The Privacy Act: what does it do, what can it do and what should it do?

Introduction

Good afternoon

It’s great to join you today.

As the Privacy Commissioner, there is one law that dominates my working life. Not surprisingly – it’s the Privacy Act. Thankfully, I have not got to dreaming about it as well. But give it time.

My topic today is broad: The Privacy Act: what does it do, what can it do and what should it do?

This is the short answer. The Privacy Act protects the personal information of the Australian people and allows them to exercise their privacy rights. It can do this, and it should do this. It is driven out of the core tenet that privacy is one of our core human rights.

The longer answer is more complex. The Privacy Act is not perfect, it has limitations. For those supporters of privacy reform, it has been a long road.

It is nearly 7 years since the ACCC released its Digital Platforms Inquiry Final Report, which recommended significant reform of the Privacy Act, which had been passed 30 years before that. The report noted “there is little doubt that the data privacy regulatory regime has not kept pace with the multiple ways in which many businesses collect, use, share and deal in data.”

Since then, we have seen a further explosion in data collection methods and technology. One could be forgiven for concluding that trying to keep up with this onrush is a lost cause. But that would be wrong.

Parliament passed legislation in November 2024 under the Privacy and Other Legislation Amendment Bill 2024 as the first tranche of reform measures. Those reforms were important. They included the expansion of the OAIC’s enforcement and investigation powers, including new tiers of civil penalties and the ability to issue infringement notices, which allow us to be nimbler and more incisive as a regulator.

We are waiting for a second tranche of reforms to be introduced by the Federal Government later this year, which could also be significant.

So, the future of privacy reform is not 100% clear. But that is no excuse for standing still. There is much to work with. As Australia’s national privacy regulator, the Office of the Australian Information Commissioner, can’t afford to sit back. We only have to see the number of complaints and issues raised with us, and the many concerning privacy practices happening in society.

Action is required. Both from us, as a regulator, and the privacy professionals listening today.

Regulator

In the past 2 years, the OAIC has become a more enforcement-focused regulator. We pursue enforcement action where we can change market practices, where our intervention is going to reshape products, reshape services, reshape platforms. If there is non-compliance, we’ll be prepared to take enforcement action. The way you advance the application of the Privacy Act is often through test cases and determinations.

In decisions, in regulatory engagement, in conversations with regulated entities – we ask ourselves:  what does good look like? This is what we have learnt.

Invest in compliance

Last year, the Federal Court handed down the first ever civil penalties under the Privacy Act against Australian Clinical Laboratories – a landmark we did not take lightly. Justice Halley’s findings are worth sitting with, because they are specific: the failure was not a failure of policy, it was a failure of investment. Inadequate testing. Insufficient training. Underpowered tools. The message from the Court is unambiguous: reasonable steps to secure personal information under APP 11 require actual resourcing, not aspirational statements.

Culture

In Vinomofo, also decided under APP 11, the compliance failure was less about technology than about organisational culture – a business posture that simply did not value customer privacy. Policies existed and training was nominal, but privacy was not genuinely embedded in how the organisation thought about its operations.

Transparency

The Administrative Review Tribunal’s decision in the Bunnings facial recognition matter – the merits review of my own determination – established something important about APP 5 and the notification of collection. General signage about video surveillance was not sufficient. The novelty of facial recognition technology required more specific disclosure.

Process

The Tribunal also found that random enquiries and ad hoc actions do not constitute the practices, procedures and systems required by APP 1. For new and potentially invasive practices, a formal, structured, documented risk assessment, conducted from the outset, is required.

Awareness

The OAIC is close to releasing the results of an investigation into third-party tracking pixels. These tracking pixels can be placed on an organisation’s website to collect information about a user’s activity. This information is then shared with third-party providers and used for targeted advertising.

The community is highly wary of being tracked in this way, particularly as these forms of data collection are not easily visible. For privacy practitioners this is a lesson in not letting new technologies be a fait accompli – the careful application of fundamental privacy rights through privacy by design can provide a framework for assessing what are often opaque practices.

The results of our investigation will highlight that the Australian Privacy Principles (APPs) are technology neutral, which allow them to adapt to changing technologies and evolve with time.

Investment, culture, transparency, process, awareness. That is the action framework the OAIC has been elaborating through our regulatory work. And yet – the data tells us we are not yet where we need to be. Our Privacy Sweep of 60 entities earlier this year found instances of non-compliance in a significant proportion. Too many data breaches, privacy complaints to the OAIC are up 30 per cent year on year.

The matters I mention all involve the non-government sector, but they are relevant to you all. They all go to clarifying the obligations and expectations of entities under the Australian Privacy Act, to building a holistic view that will assist organisations in going forward and innovating from solid foundations. They also show a regulator that is willing to act.

ACAPS

Our recently published Australian Community Attitudes to Privacy Survey 2026, also known as ACAPS, provides a bracing focus on how the public view privacy.

There is some comfort for government practitioners as the government sector is regarded as more trustworthy than others – but there is, I stress, plenty of upside.

Trust is at 68% for government agencies, behind health service providers at 74%. Trust has fallen across insurance, telecommunications, technology, retail and real estate sectors since our previous survey 3 years ago.

At the low end of the scale, trust is lowest for social media companies, data brokers (4%) and AI companies, which all sit below 5%.

The 2026 ACAPS points to a community that places a high value on privacy but does not consistently experience privacy protections as workable in practice. Australians want greater transparency, more proportionate collection of personal information, and a fairer go when using digital services.

• 87% told us that they're more concerned about their privacy today than they were 5 years ago.
• Only 10% of people think that organisations handle their data fairly, and nine and 10 told us that they didn't want their data collected for one thing to be used for another without their consent, like targeting ads, training AI models, or being sold onto third parties. But the good news is, 68% of people told us they'd be more likely to use digital services if their data was handled fairly.

So where does government fit in the picture? In terms of trust, the government sector rates better because it offers essential and public-facing services. There is a sound reason for it needing personal information to deliver its functions.

However, Australians are becoming more selective about what personal information they consider fair to share, generally limiting acceptance to basic details and situations where there are a clear purpose and a trusted context.

This cautious approach also extends to government data use, where Australians are more comfortable when information is used to deliver services or public benefit, but less accepting of practices that lack transparency, involve identifiable data, or are not clearly communicated, highlighting the importance of trust, purpose and control. This finding is particularly relevant to the use of artificial intelligence and automated decision-making (ADM) technology, which I will come back to.

When it comes to government use of personal information and data linking, comfort is higher when it is framed around service delivery, improvement, safety, or de-identification.

Comfort declines when the purpose is research or policy development, with only 36% feeling comfortable. And Australians are least comfortable with practices that reduce transparency or increase identifiability.

Artificial intelligence

When looking at the use of all artificial intelligence, the fundamental questions Australians ask themselves are: who’s using my personal information? What is it being used for? What are the impacts on me? What are the dangers?

Transparency is key. When AI is used, people expect transparency that the use is limited to the service provided and that they can challenge any decisions that might affect them.

Australians remain cautious about the use of artificial intelligence (AI) in decision-making that may affect them, with nearly all (96%) saying some conditions should be in place before it is used.

Australians expect organisations to be open about how AI is used and how decisions are made, including:

• being informed when AI is being used (79%, up from 71% in 2023)
• being informed if personal information will be shared with a third-party AI provider (74%).

Through our survey we found rising demands, when compared to 3 years ago, from the community, when it comes to the rights for a human review of decisions, validation of AI accuracy, testing for bias and discrimination, and the ability to challenge decisions made by AI.

Where most red flags occur are in those areas where the personal stakes are higher. Only one quarter view it acceptable for AI to be used for automated eligibility or risk-based decisions, such as benefit eligibility.

That has important implications for many of your organisations who are encouraged to use AI to realise productivity gains, or to consider a wide range of data sharing initiatives.

ADM and AI can increase the efficiency, accuracy, and consistency of decisions across the public and private sectors. However, the productive opportunities can only be fully realised if the ethical and legal issues associated with it are properly mitigated and trust is built with the Australian community.

A key enabler of trust is transparency and by leading the way in transparency the government can build public trust in the technology and ensure its benefits are shared widely across society.

One of the significant changes announced in the Privacy Act reforms of 2024 was the requirement that privacy policies contain information about substantially automated decisions which significantly affect individuals’ rights or interests, including the kinds of decisions and kinds of personal information used.

This is due to come into effect on 10 December. Providing individuals with greater transparency allows them to understand how an entity handles their information and for what purposes and allows them take further action if there has been a breach of their personal privacy.

The OAIC is seeking information and views to inform the development of the Guidance for the ADM Transparency Obligation and recently released an issues paper for consultation. We will be releasing our guidance in September.

Transparency is important. The OAIC has also been working on encouraging agencies to be transparent about their use of ADM through the public reporting requirements contained in the Freedom of Information Act. We have carried out a desktop review of current practices and are developing regulatory guidance to clarify obligations.

Another important feature of the 2024 reforms was the OAIC gaining a mandate to develop a Children's Online Privacy Code, which will cover not only social media platforms, but any online services likely to be accessed by children. The code must be registered before 10 December 2026, the same day as the ADM initiative commences.

One of the features of the exposure draft of the Childrens Privacy Code particularly excites me, and it ties with one of the main findings of ACAPS, which echoes previous surveys and goes to basic principles of privacy in action.

The community want simple practical solutions where less data is collected, their information is treated responsibly and is deleted when it's no longer needed.

As the OAIC has said many times, organisations should only collect only what is necessary, keep it safe, and if it is no longer needed, delete. Regularly carry out information audits to ensure the best possible outcomes.

So, coming back to the Childrens Privacy Code, under the exposure draft, parents and children will be able to request deletion, not just de-identification of their personal information. Entities will need to accede to such requests within 30 days. This proposed change will be transformative.

My hypothesis is that the Children’s Online Privacy Code has the potential to show, at scale, that an online ecosystem built around data minimisation, genuine consent, and transparency is not only legally compliant but commercially viable. That users who are treated as agents rather than data sources are users who extend trust, who stay, who recommend.

If that hypothesis is right, then the Code is not just a protection for children. It is a proof of concept for a different kind of digital economy. And the privacy community has a role to play in making that argument loudly, persistently, and in terms that resonate with boards and investors, not just regulators.

Whether I am proven right or wrong, we would definitely be wrong to ignore the sentiment expressed by the community on deletion. Government holds enormous stores of data, data that may be used as the basis for life-changing decisions. The advent of AI and ADM – and the gradual breaking down of data siloes – will test our ability to be stewards of that data. It’s incumbent on practitioners to rise to that test.

Future privacy reform

So, I think have illustrated that the privacy law environment is rich and active.

As to future privacy reform, the second tranche of measures is in the hands of the government and that reform is ongoing.

There are several areas where we have made proposals. These include:

• As I just referred to, the right to erasure – If we did go down this route, it would need a pragmatic approach, including by articulating exceptions to this right in certain circumstances and a “reasonableness threshold” to assist in reducing overly burdensome regulatory compliance.
• Dealing with complaints – bringing a greater degree of urgency to entities responding to privacy complaints in the first instance under APP 1. At the moment, there is a failure in the system, where entities are not adequately dealing with complaints in the first instance and they often come to us. People feel powerless.
• Expanding the definition of personal information in a way that could capture technical information – We have supported a change to the definition which would deliver give greater clarity and certainty for regulated entities around technical information being captured by the definition of personal information (such as online identifiers and device identifiers like cookies, IP addresses, user IDs which are increasingly being used for tracking or profiling purposes).
• A Fair and reasonable test for processing personal information – This is a very important one. A fair and reasonable test in the Privacy Act would require the collection, use or disclosure of personal information under APP 3 and 6 to be fair and reasonable in the circumstances, even if an individual consent to the processing of their personal information.

It would address the current power imbalance inherent in the existing framework by shifting the responsibility to organisations to proactively consider the impact that their data handling practices may have on individuals. It would also prevent consent from being used to legitimise handling of personal information in a manner that is, objectively, unfair or unreasonable. This would be a very important step.

We don’t know what the second tranche of privacy reform has in store. A fair and reasonable test may not come about, but it remains a very important mindset to apply to any privacy-impacting project.

It would provide confidence that, like a safety standard, privacy is built into products and services from the start.

Any organisation looking at adopting new technologies, new procedures, should of course carry out a privacy impact assessment. Good governance, and planning for privacy at the start of a new initiative, can support an organisation to adopt new and innovative data-driven technologies in a way that protects the rights of individuals.

If organisations look at some of the core principles of Australian privacy – open and transparent management of personal information, only collect what is needed, make sure information is secure – then you will be in a good position to proceed.

Look at our determinations and guidance and you will see how we seek to apply the law. Keep being a positive ambassador for privacy by design.

I hope I have made it clear today the Australian Privacy Act is vital and continuing to shape the behaviours of the regulated community, and deliver for the Australian community. It’s happening in real life – it’s not the stuff of dreams.

Thank you.