On 12 September 2024, the Attorney-General tabled the Privacy and Other Legislation Amendment Bill 2024 (Bill) before Parliament. The Bill encompasses the Australian Government’s next steps forward for Australian Privacy Law. This Privacy Bill has been cultivated from an extensive and lengthy Government consultation process. It seeks to legislate the first tranche of reforms agreed in principle by the previously published Government Response - Privacy Act Review in February 2023.

A reform of the Privacy Act 1988  is long overdue.  As the digital landscape rapidly evolves and becomes integral to Australians’ day-to-day lives, the Privacy Act no longer protects the increased risks to Australians’ personal data.

This article outlines the new reforms and changes the Bill hopes to implement.

The Bill is separated into three Schedules:

1. Schedule 1 – Privacy Reforms
2. Schedule 2 – Serious Invasions of Privacy
3. Schedule 3 – Doxxing offences.

Schedule 1: Privacy Reforms:

Schedule 1 of the Bill contains a range of measures that hope to enhance individuals’ privacy regarding the protection of their personal data. The amendments under Schedule 1 include some significant changes to protect Australians’ personal information in a growing digital world.

1. Powers of Regulators:
   1. The Bill offers enhancements to the Information Commissioner’s code-making powers and introduces new civil penalties. With this, the Information Commissioner will be given additional powers - allowing the Commissioner to proactively regulate privacy protection. The Bill will also enable the Information Commissioner to undertake public inquiries on matters relating to Privacy. 

2. Children’s privacy:
   1. Children are particularly vulnerable in online spaces and consequently face extensive privacy risks as they grow up online. The Bill proposes the development of a Children’s Online Privacy Code to enhance privacy protection for Children – specifying how online internet services must comply with privacy obligations concerning children.  
3. Overseas data flows:
   1. With the rise of globalisation, the Bill intends to provide greater certainty about when personal information can be disclosed overseas. It also wants to increase mechanisms to facilitate the free flow of information across national borders – whilst simultaneously ensuring that the privacy of individuals is respected.
4. Penalties for interference with privacy and Federal court Orders
   1. The Bill will introduce new civil penalties for breaches of the Privacy Act and empower the court to make appropriate orders for privacy violations, including ordering compensation for loss or damage suffered.
5. Automated decisions:
   1. The Bill hopes to provide individuals with greater transparency and control over their data – by enforcing improved notice and consent mechanisms when organisations use automated decision-making. The Bill will enforce organisations using automated decision-making processes (such as AI) to disclose their privacy policy where the automated decision-making process substantially uses the individuals’ data to make decisions which can ‘reasonably be expected to significantly affect the rights and interests of the individual’.

Schedule 2 - Statutory Tort for Serious Invasions of Privacy:

Schedule 2 recognises that there can often be tension between protecting an individual’s privacy and the greater public interest. If implemented, Schedule 2 would provide individuals the right to establish a cause of action for serious invasion of privacy. 

Under the proposed reforms Schedule 2, Part 2, clause 7, it is stated that:

1. An individual  (the plaintiff) has a cause of action in tort against another person (the defendant) if:
   1. The defendant invaded the plaintiff’s privacy by doing one or both of the following:
      1. Intruding upon the plaintiff’s seclusion;
      2. Misusing information that relates to the plaintiff; and
   2. A person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances; and
   3. The invasion of privacy was intentional or reckless; and
   4. The invasion of privacy was serious.

The Bill proposed that the invasion of privacy is actionable without proof of damage.

Importantly, the new tort has to be considered on the balance of public interest. Specifically, the proposed Bill outlines that, based on evidence from the plaintiff, the plaintiff must satisfy the court that the public interest in the invasion of privacy was outweighed by the public interest in protecting the plaintiff’s privacy.

The statutory tort allows for a range of defences and exemptions for legitimate activities undertaken, such as during:

1. Law enforcement
2. Intelligence agencies
3. Journalism

Schedule 3 - Doxxing offences.

Schedule 3 of the proposed Bill will amend Part 10.6 of the Criminal Code, introducing new offences that criminalise Doxxing. Simplistically, doxxing is the exposure of personal data that violates a person’s privacy, compromising their safety, well-being and reputation. It often allows the person to be identified, located, or contacted online in a menacing or harassing manner.

The doxxing offence, as proposed by the Bill, applies where a person:

1. uses a carriage service to make available, publish or otherwise distribute the personal data of one or more individuals; and
2. The person does so in a way that reasonable persons would regard as being menacing or harassing towards those individuals.

By introducing doxxing offences, the Bill hopes to outlaw the practice of doxxing as, in its current form, Australian criminal law does not explicitly address criminalising doxxing offences.

Further Reforms

This Bill is an essential first step in the Government’s privacy reform agency, with further privacy reforms yet to come. With a new era of privacy reforms on the horizon, we await to see what other reforms published in the Government Response - Privacy Act Review will be drafted into proposed legislation.

If you have any questions about the information in this article, please do not hesitate to contact Tal Williams or Isabella Campbell or speak with a member of our Business, Corporate & Commercial Team.