Privacy Amendment Act 2004

Overview

The Privacy Amendment Act 2004 (Cth) was enacted by the Parliament of Australia to address certain gaps and issues in the existing privacy framework as set out in the Privacy Act 1988. This legislation sought to enhance the privacy protections for individuals by extending the application of privacy principles, ensuring broader correction rights, and providing additional oversight functions. The primary objective was to modernise and strengthen privacy protections in response to evolving technological and societal changes. The Act amends the Privacy Act 1988 by making several key changes, including extending the extraterritorial application of privacy principles, allowing privacy codes to cover exempt acts or practices, authorising the use of government payroll identifiers for specific purposes, and granting the Privacy Commissioner additional audit functions. These amendments were designed to improve the effectiveness and reach of privacy protections, ensuring they keep pace with the changing landscape of personal information handling.

Scope and Application

The Privacy Amendment Act 2004 amends the Privacy Act 1988 to enhance privacy protection in various respects. This legislation applies to organisations and agencies that handle personal information, including Commonwealth entities, private sector entities, and certain non-profit organisations. The Act extends the application of the National Privacy Principle 9 extra-territorially, meaning that it applies to acts done outside Australia by organisations subject to the Act if those acts involve personal information of Australian residents. Additionally, the Act extends correction rights to non-Australians, thereby ensuring that individuals not residing in Australia can also seek corrections of their personal information held by organisations subject to the Act. Privacy codes approved under the Act can now cover exempt acts or practices, subjecting them to the Act's provisions, which means organisations bound by such codes are obliged not to breach the code and may be subject to complaints and investigations. The Act also facilitates the use of government payroll identifiers for superannuation services, subject to certain conditions and consultation with the Privacy Commissioner. Furthermore, it grants the Privacy Commissioner additional audit functions to review specific acts and practices of agencies concerning personal information, as prescribed by regulations.

Key Provisions

The Privacy Amendment Act 2004 (C2004A01284) amends the Privacy Act 1988 to introduce several significant changes. Firstly, the Act extends the extra-territorial application of National Privacy Principle 9 (NPP 9) (Schedule 1, Part 1, items 1 and 2). This amendment ensures that NPP 9 applies to acts done or practices engaged in outside Australia by organisations that are Australian or external organisations that offer goods or services to, or monitor the behaviour of, individuals in Australia. Secondly, the Act removes the requirement that correction rights under section 41 apply only to Australian citizens or residents (Schedule 1, Part 2, item 4). This change allows non-Australians to also seek corrections of their personal information held by organisations subject to the Privacy Act. The Privacy Amendment Act 2004 imposes several obligations on organisations and the Privacy Commissioner. Organisations must now ensure that their practices comply with NPP 9 even when conducted outside Australia (Schedule 1, Part 1). They must also allow non-Australians the same rights to correct their personal information as Australian citizens and residents (Schedule 1, Part 2). The Privacy Commissioner is granted additional audit functions, enabling them to audit specific acts and practices of agencies in relation to personal information, as prescribed by regulations (Schedule 1, Part 5, items 10 and 11). Furthermore, privacy codes may now cover exempt acts or practices, subject to certain conditions (Schedule 1, Part 3, item 6). These codes, when approved, bind organisations to obligations similar to those under the NPPs, even for exempt activities. Violations of the amended Privacy Act 1988 can result in significant penalties. For example, organisations found to be in breach of the NPPs, including the extra-territorial application of NPP 9, can face civil penalties of up to $2,100,000 for corporations and $210,000 for other entities (section 13G of the Privacy Act 1988). Additionally, the Privacy Commissioner has the authority to issue infringement notices for lesser breaches, with maximum penalties of $6,300 for corporations and $630 for other entities (section 13H of the Privacy Act 1988). Criminal penalties may also apply in certain circumstances, with maximum fines of up to $210,000 for individuals and $1,050,000 for corporations, depending on the nature and severity of the breach (section 13L of the Privacy Act 1988).