Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022
An Act to amend the law in relation to privacy, and for other purposes
1 Short title
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.5
The Act is the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022.
2 Commencement
Commencement rules for provisions in the Act.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.6
1 Section 1
The Act begins on the day after it receives Royal Assent.
The Act receives Royal Assent on the day after this section begins.
13 December
3 Schedules
Legislation in schedules is amended or repealed according to its terms.
1 At the end of subsection 59D(1)
List of non-corporate Commonwealth entities responsible for enforcing laws.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.7
2 Section 25
Substitute “(1) Subject to subsection (2), the” for “The”.
3 Paragraphs 25(e), (g) and (h)
4 Paragraph 25(k)
5 Paragraph 25(l)
6 At the end of section 25
The Information Commissioner may only delegate certain functions to staff members.
The Information Commissioner may only delegate certain functions.
7 Paragraph 29(2)(a)
Repeal paragraph 29(2)(a) and substitute with new conditions for information commissioner functions.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.8
8 Paragraph 29(2)(aa)
9 Paragraph 5B(3)(b)
Omit 'Territory;', substitute 'Territory.'.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.9
10 Paragraph 5B(3)(c)
11 Subsection 6(1)
12 Section 13G
13 Section 13G (penalty)
14 At the end of section 13G
14(1A) At the end of section 13G
14(2) At the end of section 13G
Maximum penalty for contravention of subsection (1) by a person other than a body corporate.
Prohibits exceeding $2,500,000 penalty for contravention of subsection (1)
...is an amount not more than $2,500,000.
Defines temporal scope of maximum penalty for contravention of subsection (1)
14(3) At the end of section 13G
Maximum penalty for contravention of subsection (1)
$50,000,000; 3 times the value of the benefit; 30% of adjusted turnover
14(4) At the end of section 13G
Subsection (3) applies despite paragraph 82(5)(a) of the Regulatory Powers Act.
Subsection (3) implies despite paragraph 82(5)(a)
14(5) At the end of section 13G
Adjusted turnover calculation for a body corporate during a period
Temporal interval for calculation period
(5) For the purposes of paragraph (3)(c), the adjusted turnover...
The calculation is for a period during which the body corporate, and any related body corporate, have made or are likely to make supplies...
The sum is of values of all supplies that the body corporate, and any related body corporate, have made or are likely to make during the period...
Classifies adjusted turnover calculation as an obligation
The sum is a calculated value for the purpose of determining the adjusted turnover of a body corporate during a period.
Classifies supplies not made by or to related bodies corporate as excluded
The sum excludes supplies that are input taxed; or not for consideration; or not made in connection with an enterprise...
14(6) At the end of section 13G
Expressions used in subsection (5) have the same meaning as in A New Tax System (Goods and Services Tax) Act 1999.
Same meaning as in A New Tax System (Goods and Services Tax) Act 1999.
14(7) At the end of section 13G
Defines breach turnover period for contravention
15 Subparagraphs 25(1)(a)(i) and 25A(1)(a)(i)
Substitute 'this Part' for 'this Act (other than section 13G)'
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.10
16 At the end of section 26WA
The Commissioner may obtain information or documents in relation to actual or suspected eligible data breaches.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.11
17 Paragraphs 26WK(3)(c) and 26WR(4)(c)
18 At the end of Part IIIC
26WU Power to obtain information and documents relating to
26WU(1) Power to obtain information and documents relating to
Commissioner may obtain information and documents from a person or entity.
Commissioner may obtain information and documents.
26WU(2) Power to obtain information and documents relating to
The entity must provide certain information and documents.
Entity must comply with the requirement.
26WU(3) Power to obtain information and documents relating to
Commissioner may require person or entity to provide information, produce documents, or answer questions.
26WU(4) Power to obtain information and documents relating to
Notice requirements for Commissioner's requests
26WU(5) Power to obtain information and documents relating to
Commissioner may take possession of documents and make copies or extracts.
Commissioner has permission to take possession of documents.
26WU(6) Power to obtain information and documents relating to
Power to obtain information and documents relating to
Has effect regardless of other Commonwealth law
26WU(7) Power to obtain information and documents relating to
Exemption from liability for providing information under other laws
19 Division 3 of Part IV (heading)
Repeal heading and substitute with new text.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.13
20 At the end of Division 3 of Part IV
33A Commissioner may share information with other authorities
33A(1) Commissioner may share information with other authorities
Commissioner may share information with other authorities.
33A(2) Commissioner may share information with other authorities
Commissioner must share information with covered authorities
33A(3) Commissioner may share information with other authorities
Sharing of information with other authorities is permitted under certain conditions.
Permission to share information with other authorities.
...with a receiving body under this section if...
Temporal interval of the sharing of information.
...if: (a) the information or documents were acquired by...
Recurring trace of sharing information with other authorities.
Diffusion of information to other authorities.
Sharing of knowledge with other authorities.
33A(4) Commissioner may share information with other authorities
(4) If the Commissioner acquired the information or documents from an agency, the Commissioner may only share the information or documents with a receiving body under this section if the receiving body is an agency.
Temporal interval for sharing of information.
Recurring trace of sharing of information.
Diffusion of information to authorized agencies.
33A(5) Commissioner may share information with other authorities
Receiving body may use shared information for its original purpose.
...the receiving body may use the information only for the purposes...for which it was shared.
Temporal overlap of information sharing.
Temporal until condition of information sharing.
33A(6) Commissioner may share information with other authorities
Commissioner may share information with other authorities
33B Commissioner may disclose certain information if in the public
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.14
33B(1) Commissioner may disclose certain information if in the public
Disclosure of information in public interest
33B(2) Commissioner may disclose certain information if in the public
Commissioner must consider certain factors when deciding to disclose information.
Commissioner has an obligation to consider certain factors.
Commissioner is required to disclose information if it is in the public interest.
Commissioner must have regard to the rights and interests of complainants or respondents.
Commissioner's decision-making process is bounded by temporal intervals.
Commissioner's factors for disclosure are relevant within a specific time frame.
Commissioner must consider the factors within a reasonable timeframe.
Commissioner's decision-making process is bounded by temporal intervals and other conditions.
Commissioner's factors for disclosure are relevant within a specific time frame, but also subject to other conditions.
Commissioner must consider the factors within a reasonable timeframe, but also subject to other conditions.
Commissioner's decision-making process is part of a larger diffusion process.
Commissioner's factors for disclosure are part of a broader process.
Commissioner must consider the rights and interests of complainants or respondents within the context of this process.
Commissioner's decision-making process is part of a larger cognitive AI process.
Commissioner's factors for disclosure are part of a broader cognitive AI process.
33B(3) Commissioner may disclose certain information if in the public
Commissioner may disclose certain information if in the public domain.
21 After paragraph 33C(1)(c)
Entity must comply with Part IIIC, including processes and procedures for data breaches.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.15
22 At the end of section 33C
22(3) At the end of section 33C
Commissioner may require entity or file number recipient to provide information or produce document within specified period.
Obligation to provide information or produce document.
22(4) At the end of section 33C
The Commissioner must not give a notice unless satisfied it is reasonable in the circumstances.
The Commissioner must not give a notice.
unless satisfied it is reasonable in the circumstances.
(4) The Commissioner must not give a notice under subsection (3)
unless the Commissioner is satisfied it is reasonable in the circumstances to do so
unless satisfied it is reasonable in the circumstances to do so, having regard to the following:
22(5) At the end of section 33C
Enforcement body not required to comply with notice if it prejudices enforcement activities.
Enforcement body not required to comply.
Chief executive officer believes on reasonable grounds that compliance would be prejudicial.
Recurring trace of enforcement activities.
Permits enforcement body to decide whether to comply.
22(6) At the end of section 33C
Section 70 applies to subsection (3) of section 33C.
22(7) At the end of section 33C
Granting permission to provide information
Exemption from obligation to provide information under other laws
22(8) At the end of section 33C
The Commissioner must publish information on the website.
23 At the end of subsection 44(1)
Add note for failure to give information
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.16
24 At the end of subsection 46(4)
25 At the end of subsection 47(1)
26 Subsection 50(1)
Substitute 'In this Act' for 'In this section'
27 Subsection 50(1) (after paragraph (b) of the definition of
Mandatory eSafety Commissioner for alternative complaint body
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.17
28 Subsection 50(1) (definition of Ombudsman)
29 After subparagraph 52(1)(b)(ii)
Respondent must prepare and publish a statement about conduct.
30 After paragraph 52(1A)(b)
31 After subsection 52(1A)
Inserts steps for the respondent to engage an independent adviser and provide a copy of the review.
32 After subsection 52(5)
Commissioner may publish determination on website.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.18
33 After section 52
52A Determination—requirement to notify conduct constituting
52A(1) Determination—requirement to notify conduct constituting
Respondent must notify conduct constituting interference with privacy within 14 days.
(i) the identity and contact details of the respondent or, if the respondent is the principal executive of an agency, the agency;
Describe conduct constituting interference with privacy
(ii) a description of the conduct engaged in by the respondent that constitutes the interference with the privacy of an individual;
Describe steps to be taken to prevent repetition or continuation
(iii) the steps (if any) undertaken, or to be undertaken, by the respondent to ensure the conduct is not repeated or continued;
(c) if required by the declaration—publish, or otherwise communicate, the statement in the manner specified by the declaration;
(d) give the Commissioner, within 14 days after the end of the period specified in the declaration, evidence that the actions required by paragraphs (b) and (c) were taken in accordance with this section and the declaration.
52A(2) Determination—requirement to notify conduct constituting
Matters must be reasonable and appropriate
34 Division 3 of Part V (heading)
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.19
35 At the end of section 55
Must prepare and publish a statement in accordance with a declaration.
36 At the end of section 58
37 At the end of section 59
Addition of a statement preparation task
38 Subsection 66(1)
Refusal to provide information under the Act
Prohibits refusal to provide information
State requires person to give information
Person contravenes subsection if refuses or fails to do so
Refusal to provide information overlaps with the requirement to give information
Refusal to provide information is a contravention if it occurs during the time period when the person is required to give information
Refusal to provide information repeats the requirement to give information
Refusal to provide information is a repeated contravention if it occurs during the time period when the person is required to give information
Diffusion of refusal to provide information diffuses the requirement to give information
Refusal to provide information diffuses the requirement to give information if it occurs during the time period when the person is required to give information
CogAI recognizes refusal to provide information as a contravention
Refusal to provide information is recognized by CogAI as a contravention if it occurs during the time period when the person is required to give information
39 After subsection 66(1)
Committing a system of conduct or pattern of behaviour results in multiple contraventions.
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.20
40 Subsection 66(1B)
Insertion of clause (1AA) after clause (1)
41 Subsection 66(1B) (note)
A person who wishes to rely on this subsection bears an evidential burden.
Burden of proof on the person relying on this subsection
42 Paragraph 67(b)
Omit specified phrase regardless of requirement under section 44.
43 Subsection 70(1)
44 After Division 1 of Part VIB
80UB Infringement notices
privacy-legislation-amendment-enforcement-and-other-measures-act-2022.pdf, p.21
80UB(1) Infringement notices
Subsection 66(1) of this Act is subject to an infringement notice under Part 5 of the Regulatory Powers Act.
80UB(2) Infringement notices
Identifies infringement officers for the purpose of Part 5 of the Regulatory Powers Act.
Identifies entities with a specific role.
80UB(3) Infringement notices
Commissioner is the relevant chief executive for a provision.
80UB(4) Infringement notices
Part 5 of the Regulatory Powers Act applies to every external Territory regarding infringement notices.
The provision applies to the specified Territory.
45 Application of amendments
Application of amendments from previous laws to new law