Australian Privacy Act, 1988 - An Analysis
Updated: Mar 16
The handling of personal information in Australia is governed by legislation at both a federal and state/territory level.
At a federal level, the Privacy Act 1988 (Cth) (Privacy Act) governs the way in which business entities and federal government agencies must handle personal information, largely through the 13 Australian Privacy Principles (APPs) set out within the Privacy Act.
‘Personal information’ is defined by the Privacy Act as:
information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not.
Most States and Territories in Australia (except Western Australia and South Australia) have their own data protection legislation applicable to relevant State or Territory government agencies, and private businesses that interact with State and Territory government agencies. These Acts include:
Information Privacy Act 2014 (Australian Capital Territory)
Information Act 2002 (Northern Territory)
Privacy and Personal Information Protection Act 1998 (New South Wales)
Information Privacy Act 2009 (Queensland)
Personal Information Protection Act 2004 (Tasmania), and
Privacy and Data Protection Act 2014 (Victoria)
Additionally, there are other parts of State, Territory and federal legislation that relate to data protection. For example, the following all impact privacy and data protection for specific types of data or activities: the Telecommunications Act 1997 (Cth), the Criminal Code Act 1995 (Cth), the National Health Act 1953 (Cth), the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic) and the Workplace Surveillance Act 2005 (NSW).
Who must comply with the Privacy Act?
The Privacy Act imposes obligations on ‘APP entities’.
An APP entity is, generally speaking:
an agency (which largely refers to a federal government entity and/or office holder) or
an organisation (which includes an individual, body corporate, partnership, unincorporated association, or trust).
An APP entity does not include:
a ‘small business operator’ (subject to the exceptions below), which is an operator of a business with an annual turnover of less than $3 million
a registered political party or
a state or territory authority.
However, a small business operator will be deemed to be an APP entity, and therefore required to comply with the Privacy Act if they:
operate another business with a turnover of $3 million or more
provide a health service or otherwise hold health information (other than in an employee record)
disclose, or collect, personal information about another individual for a benefit, service or advantage
are a contracted service provider for a Commonwealth contract or
are a credit reporting body.
Obligations under the Privacy Act
The key features of the Privacy Act include:
the 13 APPs which are the principles that govern the way in which personal information is to be collected, used, disclosed and stored. We have included a summary of the APPs in section 4 below. The full text of the APPs can be viewed on the Australian Information Commissioner’s website.
the credit reporting provisions of the Privacy Act (further explained in section 10 below), which govern the way in which credit-related personal information is to be collected, used, disclosed and stored. These provisions will be particularly relevant to entities that are credit providers (or agents of credit providers), credit reporting bodies, or that otherwise handle or deal in credit-related personal information and
the obligation to comply with an ‘APP code’, which is a written code of practice usually specific to a particular entity or industry. In particular, there is a Credit Reporting Code (CR Code) which imposes on entities handing credit information additional obligations to those set out in the credit reporting provisions of the Privacy Act.
Accordingly, APP entities must be aware of the full scope of the obligations imposed upon them according to the nature of their business activities.
The Australian Privacy Principles
Open and transparent management of personal information
Anonymity and pseudonymity
Collection of solicited personal information
Dealing with unsolicited personal information
Notification of the collection of personal information
Use or disclosure of personal information
No Direct marketing without consent
Cross-border disclosure of personal information
Adoption, use or disclosure of government related identifiers
Quality of personal information
Security of personal information
Access to personal information
Correction of personal information
Sensitive information
The Privacy Act generally affords a higher level of protection to ‘sensitive information’ given the mishandling of it can generally have a more detrimental impact on the relevant individual.