AustraliaPrivacy Act 1988 (Cth), Reach Over Scraped Personal Information
In force since .
A personal data rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Do not collect personal information, including personal information scraped from a public website, unless it is reasonably necessary for one or more of the entity's functions or activities.
- Do not use or disclose personal information collected for one purpose for another purpose, including model training, unless the individual consented or an Australian Privacy Principle 6.2 exception applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Australian Privacy Principle 6.5 requires an APP entity that uses or discloses personal information under paragraph 6.2(e), the enforcement-related activities limb, to make a written note of the use or disclosure. It does not say what the note must hold, who may see it or how long it is kept. Australian Privacy Principle 3 and the rest of Australian Privacy Principle 6, the clauses on collection and on use for another purpose, impose no record duty. Provisions on the Commissioner's powers and on an entity's practices are not cited by this row.
- Kind
- Explicit
- As of
- Provision
- Privacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 6.5 (a written note of a use or disclosure made under paragraph 6.2(e))
- Trigger
- personal_data_processing
What this law does
The Privacy Act 1988's definition of personal information carries no exception for information that is publicly accessible, so an APP entity (an Australian Government agency, or an organisation with an annual turnover over $3,000,000) that scrapes personal information from a public website, including for AI training, must still collect it only where reasonably necessary for its functions under Australian Privacy Principle 3.
It may use or disclose that information for another purpose only within the Australian Privacy Principle 6 exceptions. The entity must still have an Australian link for the Act to reach conduct outside Australia.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .