Do We Change How We Protect? Changes To The Privacy Act

Reforming the Privacy Act 1988 (Cth) to address present day challenges in the collection, use, storage and other handling of personal information has been an ongoing project of multiple governments. Steps to amend the Privacy Act first began in 2019 with the final report of the Australian Competition and Consumer Commission (ACCC) as part of its Digital Platforms Inquiry. This was followed by a range of issues and discussion papers from the Federal Attorney-General's Department between 2020 and 2023. The first tranche of legislative reform proposals was tabled in the Australian Parliament on 12 September 2024. While this legislation contained a range of amendments to the Privacy Act, one of those amendments relates to the way that Australian Privacy Principle (APP) 11.1, the obligation to protect personal information, is interpreted and implemented.

This commentary will consider the impact of the proposed insertion of a new APP 11.3 on the interpretation and implementation of the obligation to protect personal information contained in the Australian Privacy Principles. This commentary will first contemplate the content of APP 11.1 as it stands and recall aspects of an article previously published in this Journal to reestablish the core obligations the provision imposes. This commentary will then track the progress of the Privacy Act review and proposed reform process, including the proposed change, before arguing that the inclusion of the proposed APP 11.3 will have very little, to no, material impact on existing obligations to protect personal information as set out in the Privacy Act before the amendment.