Major changes on the horizon: Privacy Act reform signals more changes to come

The highly anticipated Privacy and Other Legislation Amendment Bill 2024 (Privacy Amendment Bill) was introduced to Parliament on 12 September 2024.  While there has been a lot of commentary about the scope of the Privacy Amendment Bill and what is hasn’t addressed, it’s important not to lose sight of what is included, what these amendments will mean and, importantly, what they signal in terms of further changes to come.

What are the changes?

The Privacy Amendment Bill is the government’s first tranche of amendments to the Privacy Act 1988 (Cth) (Privacy Act) (and a number of other laws) to address privacy risks in the digital age. The amendments will implement 23 of the 25 agreed recommendations from the Privacy Act Review Report (see Privacy Act Review Report | Attorney-General's Department (ag.gov.au)).

Significantly, the Privacy Amendment Bill proposes the following changes:

What is coming next?

When introducing the Privacy Amendment Bill, the Attorney General made it clear that a second tranche of amendments are coming “over the coming months” with targeted consultation will on draft provisions to occur.

Having regard to the Privacy Act Review Report and what is (and is not) in the Privacy Amendment Bill, we anticipate the second tranche of amendments will have a greater focus on APP entities and require entities to take action on a range of issues, including:

What do you need to do?

In order to be ready for the first tranche of amendments, APP entities should:

While entities should take these immediate steps it is important that you don’t lose momentum on preparations for the full suite of reforms – entities should continue to audit their personal information holdings to ensure they have a full picture of their data footprint to be able to implement the next tranche of amendments.

Please reach out to Chantal Tipene or Kelly Matheson to discuss the impact of these amendments on your agency.