With recent data breaches still fresh in Australians’ minds, the Federal Government has taken its first concrete step towards overhauling Australia’s privacy and data security laws. 

A recently – and some might say hastily – passed law has increased the maximum penalties for privacy breaches, while also expanding the application of the Australian Privacy Act to organisations outside Australia. The combined effect of these changes is that serious or persistent deficiencies in privacy standards may now come with a very, very hefty bill, for any organisation that has a business presence in Australia.

What’s changing?

The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (‘Enforcement Act’) was introduced on 26 October 2022 and passed with bipartisan support a mere month later on 28 November 2022. The Enforcement Act makes a suite of changes to the Privacy Act 1988 (Cth) (‘Privacy Act’) to strengthen Australia’s privacy laws in light of recent high profile data security incidents. The Enforcement Act will come into effect on the day after it receives Royal Assent, which should be a matter of weeks if not days.

Increase in privacy penalties

The biggest change is an increase in the maximum civil penalties (being the penalties the Office of the Australian Information Commissioner (‘OAIC’) may seek via court order) against organisations for “serious and repeated interferences with privacy” to the greater of:

• AU$50 million;
• if the court can determine the value of the benefit that the organisation and any related organisation obtained from the contravention, 3 times the value of that benefit;
• if the court cannot determine the value of that benefit, 30% of the adjusted turnover of the organisation during the breach turnover period for the contravention.

‘Adjusted turnover’ means the total value of all the supplies made by the body corporate or related bodies corporate in connection with Australia’s indirect tax zone. ‘Breach turnover period’ means the longer of the relevant contravention period and the 12 month period ending on the date the organisation ceased the relevant contravention – in practice this means a minimum breach turnover period of 12 months.

For comparison, the current (and soon to be replaced) maximum penalty is approximately AU$2.2 million. An exposure draft of the Morrison Government’s ‘Online Privacy Bill’ (which we updated you on late last year) proposed a much smaller (but still sizeable) increase to the greater of AU$10 million, 3 times the benefit obtained, and 10% of the organisation’s turnover in the 12 months prior to the contravention.

These penalties apply to any breach of an Australian Privacy Principle or breach of a registered APP code, in relation to personal information about a individual (being an “interference with privacy”) that is “serious” or “repeated”. These terms are not defined in the Privacy Act but the key things to understand are:

• An interference with privacy is not restricted to a ‘privacy breach’ in the traditional sense – a breach of any Australian Privacy Principle will suffice. For example a failure to comply with notification requirements when collecting personal information, or a failure to implement sufficient data security measures in relation to personal information, may lead to penalties being imposed.
• Whether an interference with privacy is serious will depend on the circumstances surrounding the interference, such as the number of individuals affected, the nature of the information affected, or the actual or likely consequences of the interference.
• However, a quality of ‘seriousness’ is not required if an organisation interferes with the privacy of an individual or individuals on two or more separate occasions, which could be the same act or practice done on two or more occasions or different acts or practices done on two or more occasions. However, a single act that affects multiple individuals, or a single act that breaches multiple Australian Privacy Principles, will not be captured by the civil penalties.

Expanded application to organisations outside Australia

One feature of the earlier Online Privacy Bill that has been carried over to the Enforcement Act, is a broader application of the Privacy Act to organisations that are not incorporated in Australia.

As we explained in our previous article, an organisation outside Australia – including those based in New Zealand – must comply with the Privacy Act if that organisation has an ‘Australian link’. A business will have an ‘Australian link’ if that organisation:

• Carries on business in Australia; and
• collects or holds information from a source inside Australia.

The Enforcement Act (consistent with the Online Privacy Bill) removes the second limb of that test. This change means that, once the Enforcement Act takes effect, the Privacy Act will apply to foreign organisations (including organisations in New Zealand) who carry on business in Australia, even if they do not collect or hold Australians’ information directly from a source in Australia.

Certain ‘small business operators’ that have an annual turnover of less than AU$3 million will remain exempt from the core provisions of the Privacy Act. However, the OAIC has advocated for the removal of this exemption and it is possible it will be affected by further Privacy Act reforms.

The explanatory memorandum for the Enforcement Act highlights the example of foreign organisations that collect personal information about Australians, from digital platforms which do not have servers in Australia and may therefore not be considered ‘in Australia’. While these types of organisations may be the intended target of the updated Privacy Act, it is likely that the actual impact of the Act could be much broader as any organisation that ‘carries on business in Australia’ may be captured.

I’m a New Zealand business, will I be affected?

New Zealand business that ‘carry on business in Australia’ could, as a result of the Enforcement Act, be liable for the new civil penalties.

There are a few non-determinative indicators on which the OAIC currently relies upon to determine whether an organisation is ‘carrying on business in Australia’, which include that the organisation has a place of business in Australia, Australia is one of the countries on the drop-down menu appearing on the organisation’s website, business or purchase orders are assessed or acted upon in Australia, and the organisation is the registered proprietor of trademarks in Australia. However, the test will unlikely be met solely on the basis that a purchase order can be placed in Australia or that the organisation’s website that can be accessed from Australia.

Our view remains that the changes to the Australian Privacy Act make it even less clear for New Zealand businesses as to whether and to what extent they may be caught by Australian privacy law.

Why the change?

The Federal Government has made it clear, in no uncertain terms, that the Enforcement Act is a response to recent cyber security incidents in Australia. The hope is that harsh penalties will incentivise businesses to implement strong privacy and data security measures to protect personal information held by them. The Enforcement Act also strengthens the OAIC’s powers to help organisations resolve privacy breaches.

These incidents include, notably, the Optus data breach, but also data breaches affecting customers of health insurer Medibank and online retail marketplace MyDeal. The Medibank data breach has escalated over the last month as tranches of sensitive customer data allegedly stolen from Medibank’s systems have been released on dark web forums.

The changes to the Privacy Act’s extra-territorial application have been proposed to ensure that the Act is fit for purpose in the new ‘digital age’ of technology. The Enforcement Act is intended to bring the Privacy Act in line with technological developments relating to the collection and storage of personal information, so that all organisations that carry on business in Australia, and deal with personal information of Australians, are subject to Australia’s privacy requirements. 

Other changes on the horizon

The Enforcement Act comes ahead of further changes to Australia’s privacy laws which may arise from the Government’s wider review of the Privacy Act. While we don’t know what these changes are yet, it is likely that they will address concerns about the Privacy Act’s effectiveness with the rise of digital technology and online platforms (which was the focus of the seemingly-shelved Online Privacy Bill).

It is also possible that the Government will seek to bring the Privacy Act in line with the GDPR and be reconsidered for an ‘adequacy decision’ from the European Commission. One of the key obstacles that will need to be overcome for this to happen is the Privacy Act’s current exemption for small business operators and other specified entities – which as mentioned above is an area of contention for the OAIC.

Start a conversation

Talk to the experts. Our privacy law specialists, Hayley Miller, Campbell Featherstone, Hayden Wilson and their teams are on hand to assist and have extensive experience advising on privacy law, and work closely with Dentons offices across the globe, including in Australia, to advise on cross-border privacy and data protection issues.

This article was written by Ashleigh Ooi, an associate in our commercial, technology and privacy team.