Privacy laws in Australia are governed by the Privacy Act 1988 (Cth) (the ‘Act’) and the Australian Privacy Principles.

The principles were introduced in 2014 to bring Australia’s privacy laws (first introduced in 2001) in line with advancing technology trends and to provide more transparency around the capture and use of personal information. They make it difficult for businesses to collect information about consumers without their knowledge, and prescribes how businesses can handle, use and store personal information.

These principles have been further strengthened by the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth) which imposes mandatory reporting requirements on entities subject to existing obligations under the Act, for an ‘eligible data breach’.

If your business is affected, you may need to update your privacy policies and your procedures and systems to comply with the law.

Which businesses are affected by the privacy laws?

The Act applies to Australian Government agencies, businesses with an annual turnover of $3 million or greater, credit reporting bodies, and smaller entities ‘trading in personal information’.

What does ‘trading in personal information’ mean?

Personal information is information that identifies, or could reasonably identify, an individual. This includes names, addresses, date of birth and bank account details.

Trading in personal information includes collecting or providing personal information to a third party for a benefit, service or advantage. If you collect personal information and then provide it to a business to manage your direct marketing, you may be trading in personal information.

What are the key obligations?

Businesses subject to the Act must:

• Ensure they have a privacy policy that addresses specific topics;
• Have procedures and systems in place to ensure they comply with the Act and the privacy principles;
• Understand what an ‘eligible data breach’ is and implement policies to deal with such breaches.

Entities affected by the Act may face significant fines for serious or repeated breaches.

How do I ensure my business complies?

Businesses affected by the Act should review and identify how they deal with personal information. The following elements need to be addressed:

Privacy Notice

When you collect personal information, inform individuals of your organisation’s name, contact details, the purpose of collection and to whom it will be disclosed.

Privacy Policy

Your privacy policy must address the required topics. These include:

• What personal information you collect,
• How you collect the personal information,
• The purposes for which you use and disclose it,
• If you provide personal information to parties overseas you need to disclose that and, if practicable, specify the countries where those parties are located, and
• Set out how you secure and store personal information.

Systems

Establish a system to ensure that:

• Staff who handle personal information comply with the new privacy laws.
• Individuals can access their personal information and correct out of date or incorrect information.
• You have a process to deal with complaints about your compliance with the laws.
• Enables recipients of direct marketing material to unsubscribe.

Understanding eligible data breaches

An eligible data breach happens if:

• There is unauthorised access to, unauthorised disclosure of, or loss of, personal information held by an entity; and
• The access, disclosure or loss is likely to result in serious harm to any of the individuals to whom the information relates.

An entity must give notification of an eligible data breach:

• If it has reasonable grounds to believe that a breach has occurred; or
• If information has been lost and unauthorised access or disclosure of that information is likely to occur; and, in either case,
• The breach would likely result in serious harm to the individuals to whom the information relates.

Dealing with eligible data breaches

If a breach occurs, an entity must notify any affected individual and the Office of the Australian Information Commissioner (OAIC).

If an entity suspects a breach has occurred, it must investigate the circumstances of the possible breach within 30 days of becoming aware of it, to determine whether it is an eligible data breach.

Notification must include:

• The entity’s identity;
• Details of the data breach – i.e. how the breach occurred;
• What information is the subject of the breach; and
• The recommended actions that individuals should take in response to the breach.

Notification is not required if an entity is able to quickly remedy a data breach so that it is unlikely to result in serious harm.

Entities that fail to carry out the investigation and notification processes prescribed by the reforms will breach their obligations under the Act and may face civil penalties.

Conclusion

Business entities that handle personal information must understand and comply with privacy laws. Staff should be trained, and policies implemented on how to collect, store and manage personal information. Policies should identify systemic problems when collecting and handling information and set out appropriate solutions.

Staying one step ahead of your privacy obligations, and minimising the potential for data breaches to occur, is essential to safeguard against fines and loss of reputation.

If you need more information or if you need assistance or advice on how to proceed please call us on (02) 9963 9800 or via our contact form, here.