Privacy Act 1988

Privacy Act 1988
Sodacan · Public domain · source
Name	Privacy Act 1988
Enacted by	Parliament of Australia
Long title	An Act relating to privacy
Territorial extent	States and territories
Date commenced	1988
Status	current

Privacy Act 1988

The Privacy Act 1988 is Australian legislation establishing privacy protections for personal information held by public sector agencies and private sector organizations. It was introduced during the term of Bob Hawke and passed by the Parliament of Australia to implement principles influenced by international instruments such as the OECD Guidelines and the Universal Declaration of Human Rights. The Act created a statutory framework for privacy that interacts with institutions including the Australian Information Commissioner, the Office of the Australian Information Commissioner, and the Australian Human Rights Commission.

Background and Purpose

The Act arose from policy development by the Attorney-General of Australia in the late 1980s amid debates involving stakeholders such as Australian Privacy Foundation, Business Council of Australia, and state privacy commissioners in New South Wales, Victoria, and Queensland. Influences included comparative law from the United Kingdom Data Protection Act 1984, the HHS interpretations under HIPAA debates, and scholarly work from Geoffrey Dodds and David Hamer. The primary purposes were to regulate the collection, storage, use and disclosure of personal information involving entities such as Commonwealth Bank of Australia, Telstra Corporation, and educational institutions like University of Sydney.

Key Provisions

The Act comprises schedules and parts establishing obligations including the Australian Privacy Principles (APPs), originally modeled on recommendations from the ALRC and influenced by the APEC privacy framework. Core provisions address rights to access and correction of personal records at agencies such as Department of Home Affairs, rules for transborder data flows involving multinationals like Google and Facebook, and security breach notification obligations developed in response to incidents affecting entities like Medibank Private and Commonwealth Bank of Australia. The Act also includes exemptions for intelligence agencies including the ASIO, defense organizations such as the Australian Defence Force, and law enforcement bodies like Australian Federal Police when handling information under statutes including the Telecommunications (Interception and Access) Act 1979. Remedies include complaints to the Australian Information Commissioner and, where applicable, civil penalty provisions that intersect with litigation in courts like the Federal Court of Australia.

Administration and Enforcement

Administration is carried out by the Office of the Australian Information Commissioner and the Australian Information Commissioner who investigate complaints, issue guidance, and pursue enforcement actions involving corporations such as Optus and government agencies including Australian Taxation Office. Enforcement tools include conciliation, determinations, and civil penalties adjudicated by the Federal Court of Australia and, in certain cases, oversight by the Parliamentary Joint Committee on Human Rights and scrutiny by the Commonwealth Ombudsman. International cooperation occurs with agencies like the UK Information Commissioner's Office and the Office of the Privacy Commissioner of Canada on cross-border investigations concerning companies such as Microsoft and Apple Inc..

Amendments and Reform History

The Act has been amended multiple times, notably by legislation implementing the 2000 amendments extending coverage, the 2012 amendments introducing the APPs and strengthening enforcement, and later reforms following high-profile data breaches involving Medibank and Optus. Reviews by the Australian Law Reform Commission and reports to the Parliament of Australia have proposed changes addressing issues raised by developments in technologies produced by Amazon (company), Twitter, and cloud providers such as IBM. Parliamentary inquiries chaired by members from parties like the Liberal Party of Australia and the Australian Labor Party have debated harmonization with international frameworks including the GDPR.

Impact and Criticism

The Act has influenced privacy practice among institutions such as ANZ Banking Group and universities like Australian National University, prompting compliance programs, privacy impact assessments, and codes of practice developed with professional bodies such as the Law Council of Australia and the Australian Bankers' Association. Critics including advocacy groups like the Australian Privacy Foundation and commentators in outlets such as The Australian Financial Review argue the Act has weaknesses: limited extraterritorial reach affecting services from Alibaba Group and Tencent, exemptions for national security agencies like Australian Signals Directorate, and comparatively modest civil penalties versus regimes such as the GDPR and enforcement by the European Data Protection Board. Academic critiques from scholars associated with University of Melbourne and Monash University highlight challenges in reconciling privacy protections with innovations led by corporations such as DeepMind and research initiatives at institutions like CSIRO.

Category:Australian federal legislation Category:Privacy law