Why CIOs need to pay attention to the most significant overhaul of Australian privacy law in 40 years

Michael Fagan, former chief transformation officer at Village Roadshow, examines the proposed changes to the Privacy Act and what CIOs in Australia need to be aware of.

I received 7 unsolicited CVs and resumes in the last 12 months, from well-educated and qualified people, seeking to join the organisation where I was working.  Unbeknownst to the senders, they put me at risk of breaching one of the 13 Australian Privacy Principles (APP), despite me not really knowing these people, and never asking them for information.  The jobseekers included a varying amount of personal information, including email address, phone numbers, home address, work and education history, and more.  One applicant even included a photograph and, no lie, their weight. (Although I suppose if I only weighed 47kg I’d put it on my CV too).  By giving me this personal information, they placed an obligation on me and my organisation to use it wisely, or risk penalties up to $1.8m.

In 2024, the government has committed to strengthening privacy law, including equipping the regulator with more powers and more options to enforce – meaning that those penalties could be even harsher.  The Attorney General’s department spent three years reviewing the 1988 Privacy Act, and released a report in February 2023 outlining 116 proposals for change.  The Australian Government published its response in September 2023 agreeing to 38 proposals, “agrees in principle” to 68 proposals (i.e. further consultation required to understand impact and alignment with other reviews like Digital ID, and the Australian Cyber Security Strategy before implementation), and notes the remaining 10.  The report is availablehere, and the responsehere, and the government’s current round of consultation ends 28 March 2024.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts