KEY DATES OF
FEDERAL DATA PRIVACY REFORM
IN AUSTRALIA
DEC. 14, 1988 PASSAGE DATE
Federal Privacy Act 1988
★ Established the 11 Information Privacy
Principles for federal government agencies
that collect, maintain and disclose individuals’
personal information.
DEC. 21, 2001 COMMENCEMENT DATE
Privacy Amendment (Private Sector)
Act 2000
★ Extended the scope of the Privacy Act to private
entities, including large businesses and health
service providers, to comply with standards known
as the 10 National Privacy Principles.
★ Clarified the distinction between personal
information, sensitive information and health
information covered by the Privacy Act.
NOV. 1, 2010 COMMENCEMENT DATE
Australian Information Commissioner
Act 2010
★ Created the Office of the Australian Information
Commissioner to take over privacy operations from
the former Office of the Privacy Commissioner.
MARCH 12, 2014 COMMENCEMENT DATE
Privacy Amendment (Enhancing Privacy
Protection) Act 2012
★ Replaced the 11 Information Privacy Principles with
the 13 Australian Privacy Principles as the new data
standards and granted new enforcement power to
the Information Commissioner.
DEC. 12, 2019 DEVELOPMENT
The former attorney general announced the
government would review the Privacy Act.
★ The announcement comes as part of its response
to the digital platforms inquiry conducted by the
Australian Competition and Consumer Commission.
OCT. 30, 2020 DEVELOPMENT
The first two documents, an issues paper
and terms of reference, are published as part
of the Privacy Act comprehensive review.
★ Public feedback was requested for potential privacy
reform areas.
OCT. 25, 2021 DEVELOPMENT
A discussion paper is published as part of
the Privacy Act comprehensive review.
★ Presented the first round of comments and solicited
a new round of public feedback.
An exposure draft, explanatory paper and
regulatory impact statement are published
as part of the consultation process for the
Privacy Legislation Amendment (Enhancing
Online Privacy and Other Measures) Bill
2021 (the Online Privacy Bill)
★ Solicited a round of public feedback.
★ Occured alongside and intended to complement
the Privacy Act comprehensive review.
★ The Online Privacy Bill was a former government
bill that was never introduced to Parliament.
OCT. 12, 2022 COMMENCEMENT DATE
Telecommunications Amendment
(Disclosure of Information for the Purpose
of Cyber Security) Regulations 2022
★ Imposes greater privacy requirements but also
enables the government and some financial services
providers to request customer data from telecom
companies in response to cybersecurity incidents.
DEC. 13, 2022 COMMENCEMENT DATE
Privacy Legislation Amendment
(Enforcement and Other Measures)
Act 2022
★ Increased penalties and information sharing
powers and ensured foreign organizations
that carry on a business in Australia meet the
obligations under the Privacy Act.
WHAT TO EXPECT IN THE FIRST HALF OF 2023
The attorney general department’s comprehensive review of the Privacy Act with public feedback has concluded.
The government is looking to amend the scope and application of the Privacy Act with recomendations that may include:
★ Developing a framework of privacy practices
for personal data.
★ Establishing a private right of action for
individuals harmed by an organization’s
data practices.
Published February 2023.
The IAPP disclaims all warranties, expressed or implied, with respect to the contents of this material, including any warranties of accuracy,
merchantability or fitness for a particular purpose. Nothing herein should be construed as legal advice.
© 2023 International Association of Privacy Professionals. All rights reserved.
SEPT. 24, 1991 COMMENCEMENT DATE
1990s
Privacy Amendment Act 1990
★ Regulated credit reporters and providers that
handle consumer credit reports and data.
2000s
JULY 1, 2000 COMMENCEMENT DATE
Privacy Amendment (Office of the Privacy
Commissioner) Act 2000
★ Created the Office of the Privacy Commissioner
to take over privacy operations from the Human
Rights and Equal Opportunity Commission.
SEPT. 14, 2006 PASSAGE DATE
Privacy Legislation Amendment Bill 2006
★ Added genetic information to the definitions of
health information and sensitive information
covered under the Privacy Act.
2010s
DEC. 12, 2012 COMMENCEMENT DATE
Privacy Amendment (Enhancing Privacy
Protection) Act 2012
★ Made amendments to credit reporting provisions.
FEB. 22, 2018 COMMENCEMENT DATE
Privacy Amendment (Notifiable Data
Breaches) Act 2017
★ Required all entities subject to the Privacy Act
to notify impacted individuals and the OAIC of
data breaches.
2020s
JULY 1, 2020 DEVELOPMENT
The Consumer Data Right launched
with the banking sector’s live sharing
of consumer data.
FEB. 16, 2021 COMMENCEMENT DATE
National Consumer Credit Protection
Amendment (Mandatory Credit Reporting
and Other Measures) Act 2021
★ Made amendments to credit reporting provisions.
FEB. 7, 2022 DEVELOPMENT
The Federal Court granted the Information
Commissioner leave to serve legal
documents on a U.S.-based entity.
FEB. 17, 2022 DEVELOPMENT
Australian Information Commissioner
finds the Privacy Act may apply to
companies without a physical presence
in Australia if they install and manage
cookies on the physical devices of
Australian users.
★ This decision was reached in the ongoing case of
Facebook v. Australian Information Commissioner.
SEPT. 16, 2022 DEVELOPMENT
The High Court granted Facebook special
leave to appeal the Federal Court’s Decision.
NOV. 28, 2022 PASSAGE DATE
Privacy Legislation Amendment
(Enforcement and Other Measures) Bill 2022
★ Amended the Privacy Act to increase maximum
penalties for serious or repeated privacy breaches,
expand the scope of compliance to include more
foreign organizations, and strengthen investigatory
and enforcement powers for regulators.
DEC. 19, 2022 DEVELOPMENT
Completion of the review of the Privacy
Act and reform recommendations
delivered to the attorney general.
★ The Government is now considering the report.
Any legislative amendments following from the
review are a decision for Government.
★ Updating the notifiable data breach scheme. ★ Imposing an independent certification
★ Updating enforcement powers in scheme for privacy compliance.
consideration of how the privacy regulatory ★ Establishing a statutory tort for serious
scheme aligns with other regulatory invasions of privacy.
frameworks.