Australia’s Privacy Legislation Amendment

How Will It Impact You & Your Organisation?
Sarah Morrison
February 16, 2023

Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022

The Australian government introduced The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 in December 2022, in response to recent data breaches. The Act aims to strengthen Australia’s privacy framework by providing more enforcement powers to regulators, including the Office of the Information Commissioner (OAIC) and the Australian Communications and Media Authority (ACMA). It also increases penalties for breaches of privacy law and introduces new measures to improve transparency and accountability.

Penalties for Serious or Repeated Interferences

Under the new legislation, OAIC will have the ability to issue fines of up to $50 million to organisations and up to $2.5 million for individuals who repeatedly interfere with privacy, both of which are significant increases from previous penalties. OAIC will also have the power to make specific determinations at the end of an investigation and ensure that foreign organisations operating in Australia meet obligations under the Act. This is a timely move, as the increasingly global nature of business means that more and more organisations are operating in multiple countries. This will make it more difficult for foreign organisations to avoid their obligations under Australian privacy laws and will ensure that individual’s personal data is protected regardless of where an organisation is based.

Notifiable Data Breaches Scheme

The Notifiable Data Breaches scheme, which has been in place since 2018, will also be strengthened to increase accountability for organisations and individuals who fail to meet the required data breach notification standards. OAIC will be able to request information from organisations to ensure compliance with the scheme.

Transparency and Accountability

The privacy legislation amendment includes measures to improve transparency and accountability, such as the right of access and correction for individuals, and the ability for OAIC to assess organisations’ data protection practices proactively. This means that individuals will have more control over their personal data, and organisations will have to be more transparent about their data handling practices.

Privacy Information Sharing

The Act also allows for information sharing between enforcement bodies and states, territories, and foreign regulators with similar privacy laws, to increase coordination and protection of personal information. OAIC and ACMA will also be able to cooperate with other enforcement bodies concerning data breaches, such as the Australian Competition and Consumer Commission. Overall, the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 is a significant step forward in protecting individuals’ privacy in Australia.

Other Impacts of a Privacy Breach

In addition to the financial penalties, organisations found to be in violation of the new privacy legislation amendment will also face reputational damage. With increased transparency and accountability, it will be more difficult for organisations to hide any non-compliance with privacy laws. This will likely lead to increased scrutiny from the public and media, which can have a significant impact on an organisation’s reputation and bottom line.

What Can You Do to Comply With Australian Privacy Legislation?

Some of the key steps your organisation should be taking to manage data privacy risk already and reduce the potential impacts from the privacy legislation amendment:

Overall, it is important for organisations to take a proactive approach to protect personal information and regularly review and update their security practices to ensure they are compliant with the new legislation.

For more information on what threat actors do with your personal information after it’s been stolen, and why it’s so valuable to them, read our informative article What Happens to Personal Data After a Breach?.

Download the PDF Now

Download our reference PDF summarising the changes to Australia’s privacy legislation amendment.

Sarah Morrison

Sarah Morrison

Sarah is the Co-CEO of Morrisec. With over 20 years in cybersecurity and a PhD in Russian information operations, Sarah has a deep understanding of threat actors and their tactics and motivations, making her highly equipped to assist organisations in their defence against them.

0 Comments