/>iTranche 2 of the Australian Privacy Act reforms is expected soon (perhaps imminently), following comments from the new attorney general in the media that suggested the time for conversation and for lobbying is over. The attorney general noted in an interview last month on Sky News that the highly anticipated “second tranche” of Australian privacy law reform is coming, saying “Australians are sick and tired of their personal data being exploited” and “not being protected,” and that “we will not have our privacy reforms dictated by multinational tech giants.”
While the exact timing and elements that will be included in tranche 2 are not yet known, there is enough material in the recommendations from the Privacy Act Review Report and the Government’s positive response to the vast majority of those recommendations, both released in 2023, for transformative privacy law changes to be brought into effect without further significant industry consultation. Indeed, the parliamentary drafting teams may have already provided a preview of some of those changes in their work to finalise tranche 1 of the reforms last year.
The comments have generated a flurry of activity and interest in affected industries and we have seen an uptick in organisations looking to ensure they have budgeted for further privacy and cyber security compliance uplifts through a combination of additional personnel, security infrastructure, and project teams.
How should you prepare?
- Prepare a ‘data inventory’ so you understand the personal information your organisation collects and holds;
- Ensure your privacy policies and practices are transparent and notified to individuals at the correct times;
- Ensure sensitive information is deleted or destroyed once its purpose is fulfillfed; and
- Ensure your organisation has an appropriate forward budget and resources to undertake the necessary privacy compliance uplift program when these changes become law
