Landmark Privacy Act Review report leads to new consultation

While the digital economy has generated significant benefits, including consumer convenience, improved efficiencies and new employment opportunities, it has also resulted in large amounts of information about people being generated, used, disclosed and stored.

The Albanese Government has released the report of the Attorney-General’s Department’s review of the Privacy Act 1988.

Strong privacy laws are essential to Australians’ trust and confidence in the digital economy and digital services provided by governments and industry.

However, the Privacy Act has not kept pace with the changes in the digital world.

Throughout the Review, the vulnerability of people’s information in the digital age has been highlighted, including recently in relation to Medibank and Optus’ high-profile data breaches, exposing millions of Australians to privacy risks including identity fraud, reputational damage and blackmail. These harms challenge the community’s trust in new applications of technology, which the Productivity Commission recently noted “is critical for future uptake, as businesses and governments need to maintain their social licence to deliver digital and data-enabled services”.

Following those breaches the Government acted swiftly to significantly increase penalties under the Privacy Act for serious or repeated privacy breaches and give the Australian Information Commissioner improved and new powers.

The report proposes “that entities should determine, and periodically review, the period of time for which they retain personal information”.

It also proposes enhancements to the Notifiable Data Breach scheme to ensure “quick action can be taken to minimise harm to affected individuals” should there be a breach.

The proposed reporting obligations would include notifying the Information Commissioner within 72 hours of becoming aware of a data breach.

Australia’s Attorney-General, Mark Dreyfus MP has confirmed that a statutory tort of privacy is among the matters to be considered as part of that overhaul, and has hinted that the introduction of a right to be forgotten will also be contemplated.

The introduction of a statutory tort of privacy would mean that Australians could sue for damages for ‘serious’ breaches of privacy, where the private information has been misused or used to intrude into a person’s physical private space.

The right to be forgotten, which is also referred to as the right of erasure, currently exists in the European Union’s ‘General Data Protection Regulation’ (the GDPR) and other EU regulations governing privacy and data protection. It provides people with a right to request that organisations delete their personal information in certain circumstances, including (but not limited to) where the information is no longer required to be held by the organisation for the purpose that it was collected.

Australians rightly expect greater protections, transparency and control over their personal information and the release of this report begins the process of delivering on those expectations.

The Government is now seeking feedback from the public in addition to public and private entities on the 116 proposals in this report before deciding what further steps to take.

In reimagining healthcare across the entire patient journey, Health Industry Hub^TM is the only one-stop-hub uniting the diversity of the Pharma, MedTech, Diagnostics & Biotech sectors to inspire meaningful change.

The Health Industry Hub^TM content is copyright protected. Access is available under individual user licenses. Please click here to subscribe and visit T&Cs here.