These reforms mark a significant shift in how personal information is protected in Australia, with wide reaching implications for businesses in Australia and overseas. New Zealand businesses that are subject to the Australian Privacy Act will need to revisit their privacy policies and internal practices to address any gaps in compliance and ensure they meet all new requirements. In this article, we outline the key features of each bill.
Australian Privacy and Other Legislation Amendment Bill 2024
On 29 November 2024, the Australian House of Representatives passed the Australian Privacy and Other Legislation Amendment Bill 2024 (Privacy Amendment Bill), amending the Privacy Act 1988 and seven other pieces of Australian legislation. It is considered the first step in major reforms aimed at modernising Australian privacy law.
Australian Privacy Commissioner Carly Kind stated, “These new powers and functions come at a critical time, as privacy harms increase, and the Australian community demands more power over their personal information.”
Key Features
The key features of the Privacy Amendment Bill include:
- Expanding the Office of the Australian Information Commissioner (OAIC) powers;
- Facilitating information sharing in emergency situations or following eligible data breaches;
- Requiring the development of a Children’s Online Privacy Code by the OAIC;
- Providing protections for overseas disclosures of personal information;
- Introducing new civil penalties; and
- Requiring increased transparency about automated decisions using personal information.
Additionally, the Privacy Amendment Bill:
- Introduces a statutory tort to provide redress for serious invasions of privacy; and
- Amends the Criminal Code 1995 to introduce criminal offences targeting what is known as “doxxing” (the release of personal data using a carriage service in a manner that would be menacing or harassing).
Implications for New Zealand businesses
The major amendments introduced by the Privacy Amendment Bill expand the enforcement and investigation powers of the OAIC and introduce new civil and criminal penalties. They also impose greater compliance obligations on organisations regulated by the Australian Privacy Act.
As several features of the Bill will be effective upon receiving royal assent, there will be a very limited grace period for compliance. Accordingly, businesses subject to the Australian Privacy Act should review their privacy policies and revisit how they handle personal information to address any gaps in compliance and ensure they meet all new requirements.
Online Safety Amendment (Social Media Minimum Age) Bill 2024
After only being introduced on 21 November 2024, the Online Safety Amendment (Social Media Minimum Age) Bill 2024 was also speedily passed by the House of Representatives on 29 November 2024.
The Social Media Minimum Age Bill restricts the use of social media platforms by individuals under the age of 16 years old in an attempt to reduce the risks of harm.
According to the Albanese Government, the Social Media Minimum Age Bill places an onus on social media platforms (such as Facebook and X (formerly Twitter)) to take ‘reasonable steps’ to prevent Australians under the age of 16 years old from having social media accounts.
Social media platforms that fail to comply with the Act will face new civil penalties, including fines as high as AUD$49.5 million.
The controversial bill has faced both criticism and praise from commentators, raising questions about the rights of children and young people, mental health, and its unconventional swift passage through parliament.
The Social Media Minimum Age Bill will not come into effect until late 2025 to allow platforms sufficient time to implement proper systems.
Future Outlook
As privacy laws continue to evolve in Australia and around the world, New Zealand businesses captured by the Australian regime will need to stay alert to these changes and proactively manage how they handle personal information to ensure they remain compliant.
These reforms also provide insight to what the future of privacy protections might hold for New Zealand.
If you have any questions about the matters raised in this article, please get in touch with the contacts listed or your usual Bell Gully adviser.