In September 2023, the Federal Government responded to the Attorney General’s Privacy Act Review Report of February 2023 (seven months response time is very prompt). The result can be summarised as:

1. 38 of 116 proposals were accepted by the Government.
2. 68 were accepted in principle, subject to further enquiry.
3. Major areas that will be legislated in 2024 include further enforcement powers for the OAIC, a Children’s Online Privacy Code, increased data destruction and security measures for personal information and requiring privacy policies to address automated decision making that affect personal information.

The OAIC Response

The OAIC welcomed the response and Commissioner Falk said: –

“This is the most significant change to the Privacy Act in decades and will require organisations to ensure that their practices are fair and reasonable in the first place. This will provide confidence to the Australian community that like a safety standard, privacy must be built into products and services from start.”

What can I do now? –

Stand by for more laws that will require you to amend your privacy policy and procedure process.  Don’t view this as yet more regulation, but as an opportunity to refresh your approach to privacy generally, an opportunity to get the whole business and team on board to show your customers that you really do care.

Not just words but action, become your customer’s advocate. If you would not accept how your business treats personal information then why should your customers feel any different?

How do I know if what I am doing is correct?

If your turnover is more than $3 million per year, you’re required to have a privacy policy. You’re probably also collecting and using a lot of personal information for the purposes of assessing risk and onboarding customers. Have a look at our privacy policy checklist here to make sure you are collecting, protecting and using your customer’s information in the right way.