The Australian Privacy Act
- Oluwafemi Adesogbon
- Jan 23
- 5 min read
Updated: Feb 15
What is the Act?
The Australian Privacy Act 1988 is the main piece of national data protection legislation in Australia. Introduced to safeguard individuals' privacy, the Act establishes a framework for regulating how Australian Government agencies and private sector organisations—particularly those with an annual turnover exceeding $3 million—collect, use, store, and disclose personal information. Over the years, the Act has undergone significant amendments to address the evolving challenges of the digital age, such as the rise of online data collection and cyber threats. By adapting to these changes, the Privacy Act remains a vital tool in ensuring that Australians’ personal information is protected in an increasingly interconnected world.
Why the Act?
The Privacy Act 1988 was established for the following purposes:
To protect individuals' privacy.
To balance privacy protection with the interests of organizations.
To provide clear guidelines for regulating privacy and handling personal information.
To promote responsible and transparent management of personal information.
To ensure secure and seamless cross-border data transfers.
To empower individuals to lodge complaints regarding privacy breaches.
To fulfill Australia’s international privacy obligations.
● Scope of the Act
The Privacy Act 1988 applies to the personal information of all individuals in Australia, regardless of their citizenship status. Specifically, it protects the data of individuals, consumers, and employees within the country. Personal information includes any data that can, or could reasonably, identify a living individual.
Principles of the Act
The Australian Privacy Principles, or APPs is the foundation of the Privacy Act of 1988. Any organisation or entity covered by the Privacy Act is subject to them. There are thirteen (13) Australian Privacy Principles and they govern standards, rights and obligations around:
● The gathering, application, and sharing of private data.
● The responsibility and control of an agency or organization.
● Personal information accuracy and integrity.
● Individuals' rights to access their personal data.
Here are the Australian Privacy Principles:
Principle 1— open and transparent management of personal information: This principle's goal is to guarantee that APP entities handle personal data in an open and transparent manner.
Principle 2— anonymity and pseudonymity: When interacting with an APP entity on a specific issue, people must be given the choice to use a pseudonym or not reveal their identity.
Principle 3— collection of solicited personal information: If an APP entity is an agency, it is prohibited from collecting personal data (except from sensitive data) unless it is directly related to or reasonably required for one or more of the duties or operations of the entity.
Principle 4— dealing with unsolicited personal information: This principle ensures that personal information that is received by an entity is still afforded privacy protections, even where the entity has done nothing to solicit the information.
Principle 5— notification of the collection of personal information: According to the notification principle, people must be informed about how and why personal data is being or will be acquired, as well as how the collecting organization plans to handle it.
Principle 6— use or disclosure of personal information: This principle sets out the circumstances in which entities may use or disclose personal information that has been collected or received.
Principle 7— direct marketing: Organizations that possess personal information about individuals are prohibited from using or disclosing that information for direct marketing purposes.
Principle 8— cross-border disclosure of personal information: This principle ensures that the obligations to protect personal information set out in the Australian Privacy Principles cannot be avoided by disclosing personal information to a recipient outside Australia.
Principle 9— adoption, use or disclosure of government related identifiers: This principle's main objective is to limit the widespread usage of government-issued identifiers and keep them from turning into de facto national identity numbers.
Principle 10— quality of personal information: An APP entity must take reasonable steps to ensure the personal information it collects is accurate, up to date and complete.
Principle 11— security of personal information: This principle sets out that An APP entity must take appropriate precautions to guard against unauthorized access, alteration, or disclosure of personal data, as well as misuse, interference, and loss. In some situations, an organization is required to erase or de-identify personal data.
Principle 12— access to personal information: If an individual's personal information is held by an APP entity, the organization is required to provide the information upon the individual's request.
Principle 13— correction of personal information: According to this principle, organizations have a duty to update personal data that is erroneous, outdated, lacking, or irrelevant.
Persons Subject to the Act
The Privacy Act 1988 applies to "APP entities," which include:
Federal government agencies and officeholders.
Organizations such as corporations, partnerships, trusts, and unincorporated associations.
Exceptions:Certain entities are not subject to the Act, such as:
Small business operators with an annual turnover below $3 million, unless they:
Provide health services or manage health information.
Trade personal information for benefits or services.
Operate another business with a turnover above $3 million.
Are contracted for a Commonwealth project.
Serve as a credit reporting body.
Registered political parties.
State or territory authorities.
In a nutshell, all Australian private sector organizations, Australian Federal government agencies, and any international organizations that qualify as ‘carrying on business’ in the country must comply with the Privacy Act 1988.
Enforcement of the Act
The Office of the Australia Information Commissioner (OAIC) is responsible for enforcing the Australia Privacy Act 1988. They have the power to conduct investigations, establish regulations based on the law, and punish offenders.
Fines and Penalties Under the Act
An APP entity may be subject to fines of up to the following if it is determined that it has interfered with an individual's privacy in a significant or persistent manner:
● $1.8 million for corporate bodies and/or
● $360,000 for non-corporate bodies (including government departments/agencies, sole-traders, partnerships, trusts, unincorporated associations).
Other penalties may include:
● Civil penalties: For major or persistent invasions of privacy, the Privacy Act establishes civil sanctions. Failure to protect personal data can result in heavy fines for organizations. The maximum civil penalty, as of the most recent changes, is AUD 50 million or 10% of the entity's yearly turnover, whichever is greater.
● The Office of the Australian Information Commissioner (OAIC) has the authority to launch investigations into complaints or carry out inquiries that are requested by the Commissioner. Enforceable undertakings, compensation orders, or other remedies for impacted parties may be the outcome of investigations.
● Reputational harm: Failure to comply can result in bad press, a decline in consumer trust, and reputational harm. A company's stakeholder relationships and reputation may suffer long-term effects if the public becomes aware of privacy violations.
How to Navigate the Act?
Businesses should make sure their privacy policy is current, accurate, and complies with all notification obligations in order to be ready for the Australia Privacy Act 1988. Additionally, they should update their cookie policies and give users a consent banner or DSAR form so they can exercise their right to privacy.
Also, businesses should verify that they are only gathering adequate information to fulfill the functions that their consumers have been informed of their privacy policy.
Businesses should also put the required security measures in place to protect such data from breaches. This can include creating a plan for notifying the OAIC and individuals in the event of any cyberattack.
Conclusion
The Australian Privacy Act 1988 is Australia's primary data protection law, regulating how personal information is handled by government agencies and businesses with over $3 million annual turnover. It applies to all individuals in Australia, covering data collection, use, and protection through 13 Australian Privacy Principles (APPs). Enforced by the Office of the Australian Information Commissioner (OAIC), non-compliance risks penalties up to AUD 50 million, reputational damage, and legal consequences.
Comments