STRONGER PENALTIES UNDER THE PRIVACY ACT

UPDATE 10/11/22: Today the bill to significantly increase penalties under the Privacy Act passed the House of Representatives and will now go to the Senate. 

UPDATE 27/10/22: The Privacy Legislation Amendment  (Enforcement and Other Measures) Bill 2022 has today been introduced into Parliament – Bill and Explanatory Memorandum are here.

On the weekend (22 October 2022), Attorney General Mark Dreyfus announced that he would table the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 in Parliament later this week.

These privacy developments are a warning signal to those who deal with customer data - respecting and protecting privacy should be at the forefront of business activities because failing to do so has dire consequences. For marketers, it's simple - don't risk your brand's reputation by breaking the law. 

Manage your marketing within the boundaries of privacy and compliance - stay up-to-date with current data privacy legislations. 

BROWSE REGULATORY COURSES

The bill will significantly increase the existing maximum AUD$2.22 million penalty set down in the Privacy Act 1988. Under the proposed bill, the maximum penalty that can be applied under the Privacy Act 1988, for a serious or repeated privacy breaches of the Privacy Act 1988 will increase to whichever is the greater of:

• A fine of AUD$50 million

• Three times the value of any benefit obtained through the misuse of information; or 

• 30% of a company's adjusted turnover in the relevant period

“Unfortunately, significant privacy breaches in recent weeks have shown existing safeguards are inadequate. It's not enough for a penalty for a major data breach to be seen as the cost of doing business,” said Dreyfus, “We need better laws to regulate how companies manage the huge amount of data they collect, and bigger penalties to incentivise better behaviour.”

The penalties outlined in the proposed bill are much greater than those initially suggested in the Opposition’s proposed reforms which only suggested maximum penalties be increased to not more than the greater of $10 million AUD or 3 times the value of any benefit obtained through the misuse of information or 10% of their domestic annual turnover. 

The Opposition’s proposed reforms suggested penalties that were consistent with maximum penalties under the Australian Consumer Law (ACL). The penalties outlined in the Bill announced on the weekend takes these penalties to a higher level, sending a strong message to corporations.

“When Australians are asked to hand over their personal data, they have a right to expect it will be protected,” said Dreyfus, “I look forward to support from across the Parliament for this Bill.”

This stance has no doubt been forced by the series of big data breaches that have occurred recently. The recent OAIC opening investigations related to serious data breaches by Optus and Medibank – each breach involving the theft of the sensitive data of millions of customers. In addition, there have been a data breaches announced by a string of other companies including (but not limited to) Energy Australia, Telstra, MyDeal, Dialog, Costa Group and G4S.

Greater powers, improved information and information sharing powers for regulators

In addition to increasing penalties, the AGD announced that the Privacy Legislation Amendment (Enforcement and Other Measures) Bill will also hand the Australian Information Commissioner (AIC) greater powers to resolve privacy breaches, strengthen the Notifiable Data Breaches scheme to improve the information provided to the AIC to better enable it to assess the risk of harm, and give the AIC and the Australian Communications and Media Authority (ACMA) greater information sharing powers.

More changes in Privacy law expected 

This Bill is in addition to a comprehensive review of the Privacy Act by the Attorney-General's Department that will be completed this year, with recommendations expected for further reform. ADMA has been actively engaged in the AGD consultations relating to their Review of the Privacy Act.
 

Ensure that you're well equipped with handling customer data - stay up-to-date with ADMA's Privacy and Data Compliance Courses

Explore courses