The Privacy Act 1988 is the primary piece of Australian law controlling and handling personal information about individuals. It is known as Data Protection Law Australia. It covers the federal public and the commercial sector's acquisition, use, storage, and disclosure of personal information. To improve privacy protection in Australia, the Privacy Act underwent substantial revisions in 2014 and 2017.
The Privacy Act allows people to know how and to who can see their personally identifiable information. Moreover, it grants people to seek access to their PII, file an appeal for information corrections, and even submit a stop-direct marketing request.
People have rights under the Privacy Act, including:
- Being given a basic explanation of the kind of information an organization is gathering, how they gather it, and the purposes of gathering it
- The Freedom of Information Act of 1982 also advises that personal information must be stored securely and protected from interference or misuse.
- Your personal information may only be collected for a lawful purpose, and you have the right to know what information an organization has about you. They need to correct it if it's inaccurate, out-of-date, or incomplete.
What kind of information does this law protect?
The Privacy Act governs the collection of personal information in Australia. The Act defines personal information as information or an opinion on a named individual or a person who can be identified with reasonable certainty, whether the information or opinion is accurate or false, and whether in a tangible form or not.
Personal data may contain a person's name or address, details about their bank accounts, credit histories, or even physical appearance. "Sensitive information" concerning an individual also falls under the personal information category. As long as the information is under privacy law, the Act defines sensitive information as information or an opinion regarding an individual's racial or ethnic origin. It also can be political opinion, religious beliefs, sexual orientation, or criminal record.
The Notifiable Data Breaches Scheme
The Privacy Amendment Notifiable Data Breaches Act of 2017 came into operation on February 22, 2018. This new amendment applies to all Australian business companies, whether for-profit, not-for-profit, commercial, or governmental. They need to satisfy specific requirements under Australian Privacy Laws.
If there is a possibility that the person whose information was accessed might suffer consequences, you must collect the record of this information and give it to authorities. In the case of an Eligible Data Breach, you are required under the Act to protect the data and inform the impacted parties and the Office of the Australian Information Commissioner (OAIC).
According to the OAIC, an Eligible Data Breach occurs when the criteria meet:
- Any individuals to whom the information relates are likely to sustain significant harm or somebody access information without authorization.
- If information gets lost in circumstances where unauthorized access or disclosure is likely to occur.
- The entity has not been able to take remedial steps to reduce the likelihood of substantial harm.
Australian Privacy Principles
There are 13 Australian Privacy Principles in the Privacy Act of Consumer Data Privacy Legislation. The APPs apply to both public and commercial organizations with a $3 million or higher yearly revenue.
- The APPs cover all phases of processing personal data and establish requirements for data collection, its use, disclosure, quality, and security.
- Moreover, they establish obligations on the Privacy Act-affected institutions and organizations regarding the right of rectification of an individual's data.
The OAIC is responsible for APP and credit reporting regulatory violations. It works under the. Powers of the OAIC include:
- Accepting enforceable agreements demanding civil penalties for privacy violations that are substantial or persistent.
- Perform privacy performance evaluations for both enterprises and government organizations in Australia.
Australian privacy laws have general concepts that allow an organization or agency to customize how they handle personal information to fit their business models and the various demands of people. They can adjust to new technologies since they are also technology agnostic.
Things To Consider If You Deal With personnel Information Of Your Clients
As a company owner, you could be obligated by the Privacy Act of 1988 (Privacy Act) to protect the private information of your clients from:
- theft\misuse
- Loss of confidentiality, unauthorized access, and interference
You must erase or de-identify your customers' personal information once you no longer require it. Store personnel information in a secure location or destroy it if you no longer need it.
Consider the following steps if your organization function under Data Protection Law Australia:
1. If Your Revenue Is $3 Million Annually
If your company generates more than $3 million in revenue annually, you must abide by the Privacy Act. Depending on the nature of your business and what you do there, you can still be compelled to abide by the Privacy Act even if your annual revenue is $3 million or less. You must still comply, for instance, if you are a:
- Complimentary therapists, gyms, weight reduction clinics, childcare facilities, and private schools are examples of private sector health service providers.
- a contractor doing services under a contract with the Australian Government
- Credit provider or credit reporting body firm that sells or purchases personal information.
- The operator of a residential tenancy database
2. Decide which personal data needs protection
Any information that allows you to identify an individual is considered personal information. Whether the knowledge is accurate or what shape it takes doesn't matter. Your client's personal information could include:
- Name
- Signature
- Address, contact number, email, and date of birth
- Medical records
- Bank details
- Videos or photos
- IP address
3. Learn how to safeguard personal information.
If the Privacy Act applies to your company, you must abide by the Australian Privacy Guidelines (APPs). They describe the proper handling, processing, and management of personal information. Checking the APPs- external site and the APP guidelines- the external site is a good idea since they will clarify your obligations. Even if the Privacy Act does not apply to your company, it is necessary to protect your clients' data sensibly.
4. Make your privacy policy
You must have a transparent and current privacy policy that describes the data you gather, what you do with it, and how you secure it. Making information available on your website is a smart move. While creating your privacy policy or if you have any other privacy concerns, you might want to get specialist legal guidance.
5. Report notified violations
You must adhere to the Notifiable Data Breaches scheme- external site if your company is subject to the Privacy Act. You must notify both the following parties if a data breach affects personal information and is likely to result in significant damage to a person:
- The individual whose data is at risk
- File a complaint at the Australian Information Commissioner office (OAIC).
Conclusion
We hope now you have all information about Australian Privacy Laws. So now it's time to prove that you are a trustworthy organization and don't compromise with your users' data. Your IT employees or the entire crew must have the knowledge to minimize privacy violations and effectively handle compromise occurrences. If you compromise with any detail of your client, you must get into trouble. It is your duty as a business owner to uphold the law and safeguard personal data.
No comments yet