The Privacy Act Review Report was released on 16 February 2023. NSWCCL was pleased to see that many of the recommendations the Council made in our submission were supported by the review.
A key recommendation in our submission which was adopted by the review is ensuring the collection of, use and disclosure of personal information is fair and reasonable, including whether the “impact on privacy is proportionate to the benefit”. The Council supports the inclusion of non-exhaustive legislated factors that are relevant to determining whether the collection, use, or disclosure of personal information is fair and reasonable in the circumstances. However, it considers that clear guidance and examples of how these factors may apply in practice must be provided.
The standard of ‘fair and reasonable’ must be assessed by reference to the perspective of the individual, rather than being assessed from an APP entity’s perspective. We consider that having clear guidance from the outset, rather than waiting to see how the courts interpret such new provisions, will empower APP entities to appropriately assess whether any proposed data collection, use or disclosure would be unfairly prejudicial to, or unreasonable having consideration to the expectations of, the individual. In particular, to the extent that these factors do require consideration of what is ‘fair and reasonable’ from the perspective of the individual, the APP entity should be required to consider and satisfy each factor. This is because the protection of personal information and right to privacy should be fundamental to the Act, and should not be readily outweighed by business considerations.
The review has also proposed “direct right of action” that allows individuals to seek compensation in the Federal Court for a breach of privacy, which privacy advocates have long called for. To access the action, a claimant would first need to make a complaint to the Office of the Australian Information Commissioner (OAIC).
The Council supports the creation of a direct right of action. The NSWCCL considers it important that individuals can personally litigate a claim for breach of their privacy under the Privacy Act. However, the ability of individuals to do so is currently limited. The creation of a direct right of action would therefore give individuals greater control over their personal information by providing an additional avenue of redress under the Privacy Act. This, in turn, would encourage better compliance by APP entities of their privacy obligations under the Act.
However, the expansion of the OAIC’s funding is critical given that several proposals contained within the Discussion Paper involve the broadening of the OAIC’s current remit. Chronic underfunding will erode the effectiveness of any privacy protections the OAIC seeks to implement and support. To properly conduct both its existing and proposed activities, the OAIC must be adequately funded and consulted in respect of the resources it requires. The OAIC received limited funding to support its privacy initiatives in the 2021-2022 Federal Budget, despite a significant expansion in its activities with the onset of its Digital Economy Strategy.
