The Privacy Act does not stipulate an age after which an individual can make their own privacy decisions. This requires that the organisation who purchases the marketing list from a third party ensures that the individuals on the list have consented to marketing or, where such consent is impractical to obtain, each communication provides the recipient with a simple means to opt out. the organisation provides a simple means by which the individual may easily opt out of such direct marketing in each direct marketing communication and the individual has not so opted out.

8.3 Is the Data Protection Officer protected from disciplinary measures, or other employment consequences, in respect of his or her role as a Data Protection Officer? There are no express legislative restrictions and penalties specifically on the use of cookies. giving the OAIC the power to issue infringement notices of up to AU$63,000 for body corporates and AU$12,600 for individuals (currently it needs to go to court to impose any fines). 11.4 What are the maximum penalties for breaches of applicable cookie restrictions? (already flagged as a definite) an increase to the maximum penalties that can be awarded by the court and payable by entities subject to the Privacy Act up to the greater of: AU$10 million for serious or repeated breaches (up from AU$2.1 million); three times the value of any benefit obtained through the breach and misuse of personal information; or, 10% of the entitys annual domestic turnover; and. cyberbullying laws The passing of the SLACIP Act would constitute the second tranche of the Security of Critical Infrastructure laws (SOCI Laws). 12.2 Please describe the mechanisms businesses typically utilise to transfer personal data abroad in compliance with applicable transfer restrictions (e.g., consent of the data subject, performance of a contract with the data subject, approved contractual clauses, compliance with legal obligations, etc.). This requires government agencies to have a designated privacy officer at all times as part of the requirements for complying with APP 1.2. 10.3 Please describe any legislative restrictions on the sending of marketing via other means (e.g., for marketing by telephone, a national opt-out register must be checked in advance; for marketing by post, there are no consent or opt-out requirements, etc.). anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; Commonwealth records in the open access period for the purposes of the. probate For banking, insurance and superannuation industries, APRA-regulated entities are required by CPS 234 to evaluate the design of a data processors information security controls that protects the entities information assets. 8.2 What are the sanctions for failing to appoint a Data Protection Officer where required? The Corporations Act 2001 (Cth) (Corporations Act) provides protections for whistle-blowers who report misconduct or an improper state of affairs or circumstances in relation to a regulated entity(ies) (including companies, banks, insurers, etc.) The Privacy Act does not distinguish between data controllers and data processors. thomson martins thomsonreuters The self-reporting of breaches is no longer a get out of jail free card. However, public guidance has been given by the OAIC regarding how their distinctive operations run and how individuals may subsequently change their browsing preferences in line with this. Yes; the Privacy Act requires the entity, if practicable to do so, to take reasonable steps to notify the contents of the statement described above to each individual to whom the information relates or who are at risk from the eligible date breach. There is no qualification generally required by law in Australia. See also further details in the last bullet point under question 5.1 above.

If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting. the recipient can opt out of the binding scheme without notice and without returning or destroying the personal information. 17.3 Describe the data protection authoritys approach to exercising those powers, with examples of recent cases.

The extent of an entitys obligations with respect to its processing activities falls under the accreditation requirements set out in the CDR scheme in Part IVD, Division 3 of the Competition and Consumer Act 2010 (Cth). In particular, the ACMA held that Telstra breached the legislations by not correctly designating approximately 50,000 individuals telephone numbers as being unlisted (or silent) on the Integrated Public Number Database (IPND) and not correctly updating personal details on the IPND for approximately 65,000 individuals. The Australian Attorney-Generals Department has responsibilities and powers in connection with the privacy of data obtained pursuant to the, The Australian Transaction Reports and Analysis Centre (, whether the information or opinion is true or not; and. As part of this obligation, the business is required to ensure that other entities to which it discloses personal information also comply with the relevant legal requirements. Yes, registration for the CDR regime can be completed online.

The OAIC launched proceedings against Facebook Inc. in March 2020 in relation to the use and disclosure of personal information collected through the use of the This is Your Digital Life application. APP 1 requires an APP entity to have a clearly expressed privacy policy which must contain information on how an individual may (i) access personal information about the individual that is held by the entity and seek the correction of such information, and (ii) complain about a breach of the APP and how the entity will deal with such a complaint. The entity must prepare a statement that sets out the identity and contact details of the entity, a description of the eligible data breach, the kinds of information concerned, and recommendations of the steps that individuals should take in response. For instance, in March 2021, an e-marketing company was fined AU$310,000 for breaching the Spam Act and sending direct marketing emails without a functional unsubscribe facility. Yes, the ACMA is the regulatory authority charged with enforcing the DNCR Act and Spam Act and it publishes actions it takes to enforce breaches of marketing restrictions covered by these Acts. 7.1 Is there a legal obligation on businesses to register with or notify the data protection authority (or any other governmental body) in respect of its processing activities? The Schrems II decision calls into question the use of Standard Contractual Clauses as a transfer mechanism and urges companies to make assessments on a case-by-case basis to ensure the data is adequately protection from acquisition by public authorities. There is no general requirement by law on the responsibilities of the Data Protection Officer. 7.4 Who must register with/notify the data protection authority (e.g., local legal entities, foreign legal entities subject to the relevant data protection legislation, representative or branch offices of foreign legal entities subject to the relevant data protection legislation)? If so, in what circumstances would a business established in another jurisdiction be subject to those laws? APP 3.5 restricts APP entities to collect personal information only by lawful and fair means.

If an individual has consented to an entitys collection of the individuals personal information for a primary purpose, then the information should not be used for another purpose (secondary purpose) save for a few exceptions, including where the individual would reasonably expect the entity to use or disclose the information for the secondary purpose. An organisation is defined in the Privacy Act as: that is not a small business operator, a registered political party, an agency, or an authority or prescribed instrumentality of a State or Territory. 15.2 Is consent or notice required? an understanding of any other legislation that governs the way the agency handles personal information.

However, where the use of cookies rises to the level of enabling identification of an individual, it will be subject to the restrictions of the APPs. a person whose continued presence in Australia is not subject to a time limitation imposed by law; a partnership formed in Australia or an external Territory; a trust created in Australia or an external Territory; a body corporate incorporated in Australia or an external Territory; or. Since 1 January 2020, all public companies, large proprietary companies and corporate trustees of registrable superannuation entities have been required to have a whistle-blower policy and to make it available to officers and employees of the company. An APRA-regulated entity includes an authorised deposit-taking institution, general insurer, life company, private health insurer and RSE licensee (as that term is defined in the Superannuation Industry (Supervision) Act 1993 (Cth) with respect to registrable superannuation entities). Where the use of cookies rises to the level of enabling identification of an individual, restrictions of the APPs apply please refer to question 16.4 with reference to penalties for data security breaches. centrelink concession pensioner if unable to be delivered because the relevant electronic address does not exist, would have been reasonably likely to have been accessed using a computer, server or device located in Australia, had the address existed. 11.3 To date, has/have the relevant data protection authority(ies) taken any enforcement action in relation to cookies? 12.4 What guidance (if any) has/have the data protection authority(ies) issued following the decision of the Court of Justice of the EU in Schrems II (Case C311/18)? There is no formal requirement regarding the appointment of a Data Protection Officer in general. As discussed further in section 16 below, certain obligations arise when specific data breaches occur. Generally, there is no obligation under the Privacy Act to register with or notify data protection authorities such as the OAIC. New South Wales, Victoria and the Australian Capital Territory have specific legislation regulating workplace surveillance.

The Privacy Act 1988 (Cth) (Privacy Act), which includes the Australian Privacy Principles (APPs), is the principal data protection legislation.

The response indicates that entities should consider the broader legal frameworks and practices that the receiving countrys privacy framework is subject to in order to make an assessment as to whether the implemented safeguards provide an equivalent standard of protection, particularly placing the onus on data controllers, exporters and importers. 5.2 Please confirm whether data subjects have the right to mandate not-for-profit organisations to seek remedies on their behalf or seek collective redress. In 2015, Australian Securities Investment Commission (ASIC) confirmed its stance in its Cyber Resilience: Health Check report, that cybersecurity falls squarely within a directors duties. referendum caledonia 1.1 What is the principal data protection legislation? Yes; the Privacy Act requires entities to give a notification if they have reasonable grounds to believe that an eligible data breach has happened, or it is directed to do so by the Commissioner. With respect to the CDR regime, if a person holds out a false accreditation for receiving and holding CDR data, the sanctions are: 7.7 What is the fee per registration/notification (if applicable)? The judgment found that through its installation and/or management of cookies on devices of Australian users, Facebook was deemed to be carrying on business in Australia and therefore subject to Australian privacy law. Exciting developments are also occurring in the infrastructure space, with the passing of the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (SLACIP Act) on 31 March 2022 and its commencement on 2 April 2022. internment war law australia 14.2 Are there limits on the purposes for which CCTV data may be used? With respect to government agencies, failure to appoint a privacy officer as required by the Government Agencies APP Code would be a breach of that Code, which is a contravention of APP 1.2 and also an interference with the privacy of an individual under clause 26A of the Privacy Act. CDR consumers may be individuals or bodies corporate. covers common issues including relevant legislation and competent authorities, territorial scope, key principles, individual rights, registration formalities, appointment of a data protection officer and processors. The maximum penalty for data security breaches under the Privacy Act is currently AU$2.22 million for a body corporate. However, there are a number of exceptions to this prohibition. an unincorporated association that has its central management and control in Australia or an external Territory. 7.12 How long does a typical registration/notification process take?

The process and time frame for relatively new CDR accreditation scheme have been developing and emerging gradually.

CPS 231 sets out the minimum matters that must be addressed by the outsourcing agreement, including: 10.1 Please describe any legislative restrictions on the sending of electronic direct marketing (e.g., for marketing by email or SMS, is there a requirement to obtain prior opt-in consent of the recipient?). In the current age of well-publicised, sophisticated cyber threats, the bar for such harm materialising is increasingly low and the recent decision of ASIC v RI Advice Group Pty Ltd demonstrates ASICs renewed concern to drive the issue home. Data Protection > 12.1 Please describe any restrictions on the transfer of personal data to other jurisdictions. It imposes an obligation on APP entities to implement practices, procedures and systems to ensure the organisation is APP compliant. Describe any relevant case law or recent enforcement actions. records in the care of the National Archives of Australia; documents placed in the memorial collection of the Australian War Memorial; or. 13.2 Is anonymous reporting prohibited, strongly discouraged, or generally permitted? The relevant terminology is APP entity, in relation to which please refer to the definition for Controller above. Therefore, this would cover business-to-business contexts where one business transfers personal information it has collected to another, and that business conducts direct marketing. ASIC made use of historical forensic cybersecurity reports which raised significant gaps in the companys cybersecurity systems before the incident occurred, which may indicate a failure to remedy a known risk (and thus poor, if any, risk management). it is reasonably believed that the recipient is subject to a law, or binding scheme, that bears overall substantial similarity to the APPs and the individual can take action to enforce such protections; the entity has obtained the individuals consent to the foreign disclosure; the foreign disclosure is required or authorised by Australian law; a permitted general situation (such as to lessen or prevent serious health and safety risks, or to take appropriate action in relation to suspected serious misconduct) applies; such disclosure is required by a Government agency under an agreement to which Australia is a party; or. Another example involves a superannuation fund in 2018 that was found by the OAIC to have unlawfully disclosed personal information of its members to third parties, ultimately ordering the superannuation fund to apologise. Rather, the terminology of use and disclose are used in the APPs. A big hot topic in this space is the proposed amendments to the Privacy Act. 15.3 To what extent do works councils/trade unions/employee representatives need to be notified or consulted? Please see details of the sanctions under question 16.1 below. An example of this occurred in 2016, where the OAIC had obtained an enforceable undertaking from a Canadian-based media company due to discomfort expressed with the security of personal information collected, as well as compliance reporting, monitoring and enforcement. camera surveillance, which is surveillance by means of a camera that monitors or records visual images; computer surveillance, which is surveillance by means of software or other equipment that monitors or records the information input or output, or other use, of a computer; and. 7.8 How frequently must registrations/notifications be renewed (if applicable)? The OAIC stated that the impact of the Schrems II decision on international data transfers is likely to be significant. APP 11.3 requires an entity to take reasonable steps to destroy or de-identify personal information if it no longer needs the personal information for any purpose for which the information may be used or disclosed under the APPs. transatlantic invalidation combine europeansting If not, then the entity must publish a copy of the statement on the entitys website (if any) and take reasonable steps to publicise the contents of the statement.

Right to complain to the relevant data protection authority(ies).

Individuals have the right to lodge privacy complaints with the OAIC if they are concerned that their personal information has been mishandled. In respect to the CDR regime, accreditation through the ACCC is a pre-requisite to receiving or holding CDR data.

Moreover, APP 11 denotes that an entity must take active steps to ensure that personal information no longer required (for the notified purpose) is deleted or de-identified. 7.9 Is any prior approval required from the data protection regulator?

Under APP 4, if an APP entity receives unsolicited personal information, the entity must determine whether it could have solicited and collected the information under APP 3. MinterEllison, The International Comparative Legal Guides and the International Business Reports are published by: Global Legal Group, The ICLG Series - In my practice as a commercial real estate risk manager at GE Capital and as a consultant to private equity clients in Europe I have used and can recommend GLG publications as a starting point for solutions to cross-border transaction hurdles. If so, are there any best practice recommendations on using such lists? There are also notice requirements in relation to employee surveillance. 7.5 What information must be included in the registration/notification (e.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes)? 17.1 Describe the enforcement powers of the data protection authority(ies).

10.4 Do the restrictions noted above apply to marketing sent from other jurisdictions? The OAIC can take, and has taken, action on foreign organisations. If so, describe what details must be reported, to whom, and within what timeframe.

The information contained in the publications is credible, accurate as of the date of printing, and a reliable first-source when seeking the support of expert resources.William Glennon, Managing Partner - UnderwritersTrust Transaction & Risk Management LLP, 2002-2022 Copyright: ICLG.com | Privacy policy | Cookie policy, William Glennon, Managing Partner - UnderwritersTrust Transaction & Risk Management LLP, Economic Crime Prevention and Compliance London 2022, The Office of the Australian Information Commissioner (, The Australian Communications and Media Authority (, The Australian Competition and Consumer Commission (. 16.4 What are the maximum penalties for data security breaches? for a body corporate, a maximum civil penalty amount being the greater of: if the relevant court can determine the value of the benefit obtained from the contravention, three times the value of that benefit; or, if the court cannot determine the value of that benefit, 10% of the body corporates annual turnover in the year preceding the contravention; or. 10.6 Is it lawful to purchase marketing lists from third parties? However, electronic messages by government bodies, political parties and charities may be exempt from this prohibition. APPs 7.2 and 7.3 stipulate that APP entities must provide individuals a simple method to request the APP entity to no longer send, and the individual to no longer receive, marketing communications. 7.2 If such registration/notification is needed, must it be specific (e.g., listing all processing activities, categories of data, etc.) As a general rule, an individual under the age of 18 has the capacity to consent when they have sufficient understanding and maturity to understand what is being proposed. a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a Commonwealth enactment, not being: an incorporated company, society or association; or, an organisation that is registered under the.

Australian Government agencies and organisations with an annual turnover of more than AU$3 million, as well as some other organisations (APP entities) must also comply with the APPs in relation to personal information, including notifying individuals that their image may be captured.

Sitemap 14