The Australian Attorney-General's Department released the Privacy Act Review Final Report¹ ('the Report') on 16 February 2023. The Report is a comprehensive review of the Privacy Act 1988 (Cth) ('the Privacy Act') and contains 116 recommendations for reforms to protect Australians in the digital age. Katherine Sainty, Ottilia Thomson, and Julia Colubriale, from Sainty Law, discuss the Report and its key recommendations.

After a year of high-profile data breaches, 2023 is shaping up to be a year of privacy reform. As the economic and personal harm of data breaches continues to be felt, governments are escalating their response to the breaches by expanding the powers of privacy regulators. Katherine Sainty and Aisling Hamilton, from Sainty Law, examines how privacy reforms have expanded the powers of the Office of Australian Information Commissioner ('OAIC') and what that means for Australian businesses.

The Security of Critical Infrastructure Act 2018 (Cth) ('the SOCI Act') provides a framework for managing risks relating to Australia's critical infrastructure, including national security risks of espionage, sabotage, and foreign interference. On 2 April 2022, the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (Cth) ('the SLACIP Act') came into effect. The SLACIP Act amends the SOCI Act and builds on the amendments of the Security Legislation Amendment (Critical Infrastructure) Act 2021 (Cth) that came into effect on 2 December 2021. Lisa Fitzgerald and Keely O'Dowd, from Lander & Rogers, provide a look into the SLACIP Act and its impact on Australia's critical infrastructure framework.

Two major Australian retailers are being investigated by the Office of the Australian Information Commissioner ('OAIC') for using facial recognition technology ('FRT') without getting informed consent from patrons. In Australia, retailers are not permitted to use biometric information for profiling and surveillance purposes without the person's knowledge. Katherine Sainty and Aisling Hamilton, from Sainty Law, discuss what FRT is, how it is used, and what businesses should consider for its use.

A data subject access request ('DSAR') is a request made by an individual to an organisation or agency, asking for access to any personal information collected or stored regarding the individual. Katherine Sainty, Director at Sainty Law, considers how, under Australian law, organisations should handle DSARs involving employees and prospective employees, also discussing situations where personal information is stored on employee's own devices used during the course of their work.