First steps to reform Australian privacy laws
Recently, on 24 June 2010, the Federal Cabinet Secretary, Senator the Honourable Joe Ludwig, released exposure draft legislation that Government proposes in order to implement its first stage response to reform privacy law in Australia. This is the first formal step by the Government to implement the recommendations of the Australian Law Reform Commission (ALRC) that the Government has accepted to update our laws that protect personal (or private) information.
As readers will be aware, on 31 January 2006, the Commonwealth Attorney-General asked the ALRC to review Australian privacy laws and to make recommendations about ways in which those laws (that have applied to the private sector at the Federal level since 2001) could be improved. According to the terms of reference, there were significant concerns that the advent of new technologies (including data matching, facial recognition technologies and improvements in genetic mapping), and how information is gathered, stored and communicated, together with changes in community views and the complex interaction with other privacy laws introduced by State and Territory governments, have meant that the current privacy laws may not respond appropriately to the current (and future) environment. The ALRC undertook a detailed analysis of the laws, and extensive public consultation. In response, the ALRC made a significant number of recommendations, focusing on each of the following:
- the technology neutrality of the law;
- a harmonised set of Privacy Principles;
- a redrafting of the Privacy Act to make it more accessible;
- a new comprehensive credit reporting framework;
- improvements in health sector information flows;
- enhanced powers for the Privacy Commissioner;
- codes to operate in conjunction with, and not instead of, unified privacy principles;
- an audit power to be granted to Privacy Commissioner;
- administrative review of determinations by Commissioner;
- greater penalty and enforcement provisions;
- a specific principle for direct marketing activities (but a rejection of any age based distinctions for direct marketing obligations);
- requirement to take reasonable steps to ensure that data is relevant;
- changes to what happens if access or correction is refused.
The Government has accepted some of those recommendations. Some of the recommendations have been rejected and some of those recommendations are still under consideration by the Government. The exposure draft bill and accompanying guide released by the Government is the Government’s proposed legislative response to the recommendations that it has accepted.
A key recommendation of the ALRC, accepted by the Government, is to unify the current Information Privacy Principles and the National Privacy Principles. The draft bill, if passed, will replace each of these principles with 13 “Australian Privacy Principles” (APPs). This will be instead of the separate 11 IPPs and 10 NPPs that currently exist. The APPs will apply to all “agencies” and “organisations”. State and Territory authorities and prescribed instrumentalities, together with individuals, small business operators and registered political parties will still be exempt from these new principles (subject to the Government’s response to the ALRC recommendations in relation to some of these exemptions in the second stage of the process). However, if the current Bill is passed, it will mean that Commonwealth government departments and agencies and all private businesses (other than small business operators) will have to comply with the same 13 principles.
The Government has indicated that it intends that the drafting of the new Act will be done in parts, with each part to be referred to a Senate committee for consideration and public consultation as the drafting of each is completed. In accordance with this commitment, Senator Ludwig has also tabled these proposed principles in the Senate for referral to a Senate committee which will conduct public hearings on the proposed reforms.
The Government intends that at least three further parts will be released, in order to implement the recommendations of the ALRC that have been accepted by the Government. At this stage, following the current exposure draft, the following 3 further parts will be released for public consultation:
- provisions introducing more comprehensive credit reporting, alongside privacy protections and responsible lending practices;
- provisions relating to the protection of health information, in particular improving health sector information flows, and giving individuals new rights to have their health record transferred between providers; and
- provisions strengthening the Privacy Commissioner’s powers to conduct investigations, resolve complaints and promote compliance with the Privacy Act, to be integrated into the newly-created Office of the Australian Information Commissioner.
Second stage Government response
Stage two of the Government’s response will consider the remaining 98 recommendations in the ALRC report that the Government has not yet accepted or rejected. This stage will deal with a number of significant and contentious issues, including:
- clarification or removal of exemptions (including the current employee exemption)
- a scheme for compulsory data breach notification
- a statutory cause of action for serious invasions of privacy
- privacy and decision making issues for children and authorised representatives
- handling of personal information under the Telecommunications Act 1997
The Government will consider and respond to these recommendations once the first stage reforms have been progressed. At this stage, there is no indication of the timing of this. Any further changes that the Government proposes will be subject to a similar process of Senate committee review and further public consultation, similar to the process adopted by the Government in relation to the current exposure draft Bill.
There has been no change in the attitude or approach of the Gillard Government.
Attitude of the Opposition
The attitude of the Opposition to the proposals, or many of the ALRC recommendations, is not clear. In August 2008, Senator Brandis (the Opposition shadow Attorney-General) indicated that the:
Opposition will examine the Report of the Australian Law Reform Commission, and any legislative response from the Government, with care.
Senator Brandis went on to say, in the context of a caution that any move to create a statutory cause of action for privacy, that:
Nevertheless, it is most unlikely that the Opposition would support the erosion of existing guarantees of freedom of speech.
I have not been able to find any more recent statements by Senator Brandis or the Coalition on these issues, or the Government’s proposals. The Coalition is yet to release any policy on the ALRC recommendations or the proposed reforms.
Now that a Federal election has been called (including a half-Senate election) it will be interesting to see the policy of the Opposition in relation to the amendments, and the recommendations of the ALRC, and the likely outcome of the proposed reforms, following the 21 August election.
For further information, please contact Swaab Attorneys.