Privacy Amendment (Enhancing Privacy Protection) Act 2012
No. 197, 2012
Compilation No. 1
Compilation date: 12 March 2014
Includes amendments up to: Act No. 5, 2015
Registered: 6 March 2015
About this compilation
This compilation
This is a compilation of the Privacy Amendment (Enhancing Privacy Protection) Act 2012 that shows the text of the law as amended and in force on 12 March 2014 (the compilation date).
This compilation was prepared on 6 March 2015.
The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law.
Uncommenced amendments
The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on ComLaw (www.comlaw.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the series page on ComLaw for the compiled law.
Application, saving and transitional provisions for provisions and amendments
If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes.
Modifications
If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the series page on ComLaw for the compiled law.
Self-repealing provisions
If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes.
Contents
1 Short title
2 Commencement
3 Schedule(s)
Schedule 1—Australian Privacy Principles
Privacy Act 1988
Schedule 2—Credit reporting
Privacy Act 1988
Schedule 3—Privacy codes
Privacy Act 1988
Schedule 4—Other amendments of the Privacy Act 1988
Schedule 5—Amendment of other Acts
Part 1—Amendments relating to the Australian Privacy Principles
Acts Interpretation Act 1901
Aged Care Act 1997
A New Tax System (Family Assistance) (Administration) Act 1999
Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006
AusCheck Act 2007
Australian Citizenship Act 2007
Australian Curriculum, Assessment and Reporting Authority Act 2008
Australian Passports Act 2005
Australian Prudential Regulation Authority Act 1998
Commonwealth Electoral Act 1918
Crimes Act 1914
Dairy Produce Act 1986
Defence Act 1903
Defence Force (Home Loans Assistance) Act 1990
Defence Home Ownership Assistance Scheme Act 2008
Defence Service Homes Act 1918
Education Services for Overseas Students Act 2000
Extradition Act 1988
Fair Work (Building Industry) Act 2012
Freedom of Information Act 1982
Healthcare Identifiers Act 2010
Higher Education Support Act 2003
Horse Disease Response Levy Collection Act 2011
Inspector of Transport Security Act 2006
Migration Act 1958
Military Rehabilitation and Compensation Act 2004
Mutual Assistance in Criminal Matters Act 1987
National Health Act 1953
National Health Reform Act 2011
National Health Security Act 2007
National…
Overview
The Privacy Amendment (Enhancing Privacy Protection) Act 2012 was enacted to address various issues and gaps in the existing privacy legislation, particularly focusing on strengthening privacy protections. This Act amends the Privacy Act 1988 by introducing new Australian Privacy Principles (APPs) and making various other amendments to enhance privacy protections for individuals. The Act was passed by the Australian Parliament and received Royal Assent on 12 December 2012. The key objectives of this legislation include promoting the protection of privacy, facilitating responsible and transparent handling of personal information by entities, and ensuring the privacy of individuals is respected in credit reporting systems. Additionally, the Act aims to implement Australia's international obligations in relation to privacy.
Scope and Application
The Privacy Amendment (Enhancing Privacy Protection) Act 2012 is an Act of the Commonwealth of Australia that amends the Privacy Act 1988 to enhance the protection of privacy. The Act applies to APP entities (agencies, organisations, and small business operators) and credit reporting bodies (organisations that carry on a credit reporting business). The Act also applies to acts and practices of entities outside Australia and the Australian external Territories if the entities have an Australian link. The Act outlines the Australian Privacy Principles which APP entities must comply with, as well as specific provisions relating to credit reporting and privacy codes. The Australian Privacy Principles set out how APP entities must manage personal information, including collection, use, disclosure, and retention. The Act also establishes a framework for the development, registration, and review of privacy codes, and provides for the making of determinations and civil penalty orders. The Commissioner has various functions under the Act, including conducting investigations, making determinations, and accepting undertakings. The Act's provisions relating to Australian Privacy Principles, credit reporting, and privacy codes apply to acts and practices done, or engaged in, after the Act's commencement. The Act also contains transitional and savings provisions to ensure continuity in the operation of the Privacy Act during the period between the Act's Royal Assent and commencement.
Key Provisions
- The Privacy Amendment (Enhancing Privacy Protection) Act 2012 makes several key changes to the Privacy Act 1988. Firstly, it introduces Australian Privacy Principles (APPs) which replace the previous National Privacy Principles (NPPs). APP entities (which include agencies, organisations, and small business operators) are required to comply with these APPs. Key provisions include ensuring open and transparent management of personal information (APP 1), anonymity and pseudonymity (APP 2), collection and notification of personal information (APPs 3 and 4), use and disclosure of personal information (APP 6), and cross-border disclosure of personal information (APP 8). APP entities must not engage in any act or practice that breaches the APPs. The Act also sets out permitted general situations and permitted health situations in which the APPs may be breached.
- Secondly, the Act imposes specific obligations on APP entities in relation to the collection, use, disclosure, and retention of personal information. For example, APP entities must not collect personal information unless it is necessary for their functions or activities (APP 3). They must also take reasonable steps to ensure the accuracy, security, and quality of personal information (APPs 10 and 11). APP entities must notify individuals of the collection of their personal information and provide access to that information (APPs 12 and 13). Thirdly, the Act introduces a new registered Credit Reporting (CR) code that applies to credit reporting bodies and credit providers. It limits the collection, use, and disclosure of credit information by these entities.
- The Act also provides for offences, penalties, and consequences for breaches. APP entities that breach the APPs or the registered APP code commit an interference with privacy which may result in a civil penalty order. The maximum penalty for serious and repeated interferences with privacy is 2,000 penalty units (currently around $220,000). Entities that obtain or disclose personal information in contravention of the Act also face penalties of up to 2,000 penalty units. Credit reporting bodies and credit providers that breach the registered CR code or certain credit reporting provisions also commit offences and face penalties of up to 2,000 penalty units. The Act also provides for the Commissioner to issue public interest determinations and civil penalty orders.
- In summary, the key changes introduced by the Act are the replacement of the NPPs with the APPs, expanded obligations on APP entities in relation to the handling of personal information, and new rules governing the operation of the credit reporting system in a privacy-protective manner. The Act aims to enhance privacy protections while still facilitating an efficient credit reporting system.
- Area of Law
- Privacy Law
- Consumer Law
- Financial Services Regulation
- Instrument
- Act
- Concepts
- Definitions & Interpretation
- Regulatory Standards
- Enforcement Powers
- Civil Penalty Provisions
