Privacy Amendment (Private Sector) Act 2000

Overview

The Privacy Amendment (Private Sector) Act 2000 was enacted to address the gap in privacy regulation for the private sector. Prior to this Act, the Privacy Act 1988 primarily focused on government agencies, leaving private sector organisations largely unregulated in terms of privacy. This legislation was introduced to establish a comprehensive national scheme for privacy protection, extending its reach to private sector organisations. The primary objectives of the Act are to ensure the appropriate collection, holding, use, correction, disclosure, and transfer of personal information by private sector organisations, while balancing individuals' privacy interests with the broader social and economic interests, including the free flow of information. The Act was assented to on 21 December 2000 and commenced on 1 July 2001. It amends the Privacy Act 1988 and other related Acts to incorporate these new privacy standards for the private sector.

Scope and Application

The Privacy Amendment (Private Sector) Act 2000 amends the Privacy Act 1988 to extend its application to the private sector. It establishes a comprehensive national scheme for the collection, holding, use, correction, disclosure, and transfer of personal information by private sector organisations. The Act applies to organisations, which include individuals, body corporates, partnerships, unincorporated associations, and trusts, that are not small business operators, registered political parties, agencies, State or Territory authorities, or prescribed instrumentalities of a State or Territory. The Act applies to acts and practices of organisations that are done or engaged in outside Australia and the external territories if certain conditions are met, such as the act or practice relating to personal information about an Australian citizen or a person whose continued presence in Australia is not subject to a limitation as to time imposed by law. The Act also applies to acts and practices of organisations that relate to personal information collected or held by the organisation in Australia or an external territory. The Act extends to Commonwealth contracts, State contracts, and other specified acts and practices. The Act allows for the approval of privacy codes by the Privacy Commissioner and the revocation of such approvals. It also establishes a register of approved privacy codes and provides for the review of approved privacy codes. The Act includes provisions for the Commissioner to investigate complaints about acts or practices of organisations that may be interferences with privacy. It sets out the National Privacy Principles, which govern the handling of personal information by organisations. The Act also includes provisions for the Commissioner to make determinations about acts or practices of organisations that breach approved privacy codes or National Privacy Principles, and for the Commissioner to make temporary public interest determinations. The Act provides for the enforcement of determinations made by the Commissioner and establishes a register of determinations. It also includes provisions for the Commissioner to approve guidelines for the use and disclosure of health information for research and public health purposes, and for agencies entering into Commonwealth contracts to take contractual measures to ensure that contracted service providers do not breach approved privacy codes or National Privacy Principles.

Key Provisions

• The Privacy Amendment (Private Sector) Act 2000 amends the Privacy Act 1988 to establish a comprehensive national scheme for the collection, holding, use, correction, disclosure and transfer of personal information by private sector organisations. The Act introduces the concept of National Privacy Principles and approved privacy codes to regulate the handling of personal information by organisations. The Act also extends to acts and practices done or engaged in outside Australia by organisations that have a connection to Australia or its citizens.
• The Act imposes obligations on organisations to comply with the National Privacy Principles and approved privacy codes. Organisations must not engage in acts or practices that breach these principles or codes. The Act also sets out exceptions to the application of the National Privacy Principles, such as when an act or practice is required by a foreign law or when it is related to journalism or political activities.
• Organisations are subject to civil and criminal penalties for breaches of the Act. The Australian Information Commissioner can investigate complaints and take action against organisations that violate the Act. The Commissioner can also issue evidentiary certificates, which are considered prima facie evidence of the facts set out in the certificate.
• The Act includes provisions for the approval, variation, and revocation of privacy codes by the Commissioner. It also allows for the review of approved privacy codes and the review of adjudicator's decisions under an approved privacy code.
• The Act establishes a regime for public interest determinations and temporary public interest determinations, which can exempt organisations from liability for certain breaches of privacy if the public interest in the act or practice outweighs the public interest in adhering to the privacy principles or codes.
• The Act also includes provisions for the approval of guidelines for the use and disclosure of health information for research or statistical purposes, as well as requirements for Commonwealth contracts to ensure that contracted service providers do not breach privacy principles. The Act sets out the National Privacy Principles, which govern the collection, use, disclosure, and transfer of personal information by organisations. These principles include requirements for the collection of personal information, the use and disclosure of personal information, data quality, data security, openness, access and correction, identifiers, anonymity, transborder data flows, and sensitive information.
• In summary, the Privacy Amendment (Private Sector) Act 2000 establishes a comprehensive framework for the protection of personal information in the private sector, including National Privacy Principles, approved privacy codes, and obligations on organisations to comply with these principles and codes. The Act also provides for the investigation of complaints, enforcement of determinations, and civil and criminal penalties for breaches.

Legal classification tags

Area of Law

Privacy Law

Administrative Law

Instrument

Act

Concepts

Commencement Provisions

Definitions & Interpretation

Delegated & Subordinate Legislation

Repeal & Amendment

Licensing & Registration

Enforcement Powers