AICD submission on the Privacy and Other Legislation Amendment Bill 2024

Our submission urged the Government to consider legislative amendments to the Privacy Act holistically with other potential reforms in adjacent policy areas, including implementation of the 2023-2030 Australian Cyber Security Strategy and the Mandatory Guardrails for AI. A coordinated approach across portfolios must be taken to ensure policy settings and reforms are consistent.

Our key points in the submission on the Bill were:

• Qualified support for a statutory tort for serious invasions of privacy based on the model recommended by the ALRC Report 123. It is critical that the statutory tort be confined to ‘serious’ invasions of privacy and require a fault element of ‘intentionality or recklessness’. We strongly urged these thresholds be retained in the Bill.
• Do not support providing the OAIC with the ability to develop APP codes at the direction of the Minister. Providing a regulator with delegated legislation capacity should be approached with considerable caution, particularly where the code is intended to impose significant new 3 policy on entities. This approach could undermine the legitimate role of the legislature and risk regulator over-reach.
• Support the introduction of mid and lower tier penalty provisions that are commensurate with the seriousness of the interference with privacy and the OAIC being able to issue infringement notices for minor breaches of the Privacy Act.
• Do not support the proposed changes to APP 1 in respect of the transparency of automated decision making. We consider this requirement will capture many common business tools and decision-making aids with a significant cost and compliance burden to entities. We are not satisfied this change will result in material transparency benefits that will outweigh the significant cost of meeting the requirement. We are also concerned that the proposal does not align with the Government’s direction on the Mandatory Guardrails for AI.