Privacy Amendment Bill

In the face of the myriad of parties vying for access to our personal information, the Labour Government introduced the Privacy Amendment Bill (Bill) in early September this year. This Bill looks to amend Privacy Act 2020 (the principal Act) section 22, which regulates the collection, storage, use, and disclosure of personal information.
In its ‘Explanatory note’ the Bill states that its purpose is “to improve transparency for individuals about the collection of their personal information and better enable individuals to exercise their privacy rights.” It looks to deliver on this by dealing with “a current gap that arises because there is no requirement for an agency (public or private) to notify an individual when it collects personal information about the individual indirectly (i.e., from a source other than from the individual concerned).” In short, there may be agencies that hold your personal information that you are unaware of or not able to identify.
Currently under the principal Act it is already a requirement for an agency collecting information directly from an individual to make them aware of this. However, for those agencies that collect this information indirectly, for example via another agency, there is no requirement that the individual is informed. The Bill will extend this requirement to ensure that individuals are notified when their personal information is shared with other agencies.
To encapsulate this the Bill will amend section 22 of the principal Act by introducing new information principle 3A (IPP 3A); which relates to the indirect collection of personal information. Following the principal Act’s IPP 3 requirements for direct collection, IPP 3A will require that agencies collecting
personal information, other than from the individual concerned, must take any reasonable steps to ensure that the individual concerned is aware of:
• the fact that the information has been collected;
• the purpose for which the information has been collected;
• the intended recipients of the information;
• the name and address of the agency that has collected the information; and the agency that is holding the information;
• if the collection of the information is authorised or required by or under the law, the particular law by or under which the collection of the information is authorised or required; and
• the rights of access to, and correction of, the information.
After collecting an individual’s information, the agency must comply with the steps in IPP 3A as soon as reasonably practicable.
As under the principal Act there are exceptions that would also apply under IPP 3A, these include if the individual’s information is already publicly available, or if the first agency directly collecting the information made the individual aware that their information would be disclosed to the second agency. Other exceptions include where non-compliance is necessary for the enforcement of law, or where compliance would cause a serious threat to public health or safety.
The Bill would not apply retrospectively, with the IPP 3A applying to the collection of personal information from 1 June 2025.
The Bill has yet to have its first reading, after which it is expected that the public will be invited to make
submissions to the Justice Select Committee in 2024.
As the Privacy Commissioner has pointed out, “This amendment is also about keeping up with international best practice. Australia already has it.” And with that endorsement, there is reasonable expectation that it will progress.