Renewed commitment to Safeguarding Privacy: Privacy Act Enforcement
The Australian Information Commissioner’s Federal Court proceedings against Australian Clinical Labs Limited (ACL) mark a significant milestone for privacy law in Australia. As recent data breaches continue to expose millions of Australians’ sensitive personal information, the enforcement of the Privacy Act 1988 (Cth) has become a top priority.
Equipped with enhanced regulatory powers, increased penalties, and additional funding, the Commissioner is taking a proactive approach to address privacy concerns. The Commissioner alleges that ACL violated section 13G of the Privacy Act, which stipulates a civil penalty when an organization or government agency seriously interferes with an individual’s privacy. ACL is accused of failing to take reasonable steps to protect customers’ personal information from unauthorized access or disclosure between May 2021 and September 2022.
ACL, a pathology business, collects and stores health information on millions of Australians. The personal information held by ACL includes contact details, copies of Medicare cards, and numbers. The Commissioner’s investigation into ACL’s privacy practices was initiated following a data breach in February 2022, which the company reported to the Office of the Australian Information Commissioner (OAIC) in July 2022.
The Australian Government’s Privacy Act Review Report emphasized the infrequency of cases involving section 13G, highlighting the challenges in determining when the threshold of ‘serious interference’ has been breached.
The current proceedings against ACL are seen by many as a test case to interpret the legislation and the standards applied. Organizations should closely monitor any judicial consideration of the reasonable steps required to protect personal information from unauthorized access.
The maximum penalty for a breach of section 13G applicable to this case is $2,220,000 for each contravention. However, future activities related to privacy law enforcement are expected to reflect the significantly increased maximum penalties introduced in December 2022 through the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth) (Privacy Enforcement Act).
Under the Privacy Enforcement Act, the penalty for a serious or repeated privacy breach by a corporation has been raised to the greater of $50 million or three times the benefit obtained from the breach. If the benefit cannot be determined, a penalty of 30 percent of the company’s domestic turnover during the ‘breach turnover period’ can be imposed.
The Privacy Enforcement Act also introduced reforms to the Notifiable Data Breach Scheme, granting the Commissioner new powers to obtain information on actual or suspected eligible data breaches, expanding the Commissioner’s authority to assess compliance, and requiring entities to specify the types of information involved in a data breach.
Strengthening privacy law enforcement is one of the key areas identified in the Australian Government’s Response to the Privacy Act Review released in September 2023. The Response supports proposed reforms aimed at enhancing the Commissioner’s powers and regulatory toolkit, including the introduction of a tiered structure for civil penalty provisions and expanding the court’s authority to impose orders in civil penalty proceedings.
Recognizing the need for a strategic review of the OAIC, the Australian Government is working towards a stronger enforcement focus, considering the necessary resources for effective operations.
Looking ahead, the Commissioner is expected to utilize their new powers to enhance the effectiveness of Australia’s privacy regulator.
Proactive measures taken now can help organizations minimize the costs of system upgrades when the changes become legislated.
While the legislation to implement these changes has not been drafted yet, businesses should prepare for the alterations that will affect their structure, IT systems, and information management. Using this lead time to adapt and update systems is advisable.
Elizabeth Carroll, Partner at Holding Redlich, highlighted the importance of businesses embracing the forthcoming changes and proactively adjusting their systems.
Disclaimer: The information provided in this article is of a general nature and is not intended to address specific circumstances. While we strive to provide accurate and timely information, we do not guarantee its accuracy or future validity.
(Note: The news article has been crafted based on the guidelines provided, summarizing the given details while adhering to legal and ethical standards.)
