Australia has taken a significant step forward in modernising its privacy laws with the passage of the Privacy and Other Legislation Amendment Bill 2024. The legislation, which cleared both Houses of Parliament in late November, introduces several groundbreaking changes to protect individuals’ privacy in the digital age.
One of the most notable reforms is the creation of a new statutory tort for serious invasions of privacy, allowing individuals to sue when their privacy has been breached through intrusion or misuse of personal information. The law caps damages at $478,550 and includes specific exemptions for journalists and law enforcement agencies.
The legislation also criminalises “doxxing” – the malicious publication of personal information online. Offenders could face up to six years in prison, with increased penalties of up to seven years if the doxxing targets individuals based on characteristics such as race, religion, or sexual orientation.
Organisations handling personal information will face stricter requirements, including new obligations to implement technical and organisational measures to protect data security. Privacy policies must now disclose the use of automated decision-making systems that could significantly affect individuals’ rights or interests, though organisations have a two-year grace period to comply with this requirement.
Additionally, the Office of the Australian Information Commissioner (OAIC) will receive enhanced powers, including the ability to issue compliance notices and infringement penalties for Privacy Act violations. The reforms also introduce a mechanism for “white listing” countries with similar privacy protections, simplifying international data transfers.
As part of the reform, the OAIC must develop a Children’s Online Privacy Code within two years to enhance protection of children’s privacy online. The code will apply to social media services and other online platforms likely to be accessed by children.
While these changes represent significant progress, they are just the first phase of Australia’s broader privacy reform agenda, with more comprehensive changes expected in future legislation.
For a full reading of the Bill, see here.
