Privacy Act 1988

Part I Preliminary

This part establishes the Act's short title, commencement, objects, and application across Australian States and Territories and beyond their boundaries. It clarifies how the Act relates to State and Territory laws, the Criminal Code, the Crown, and external Territories.

Part II Interpretation

This part contains definitions divided into three groups: general definitions applicable throughout the Act, key definitions specific to credit reporting, and other definitional and application matters.

Division 1 General definitions

This division defines core terms used in the Act including responsible person, breaches of privacy principles and codes, organisations, small businesses, health information and health services, and explains how different entity types are treated for the Act's purposes.

Division 2 Key definitions relating to credit reporting

This division defines credit-related terms including credit provider, access seeker, credit, credit information, credit reporting business, and specific categories of credit information such as default information, payment information, and repayment history information.

Division 3 Other matters

This division addresses how agencies and organisations' acts and practices are attributed to them, when certain acts are exempt including political acts, which staff conduct is covered, which agencies hold records, and exceptions to the Act's application such as for State banking and insurance.

Part III Information privacy

This part establishes the framework for privacy protection by identifying interferences with privacy, setting out Australian Privacy Principles that entities must comply with, and addressing credit reporting operations and enforcement mechanisms including complaints, court orders, and review processes.

Division 1 Interferences with privacy

This division identifies what constitutes an interference with privacy, establishes when certain acts by related bodies corporate or due to overseas legal requirements are not covered, and sets civil penalty provisions for serious and other interferences with privacy of individuals.

Division 2 Credit reporting bodies

This division sets out how credit reporting bodies must collect, use, disclose, secure and maintain the quality of credit information, how individuals can access and correct their information, and requirements for destroying information after specified retention periods.

Division 3 Credit providers

This division requires credit providers to manage credit information transparently, disclose certain information to credit reporting bodies, handle credit eligibility information appropriately, notify individuals of credit refusals, and provide access to and correction of credit information.

Division 4 Affected information recipients

This division governs how mortgage insurers, trade insurers, related bodies corporate, credit managers, and advisers manage and use regulated credit information they receive.

Division 5 Complaints

This division addresses how individuals may lodge complaints about breaches of provisions in Part IIIA, and sets out procedures for dealing with such complaints and notifying corrective actions.

Division 6 Unauthorised obtaining of credit reporting information etc

This division covers obtaining credit reporting information from credit reporting bodies and obtaining credit eligibility information from credit providers.

Division 7 Court orders

This division establishes that courts may make compensation orders and other orders to compensate for loss or damage related to privacy matters.

Division 8 Review

This part establishes a framework for privacy codes, including registered Australian Privacy Principles (APP) codes and credit reporting (CR) codes. It covers development, registration, variation and removal of codes, and operation of a codes register and review mechanisms.

Part IIIC Notification of eligible data breaches

This part sets out when entities must notify about eligible data breaches, including defining what constitutes an eligible data breach, requiring notification to affected individuals and the Commissioner, and granting the Commissioner powers to obtain information about breaches and authorise collection and use of personal information for response purposes.

Division 1 Introduction

This division provides guidance on Part IIIC and defines key terms including 'entity' and 'deemed holding' of information, and notes an exception for notification obligations under the My Health Records Act 2012.

Division 2 Eligible data breach

This division defines an eligible data breach as unauthorised access or disclosure of personal information that is likely to result in serious harm to affected individuals, outlines exceptions including where remedial action prevents harm, and specifies matters relevant to assessing likelihood of serious harm.

Division 3 Notification of eligible data breaches

This division requires entities to assess suspected breaches and notify affected individuals and the Commissioner when an eligible data breach occurs, with exceptions for breaches of other entities, enforcement-related activities, inconsistency with secrecy provisions, and situations where the Commissioner declares notification unnecessary. The Commissioner may also direct entities to notify about eligible data breaches.

Division 4 Commissioner’s powers to obtain information or documents relating to eligible data breaches

This division grants the Commissioner power to obtain information and documents from entities relating to eligible data breaches.

Division 5 Dealing with personal information involved in eligible data breaches

This division allows the Commissioner to declare an eligible data breach and authorise collection, use and disclosure of personal information needed to respond to the breach. It prohibits unauthorised disclosure of information about breach response activities and preserves the constitutional authority and operation of these breach response powers.

Part IV Functions of the Information Commissioner

Part IV sets out the role of the Commissioner covering their core functions, their powers to report and share information, and miscellaneous provisions relating to their oversight responsibilities.

Division 2 Functions of Commissioner

This division specifies the Commissioner's functions including providing guidance, conducting monitoring, and giving advice. The Commissioner must consider the Act's objects when performing these functions.

Division 3 Reports and information sharing by Commissioner

This division sets out the Commissioner's powers to report following investigations and examinations of proposed laws, to share information with other authorities, to conduct assessments and direct privacy impact assessments, and to hold public inquiries with associated powers.

Division 4 Miscellaneous

This division addresses documents exempt under freedom of information law, directions for amending exempt documents, and the Commissioner's power to recognise external dispute resolution schemes.

Part V Investigations etc

Part V covers the Commissioner's investigation processes, determinations following complaints, enforcement of those determinations, special provisions for Commonwealth agencies, and miscellaneous related matters.

Division 1 Investigation of complaints and investigations on the Commissioner’s initiative

This division sets out how the public can lodge complaints or representative complaints, conditions the Commissioner may apply to such complaints, how investigations are conducted including compulsory conferences and examination of witnesses, and circumstances where the Commissioner must or may decline to investigate.

Division 2 Determinations following investigation of complaints

This division specifies how the Commissioner makes determinations after investigating complaints, requirements to notify affected individuals of privacy interference findings, identification of class members affected by determinations, and rules for substitute respondents and outsourcing arrangements.

Division 3 Enforcement of determinations

This division addresses how determinations under the Act can be enforced, covering the division's scope, duties on entities and small business operations subject to determinations, mechanisms for pursuing enforcement action through the Australian courts, and proof of determinations through certificates.

Division 4 Review and enforcement of determinations involving Commonwealth agencies

This division establishes specific obligations for Commonwealth agencies and their principal executives to comply with determinations, including compensation requirements, and sets out enforcement mechanisms against agencies.

Division 5 Miscellaneous

This division covers legal assistance for complainants, immunity from civil liability for the Commissioner, penalties for failing to attend or provide information to the Commissioner, protection from civil actions for those cooperating with investigations, and confidentiality of documents and information held by the Commissioner.

Part VI Public interest determinations and temporary public interest determinations

This part covers procedures for making public interest determinations and temporary determinations, emergency declarations, authorisation to use and disclose personal information in emergencies, and related offences and compliance matters.

Division 1 Public interest determinations

The Privacy Commissioner can make determinations on applications from APP entities regarding public interest exemptions, including temporary determinations pending final decisions, and maintains a register of all determinations.

Division 2 Declaration of emergency

The Privacy Commissioner may declare emergencies for events of national significance or events outside Australia, with provisions specifying what circumstances each covers and when declarations end.

Division 3 Provisions dealing with the use and disclosure of personal information

Organisations may collect, use and disclose personal information when authorised under emergency declarations.

Division 4 Other matters

This part establishes offences for unauthorised disclosure, monitoring and investigation powers, civil penalties, infringement notices, compliance notices, enforceable undertakings, and injunctions to enforce privacy requirements.

Part VII Privacy Advisory Committee

A committee is established with appointed members to advise on privacy matters, with provisions governing membership, meetings, leave, removal, and member remuneration.

Part VIII Obligations of confidence

This part extends certain obligations of confidence arising under other laws to apply to personal information, and provides relief remedies for breaches of those extended obligations.

Part IX Miscellaneous

This part addresses guidelines for health and genetic information, Commonwealth contract requirements, partnership and association treatment, director and agent conduct, and administrative review procedures.

Schedule 1 Australian Privacy Principles

Thirteen principles establish standards for open management of personal information, anonymity, collection, direct use and disclosure, cross-border transfer, identifiers, data quality and security, and access and correction.

Schedule 2 Statutory Tort for Serious Invasions of Privacy

A civil cause of action is created for serious invasions of personal privacy, with defences for journalists and certain authorities, remedies including damages and injunctions, and restrictions on when proceedings may be commenced.