The 3 Penalties of Australia’s New Privacy Bill Corporations Need to Know About

Following recent cyber-attacks on two of Australia's largest corporations,[1] the Australian Parliament has approved the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (the Bill).[2]

The Bill attempts to enhance Australia's privacy protection by:

• Increasing penalties for serious and repeated data breaches;
• Expanding enforcement and information-sharing powers of the Office of the Australian Information Commissioner (OAIC); and 
• Allowing extraterritorial application of the Privacy Act 1988 (Cth) (the Act).

What are the increased penalties?

For non-corporate entities, the maximum penalty that may be imposed for a serious or repeated privacy breach has increased from $444,000 to $2.22 million. For entities like Optus and Medibank, the maximum penalty that may be imposed has increased from $2.5 million to either of the following (whichever is highest):

• $50 million;
• Three times the value of any benefit obtained, directly or indirectly, and that is reasonably attributed to the privacy breach; or 
• 30% of the adjusted turnover of the body corporate during the breach turnover period for the contravention.

The significantly increased penalties aim to incentivise companies to comply with their privacy obligations whilst also bringing Australian privacy law more in line with international penalties under the European General Data Protection Regulation.[3] It provides a much bigger stick than the OAIC had. 

How have the OAIC's powers increased?

With respect to the OAIC's increased powers, one of the key takeaways includes the OAIC's enhanced information-gathering powers, such as:

• The power to conduct assessments of an organisation's compliance with Privacy obligations;
• The power to obtain information or documents in relation to an actual or suspected eligible data breach; and
• The power to share information with other authorities and disclose information where it is in the public interest to do so.

Furthermore, international organisations that carry on businesses in Australia will also be captured by the Act. This is due to the removal of the requirement for an organisation to collect or hold personal information in Australia, which was previously required for the Act to apply. Australian Information Commissioner and Privacy Commissioner, Angele Falk, said this was to "mitigate against overseas companies avoiding the jurisdiction based on complex structural and technical matters". 

[1] https://www.austrac.gov.au/optus-data-breach-working-our-reporting-entities

[2] https://www.oaic.gov.au/updates/news-and-media/oaic-welcomes-passing-of-privacy-bill 

[3] https://www.oaic.gov.au/updates/news-and-media/oaic-welcomes-passing-of-privacy-bill