Last week the federal Government released its response (the Response) to the recommendations proposed by the AGD’s Privacy Act Review Report released in February 2023 (the Report).

The Response is largely supportive of the significant reforms proposed in the Report, including agreement in-principle to:

1. Remove the small business exemption (subject to further consultation and an appropriate transition period).
2. Alter the employee records exemption and to extend enhanced privacy protections to private sector employees.
3. Strengthen obligations around reporting and responding to data breaches.
4. Require entities to appoint or designate a senior employee with specific responsibility for privacy within the organisation.
5. Provide individuals an unqualified right to opt-out of personal information being used or disclosed for direct marketing purposes.
6. Introduce a distinction between controllers and processors of personal information to reduce compliance burden on processors.
7. Create a direct right of action for individuals to seek remedies from the court for breaches of the Privacy Act.
8. Introduce a statutory tort for serious invasions of privacy, based on the Australian Law Reform Commission’s recommended model.
9. Introduce a new, overarching requirement that collections, uses and disclosures of personal information must be fair and reasonable in the circumstances.
10. Require entities to determine and record the purposes for which they will collect, use and disclose personal information.
11. Require Privacy Impact Assessments for all high privacy risk activities.
12. Require additional information to be included in privacy policies.
13. Investigate the feasibility of an industry funding model for the OAIC.

With all these and more, 2024 is set to be another big year for privacy and cybersecurity. There is still time to get your organisation’s affairs in order to prepare for these changes: get a privacy and cybersecurity health check today!

Maddy Bassal also contributed to this article.