privacy-and-other-legislation-amendment-act-2024.pdf, p.8
Repeal paragraph and substitute with new provisions promoting privacy protection.
1 Paragraph 2A(a)
privacy-and-other-legislation-amendment-act-2024.pdf, p.64
Must provide personal info in APP privacy policy under certain conditions
1 Section 1
The decision must affect individual rights or interests
Decision affects individual rights or interests
the decision could reasonably be expected to significantly affect the rights or interests of an individual;
The entity must have arranged for a computer program
Entity has arranged for computer program
the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision;
The personal info must be used in the computer program
personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.
The entity must use the computer program to make a decision
Entity uses computer program to make decision
Defines types of personal information covered by the subclause.
Defines terms for subclauses 1.7 and 1.8 regarding decisions and actions affecting individual rights or interests.
Defines terms for subclauses 1.7 and 1.8.
Applies to individual rights or interests.
Replace existing paragraph with new one.
privacy-and-other-legislation-amendment-act-2024.pdf, p.12
Declaration under section 80J is a legislative instrument.
10 At the end of section 80J
Minister must provide writing in writing.
11 Subsection 80K(1)
privacy-and-other-legislation-amendment-act-2024.pdf, p.22
Steps including technical and organisational measures are required.
11 Section 11
Declaration under section 80K is a legislative instrument.
12 At the end of section 80K
Inserts privacy reforms and emergency declarations into the Privacy and Other Legislation Amendment Act 2024.
13 After section 80K
privacy-and-other-legislation-amendment-act-2024.pdf, p.35
Civil penalty provision for serious interference with privacy of an individual
13G Civil penalty provision for serious interference with privacy of
privacy-and-other-legislation-amendment-act-2024.pdf, p.37
13H Civil penalty provision for interference with privacy of
Interference with privacy of an individual is prohibited.
13H(1) Civil penalty provision for interference with privacy of
...the entity does an act, or engages in a practice...
Defines temporal interval for contravention.
(1) An entity contravenes this subsection...
Classifies entities that contravene the provision using AI.
Diffuses information about contravention.
Defines temporal trace for contravention.
Civil penalty provision for interference with privacy of
13H(2) Civil penalty provision for interference with privacy of
Maximum penalty amount for contravention of subsection (1)
13H(3) Civil penalty provision for interference with privacy of
(3) The amount of the penalty payable by a person...
Interference with privacy is not serious if court is satisfied.
13J Alternative orders
Interference with privacy is not serious.
privacy-and-other-legislation-amendment-act-2024.pdf, p.38
13K Civil penalty provision for which infringement notices or
Non-compliance with Australian Privacy Principles
13K(1) Civil penalty provision for which infringement notices or
Privacy principles are classified as applicable
Australian Privacy Principles are prescribed by regulations
Failure to comply with subsection 26WK(3) results in contravention of this subsection.
13K(2) Civil penalty provision for which infringement notices or
Prohibits entity from taking certain action.
13K(3) Civil penalty provision for which infringement notices or
Maximum penalty amount for contravention of subsections (1) and (2)
13K(4) Civil penalty provision for which infringement notices or
(4) The amount of the penalty payable by a person...
privacy-and-other-legislation-amendment-act-2024.pdf, p.15
14 Sections 80L and 80M
Substitute 'cease to be in force' for 'cease to have effect'
15 Section 80N (heading)
Omit 'ceases to have effect at the earliest of', substitute 'ceases to be in force at the earliest of the following'.
16 Section 80N
Substitute ‘ceases to be in force at the earliest of the following’
Replaces 'earliest of' with a temporal interval
Omit ‘ceases to have effect at the earliest of’
Prohibits the use of 'ceases to have effect at the earliest of'
17 Paragraph 80N(a)
18 Paragraph 80N(a)
Omit “revoked; or”, substitute “repealed;”.
19 Paragraph 80N(b)
Substitute 'obligations' for 'obligation'
2 Paragraph 2A(h)
Repeal paragraph, substitute start of day after end of 12-month period beginning on declaration commencement
20 Paragraph 80N(c)
Permitted purpose specified in declaration
21 Paragraphs 80P(1)(b) to (e)
privacy-and-other-legislation-amendment-act-2024.pdf, p.16
22 Subsection 80P(7) (paragraph (a) of the definition of
Insertion of subsections after certain definitions.
23 Subsection 80P(7) (paragraph (a) of the definition of
Granting permission for section 15LC of the Crimes Act 1914.
24 Subsection 80P(7) (after paragraph (a) of the definition of
25 Subsection 80P(7) (paragraph (c) of the definition of
Insert sections of the Witness Protection Act 1994
26 Subsection 80P(7) (after paragraph (ca) of the definition of
Inserts sections of the Witness Protection Act 1994
privacy-and-other-legislation-amendment-act-2024.pdf, p.9
26GA Development of APP codes by the Commissioner—at the
Minister may direct Commissioner to develop APP code if in public interest.
26GA(1) Development of APP codes by the Commissioner—at the
The Commissioner must specify matters that the APP code must deal with.
26GA(2) Development of APP codes by the Commissioner—at the
The Commissioner must specify one or more matters that the code must deal with.
Commissioner must develop and register code
26GA(3) Development of APP codes by the Commissioner—at the
The Commissioner must develop and register an APP code if the Minister gives a direction.
26GA(4) Development of APP codes by the Commissioner—at the
The Commissioner must develop and register an APP code.
privacy-and-other-legislation-amendment-act-2024.pdf, p.10
26GB Development of APP codes by the Commissioner—temporary
The Minister may direct the Commissioner to develop a temporary APP code.
26GB(1) Development of APP codes by the Commissioner—temporary
The Minister may direct the Commissioner.
Temporary direction for APP code development
26GB(2) Development of APP codes by the Commissioner—temporary
Commissioner must develop and register APP codes.
26GB(3) Development of APP codes by the Commissioner—temporary
Commissioner must develop and register temporary APP code on Minister's direction.
26GB(4) Development of APP codes by the Commissioner—temporary
Obligation to develop and register APP code
Temporary APP code must not cover exempt acts or practices
26GB(5) Development of APP codes by the Commissioner—temporary
Commissioner may consult persons for temporary APP code development
26GB(6) Development of APP codes by the Commissioner—temporary
The temporary APP code period must not exceed 12 months.
26GB(7) Development of APP codes by the Commissioner—temporary
(7) The period set out for the temporary APP code...
Section 42 of the Legislation Act 2003 does not apply to a temporary APP code that is a registered APP code.
26GB(8) Development of APP codes by the Commissioner—temporary
Temporary APP codes overlap with section 42 of the Legislation Act 2003.
(8) Section 42 (disallowance) of the Legislation Act 2003 does not apply to a temporary APP code that is a registered APP code.
Exempts temporary APP codes from section 42 of the Legislation Act 2003.
Section 42 (disallowance) of the Legislation Act 2003 does not apply to a temporary APP code that is a registered APP code.
Temporary APP codes are permitted under section 42 of the Legislation Act 2003.
Temporary APP codes are exempt from section 42 of the Legislation Act 2003.
Temporary APP codes repeat section 42 of the Legislation Act 2003.
privacy-and-other-legislation-amendment-act-2024.pdf, p.18
26GC Development of APP codes by the Commissioner—Children’s
The Commissioner must develop an APP code about online privacy for children.
26GC(1) Development of APP codes by the Commissioner—Children’s
Section applies provisions of Division to Children's Online Privacy Code subject to this section.
26GC(2) Development of APP codes by the Commissioner—Children’s
The Children's Online Privacy Code must set out how one or more of the Australian Privacy Principles are to be applied or complied with in relation to the privacy of children.
26GC(3) Development of APP codes by the Commissioner—Children’s
Obligation to comply with the Australian Privacy Principles
The Children's Online Privacy Code must not cover certain acts or practices exempt under subsection 7B(1), (2) or (3).
26GC(4) Development of APP codes by the Commissioner—Children’s
Allows exemptions under subsection 7B(1), (2) or (3)
the code must not cover an act or practice that is exempt within the meaning of subsection 7B(1), (2) or (3)
Imposes a duty on entities to comply with the Children's Online Privacy Code
An APP entity must comply with the Children’s Online Privacy Code under certain conditions.
26GC(5) Development of APP codes by the Commissioner—Children’s
Obligation to comply with the Children’s Online Privacy Code
(5) Subject to subsection (7), an APP entity is bound by the Children’s Online Privacy Code...
Entity is not providing a health service
(iii) the entity is not providing a health service;
APP entity is a provider of a social media service, relevant electronic service or designated internet service
(i) the entity is a provider of a social media service, relevant electronic service or designated internet service (all within the meaning of the Online Safety Act 2021);
Entity is likely to be accessed by children
(ii) the service is likely to be accessed by children;
Exempts Children's Online Privacy Code from certain provisions.
26GC(6) Development of APP codes by the Commissioner—Children’s
Prohibits application of paragraph 26C(2)(b) to the Children's Online Privacy Code.
(6) Paragraph 26C(2)(b) does not apply in relation to the Children’s Online Privacy Code.
Exemption for APP entities from the Children's Online Privacy Code
26GC(7) Development of APP codes by the Commissioner—Children’s
APP entity or class of entities specified in the code
privacy-and-other-legislation-amendment-act-2024.pdf, p.25
26WA Guide to this Part
Minister must make eligible data breach declaration
26X Eligible data breach declaration
privacy-and-other-legislation-amendment-act-2024.pdf, p.28
Cease of force for data breach declaration
26XA When declarations cease to be in force
12-month period for declaration cessation
(c) the start of the day after the end of the period of 12 months beginning on the day the declaration commences.
(b) the time at which the declaration is repealed;
26XB Authorisation of collection, use and disclosure of personal
Entity may collect, use or disclose personal information under specified conditions.
26XB(1) Authorisation of collection, use and disclosure of personal
Permission to collect, use or disclose personal information.
Entity must reasonably believe that the individual is at risk from the eligible data breach.
At any time when an eligible data breach declaration is in force in relation to an eligible data breach,
Information of a kind or kinds specified in the declaration.
The collection, use or disclosure is for a permitted purpose specified in the declaration.
Information disclosed by an entity specified in the declaration.
The information is disclosed to an entity specified in the declaration, or an entity included in a class of entities specified in the declaration.
Conditions specified in the declaration subject to conditions.
If a matter mentioned in paragraph (b), (c), (d) or (e) is specified in the declaration subject to conditions—those conditions are satisfied.
Conditions must be satisfied before collection, use or disclosure.
The information is disclosed by an entity specified in the declaration, or an entity included in a class of entities specified in the declaration; and
Authorisation of collection, use and disclosure of personal information
26XB(2) Authorisation of collection, use and disclosure of personal
Liability for breach of duty of confidence
26XB(3) Authorisation of collection, use and disclosure of personal
No breach of Australian Privacy Principle or APP code if authorized by subsection (1)
26XB(4) Authorisation of collection, use and disclosure of personal
...in respect of a collection, use or disclosure of personal information authorised by subsection (1).
Entity exempt from breach obligation if authorized
Authorized collection, use and disclosure of personal information by agency officers or employees.
26XB(5) Authorisation of collection, use and disclosure of personal
Officer/employee authorized to collect, use and disclose personal information.
Agency authorization required for officer/employee actions.
Agency must authorize officer/employee actions.
Authorises collection, use and disclosure of personal information
26XB(6) Authorisation of collection, use and disclosure of personal
Authorisation to collect, use and disclose personal info
designated secrecy provision means any of the following:
privacy-and-other-legislation-amendment-act-2024.pdf, p.30
26XC Disclosure of information—offence
Disclosing personal information without consent is an offence.
26XC(1) Disclosure of information—offence
Prohibits disclosure of personal information.
Disclosure of information is permitted under certain conditions.
26XC(2) Disclosure of information—offence
Disclosure of personal information is authorized by this section.
26XC(3) Disclosure of information—offence
Authorizes disclosure of personal information
(3) If a disclosure of personal information is covered by subsection (2), the disclosure is authorized by this section.
Court must include any tribunal, authority or person having power to require production of documents or answering of questions.
26XC(4) Disclosure of information—offence
Includes any tribunal, authority or person...
privacy-and-other-legislation-amendment-act-2024.pdf, p.31
26XD Division not limited by secrecy provisions
Operation of Division not limited by secrecy provisions.
26XD(1) Division not limited by secrecy provisions
...except to the extent that the secrecy provision expressly excludes the operation of this section.
Division not limited by secrecy provisions.
(1) The operation of this Division is not limited by a secrecy provision...
Secrecy provision excludes operation of section.
State and Territory laws concurrent with Commonwealth law.
Note: Section 3 provides for the concurrent operation of State and Territory laws.
No requirement to collect, use or disclose personal information
26XD(2) Division not limited by secrecy provisions
26XD(3) Division not limited by secrecy provisions
Applies to explicit class/type/subclass hierarchies
Relies on Commonwealth's legislative powers under paragraph 51(xxix) of the Constitution.
26XE Constitutional basis of this Division
Obligation to give effect to Australia's obligations under relevant international agreements
Relies on Commonwealth's legislative powers
privacy-and-other-legislation-amendment-act-2024.pdf, p.32
26XF Additional operation of this Division
26XF(1) Additional operation of this Division
Commonwealth entities must comply with the Division's effect when performing their functions or duties.
26XF(10) Additional operation of this Division
Commonwealth entities must comply with the Division's effect.
Conditional effect of Division on corporations to which paragraph 51(xx) applies
26XF(2) Additional operation of this Division
Reference to collection, use or disclosure confined to banking business within the State concerned.
26XF(3) Additional operation of this Division
...other than State banking not extending beyond the limits of the State concerned.
Defines a temporal interval that is relevant to the carrying on of banking business within the State concerned.
(3) This Division also has the effect it would have if...
Defines a recognition that is relevant to the carrying on of banking business within the State concerned.
Imposes a duty on States to limit collection, use or disclosure of personal information.
Defines a diffusion that is relevant to the carrying on of banking business within the State concerned.
Defines a recurring trace that is relevant to the carrying on of banking business within the State concerned.
Reference to collection, use or disclosure confined to insurance business within the meaning of paragraph 51(xiv) of the Constitution.
26XF(4) Additional operation of this Division
Eligible data breaches must be reported to the relevant authorities.
26XF(5) Additional operation of this Division
(5) This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure that occurs in the course of, or in relation to, trade or commerce:
(a) between Australia and places outside Australia; or (b) among the States; or (c) within a Territory, between a State and a Territory or between 2 Territories.
Territories are subject to the provisions of this Division.
26XF(6) Additional operation of this Division
Reference to collection, use or disclosure confined to a Territory.
26XF(7) Additional operation of this Division
Reference to collection, use or disclosure confined to alien within Constitution
26XF(8) Additional operation of this Division
Temporal overlap between reference and collection, use or disclosure
(8) This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to:
Incorporated reference to aliens within Constitution into AI systems
Incorporates reference to aliens within Constitution into AI systems
(b) a collection, use or disclosure of personal information about an alien (within the meaning of paragraph 51(xix) of the Constitution)
Restricts reference to aliens within Constitution
(a) a collection, use or disclosure by an alien (within the meaning of paragraph 51(xix) of the Constitution)
Diffused reference to aliens within Constitution
Diffuses reference to aliens within Constitution into surrounding provisions
Repeating trace of reference and collection, use or disclosure
Prohibits reference to collection, use or disclosure within Australia.
26XF(9) Additional operation of this Division
privacy-and-other-legislation-amendment-act-2024.pdf, p.34
Section 12B does not apply in relation to this Division.
26XG Interaction with section 12B
26XH Compensation for acquisition of property
Commonwealth liable to pay reasonable compensation for acquisition of property on just terms.
26XH(1) Compensation for acquisition of property
Commonwealth has an obligation to pay compensation.
Compensation for acquisition of property
26XH(2) Compensation for acquisition of property
27 Subsection 80P(7) (definition of entity)
Disclosure for carrying out constitutional functions, powers or duties
28 After paragraph 80Q(2)(a)
privacy-and-other-legislation-amendment-act-2024.pdf, p.17
Amendments apply to declarations made on or after commencement.
29 Application of amendments
3 Subsection 6(1)
30 Subsection 6(1)
Defines classes of entities, personal information, and activities for APP codes.
31 After subsection 26C(4)
32 Before section 26H
privacy-and-other-legislation-amendment-act-2024.pdf, p.21
Commissioner develops a Children’s Online Privacy Code under section 26GC.
33 After paragraph 26H(1)(b)
Creates an obligation to develop a Children’s Online Privacy Code.
privacy-and-other-legislation-amendment-act-2024.pdf, p.46
33E Inquiries by Commissioner
Directs Commissioner to conduct or approve a public inquiry.
33E(1) Inquiries by Commissioner
Commissioner must specify acts and personal information for inquiry.
33E(2) Inquiries by Commissioner
The Commissioner must specify certain details for the inquiry.
33E(3) Inquiries by Commissioner
Variation of direction or approval by Minister
33E(4) Inquiries by Commissioner
Commissioner must conduct a public inquiry.
33E(5) Inquiries by Commissioner
(5) The Commissioner must conduct a public inquiry in accordance with a direction or approval given under subsection (1).
Commissioner may conduct inquiry in manner as Commissioner thinks fit.
33E(6) Inquiries by Commissioner
Inquiry does not constitute an investigation or preliminary inquiry.
33E(7) Inquiries by Commissioner
If inquiry, then not investigation or preliminary inquiry.
(7) Inquiry does not constitute an investigation under section 40 nor a preliminary inquiry under section 42.
Inquiry is the negation of investigation and preliminary inquiry.
A direction or approval given under subsection (1) is not a legislative instrument.
33E(8) Inquiries by Commissioner
privacy-and-other-legislation-amendment-act-2024.pdf, p.47
Commissioner may invite submissions on matters of a public inquiry.
33F Commissioner may invite submissions
Commissioner has the power to invite submissions.
Commissioner has an obligation to inform themselves on any matter in a manner of their choice.
33G Commissioner not bound by the rules of evidence
Commissioner has an obligation to inform themselves.
Sections 44 and 45 apply to a public inquiry in the same way as they do to an investigation under Part V.
33H Commissioner’s powers
privacy-and-other-legislation-amendment-act-2024.pdf, p.48
33J Reporting on public inquiries
The Commissioner must prepare a written report on the inquiry and give it to the Minister.
33J(1) Reporting on public inquiries
Must provide a copy of the report to entities specified in a direction or approval.
33J(2) Reporting on public inquiries
Reporting on public inquiries is required.
33J(3) Reporting on public inquiries
Report must not include certain findings or recommendations about privacy.
33J(4) Reporting on public inquiries
Table a copy of the report within 15 sitting days.
33J(5) Reporting on public inquiries
Publicly available report on public inquiries
33J(6) Reporting on public inquiries
34 At the end of clause 11 of Schedule 1
Amendment of clause 11 of Schedule 1 applies to information held after commencement.
35 Application of amendment
privacy-and-other-legislation-amendment-act-2024.pdf, p.23
36 After subsection 100(1)
The Minister must be satisfied that the laws of a country or binding scheme protect personal information in a substantially similar way to Australian Privacy Principles.
36(1A) After subsection 100(1)
Prescribes conditions for regulations to apply Australian Privacy Principle 8.3
36(1B) After subsection 100(1)
conditions in relation to a specified kind or kinds of personal information
Disclosure of information must comply with subclause 8.3.
37 After paragraph 8.2(a) of Schedule 1
38 At the end of clause 8 of Schedule 1 (after the note)
privacy-and-other-legislation-amendment-act-2024.pdf, p.24
Amendments apply regardless of when information was acquired or created.
39 Application of amendments
4 Section 26G (at the end of the heading)
Definition of eligible data breach declaration
40 Subsection 6(1)
Repeal heading and substitute with new text.
41 Section 26WA (heading)
Deals with collection, use and disclosure of personal information involved in eligible data breaches.
42 At the end of section 26WA
43 At the end of Part IIIC
Division applies in relation to eligible data breaches and information collected, used or disclosed after commencement.
44 Application provision
Division applies in relation to eligible data breaches that happen on or after the commencement of this Part.
Substitute sections 13, 13G and 13H for sections 13 and 13G.
45 Paragraph 16F(1)(b)
Replaces section references with new ones.
Replace section 13G with sections 13G and 13H.
46 Subsection 16F(3)
47 Paragraphs 37(2)(b) and 38(1)(b)
48 Paragraph 10A(2)(b)
Replaces section 13 with sections 13, 13G and 13H.
49 Section 13G (heading)
5 After section 26G
Repeal of subsection and substitution with civil penalty provision
50 Subsection 13G(1)
Prohibition of interference with individual privacy
privacy-and-other-legislation-amendment-act-2024.pdf, p.36
Factors that may be taken into account in determining if interference with privacy is serious
51 After subsection 13G(1A)
Interference with privacy is serious if...
Consider factors when determining seriousness of interference with privacy
52 Before subsection 13G(2)
53 Subsection 13G(3)
54 Before subsection 13G(5)
55 Before subsection 13G(7)
56 At the end of Division 1 of Part III
privacy-and-other-legislation-amendment-act-2024.pdf, p.39
57 Subsection 80UB(1)
Exempts certain provisions from infringement notices
57(1) Subsection 80UB(1)
Exempts listed corporations from certain regulatory requirements
57(1A) Subsection 80UB(1)
if an infringement notice relates to only one alleged contravention of subsection 13K(1) or (2), or 80UC(4)
Specifies the temporal scope of the exemption
(1A) Despite subsection 104(2) of the Regulatory Powers Act
the amount to Schedule 1 Privacy reforms
by a listed corporation (within the meaning of the Corporations Act 2001)
privacy-and-other-legislation-amendment-act-2024.pdf, p.40
57A After Division 1A of Part VIB
privacy-and-other-legislation-amendment-act-2024.pdf, p.43
58 Application of amendments
privacy-and-other-legislation-amendment-act-2024.pdf, p.44
59 At the end of Division 1 of Part VIB
privacy-and-other-legislation-amendment-act-2024.pdf, p.11
Omit section 26G and substitute with sections 26G, 26GA or 26GB.
6 Paragraph 26H(1)(b)
privacy-and-other-legislation-amendment-act-2024.pdf, p.45
Section applies Privacy Act 1988 amendments to proceedings instituted after Part commencement.
60 Application of amendments
61 Subsection 33(1)
Omit 'or monitoring', substitute ', monitoring or inquiry'
62 Subsection 33(3)
Insert clause after Division 3A of Part IV
63 After Division 3A of Part IV
privacy-and-other-legislation-amendment-act-2024.pdf, p.49
Division 3B of Part IV of the Privacy Act 1988 applies in relation to public inquiries commenced on or after the commencement of this Part.
64 Application of amendments
Division 3B applies to inquiries on or after commencement.
privacy-and-other-legislation-amendment-act-2024.pdf, p.50
Allow reasonably foreseeable loss or damage that is likely to be suffered.
65 Subparagraph 52(1)(b)(ii)
66 Paragraph 52(1A)(c)
Amendments apply after commencement of this Part.
67 Application of amendments
privacy-and-other-legislation-amendment-act-2024.pdf, p.51
Inserts 'during the year' after 'performance'
68 Paragraph 32(1)(a)
69 Paragraph 32(1)(b)
7 Subsection 80G(1)
Entity includes person, agency, and organisation
Add details about complaints under section 36 of the Privacy Act 1988.
70 At the end of subsection 32(1)
Amendments apply to annual reports after Part commencement
71 Application of amendments
privacy-and-other-legislation-amendment-act-2024.pdf, p.52
72 Paragraph 41(1)(dc)
Amendment applies in relation to complaints made before or after commencement.
73 Application of amendments
privacy-and-other-legislation-amendment-act-2024.pdf, p.53
Power to investigate contraventions of civil penalty provisions
74 Subsection 56ET(3) (at the end of the note)
The Information Commissioner has the power to investigate during Division 5 of Part IVD of this Act.
Temporal interval for investigation power
Division 1AC of Part VIB of the Privacy Act 1988
The Information Commissioner has the power
Obligation to investigate contraventions
75 Subsection 56ET(4) (item 5 of the table)
76 Subsection 56ET(4) (note 1)
77 Subsection 56ET(4) (note 2)
78 Subsection 85ZZG(1)
Commissioner has power to monitor compliance with Divisions 2 and 3 of this Part.
79 At the end of subsection 85ZZG(1)
Commissioner's power is during Division 2 and 3.
Subsection 80TB(1) of the Privacy Act 1988
Commissioner has power to monitor compliance.
8 Section 80H
Disclosure of personal information to overseas recipient is subject to certain conditions.
8 Section 8
Commissioner has power to monitor under Schedule 1 Privacy reforms
80 Subsection 13(7)
privacy-and-other-legislation-amendment-act-2024.pdf, p.13
80KA Matters covered by declarations
Emergency declaration must specify personal information details
80KA(1) Matters covered by declarations
Entities or classes of entities may include State or Territory authorities, but must not include media organisations.
80KA(2) Matters covered by declarations
Special Broadcasting Service Corporation
Purpose must relate to Commonwealth's response to emergency or disaster
80KA(3) Matters covered by declarations
Permitted purposes in relation to an emergency or disaster
80KA(4) Matters covered by declarations
privacy-and-other-legislation-amendment-act-2024.pdf, p.54
Subject to monitoring and investigation under the Regulatory Powers Act.
80TA Simplified outline of this Part
Subject to monitoring and investigation.
privacy-and-other-legislation-amendment-act-2024.pdf, p.55
80TB Monitoring powers
Provisions subject to monitoring under Part 2 of the Regulatory Powers Act.
80TB(1) Monitoring powers
Subject to monitoring under Part 2 of the Regulatory Powers Act.
80TB(2) Monitoring powers
privacy-and-other-legislation-amendment-act-2024.pdf, p.58
Use of force in executing a monitoring warrant
80TC Modifications of Part 2 of the Regulatory Powers Act
Use of force is necessary and reasonable in the circumstances
Authorized person may use such force against things as is necessary and reasonable in the circumstances
Person assisting authorized person may use such force against things as is necessary and reasonable in the circumstances
A person assisting the authorized person may use such force against things as is necessary and reasonable in the circumstances
privacy-and-other-legislation-amendment-act-2024.pdf, p.59
Investigation powers for certain provisions
80TD Investigation powers
Prohibits investigation of certain provisions
Includes provisions subject to investigation in Part 3 of the Regulatory Powers Act
privacy-and-other-legislation-amendment-act-2024.pdf, p.62
80TE Modifications of Part 3 of the Regulatory Powers Act
Authorized persons may use force against things necessary and reasonable in the circumstances.
80TE(1) Modifications of Part 3 of the Regulatory Powers Act
Exercise powers under Part 3 of the Regulatory Powers Act in relation to premises occupied by or on behalf of specific entities.
80TE(2) Modifications of Part 3 of the Regulatory Powers Act
Powers exercised during specified time period.
Entity has obligation to exercise powers under Part 3.
Exercise of powers implies entity's obligation.
Powers under Part 3 of the Regulatory Powers Act.
Entity has power to exercise Part 3 powers.
Premises are occupied by or on behalf of specified entities.
Premises occupied by or on behalf of specified entities.
Court may make order in proceedings where entity has contravened a civil penalty provision.
80UA Powers of court to make other orders
80UC Compliance notices
Notice may be given by the Commissioner or staff member to an entity for contravening subsection 13K(1)
80UC(1) Compliance notices
Notice may be given during Commissioner's reasonable belief
Commissioner reasonably believes entity has contravened subsection 13K(1)
Commissioner or staff member may give notice
Commissioner has authority to vary or revoke notice
Details of contravention, action to be taken, and steps to prevent repetition.
Entity must take action to address contravention within a reasonable period.
80UC(2) Compliance notices
Entity must comply with compliance notice
80UC(3) Compliance notices
Failure to comply with a notice results in contravention.
80UC(4) Compliance notices
Notice must be within a specific temporal interval.
(4) An entity contravenes this subsection if: (a) the entity is given a notice under subsection (1); and (b) the entity fails to comply with the notice.
Prohibits entity from failing to comply with a notice.
Notice must be diffused to all relevant entities.
Entity must fail to comply until the notice expires.
80UC(5) Compliance notices
Subsection (4) is a civil penalty provision during the period covered by section 80U.
Section 80U deals with civil penalty provisions in this Act.
Subsection (4) is a civil penalty provision.
Maximum penalty for contravention of subsection (4)
80UC(6) Compliance notices
(6) The amount of the penalty payable by a person...
Compliance with notice relieves liability for contravention of subsections 13K(1) or (2)
80UC(7) Compliance notices
80UD Review of compliance notices
Entity may apply for review of compliance notice on grounds that entity has not committed contravention or notice does not comply with subsection 80UC(2).
80UD(1) Review of compliance notices
Entity has the right to apply for review.
Court may stay operation of notice on terms and conditions.
80UD(2) Review of compliance notices
Court obligation to stay notice operation.
Court may confirm, cancel or vary compliance notice.
80UD(3) Review of compliance notices
81 Subsection 135AB(3)
82 Subsection 6(1)
...a person referred to in section 23 of the Australian Information Commissioner Act 2010.
83 Sections 68 and 68A
84 Part VIB (heading)
85 Before Division 1 of Part VIB
privacy-and-other-legislation-amendment-act-2024.pdf, p.63
Amendments apply retroactively to monitoring and investigating matters after commencement.
86 Application of amendments
Australian Privacy Principle 1.7 (contents of APP privacy policy—automated decisions)
87 After subparagraph 13K(1)(b)(ii)
88 At the end of clause 1 of Schedule 1
privacy-and-other-legislation-amendment-act-2024.pdf, p.65
89 Application of amendment
Insertion of writing after 'Minister may'
9 Subsections 80J(1) and (2)
privacy-and-other-legislation-amendment-act-2024.pdf, p.66
1 Section 2A
privacy-and-other-legislation-amendment-act-2024.pdf, p.67
Establishes a cause of action for serious invasions of privacy and provides for defences, remedies and exemptions.
1 Objects of this Schedule
Provides for defences, remedies and exemptions
Implements Australia's international obligations in relation to privacy
10 At the end of the Act
privacy-and-other-legislation-amendment-act-2024.pdf, p.76
10 Summary judgment
The court may give judgment for the defendant if the court is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings.
10(1) Summary judgment
If the court is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings, then the court may give judgment for the defendant
The court is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings.
The court may give judgment for the defendant
Satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings
Court's powers not limited by this clause.
10(2) Summary judgment
privacy-and-other-legislation-amendment-act-2024.pdf, p.77
11 Damages
Court may award damages to the plaintiff.
11(1) Damages
11(2) Damages
Prohibition of awarding aggravated damages
Court may award damages for emotional distress.
11(3) Damages
Court must award damages for emotional distress.
Court may award exemplary damages in exceptional circumstances.
11(4) Damages
$478,550 or the maximum amount of damages for non-economic loss that may be awarded in defamation proceedings under an Australian law
11(5) Damages
Court may consider certain factors when determining damages.
11(6) Damages
privacy-and-other-legislation-amendment-act-2024.pdf, p.78
12 Other remedies
Court may grant additional remedies in circumstances.
12(1) Other remedies
Remedies for invasion of privacy may include an account of profits, injunction, apology order, correction order, destruction or delivery up of material, and declaration that the defendant has seriously invaded the plaintiff's privacy.
12(2) Other remedies
The state is obligated to provide remedies for invasion of privacy.
Apology does not constitute admission of fault or liability.
13 The effect of an apology on liability
14 When proceedings must be commenced
Commence proceedings within a specified timeframe after invasion of privacy.
14(1) When proceedings must be commenced
The commencement period falls within a specific temporal interval.
(i) the day that is 1 year after the day on which the plaintiff became aware of the invasion of privacy; and (ii) the day that is 3 years after the invasion of privacy occurred.
A specific point in time for knowledge spread.
The day that is 3 years after the invasion of privacy occurred.
Proceedings must be commenced within the specified timeframe.
The plaintiff must commence proceedings under this Schedule.
Knowledge of the invasion spreads over time.
Commencement is conditional upon awareness or a specific timeframe.
(b) otherwise—before the earlier of: (i) the day that is 1 year after the day on which the plaintiff became aware of the invasion of privacy; and (ii) the day that is 3 years after the invasion of privacy occurred.
Allow plaintiff to commence proceedings despite specified day
14(2) When proceedings must be commenced
Court may make order if plaintiff did not reasonably commence proceedings.
14(3) When proceedings must be commenced
...if it was not reasonable in the circumstances for the plaintiff to have commenced proceedings.
Excerpt describes a temporal interval where the court may make an order.
Excerpt describes a knowledge representation where the court may make an order.
...if the court is satisfied that it was not reasonable in the circumstances for the plaintiff to have commenced proceedings...
Court has obligation to make order if plaintiff did not reasonably commence proceedings.
Excerpt describes an information flow where the court may make an order.
Excerpt describes a temporal trace where the court may make an order.
Must commence proceedings within 6 years of invasion of privacy.
14(4) When proceedings must be commenced
The temporal interval between the day specified in the order and the day on which the invasion of privacy occurred is equal to 6 years.
The day specified in the order must not be later than 6 years after the day on which the invasion of privacy occurred.
Obligation to commence proceedings within 6 years.
Day specified in order must not be later than 6 years after the day on which the invasion of privacy occurred.
privacy-and-other-legislation-amendment-act-2024.pdf, p.79
15 Journalists etc.
Exempts journalists and their assistants from the application of Schedule 2
15(1) Journalists etc.
The exemption does not apply during the collection, preparation or publication of material
The exemption excludes temporal intervals where journalists collect, prepare or publish material
The exemption applies to journalists who collect, prepare or publish material
Schedule 2 does not apply to journalists and their assistants
Journalists and their assistants are exempt from Schedule 2
Schedule 2 applies to journalists and their assistants
Exemption for journalistic material from invasion of privacy
15(1A) Journalists etc.
Temporal interval applies to the extent of publication or distribution
Journalist must adhere to standards of professional conduct or a code of practice.
15(2) Journalists etc.
Material is journalistic material if it has the character of news, current affairs or a documentary.
15(3) Journalists etc.
Journalist's invasion of privacy is an obligation for the state.
15(4) Journalists etc.
State has a duty to protect journalists' privacy.
privacy-and-other-legislation-amendment-act-2024.pdf, p.80
No serious invasions of privacy by State and Territory authorities (excluding intelligence agencies and law enforcement bodies) in good faith.
16 Agencies and State and Territory authorities (other than
Prohibits serious invasions of privacy by State and Territory authorities (excluding intelligence agencies and law enforcement bodies) in good faith.
privacy-and-other-legislation-amendment-act-2024.pdf, p.81
Staff members of agencies or State and Territory authorities have an obligation to respect individual privacy in good faith.
16A Staff members of agencies or State and Territory authorities
They must respect individual privacy in good faith during this time.
Respect individual privacy during performance of duties
Staff members of agencies or State and Territory authorities perform their duties during this time.
Respect individual privacy implies respecting privacy
Staff members of agencies or State and Territory authorities have a duty to respect individual privacy.
Respect individual privacy requires cognitive effort
Obligation to respect individual privacy
Respect individual privacy diffuses to other staff members
16B Law enforcement bodies
Exemptions from Schedule 2's provisions for certain intelligence agency activities and disclosures.
17 Intelligence agencies
Exemptions from Schedule 2's provisions.
privacy-and-other-legislation-amendment-act-2024.pdf, p.82
18 Persons under 18
19 Single publication rule
Prohibits subsequent publication of substantially the same information in a different manner.
19(1) Single publication rule
(1) This clause applies if: (a) a publisher publishes information that relates to an individual to the public (the first publication); and (b) the publisher or an associate of the publisher subsequently publishes (whether or not to the public) information that is substantially the same (the subsequent publication); and (c) the manner of the subsequent publication is not materially different from the manner of the first publication.
(a) a publisher publishes information that relates to an individual to the public (the first publication); and (b) the publisher or an associate of the publisher subsequently publishes (whether or not to the public) information that is substantially the same (the subsequent publication); and (c) the manner of the subsequent publication is not materially different from the manner of the first publication.
Invasion of privacy occurs on the day of first publication.
19(2) Single publication rule
The single publication rule is between the first and subsequent publications.
(2) If an invasion of the individual’s privacy consists of the first publication or the subsequent publication, the invasion of privacy is taken to occur on the day of the first publication for the purposes of this Schedule.
The single publication rule is recognized by AI systems.
Invasion of privacy takes effect on the day of first publication.
The single publication rule diffuses to other publications.
The invasion of privacy continues until the subsequent publication.
Court may consider level of prominence and extent of subsequent publication when determining if manner is materially different.
19(3) Single publication rule
The court's consideration is during the determination process.
(3) In determining whether the manner of the subsequent publication is materially different from the manner of the first publication, the court may have regard to:
Obligation to consider certain factors when determining material difference in publication manner.
Definition of associate for the purpose of the single publication rule.
19(4) Single publication rule
Obligation on publishers and associated entities
2 At the end of section 2A
privacy-and-other-legislation-amendment-act-2024.pdf, p.68
Establishes a cause of action in tort for serious invasions of privacy.
2 Simplified outline of this Schedule
Establishes time limits for proceedings.
Provides defences to the cause of action.
Provides remedies for the cause of action.
privacy-and-other-legislation-amendment-act-2024.pdf, p.83
20 Deceased persons
No action can be asserted, continued or enforced under this Schedule in relation to invasion of privacy of a deceased person.
20(1) Deceased persons
the action overlaps with the deceased person's death
Temporal overlap between the deceased person's death and the action
(1) A person (including a personal representative of a deceased person)
cannot assert, continue or enforce an action under this Schedule
Prohibition on asserting, continuing or enforcing an action
no action can be asserted, continued or enforced in relation to invasion of privacy by a person who has died
No action can be asserted, continued or enforced in relation to invasion of privacy by a person who has died
(b) an invasion of privacy by a person who has died
No diffusion of the prohibition to other persons or entities
the action is prohibited until the end of the deceased person's life
Action is prohibited until the end of the deceased person's life
Court may determine costs for proceedings discontinued due to clause.
20(2) Deceased persons
21 Saving of other laws and remedies
This Schedule is not intended to exclude or limit the concurrent operation of any law, whether written or unwritten
This Schedule is not intended to exclude or limit the concurrent operation of any law
May intervene in proceedings under this Schedule with court leave.
22 Intervention of Information Commissioner
23 Jurisdiction
Jurisdiction is conferred on the Federal Circuit and Family Court of Australia (Division 2) in relation to matters arising under this Schedule.
23(1) Jurisdiction
Jurisdiction is conferred on the courts of the Territories.
23(2) Jurisdiction
Jurisdiction is limited by the Constitution and the court's jurisdiction.
23(3) Jurisdiction
3 Section 3
privacy-and-other-legislation-amendment-act-2024.pdf, p.69
3 Crown to be bound
4 At the end of section 3
4 Constitutional basis of this Schedule
5 Section 5A
5 Additional operation of this Schedule
5(1) Additional operation of this Schedule
Reference to invasion of privacy is expressly confined.
5(2) Additional operation of this Schedule
Reference to invasion of privacy confined to corporations with constitutional protection
5(3) Additional operation of this Schedule
Reference to invasion of privacy confined to a Territory.
5(4) Additional operation of this Schedule
...it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy in a Territory.
Reference to invasion of privacy confined to specific contexts
5(5) Additional operation of this Schedule
Reference to invasion of privacy confined to specific businesses
5(6) Additional operation of this Schedule
Businesses specified in the Constitution
Reference to invasion of privacy is confined to legislative powers or executive power.
5(7) Additional operation of this Schedule
Restricts reference to invasion of privacy.
6 At the end of section 5A
privacy-and-other-legislation-amendment-act-2024.pdf, p.70
6 Interpretation
Definition of terms used in the Schedule
6(1) Interpretation
Disregard expressions used in the rest of the Act unless otherwise provided by this Schedule.
6(2) Interpretation
Disregard other parts of the Act when interpreting a provision.
6(3) Interpretation
Section applies if not applicable to Schedule 2.
7 At the end of section 5B
privacy-and-other-legislation-amendment-act-2024.pdf, p.73
7 Cause of action
Plaintiff has a cause of action in tort against defendant if certain conditions are met.
7(1) Cause of action
(1) An individual (the plaintiff) has a cause of action in tort against another person (the defendant)
The defendant has invaded the plaintiff's privacy
Defendant has invaded the plaintiff's privacy
(i) intruding upon the plaintiff’s seclusion;
The plaintiff would have had a reasonable expectation of privacy
Plaintiff would have had a reasonable expectation of privacy
(b) a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances;
The invasion of privacy was intentional or reckless
(c) the invasion of privacy was intentional or reckless;
(d) the invasion of privacy was serious;
Invasion of privacy is actionable without proof of damage.
7(2) Cause of action
Freedom of expression and other matters of public interest may constitute a countervailing public interest.
7(3) Cause of action
Includes freedom of expression and other matters of public interest.
Court may consider factors when determining reasonable expectation of privacy
7(5) Cause of action
(a) the means, including the use of any device or technology, used to invade the plaintiff’s privacy;
Consider factors when determining invasion of privacy was serious
7(6) Cause of action
Consider whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff
(b) whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff;
Classify whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff
Classify if the defendant was motivated by malice
(c) if the invasion of privacy was intentional—whether the defendant was motivated by malice.
Consider if the invasion of privacy was intentional and whether the defendant was motivated by malice
Plaintiff's privacy rights are violated if defendant misuses information relating to the plaintiff.
7(7) Cause of action
Plaintiff's privacy rights are violated.
Defendant misuses information relating to the plaintiff.
Defendant has violated plaintiff's right to privacy.
Defendant's obligation to respect plaintiff's privacy is breached
Plaintiff's right to privacy is violated.
Plaintiff's right to privacy is breached by defendant's actions
8 At the end of section 12B
privacy-and-other-legislation-amendment-act-2024.pdf, p.75
8 Defences
8(1) Defences
Defence to the cause of action if defendant invaded plaintiff's privacy by publishing information related to the plaintiff.
8(2) Defences
The defendant would be able to establish the related defence if a reference in the Australian law to the publication of defamatory matter were to include a reference to the invasion of privacy.
The defendant would be able to establish the related defence if a reference in the Australian law to the publication of defamatory matter were to include a reference to the invasion of privacy
If the defendant invaded the plaintiff's privacy by publishing information related to the plaintiff, then the defendant would be able to establish the related defence.
The Australian law provides for a related defence.
The Australian law provides for a related defence
If the defendant invaded the plaintiff's privacy by publishing information related to the plaintiff, then it is also a defence to the cause of action.
The defendant has a defence to the cause of action.
The defendant invaded the plaintiff's privacy by publishing information related to the plaintiff.
The defendant invaded the plaintiff's privacy by publishing information related to the plaintiff
If the defendant invaded the plaintiff's privacy by publishing information related to the plaintiff, then it is also a defence to the cause of action if the Australian law provides for a related defence.
Conditional commencement is Undertaking, not Prohibition
Defences for the purposes of this clause
8(3) Defences
8A Determination whether exemption applies
Court may determine exemption applicability
8A(1) Determination whether exemption applies
Court may make determination on application or its own motion.
8A(2) Determination whether exemption applies
Court must make determination before trial commences.
8A(3) Determination whether exemption applies
8A(4) Determination whether exemption applies
Court's obligation to exercise powers within limits.
(4) This clause does not limit any powers that the court has apart from this clause.
Court's permission to exercise powers within limits.
9 Before section 95 of Part IX
9 Injunctions
Court may grant injunction to restrain defendant from invading plaintiff's privacy.
9(1) Injunctions
Court must consider public interest when granting injunctions.
9(2) Injunctions
Public interest consideration is obligatory
94A Schedule 2
94A(1) Schedule 2
Disregard expressions in Schedule 2 when interpreting other provisions.
94A(2) Schedule 2
Schedule 2 is to be disregarded in determining the meaning of a provision of this Act.
94A(3) Schedule 2
privacy-and-other-legislation-amendment-act-2024.pdf, p.85
1 After section 474.17B of the Criminal Code
474 Section 474
privacy-and-other-legislation-amendment-act-2024.pdf, p.86
Using a carriage service to make available, publish or otherwise distribute personal data of group members in a way that is menacing or harassing.
474(1) Section 474
The conduct must occur within a certain time frame.
Defines temporal interval for menacing or harassing conduct
(d) the person engages in the conduct in a way that reasonable persons would regard as being, in all the circumstances, menacing or harassing towards those members.
The person's belief is a necessary condition for the conduct.
Describes implication of menacing or harassing conduct
(c) the person engages in the conduct in whole or in part because of the person’s belief that the group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin;
(a) the person uses a carriage service to make available, publish or otherwise distribute information;
The conduct must be distributed through a carriage service.
Describes spread of menacing or harassing conduct
Requires recurring trace of menacing or harassing conduct
474(2) Section 474
personal data of one or more members means information about the members that enables the members to be identified, contacted or located
Defines temporal overlap for personal data collection
(2) For the purposes of paragraph (1)(b),
Defines recognition for personal data collection
Includes specific types of information in personal data
Defines diffusion for personal data collection
Defines universal quantification for personal data collection
It is immaterial whether the group is actually distinguished by certain characteristics.
474(3) Section 474
Using a carriage service to make available, publish or distribute personal data in a menacing or harassing way is an offence.
The conduct must occur within a reasonable time frame
Imposes a duty to refrain from menacing or harassing conduct
Conduct is only menacing or harassing if it meets the conditions in (c)
Defines personal data for the purposes of paragraph (1)(b)
personal data of an individual means information about the individual that enables the individual to be identified, contacted or located, during their residence
Defines a temporal interval for personal data collection
(f) a residential address of the individual;
personal data of an individual means information about the individual that enables the individual to be identified, contacted or located, through their residence
Defines a cognitive pattern for personal data collection
personal data of an individual means information about the individual that enables the individual to be identified, contacted or located,
Defines a diffusion pattern for personal data collection
privacy-and-other-legislation-amendment-act-2024.pdf, p.5
1 Short title
privacy-and-other-legislation-amendment-act-2024.pdf, p.6
Table of sections and commencement provision
10 December
10 June 2025
11 December
privacy-and-other-legislation-amendment-act-2024.pdf, p.7
Note on table limitations and amendments
2 Commencement
2 Section 2
Schedule 1 items 45 and 46 immediately after commencement of provisions covered by table item 5.
Legislation in schedules is amended or repealed according to its terms.
3 Schedules
Commencement of provisions covered by table item 5 and the Digital ID Act 2024.
4 Section 4
4 Review of operation of amendments made by Schedule 3
Independent review of amendments made by Schedule 3
4(1) Review of operation of amendments made by Schedule 3
The Minister must cause an independent review.
4(2) Review of operation of amendments made by Schedule 3
Minister must receive written report from review persons within 6 months of commencement.
4(3) Review of operation of amendments made by Schedule 3
Must provide a copy of the report to each House of Parliament within 15 sitting days.
4(4) Review of operation of amendments made by Schedule 3
5 Section 5
6 Section 6
7 Section 7
9 Section 9
An Act to amend the law in relation to privacy and the criminal law, and for related purposes
Privacy and Other Legislation Amendment Act 2024