# Standards and Regulatory References — Australia Privacy Act

## Primary Legislation

### Privacy Act 1988 (Cth)
- **Enacted**: 1988; substantially amended 2012 (APPs), 2017 (NDB), 2024 (reform amendments)
- **Scope**: Federal agencies, private sector organisations with >AUD 3M turnover, health providers, credit bodies
- **APPs**: 13 Australian Privacy Principles in Schedule 1
- **Notifiable Data Breaches**: Part IIIC, effective 22 February 2018

### Privacy Act Review Report (February 2023)
- Attorney-General's Department report with 116 proposals for Privacy Act reform
- Accepted proposals formed basis of the 2024 reform amendments
- Key proposals: statutory tort, children's code, automated decision-making, individual rights expansion

### 2024 Reform Amendments
- Statutory tort for serious privacy invasions
- Right to erasure and de-identification
- Automated decision-making transparency
- Children's Online Privacy Code
- Enhanced civil penalties (AUD 50M / 3x benefit / 30% turnover)
- Strengthened OAIC enforcement powers

## OAIC Guidance

### APP Guidelines (Chapter 1-13)
- Comprehensive interpretation of each APP
- Updated following 2024 amendments
- Practical examples and case studies

### Guide to Data Analytics and the Australian Privacy Principles (2018)
- Guidance on privacy-compliant data analytics
- Relevant to automated decision-making obligations post-2024

### Notifiable Data Breaches Guidance
- When to assess; how to assess serious harm; notification procedures
- Practical tools including the NDB assessment tool

## APEC CBPR
- Australia is a participant in the APEC Cross-Border Privacy Rules (CBPR) system
- OAIC is the designated enforcement authority
- CBPR certification available as a cross-border transfer supplement

## Privacy Act vs GDPR Key Differences

| Feature | Privacy Act | GDPR |
|---------|------------|------|
| Consent model | APPs (collection + use/disclosure rules) | Six lawful bases |
| Turnover threshold | AUD 3M (some exemptions) | No turnover threshold |
| Breach notification | 30-day assessment + notification | 72 hours |
| Maximum penalty | AUD 50M / 3x benefit / 30% turnover (2024) | EUR 20M / 4% global turnover |
| Right to erasure | New (2024) | Available since 2018 |
| Automated decision rights | New (2024) | Art. 22 |
| DPO requirement | No statutory requirement | Mandatory for certain entities |
| Children's code | Forthcoming (2024 amendments) | Varies by Member State |
| Statutory tort | New (2024) | No equivalent in GDPR |

## Enforcement Precedents

### OAIC v. Clearview AI (2021) — Biometric scraping; ordered to cease and destroy
### OAIC v. 7-Eleven (2021) — Facial recognition in stores without consent
### OAIC v. Meta/Facebook (ongoing) — Cambridge Analytica civil penalty proceedings