AustraliaPrivacy Act 1988 (Cth), Civil Penalties for Serious Interference with Privacy
Privacy Act 1988 (Cth) No. 119, 1988, s. 13G, as amended by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, No. 83, 2022
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
As of .
What it requires
- Do not do an act, or engage in a practice, that is a serious interference with the privacy of an individual.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Section 13G applies to a serious interference with privacy: for a body corporate the ceiling is the greatest of $50,000,000 and either three times the value of the benefit obtained, where the court can determine it, or 30% of adjusted turnover during the breach turnover period, where it cannot; for an individual the ceiling is $2,500,000.
- Rule
- Higher of
- As of
- Currency
- AUD
- Fixed cap
- 50,000,000
- Turnover percentage cap
- 30
What this law does
Section 13G makes a serious interference with the privacy of an individual a civil penalty provision. For a body corporate the maximum penalty is the greatest of $50,000,000 and either three times the value of the benefit obtained, where the court can determine it, or 30% of adjusted turnover during the breach turnover period, where it cannot. For an individual the maximum is $2,500,000.
The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 set these maximums, and its Schedule 1 commenced on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, sends automated outreach, generates content with AI, processes biometric data or makes high-risk automated decisions.