Assent.[40]

1.42The COP Code would be required to set out how the APPs 'are to be applied or complied with in relation to the privacy of children'.[41] For example, the COP Code could set out how APP entities communicate their privacy policies and consent notices to children:

…the COP Code may set out how regulated entities must meet requirements in APP 1 and 5 in relation to privacy policies and consent notices by ensuring that information addressed to a child is clearly expressed and understandable – such as through the use of graphics, video and audio content rather than relying solely on written communication.[42]

1.43Providers of online services 'are expected to proactively assess the likelihood that their service is accessed by children, regardless of if the service is not explicitly targeted at children'.[43] To assist them in making that assessment, the Information Commissioner may provide written guidelines to assist entities in determining whether they provide a service that is likely to be accessed by children.[44]

1.44The COP Code would differ from other APP codes as it must be developed by the Information Commissioner rather than 'by an APP code developer on their own initiative, or on request by the Information Commissioner'. The COP Code would be developed in this way as:

There is a public interest and community expectation in ensuring that a COP Code is developed and registered, and is developed by the Information Commissioner who has particular expertise in privacy. This will avoid any potential industry regulatory biases, and conflicting commercial interests.[45]

1.45The Attorney-General indicated that children are particularly vulnerable to online privacy risks. The extent of that risk is evident in the amount of data that is collected about them. According to the Attorney-General, 'by the time a child turns 13, around 72 million pieces of data will be collected about them'.[46]

1.46Social media companies and other providers of online services accessed by children would be required to adhere to the COP Code. The code would 'specify how these entities must comply with privacy obligations in relation to children'. It would also align as closely as 'possible with similar codes in like-minded countries, such as the United Kingdom'.[47]

Part 6—Overseas data flows

1.47The bill would amend the Privacy Act to introduce APP 8.3.[48] That APP would allow for countries, or binding schemes, that have data privacy laws that are 'substantially similar' to Australia's to be prescribed via regulation.[49]

1.48The EM states that its introduction:

…would enhance the free flow of information across national borders while ensuring the privacy of individuals is respected by providing greater certainty to disclosing entities about the standard of privacy protections in countries in which overseas recipients of personal information are located.[50]

1.49In the globalised economy, the transnational flow of information 'is critical for international trade and services'. The bill would enable 'countries with substantially similar data privacy laws to Australia to be prescribed. Businesses and individuals will be able to have greater confidence that personal information will be kept safe'. The provision would 'also reduce costs for business when entering into contracts and agreements with overseas entities'.[51]

Part 8—Penalties for interference with privacy

1.50The bill would amend the Privacy Act to introduce civil penalty provisions for the serious interference with the privacy of an individual.[52]

1.51To determine if an interference with the privacy of an individual is serious, the following factors may be taken into account:

(a)the particular kind or kinds of information involved in the interference with privacy;

(b)the sensitivity of the personal information of the individual;

(c)the consequences, or potential consequences of the interference with privacy for the individual;

(d)the number of individuals affected by the interference with privacy;

(e)whether the individual affected by the interference with privacy is a child or person experiencing vulnerability;

(f)whether the act was done, or the practice engaged in, repeatedly or continuously;

(g)whether the contravening entity failed to take steps to implement practices, procedures and systems to comply with their obligations in relation to privacy in a way that contributed to the interference with privacy; and

(h)any other relevant matter.[53]

1.52The maximum penalty that would be applied to someone who is found to have seriously interfered with an individual's privacy would be 2000 penalty units (currently $626 000).[54] Alternatively, if the court finds that an individual's privacy has been interfered with, but not in a serious manner, it may make a pecuniary penalty order.[55]

1.53The bill would allow a court to apply a civil penalty to an entity if it is found noncompliant with certain APPs. That penalty would not exceed 200 penalty units (currently $62 600).[56]

1.54The EM states that the bill would introduce a tiered penalty regime that is 'commensurate with the seriousness of the interference with privacy'.[57]

1.55The Attorney-General argued the tiered civil penalty regime would assist in the enforcement of the Privacy Act.[58]

Part 15—Automated decisions and privacy policies

1.56The bill would amend the Privacy Act to introduce APP 1.7.[59] That principle would apply to an APP entity if:

(a)the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making a decision;

(b)the decision could reasonably be expected to significantly affect the rights or interests of an individual; and

(c)personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.[60]

1.57If APP 1.7 applies to an entity, the entity would be required to provide the following information in its privacy policy:

(a)the kinds of personal information used in the operation of such computer programs;

(b)the kinds of such decisions made solely by the operation of such computer programs; and

(c)the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.[61]

1.58Automated decision-making processes 'have the potential to increase the efficiency, accuracy and consistency of decisions, and they present opportunities for improved outcomes in health, environment, defence and national security'.[62]

1.59The bill would 'provide individuals with transparency about the use of their personal information in automated decisions which significantly affect their interests'. Any entity that makes automated decisions would be required 'to specify the kinds of personal information used in these sorts of decisions in their privacy policies'.[63]

Schedule 2—Serious invasions of privacy

1.60Schedule 2 of the bill would insert a statutory tort for serious invasions of privacy into the Privacy Act.

1.61The objects of Schedule 2 would be to:

(a)establish a cause of action for serious invasions of privacy;

(b)provide for defences, remedies and exemptions in respect of the cause of action;

(c)recognise that there is a public interest in protecting privacy;

(d)recognise that the public interest in protecting privacy is balanced with other public interests; and

(e)implement Australia's international obligations in relation to privacy.[64]

Cause of action

1.62The bill would provide a plaintiff with a cause of action in tort against a defendant if:

(a)the defendant invaded the plaintiff's privacy by doing one or both of the following:

(i)intruding upon the plaintiff's seclusion;

(ii)misusing information that relates to the plaintiff; and

(b)a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances;

(c)the invasion of privacy was intentional or reckless; and

(d)the invasion of privacy was serious.[65]

1.63Proof of damage would not be required to demonstrate that the defendant invaded the plaintiff's privacy.[66]

1.64If the defendant argues that there was a public interest in invading the privacy of the plaintiff, the defendant would be required to provide evidence to demonstrate the public interest outweighed the protection of the plaintiff's privacy.[67]

1.65Without restricting the kind of evidence that the defendant could present, the kind of evidence they could provide to meet the public interest test would include:

(a)freedom of expression, including political communication;

(b)freedom of the media;

(c)the proper administration of government;

(d)open justice;

(e)public health and safety;

(f)national security; or

(g)the prevention and detection of crime and fraud.[68]

1.66In its consideration of whether the plaintiff had a reasonable expectation of privacy, the court may consider the following non-exhaustive matters:

how the defendant invaded the plaintiff's privacy, including through the use of a device or technology;

the defendant's reason for invading the plaintiff's privacy;

the plaintiff's personal attributes, such as age, occupation or cultural background;

whether the plaintiff 'invited publicity or manifested a desire for privacy';

where the intrusion of the plaintiff's privacy occurred;

the type of information that the defendant misused in their invasion of the plaintiff's privacy, how that information was obtained or shared by the defendant, and the extent to which that information was already in the public domain.[69]

1.67To determine if the invasion of privacy was serious, the court may consider a range of matters not limited to:

(a)the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff;

(b)whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff;

(c)if the invasion of privacy was intentional—whether the defendant was motivated by malice.[70]

1.68The EM states that the statutory cause of action:

…would implement the Australian Law Reform Commission's recommendation in its 2008 report For Your Information: Australian Privacy Law and Practice (ALRC Report 108). The model of the statutory tort set out in this Bill is informed by the ALRC's 2014 report Serious Invasions of Privacy in the Digital Era (ALRC Report 123).[71]

1.69The Attorney-General explained that the bill would address community expectations in relation to individual rights to seek legal recourse when reasonable expectations of privacy have been breached. He stated:

There are parts of our lives that we reasonably expect to be able to keep to ourselves. The freedom to enjoy a private and family life, and express ourselves and our beliefs in safety, is critical to our wellbeing and dignity.

Ensuring that individuals have a clear right to seek a legal remedy against people or entities who seriously invade their privacy is a key part of ensuring that our privacy laws keep pace with community expectations and advances in technology.[72]

Defences

1.70It would be a defence to the cause of action if the:

invasion of the plaintiff's 'privacy was required or authorised by or under an Australian law or court/tribunal order';

plaintiff, or a person lawfully acting on their behalf, 'expressly or impliedly consented to the invasion of privacy';

defendant had a reasonable belief that invading the plaintiff's 'privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person';

invasion of the plaintiff's privacy was 'incidental to the exercise of a lawful right of defence of persons or property and proportionate, necessary and reasonable';

defendant published defamatory information about the plaintiff and there is a related defence under Australian law that references the invasion of privacy.[73]

Interim injunctions

1.71The bill would allow a court to 'grant an injunction restraining the defendant from invading the plaintiff's privacy'. In cases where the defendant invaded the plaintiff's privacy by publishing information related to them, 'the court must have particular regard to the public interest in the publication of the information when considering whether to grant the injunction'.[74]

Damages

1.72The bill would not allow a court to award aggravated damages. The court would be able to award damages for emotional distress. In exceptional circumstances, the court would be able to award exemplary or punitive damages.[75]

1.73The sum of the damages awarded against the defendant would not exceed the greater of $478 550 and 'the maximum amount of damages for non-economic loss that may be awarded in defamation proceedings under an Australian law'.[76]

1.74When determining the amount of damages, the court may consider how the plaintiff and defendant engaged with each other after the invasion of privacy occurred. The matters it could consider could include, but not be limited to:

(a)whether the defendant apologised to the plaintiff;[77]

(b)if the defendant invaded the plaintiff's privacy by publishing information that relates to the plaintiff—whether the defendant published a correction;

(c)whether the plaintiff received or agreed to receive compensation in relation to the invasion of privacy;

(d)whether the plaintiff or the defendant took reasonable steps to settle the dispute;

(e)whether the defendant engaged in conduct after the invasion of privacy, including during the proceedings, that was unreasonable and subjected the plaintiff to particular or additional embarrassment, harm, distress or humiliation.[78]

1.75The court would be able to grant other remedies instead of, or in addition to, awarding damages.[79]

Exemptions

1.76If the invasion of privacy involved 'the collection, preparation for publication or publication of journalistic material', the cause of action would not apply to:

(a)a journalist;

(b)an employer of a journalist;

(c)a person assisting a journalist who is employed or engaged by the journalist's employer; or

(d)a person assisting a journalist in the person's professional capacity.[80]

1.77The cause of action would also not apply to:

enforcement bodies, provided 'that the invasion of privacy is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body';[81]

intelligence agencies;[82]

someone under the age of 18;[83] or

a deceased person or a representative of that person.[84]

1.78According to the Attorney-General, '[t]hese exemptions are important to protect press freedom, and ensure that legitimate activities of government can be delivered effectively'.[85]

Schedule 3—Doxxing offences

1.79Schedule 3 of the bill would amend the Criminal Code Act 1995 (Criminal Code) to create new doxxing offences.

1.80For the purpose of the doxxing offences, the bill would define personal data as information that could enable an individual or group of individuals to be identified, contacted or located. That information would include any of the following details of an individual or group of individuals:

their name or names;

photographs or other images of them;

their telephone number or numbers;

their email address or addresses;

details of an online account or accounts belonging to them;

their residential address or addresses;

their work or business address or addresses;

a place or places of education attended by them; or

a place or places of worship attended by them.[86]

Using a carriage service to make personal information publicly available

1.81If a person uses a carriage service to share the personal data of one or more individuals in a menacing or harassing way, then that person would have committed an offence. The penalty for committing the offence would be imprisonment for six years.[87]

1.82For example, if a person publishes an individual's name, image and telephone number on a website and encourages other people to harass that individual by leaving them violent or threatening messages that is an example of doxxing that would be covered by the bill.[88]

Using a carriage service to make personal information of one or more members of certain groups publicly available

1.83A person would have committed an offence if they use a carriage service to share the personal information of one or more members of a group based on a belief that they have certain characteristics and share that information in a menacing or harassing way. The penalty for committing this offence would be imprisonment for seven years.[89]

1.84For example, if a person publishes the name, image and residential address of one or more members of a private online religious discussion group on a website and encourages other people to attend those addresses, block entryways, or otherwise harass the members of the group that would be an example of doxxing that would be covered by the bill.[90]

Consideration by other parliamentary committees

1.85When examining a bill, the committee takes into account any relevant comments published by the Senate Standing Committee for the Scrutiny of Bills (the Scrutiny Committee) and the Parliamentary Joint Committee on Human Rights (PJCHR).

Senate Standing Committee for the Scrutiny of Bills

1.86The Scrutiny Committee stressed that the exemption of legislative instruments from disallowance should only be permitted under 'exceptional circumstances'. There should be a full justification as to why legislation would be exempt from the usual disallowance process in the bill's EM.[91]

1.87The Scrutiny Committee acknowledged that the EM explains the exemption is necessary 'to ensure that decisive action can be taken'. In emergency situations or in scenarios where events are quickly changing the exemption 'would establish an immediate, clear and certain legal basis for entities to handle personal information'.[92]

1.88In the view of the Scrutiny Committee that could be achieved 'while allowing parliamentary oversight'. It did not consider this an appropriate basis for 'an exemption from disallowance'. The Scrutiny Committee left it for the Senate to determine the appropriateness of exempting the provisions from disallowance and drew the matter to the attention of the Senate Standing Committee for the Scrutiny of Delegated Legislation.[93]

1.89In relation to the exemption of disallowance for the creation of temporary APP codes, the Australian Human Rights Commission considered 'the exemption from disallowance is – on balance – appropriate in these limited circumstances'.[94]

1.90The AGD stated the provisions of the bill that would be exempt from disallowance relate to circumstances 'where prompt action and certainty is required'. For example, during declared emergencies and data breaches 'people would be able to rely on the contents of [the legislative instrument] immediately'.[95]

Footnotes

[1]Journals of the Senate, No. 135, 19 September 2024, pp. 4076–4079.

[2]Senate Standing Committee for the Selection of Bills, Report No. 11 of 2024, 19 September 2024, Appendix 4, pp. [13–16].

[3]Note: The Hon Mark Dreyfus KC MP, Attorney-General, has foreshadowed that the government will consult on a second tranche of reforms, see: House of Representatives Proof Hansard, 12September2024, p. 22.

[4]Australian Law Reform Commission (ALRC), Serious Invasions of Privacy in the Digital Era: Final Report, 3 September 2014, p. 9.

[5]Australian Competition and Consumer Commission (ACCC), Digital Platforms Inquiry, June 2019, pp. 34–36.

[6]ACCC, Digital Platforms Inquiry, June 2019, p. 37.

[7]Attorney-General's Department (AGD), Privacy Act Review Report 2022 (Privacy Act Review), February 2023, p. 18.

[8]AGD, Government Response to the Privacy Act Review Report (Government Response), September2023, p.2.

[9]AGD, Government Response, September 2023, p.2.

[10]AGD, Government Response, September 2023, p.2.

[11]Explanatory memorandum (EM), p. 3.

[12]EM, pp. 5–6.

[13]EM, p. 6.

[14]EM, p. 3.

[15]Ms Elizabeth Brayshaw, Acting First Assistant Secretary, Integrity Frameworks Division, AGD, Proof Committee Hansard, 31 May 2024, p. 113.

[16]AGD, Government Response, September 2023, p.2.

[17]EM, p. 3.

[18]The Hon. Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 22.

[19]Item 5 in Part 2 of Schedule 1 of the Privacy and Other Legislation Amendment Bill 2024 [Provisions] (the bill); proposed section 26GA of the bill.

[20]Item 5 in Part 2 of Schedule 1 of the bill; proposed subsection 26GA(7) of the bill.

[21]Office of the Australian Information Commissioner, Privacy codes register, no date, www.oaic.gov.au/privacy/privacy-registers/privacy-codes/privacy-codes-register (accessed 7November 2024).

[22]Item 5 in Part 2 of Schedule 1 of the bill; proposed section 26GB of the bill.

[23]Item 5 in Part 2 of Schedule 1 of the bill; proposed subsection 26GB(7) of the bill.

[24]EM, p. 10.

[25]EM, p. 10.

[26]EM, p. 33.

[27]EM, p. 34.

[28]Note: the EM suggests that the kinds of personal information would be specified in the declaration. The declaration could, for example, 'specify that only an individual's legal identity and identity documents may be handled', see: p. 36.

[29]Note: the EM suggests that the types of entities would be specified in the declaration. The declaration could, for example, 'specify that only health service providers may disclose personal information to entities who provide humanitarian aid', see: p. 36.

[30]Item 13 in Part 3 of Schedule 1 of the bill; proposed subsection 80KA(1) of the bill. Note: the types of entities that would be permitted to share personal information could include a state or territory authority. Such an entity must not be or include a media organisation, see: Item 13 in Part 3 of Schedule 1 of the bill; proposed subsection 80KA(2) of the bill. The EM suggests that the permitted purposes for sharing personal information would be specified in the declaration. The declaration could, for example, 'specify that entities may only handle personal information for the purposes of identifying individuals who are or may be, or at risk of, being injured, missing or dead', see: p. 36.

[31]Item 13 in Part 3 of Schedule 1 of the bill; proposed subsection 80KA(3) of the bill. Note: according to the EM, this provision would 'limit the types of situations for which a declaration may authorise information handling', see: p. 37.

[32]Note: those individuals include those who are, or are at risk of becoming, injured, missing or dead as a result of the emergency or disaster, see: Item 13 in Part 3 of Schedule 1 of the bill; proposed paragraph 80KA(4)(a) of the bill.

[33]Item 13 in Part 3 of Schedule 1 of the bill; proposed subsection 80KA(4) of the bill. Note: the EM states this 'list is intended merely as a guide'. It should not limit the purposes for which information may be shared, see: p. 37.

[34]EM, p. 35.

[35]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 22.

[36]Item 32 in Part 4 of Schedule 1 of the bill; proposed subsection 26GC(1) of the bill.

[37]EM, p. 25.

[38]Item 32 in Part 4 of Schedule 1 of the bill; proposed paragraph 26GC(5)(a) of the bill. Note: the EM indicates this provision would ensure 'the COP Code is not a barrier to providing essential services to children'. For the purposes of the bill, a health service 'can cover online health services such as counselling, advice and telehealth. However, more general health, fitness or wellbeing apps or services may be covered by the COP Code', see: pp. 41–42.

[39]Item 32 in Part 4 of Schedule 1 of the bill; proposed paragraph 26GC(5)(b) of the bill.

[40]Item 32 in Part 4 of Schedule 1 of the bill; proposed subsection 26GC(10) of the bill.

[41]Item 32 in Part 4 of Schedule 1 of the bill; proposed subsection 26GC(3) of the bill.

[42]EM, p. 40.

[43]EM, p. 41. Note: the EM suggests that in assessing whether they provide a service that could be accessed by children, online service providers should consider: whether the nature and content of their service is likely to appeal to children; market research and user information related to their service or other similar services; and whether there are any measures in place that effectively prevent children from accessing the service, see: p.41.

[44]Item 32 in Part 4 of Schedule 1 of the bill; proposed subsection 26GC(11) of the bill.

[45]EM, p. 40.

[46]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 22.

[47]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 22.

[48]Item 38 in Part 6 of Schedule 1 of the bill; subcl. 8.3 of the bill.

[49]Item 36 in Part 6 of Schedule 1 of the bill; proposed subsections 100(1A) and 100(1B) of the bill.

[50]EM, p. 11.

[51]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 23.

[52]Item 50 in Part 8 of Schedule 1 of the bill; proposed subsection 13G(1) of the bill.

[53]Item 51 in Part 8 of Schedule 1 of the bill; proposed subsection 13G(1B) of the bill.

[54]Item 56 in Part 8 of Schedule 1 of the bill; proposed subsection 13H(3) of the bill.

[55]Item 56 in Part 8 of Schedule 1 of the bill; proposed section 13J of the bill.

[56]Item 56 in Part 8 of Schedule 1 of the bill; proposed section 13K of the bill.

[57]EM, p. 12.

[58]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, pp. 22–23.

[59]Item 87 in Part 15 of Schedule 1 of the bill; proposed subparagraph 13K(1)(b)(iia) of the bill.

[60]Item 88 in Part 15 of Schedule 1 of the bill.

[61]Item 88 in Part 15 of Schedule 1 of the bill.

[62]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 23.

[63]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 23.

[64]Item 1 in Part 1 of Schedule 2 of the bill.

[65]Item 7 in Part 2 of Schedule 2 of the bill; subcl. 7(1) of the bill.

[66]Item 7 in Part 2 of Schedule 2 of the bill; subcl. 7(2) of the bill.

[67]Item 7 in Part 2 of Schedule 2 of the bill; subcl. 7(3) of the bill

[68]Item 7 in Part 2 of Schedule 2 of the bill; subcl. 7(4) of the bill.

[69]Item 7 in Part 2 of Schedule 2 of the bill; subcl. 7(5) of the bill. Note: for the purpose of the bill, the information misused by the defendant in the course of invading the plaintiff's privacy may be true or false, see: Item 7 in Part 2 of Schedule 2 of the bill; subcl. 7(7).

[70]Item 7 in Part 2 of Schedule 2 of the bill; subcl. 7(6).

[71]EM, p. 5. Also see: ALRC, For Your Information: Australian Privacy Law and Practice (ALRC Report108), 12 August 2008; ALRC, Serious Invasions of Privacy in the Digital Era (ALRC Report 123), 3 September 2014.

[72]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 23.

[73]Item 8 in Part 2 of Schedule 2 of the bill; cl. 8 of the bill.

[74]Item 9 in Part 2 of Schedule 2 of the bill; cl. 9 of the bill.

[75]Item 11 in Part 2 of Schedule 2 of the bill; cl. 11 of the bill.

[76]Item 11 in Part 2 of Schedule 2 of the bill; subcl. 11(5) of the bill.

[77]An apology would 'not constitute an express or implied admission of fault or liability by the defendant in connection with the invasion of privacy'. It would also not be 'relevant to the determination of fault or liability in connection with the invasion of privacy', see: Item 13 in Part 2 of Schedule 2 of the bill; cl. 13 of the bill.

[78]Item 11 in Part 2 of Schedule 2 of the bill; subcl. 11(6) of the bill.

[79]Item 12 in Part 2 of Schedule 2 of the bill; subcl. 12(1) of the bill.

[80]Item 15 in Part 3 of Schedule 2 of the bill; subcl. 15(1) of the bill.

[81]Item 16 in Part 3 of Schedule 2 of the bill; cl. 16 of the bill.

[82]Item 17 in Part 3 of Schedule 2 of the bill; cl. 17 of the bill.

[83]Item 18 in Part 3 of Schedule 2 of the bill; cl. 18 of the bill.

[84]Item 20 in Part 4 of Schedule 2 of the bill; subcl. 20(1) of the bill.

[85]The Hon Mark Dreyfus KC MP, Attorney-General, House of Representatives Proof Hansard, 12September 2024, p. 24.

[86]Item 1 in Schedule 3 of the bill; proposed subsections 474.17C(2) and 474.17D(2) of the bill.

[87]Item 1 in Schedule 3 of the bill; proposed subsection 474.17C(1) of the bill.

[88]Note to Item 1 in Schedule 3 of the bill; proposed subsection 474.17C(1) of the bill.

[89]Item 1 in Schedule 3 of the bill; proposed subsection 474.17D(1) of the bill. Note: those characteristics include 'race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin'. Proposed subsection 474.17D(3) clarifies that 'it is immaterial whether the group is actually distinguished by' those characteristics.

[90]Note to Item 1 in Schedule 3 of the bill; proposed subsection 474.17D(1) of the bill.

[91]Senate Standing Committee for the Scrutiny of Bills (Scrutiny Committee), Scrutiny Digest 13/24, 9October 2024, pp. 44‍–45.

[92]Scrutiny Committee, Scrutiny Digest 13/24, 9 October 2024, pp. 45–46; EM, pp. 34–36 and 48–49.

[93]Scrutiny Committee, Scrutiny Digest 13/24, 9 October 2024, p. 46.

[94]Australian Human Rights Commission, Answers to spoken questions on notice, 22 October 2024 (received 4 November 2024).

[95]Ms Catherine Fitch, Assistant Secretary, Privacy Reform Taskforce, Integrity Frameworks Division, AGD, Committee Hansard, 22 October 2024, p. 66.