As you may have heard, last night the Privacy and Other Legislation Amendment Bill 2024 to enact the first tranche of reforms to the Privacy Act 1988, passed both houses of Parliament.
While most of the provisions will come into effect imminently (after royal ascent), the privacy policy requirements for ADM will commence 2 years after royal ascent, and the provisions enacting a Statutory Tort for serious invasions of privacy will commence within 6 months (at a date to be proclaimed).
A number of amendments were made to the Bill in the Senate which the House also agreed to, including the following proposed amendments recommended by the Legal and Constitutional Affairs Legislation Committee in its report – published earlier in November:
- the minimum consultation period for the Children’s Online Privacy Code has been extended to 60 days.
- a requirement was included for the Information Commissioner to consult with relevant industry bodies or organisations when developing the Children’s Online Privacy Code.
- the exclusion for media organisations from accessing personal information during declared emergencies has been extended to the ABC and SBS.
- a number of amendments have been made to empower the Information Commissioner to issue discretionary notices to entities to remedy alleged breaches of the Privacy Act in certain circumstances, before issuing an infringement notice.
- a number of amendments were made to the operation of the statutory tort, including amendments to clarify that the journalism exemption applies to a person involved in the publication or distribution of journalistic material, and that the concept of ‘journalistic material’ includes ‘editorial’ material.
The addendum to the Explanatory memorandum to the Bill also makes clear that the level of information required in privacy policies is not expected to compromise commercial-in-confidence information about automated decision-making systems.
The amendments that were proposed by Senator David Shoebridge to include a fair and reasonable test, a definition of consent, and a revised definition of Personal Information along the lines of the Privacy Act Review Report Recommendations in this first tranche of reforms – have not been adopted.
We will keep you posted on the progress of consultation on the second tranche of the reforms.