Privacy Reforms:  Privacy and Other Legislation Amendment Bill 2024

Overview of Privacy Reforms incorporated in the Bill

On 12 September 2024, as the next step in a reform process that commenced in 2019, the Australian Government introduced to Parliament its first tranche of legislation to reform Australia’s privacy laws.  The key provisions of the Bill provide for:

• a statutory privacy tort
• a Children’s Online Privacy Code
• privacy policy requirements for automated decision-making
• strengthened civil penalty provisions
• criminal offences for doxxing
• enhanced regulator powers.

This Insight looks at the privacy law changes contemplated by the Bill in its current form.

Statutory tort for serious invasions of privacy

Grounds for action

The Bill introduces a statutory tort allowing individuals to sue for serious invasions of privacy. This includes situations of intrusion on seclusion or the misuse of private information. The invasion must be serious and the other criteria for establishing the privacy tort will be:

• the invasion must occur where a reasonable expectation of privacy exists; and
• the defendant must have acted intentionally or recklessly.

Relief without proof of harm

Notably, a plaintiff will not be required to prove actual harm to succeed in a claim. Courts will be able to order compensation for emotional distress, and in exceptional cases, exemplary or punitive damages may be awarded. Caps will apply to exemplary or punitive damages and non-economic loss.

Additionally, Courts will be able to order other remedies such as an account of profits, injunctions, apologies and corrections, orders for destruction or delivery of material and declarations that a serious invasion of privacy has occurred.

Exemptions and Defences

Journalists, their employers, and assistants will be exempt from the privacy tort in cases of collection, preparation for publication or publication of journalistic material. This exemption will only apply where the journalist is subject to standards or codes and in respect of work in a professional journalistic capacity.

Defences will include consent, where authorised by law, and certain defamation-related defences. A defendant may also argue that the privacy invasion served the public interest, in which case the plaintiff will be required to demonstrate that their right to privacy outweighs the competing public interest.

Children’s Online Privacy Code

The Australian Information Commissioner would be obliged to develop and register a Children’s Online Privacy Code within 24 months of the Bill receiving Royal Assent. This code would dictate how the Australian Privacy Principles (APPs) apply to children online, focusing on services accessed by children.

The proposed Code would apply to providers of social media services, relevant electronic services and designated internet service providers, all as defined under the Online Safety Act 2021 (Cth), provided that the service is likely to be accessed by children and the entity is not providing a health service. Other APP entities may also be specified.

Automated decision-making

To increase transparency, APP entities using automated decision-making will be required to disclose relevant details in their privacy policies. This will apply where an entity arranges for computer programs to make decisions affecting individual rights and interests, utilising personal information in the operation of that computer program.

Civil Penalty Provisions

Revised section 13G

The Bill introduces changes to the civil penalty regime under the Privacy Act. Under the revised section 13G of the Privacy Act, civil penalties may be sought by the Australian Information Commissioner for any act or practice that constitutes a “serious” interference with privacy. The other limb currently contained in section 13G, which relates to repeated acts or practices interfering with privacy, would be removed. The Bill includes a new provision that outlines various factors for assessing seriousness, of which the doing of the act or practice “repeatedly or continuously” is one.

New section 13H:  Low-level Interferences

A new section 13H contained in the Bill will provide for civil penalties for low-level inferences with privacy, with penalties of up to $660,00 for individuals and $3.3 million for bodies corporate (on the basis of the current value of penalty units). If a Court was not satisfied that a “serious” contravention had occurred under section 13G in proceedings commenced by the Australian Information Commissioner, it could instead make a finding under the lower threshold in section 13H.

New civil penalty provisions

The proposed new section 13K provides a power for the Australian Information Commissioner to issue infringement notices for breaches of specific obligations in the APPs and for non-compliant eligible data breach statements.

Criminal Offences for Doxxing

The Bill seeks to amend the Commonwealth Criminal Code, by introducing two new offences for doxxing. One protects individuals and the other protects members of a group.

Enhanced Regulator Powers

The Australian Information Commissioner will gain new powers under the Bill to conduct public inquiries with Ministerial approval and to award damages for reasonably foreseeable future loss when making determinations.

Future privacy reforms

The Bill omits key reform proposals that have been the subject of significant consultation since 2019. Noticeably absent from the Bill are a direct right of action for individuals for breaches of the Privacy Act, a “fair and reasonable” test, definitional changes, including to “personal information” and provisions dealing with targeted advertising and data trading. The Government has flagged that a second tranche of legislation is expected next year which it is assumed will cover these areas and more.

This article was prepared with the assistance of Cate Cloudsdale, who will be joining Quay Law Partners as Counsel in October 2024.