The government has provided “in-principle” conditional support for more than half of the recommendations stemming from a two-year review of the Privacy Act. In its formal response, the government fully agreed to 38 of the review’s 116 recommendations. Legislation incorporating these changes will be drafted and subjected to further consultation. However, for many recommendations, support ranged from “in-principle” agreement for 68 recommendations to 10 recommendations being “noted” but with no clear path forward.
Recommendations given only in-principle support include the introduction of a tort of serious privacy invasion, subject to consultation with states and territories for a consistent national approach. The right of individuals to “apply to the courts for relief in relation to an interference with privacy” is also accepted in-principle with no implementation timeline. Other matters, such as individuals’ rights to control data collection and use, a “fair and reasonable” test for data collection, and data collection for marketing purposes, will require additional consultation.
The review explored ways to give individuals more control over how organizations collect and use their data, including the right to view collected data, the right to object to data collection, and the “right to be forgotten” through erasure, de-indexing, and correction of personal information. The proposed “fair and reasonable use” test for personal information handling, which could address “dark patterns,” has been accepted in-principle. However, reform of the Privacy Act’s treatment of political parties and journalism exemptions is off the agenda for now, with the government noting the report’s proposals.