New law in Australia: Privacy breach can invite lawsuit

Under the proposed changes, residents of Australia would be granted the ability to file a lawsuit against those responsible for “serious” invasions of their privacy. Additionally, small enterprises will be required to comply with privacy regulations for the very first time.

A greater right for adults to opt out of targeted advertising was recommended by the Attorney General’s Department, but the Albanese government has rejected this recommendation, which is a decision that is sure to disappoint activists for consumer rights. Children will also enjoy further privacy protection, but this choice is likely to disappoint consumer rights advocates.

On Thursday, Attorney General Mark Dreyfus will provide a response to the review of the Privacy Act that was conducted by his department. He will indicate that he agrees with 38 of the review’s 116 recommendations and that he agrees in principle with 68 other recommendations, all of which will require additional consultation before a final decision is made. The modifications are going to be enacted into law by the government in 2024.

The government has just “noted” – not approved – 10 recommendations, including the advice to provide individuals with “an unqualified opt-out of receiving targeted advertising” and the plans to reduce the political exemption to the Privacy Act. Among the other recommendations “noted” by the government is the recommendation to provide individuals with “an unqualified opt-out of receiving targeted advertising.”

This judgment will leave people open to “misleading” methods, such as political parties or campaigns promising to enable postal votes in order to gather their information, something the Australian Electoral Commission has complained about during the Indigenous voice referendum. Specifically, this decision will leave people vulnerable to “misleading” tactics that involve offering to assist postal votes.

Parties are exempt “to encourage freedom of political communication and enhance the operation of electoral and political processes in Australia,” according to a paper that summarizes the government’s answer and was released under embargo by Dreyfus’s office. Independent Member of Parliament Kate Chaney has proposed a private member’s bill that, if passed, would put an end to the current exemption of parties from privacy regulations.

Under the strategy that the government has devised, it will be illegal for businesses to actively promote to children, target children in their marketing efforts, or trade in the personal information of children. A children’s internet privacy code that takes into account what is in the child’s best interest when it comes to the handling of their personal information has also received the support of the Labor party.

It was decided, in principle, that it should be illegal for organizations to target individuals based on sensitive information (such their ethnicity or sexual orientation), unless doing so would result in content that would be helpful to society.

The government reached an agreement in principle over the right to sue for invasions of privacy that are “serious, preventing individuals from pursuing legal action over more trivial matters”.

People would be entitled to file claims for financial compensation in the event that their private information was misused or that they were subjected to an infringement on their privacy, such as when they were videotaped in situations in which they had a reasonable expectation of maintaining their anonymity.

Plaintiffs would have the burden of proving that the interest in privacy is greater than any competing public interest; hence, journalism that serves the public interest may not be subject to legal action. The government aims to continue consulting with representatives from other media organizations.

Journalism will continue to be exempt from the Privacy Act and media organizations will continue to be exempt from elements of the act that require firms to disclose individuals what information they possess about them upon request. This decision was made in response to a vigorous backlash regarding the potential impact of the act on reporting.

Media companies had voiced concerns that this could put them in danger of receiving nuisance complaints or fishing expeditions aimed to obstruct the process of gathering news for public interest journalism.

However, media organizations will be required to maintain the confidentiality of information, delete it once it is no longer required, and notify the Office of the Australian Information Commissioner of any eligible data breaches that occur.

At this time, the majority of small firms that have an annual turnover of $3 million or less are exempt from the requirements of the Privacy Act. This means that these organizations are under no obligation to keep personal information private or to notify anyone who may be affected in the case of a data breach.

Although the department suggested that an impact analysis, transition time, and support package be provided first, the government agreed in principle to eliminate this exemption. However, the government should first offer these things.

The government came to an agreement in principle that data gathering should be “fair and reasonable,” and that it should expand the definition of personal information to include data that may be used to identify individuals, such as cookie identifiers and Internet protocol (IP) addresses.

A right to erasure was proposed, and the government gave its preliminary approval to the idea. However, criminals would not have the right to delete their records, and the right would not supersede regulations that require businesses to keep identifying documents on file.

It also agreed in general with the proposed restricted right to request that results from an online search of the person’s name be removed from the search engine’s database, but it did not agree with the proposal to eliminate public reporting. De-indexing may make it more difficult to locate content on the internet, but it will not delete the content from the original location where it was posted.