AustraliaPrivacy Act 1988 (Cth), Australian Privacy Principles
Privacy Act 1988 (Cth), No. 119, 1988, ss. 5B, 6, 6D, 13, 14, 15 and Schedule 1
In force since .
A comprehensive regime rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Comply with the Australian Privacy Principles in Schedule 1 to the Privacy Act 1988 for any personal information about an individual, if the entity is an Australian Government agency or an organisation with an annual turnover over $3,000,000.
- Comply with the Australian Privacy Principles for an act done, or a practice engaged in, outside Australia if the entity has an Australian link.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Australian Privacy Principle 6.5 requires an APP entity that uses or discloses personal information because it reasonably believes this is reasonably necessary for an enforcement body's enforcement related activities (APP 6.2(e)) to make a written note of the use or disclosure. The clause names no content, retention period or reader of the note, and no other principle in Schedule 1 requires a log or record. The Commissioner's powers to investigate or assess an entity sit outside the sections this row cites. The hook is the Australian link in section 5B(2) (incorporation or formation in Australia, or central management and control there) and 5B(3) (carrying on business in Australia).
- Kind
- Explicit
- As of
- Provision
- Schedule 1, Australian Privacy Principle 6.5
- Trigger
- personal_data_processing
What this law does
Binds Commonwealth agencies and organisations, including businesses with an annual turnover over $3,000,000, to comply with the Australian Privacy Principles in Schedule 1. It also extends to an act done or a practice engaged in outside Australia by an entity with an Australian link. Sections 13 to 15 and the Australian Privacy Principles in Schedule 1 were substituted by the Privacy Amendment (Enhancing Privacy Protection) Act 2012, whose Schedules 1 to 4 commenced on .
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .