Privacy Reforms – Why Your Organisation Should Act Now

The Federal Government’s proposed privacy reforms are extensive. They would affect almost every stage of the information lifecycle: from collection and consent through to data security, breach response, marketing practices, retention and deletion.

The proposals signal a major shift in privacy regulation.

Although the reforms remain subject to further consultation, boards, executives, compliance officers, technology teams and marketing teams should be aware of, and consider, the significant implications of these reforms. Substantive proposals dealing with privacy obligations, security, access rights, research and processor arrangements are covered by the reforms.

Important commencement, transitional and implementation details remain unsettled. Regulatory guidance from the Office of the Australian Information Commissioner (OAIC) will likely play an important role in determining how several of the new concepts operate in practice.

Perhaps the most significant proposal is the introduction of a ‘fair and reasonable’ handling test. This new test would fundamentally reshape privacy law in Australia. Instead of relying heavily on established concepts such as primary purpose, secondary purpose, solicited versus unsolicited information and reasonable necessity, organisations would be required to assess and apply a range of factors as part of a ‘fair and reasonable’ information management test. This includes:

• Reasonable expectations
• Connection to organisational functions
• Transparency
• Data minimisation
• Genuine choice
• Impacts on individuals
• Proportionality
• If relevant, the best interests of children.

Organisations would need to develop new governance processes and revise approval frameworks and privacy impact assessment methodologies to demonstrate that their information handling activities are fair and reasonable.

Another significant proposal is the expansion of the definition of personal information.

Currently, information must be ‘about’ an individual to be personal information. The reforms propose to replace that concept with information that ‘relates to’ an identified or reasonably identifiable individual. The reforms also propose the introduction of new rules regarding identifiability, including consideration of information that can be combined with other reasonably available information to identify a person.

For organisations, this change could substantially increase the amount of information falling within the scope of privacy regulation. Information that may previously have been regarded as anonymous, operational or technical data could potentially become personal information depending upon the context in which it is used or combined with other datasets. Analytics, AI systems, behavioural profiling and inferred or derived data could therefore attract greater scrutiny. These changes would mean organisations would not only need to understand what data they hold, but also how that information may be linked, analysed and repurposed over time.

The reforms would also broaden the definition of sensitive information. Two notable additions are precise geolocation tracking data and genomic information. As sensitive information attracts higher compliance obligations (including consent requirements) under both existing laws and the proposed reforms, organisations that utilise location-based services and mobile applications would be likely to face increased compliance burdens.

The proposals also recognise that sensitive information may be inferred or derived from other information, rather than collected directly from an individual. This has potentially significant implications for organisations using predictive analytics, AI, profiling or automated decision-making tools.

Data breach obligations would become more demanding under the proposed reforms. Most notably, organisations would be required to provide a statement to the OAIC within 72 hours after forming reasonable grounds to believe that an eligible data breach has occurred. This would operate alongside the existing framework for assessing suspected breaches.

The reforms would also impose ongoing mitigation obligations and require organisations to maintain practices, procedures and systems enabling effective breach response. Incident response plans, escalation protocols, governance structures and decision-making frameworks would therefore be reviewed well before any reforms commence.

The proposed amendments to Australian Privacy Principle (APP) 11 would increase expectations regarding security, retention and destruction practices. Under these reforms, organisations would need to:

• Identify personal information that they hold
• Regularly evaluate the effectiveness of privacy controls
• Consider destruction before de-identification if information is no longer required
• Maintain appropriate technical and organisational safeguards.

In practical terms, organisations would require robust information inventories, retention schedules, destruction frameworks and evidence demonstrating ongoing compliance.

Currently, the Privacy Act provides for permitted general situations as exceptions to the APPs. Permitted general situations include the collection, use or disclosure of personal information which is reasonably necessary for the:

• Establishment, exercise or defence of a legal or equitable claim, or
• Purposes of a confidential alternative dispute resolution process.

It is proposed that these permitted general situations be amended to only apply to a collection, use or disclosure if the recipient is not overseas.

This reform would have significant consequences for organisations that operate across borders and which disclose information within their corporate group entities located overseas.

It would also likely impede communications with insurers, underwriters, advisers, service providers, and impact cross-border litigation, including communications with witnesses and experts.

The reforms reinforce the principle that de-identification is not a one-off exercise. Information would only be considered de-identified if, in the circumstances, it does not relate to an identified or reasonably identifiable individual.

Whether information is genuinely de-identified may therefore change over time as technologies evolve and new datasets become available. Organisations would need to regularly assess re-identification risks and ensure that governance frameworks account for changing technological and operational circumstances.

The reforms propose substantial changes to direct marketing and information trading practices. While direct marketing itself may not always require consent, the reforms would generally prohibit the trading of personal information without consent unless a specific exception applies. The concept of trading under the reforms is broad and may extend beyond traditional data sales to include certain advertising technology arrangements involving cookies, pixels and targeted advertising ecosystems.

The reforms would also require organisations to provide simple and effective opt-out mechanisms and to take reasonable steps to give effect to opt-out requests.

Businesses engaged in digital advertising or customer targeting would need to carefully review their existing data-sharing arrangements and marketing practices.

The reforms would amend access rights and introduce a new right to erasure for large digital platforms. Large digital platforms, generally those with annual revenue of at least $500 million or more than 2.5 million monthly end users, may be required to destroy personal information upon request unless a specified exception applies. Those exceptions include legal obligations, public interest considerations and circumstances in which destruction is technically impossible or infeasible.

The exposure draft introduces a controller-processor framework.  The reforms would allocate primary responsibility for privacy compliance to the controller, being the entity determining the purposes for which information is handled. A processor, acting as the controller’s agent by handling information on behalf of the controller, can limit its responsibility only by following the controller’s documented instructions and handling information solely for the purposes specified in those instructions.

While processors would retain certain direct obligations, including obligations relating to privacy governance and security, responsibility for many privacy obligations would effectively shift to controllers. This places increased emphasis on contractual arrangements, documented instructions, audit rights and vendor oversight.

The proposed reforms represent more than a series of technical amendments to the Privacy Act. They signal a fundamental shift towards broader definitions, stronger accountability obligations, enhanced individual rights and increased regulatory expectations.

Although the reforms remain subject to further consultation, organisations should consider reviewing their current practices now, to assess the impact of these reforms on them and their business practices, should the reforms pass. Priority review areas include:

• Privacy frameworks
• Governance processes capable of evidencing fair and reasonable handling decisions
• Data inventories and conducting data mapping exercises
• Identification of inferred and derived data sets utilised in the business
• Consent mechanisms and collection notices
• Assessing existing incident response frameworks against a 72-hour notification scenario
• Retention and destruction practices
• Cloud, outsourcing and processor arrangements
• Marketing and advertising technology arrangements.

While many aspects of the reforms remain uncertain, the overall direction is clear. Organisations which review and assess their current data practices, governance arrangements and privacy controls now will be significantly better positioned to manage compliance risks once the final legislative framework emerges.

To better understand what these changes mean in practice and the steps your organisation should be taking now, join our upcoming Continued Professional Development (CPD) webinar Australia’s Biggest Privacy Reforms in a Generation: Are You Ready? on Tuesday 24 November. The link is here.