Support Centre

Australia - Federal


LawPrivacy Act 1988 (No. 119, 1988) (as amended) ('the Privacy Act') 

Regulator: The Office of the Australian Information Commissioner ('OAIC')  

Summary: The Privacy Act, which includes a set of Australian Privacy Principles, provides general personal data protection requirements and provisions, including the right to access and to be informed. However, the Privacy Act does not explicitly refer to 'data controllers' or 'data processors,' nor does it include provisions regarding data protection officer appointments or Data Protection Impact Assessments. On 22 February 2018, the 'notifiable data breaches' provisions of the Privacy Act came into effect, requiring mandatory notification of all 'eligible data breaches' to the OAIC as well as affected individuals. In addition, in 2019 the Australian Government passed the Treasury Laws Amendment (Consumer Data Right) Bill, which provides consumers with the right to data portability in order to enable them to switch between products and services. The Consumer Data Right was introduced to the banking sector in 2020 and will be rolled out progressively into the retail energy and telecommunications sectors.

Notably, the Australian Parliament approved the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 ('the 2022 Bill'), which came into effect on 13 December 2022. Importantly, the 2022 Bill significantly increases penalties for repeated or serious privacy breaches by companies which fail to take adequate care of customer data and provides the OAIC with greater powers to resolve privacy breaches and quickly share information about data breaches to help protect impacted customers.

On 16 Febuary 2023, the Attorney General publicly released a Report on the Privacy Act Review. The Report outlines the 116 proposed reforms to the Privacy Act and was informed by feedback received in response to the aforementioned Issues Paper released in October 2020 and a Discussion Paper, released in October 2021. At the same time as releasing the Discussion Paper for the Privacy Act review, the Australian Government published an Exposure Draft for the proposed Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021, however the bill was never introduced to Parliament. 


Success in the legal industry requires firms to streamline business processes, improve efficiency, and focus their attention on delivering exceptional client service. The race to success has seen many firms adopt tools powered by artificial intelligence (AI). AI-powered tools have the potential to assist lawyers with conducting legal research, contract drafting, and document review more efficiently, allowing them to focus the time saved on advising on more complex legal issues, client service, and business development.

However, there are concerns about how lawyers can use AI-powered tools while simultaneously fulfilling their legally mandated professional duties if the security, accuracy, and quality of information of AI-powered tools are continuously questioned. Katherine Sainty, and Julia Colubriale, from Sainty Law, explore the application of AI-powered tools in the Australian legal profession and their interaction with the professional responsibilities under the Legal Professional Uniform Law 2014 (LPUL)1 and the Australian Solicitor's Conduct Rules 2015 (ASCR)2 that lawyers must adhere to when incorporating these tools into their legal practice.

The use of artificial intelligence (AI) in Australia's tech landscape is growing rapidly, presenting unique and unprecedented challenges to businesses and consumers. Since late 2022, the use of a form of AI called large language models (LLM) has grown exponentially. The generative AI market is expected to continue to grow to a value of $20.6 billion by 2032.

Katherine Sainty and Ottilia Thomson, from Sainty Law, examine LLMs, the balance between their potential benefits for businesses, coinciding privacy concerns, and potential AI-specific legislative reform.

May 7, 2023 saw the conclusion of Australia's annual Privacy Awareness Week (PAW). PAW is run by the Office of the Australian Information Commissioner (OAIC) in conjunction with state and territory privacy regulators and the Asia Pacific Privacy Authorities forum. Katherine Sainty and Ottilia Thomson, from Sainty Law, discuss the theme of PAW 2023 and the privacy basics that businesses need to consider.

The Attorney-General's Final Report1 on the Review of the Privacy Act 1988 (Cth) ('the Privacy Report'), published on 16 February 2023, considers enacting a right to be forgotten, also known as the right to erasure. This right would empower individuals to have more control over how organisations retain their personal information, giving them the right to delete their information. Katherine Sainty and Julia Colubriale, from Sainty Law, provide an overview of the right to be forgotten, the proposed amendment, its limitations, the significance, the implications for organisations, and how organisations can best prepare for the possibility that this right may be enshrined in Australian legislation.

The Australian Attorney-General's Department released the Privacy Act Review Final Report1 ('the Report') on 16 February 2023. The Report is a comprehensive review of the Privacy Act 1988 (Cth) ('the Privacy Act') and contains 116 recommendations for reforms to protect Australians in the digital age. Katherine Sainty, Ottilia Thomson, and Julia Colubriale, from Sainty Law, discuss the Report and its key recommendations.

In Australia, Federal, State, and Territory privacy laws govern anonymisation and pseudonymisation of personal information. Lisa Fitzgerald and Keely O'Dowd, from Lander & Rogers, provide an overview of the laws and guidance governing anonymisation and pseudonymisation in Australia, as well as a look at the scope and permitted uses for such data.

After a year of high-profile data breaches, 2023 is shaping up to be a year of privacy reform. As the economic and personal harm of data breaches continues to be felt, governments are escalating their response to the breaches by expanding the powers of privacy regulators. Katherine Sainty and Aisling Hamilton, from Sainty Law, examines how privacy reforms have expanded the powers of the Office of Australian Information Commissioner ('OAIC') and what that means for Australian businesses.

The Security of Critical Infrastructure Act 2018 (Cth) ('the SOCI Act') provides a framework for managing risks relating to Australia's critical infrastructure, including national security risks of espionage, sabotage, and foreign interference. On 2 April 2022, the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (Cth) ('the SLACIP Act') came into effect. The SLACIP Act amends the SOCI Act and builds on the amendments of the Security Legislation Amendment (Critical Infrastructure) Act 2021 (Cth) that came into effect on 2 December 2021. Lisa Fitzgerald and Keely O'Dowd, from Lander & Rogers, provide a look into the SLACIP Act and its impact on Australia's critical infrastructure framework.

A string of major data breaches by Australian companies have resulted in far-reaching implications for both Australian and international businesses and consumers. In parallel, the introduction of the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (Cth) ('the Privacy Bill') signals that the data security landscape in Australia is changing and that enhanced data handling and cybersecurity practices are imperative. Katherine Sainty, Aisling Hamilton, and Julia Colubriale, from Sainty Law, outline the implications of data breaches, regulatory responses, including changes to the Privacy Act 1988 (Cth) No. 119 1988 (as amended) ('the Privacy Act'), and key lessons for businesses going forward.

Two major Australian retailers are being investigated by the Office of the Australian Information Commissioner ('OAIC') for using facial recognition technology ('FRT') without getting informed consent from patrons. In Australia, retailers are not permitted to use biometric information for profiling and surveillance purposes without the person's knowledge. Katherine Sainty and Aisling Hamilton, from Sainty Law, discuss what FRT is, how it is used, and what businesses should consider for its use.

The American Data Privacy and Protection Act1 ('ADPPA'), whilst still under review, has many similarities with existing privacy legislation, including Australia's Privacy Act 1988 (Cth) ('the Privacy Act'). Katherine Sainty and Aisling Hamilton, from Sainty Law, provide an introduction to some of the main features of the ADPPA, as well as a glance into how the ADPPA compares with the Privacy Act.

A data subject access request ('DSAR') is a request made by an individual to an organisation or agency, asking for access to any personal information collected or stored regarding the individual. Katherine Sainty, Director at Sainty Law, considers how, under Australian law, organisations should handle DSARs involving employees and prospective employees, also discussing situations where personal information is stored on employee's own devices used during the course of their work.