Australian Federal Privacy Laws
© Xamax Consultancy Pty Ltd, 1995-2024
Infrastructure
& Privacy
Matilda
Australian Federal Privacy Laws© Xamax Consultancy Pty Ltd, 1995-2024 |
|
|||||
| HOME | eBusiness |
Information Infrastructure |
Dataveillance & Privacy |
Identity Matters | Other Topics | |
| What's New |
Waltzing Matilda | Advanced Site-Search | ||||
This document is a partner to pages on Privacy Laws of the Australian States and Territories, and on International Instruments
This document provides access to laws of the Australian Commonwealth that are relevant to privacy, and that have application to the federal public sector, and some of the private sector nation-wide. If you're aware of errors or omissions, please tell me.
If you're looking for the laws of a State or Territory, those details are in another document. See: N.S.W., Victoria, Queensland, Western Australia, South Australia, Tasmania, A.C.T., Northern Territory.
This page contains the following sections:
The primary statute is the Privacy Act 1988. The original version applied to the Commonwealth public sector. It was amended in 1990 to apply also to the credit reporting industry. It was then further amended in 2000 to apply to much of the private sector.
The original statute was adequate, and the 1990 credit reporting amendment was reasonably strong. The 2000 private sector amendment, on the other hand, was so bad that some people thought that it was the world's worst privacy legislation. Subsequently, the NSW Act challenged it for that mantle. But then the 2012 amendments were passed, which make the Privacy Act (Cth) unequivocally the most privacy-hostile data protection law in the world.
The law has all manner of exceptions, exemptions, authorisations and designed-in loopholes scattered through it, and the complexities are such that there are many unintended loopholes, ambiguities and uncertainities as well. Its effect has also been greatly weakened by large numbers of exceptions and authorisations written into other legislation. Corporations and expensive lawyers and consultants spend a lot of time wading through the verbiage in order to find multiple ways in which organisations can breach data privacy, but avoid breaching data privacy law.
The Privacy Act has been very heavily amended since its original passage in 1988. Here are:
The Australian Privacy 'Principles', which came into force on 12 March 2014, greatly weakened the previous protections.
They're a monstrous 5,000 words, and contain all manner of concessions to
business and government, at great cost to privacy. The public sector IPPs
(1989-2014) were already very long, for a body of 'principles', at 1,600
words – but that was because they contained so many exemptions and
exceptions. The private sector NPPs (2001-2014) were 3,200 words – because
they contained even more exemptions and exceptions. Here are:
Important prior documents, 1988-2014:
The Attorney-General's Department's ComLaw database can also be used, by searching on 'Privacy Act', and then sifting through the hundreds of hits to find the particular document and version that you want.
The Privacy Act granted the National Health and Medical Research Council the extraordinary power to issue its own guidelines. For these, see:
There's a vast array of legislation that authorises surveillance by Commonwealth agencies, much of it enacted since September 2001, most of it grossly excessive, and most of it subject to seriously inadequate controls. Valuable summaries are provided by the Commonwealth Parliamentary Library, but they keep disappearing every few years, because web-site re-designs are conducted with a cavalier attitude to history, and information policy standards in government seem to be non-existent, or else seriously inadequate. Checks in November 2013 and March 2017 found these two:
Here's an enumeration of the 65 'counter-terrorism' statutes 2001-15, a categorisation of their provisions, a list of the resulting compromises to human rights, and assessment of the extent to which PIAs were performed.
Statutes of particular relevance are:
Relevant organisations include:
Here's some documentation re the first 25 years' attempts to impose a National ID Scheme (c.1985-2010):
Here are some extant id-related schemes, which are subject to some regulatory constraints, many woefully inadequate:
A phantom organisation exists called the National Statistical Service, which is a community of government agencies that expropriate personal data and make it available for research. It appears to be primarily ABS, with AIHW and AIFS – which are designated by another phantom organisation called the 'Cross Portfolio Data Integration Oversight Board', under an "interim accreditation scheme", as 'Data Linkage Integrating Authorities'. But every agency is invited to be involved and donate 'their' data-holdings about people. It appears that the 'National Statistical Service' is a backdoor mechanism being used to establish and maintain a Danish-style national databank containing everything available about every Australian resident.
[NEEDS HERE: identification of and links to relevant laws and agencies:]
Crimtrac (1990-2016), now part of the Australian Criminal Intelligence Commission, operates criminal records, criminal intelligence records and biometrics records, and would love to operate an ANPR-based national traffic surveillance network as well.
[NEEDS HERE: identification of and links to relevant laws and agencies:]
[NEEDS HERE: identification of and links to any other relevant laws:]
[NEEDS HERE: identification of and links to other relevant laws and agencies:]
A centralised eHealth record has been imposed on Australians, originally misnamed the 'Personally Controlled Electronic Health Record' (PCEHR), subsequently re-born as 'MyHR'. It is not designed to support patient health care, and is of little use to patients or clinicians. Its purpose is to greatly increase the availability to federal bureaucrats of personal health care data, for such uses as statistics for the Minister's office, waste and fraud control, and research. The scheme is all about expropriation of personal data by the public service.
The Australian Institite of Health & Welfare (AIHW) expropriates vast quantities of highly sensitive personal data from a wide variety of sources, including hospitals, stores it in a database, and makes it available to researchers as identified or at least readily re-identifiable personal data. (I'm currently unclear what the legal authority is, and what the legal protections are).
Some limited protections for data expropriated for research were created in 1981 by the Epidemiological Studies (Confidentiality) Act (Cth); but under s.35 of its 1987 Act, AIHW is exempted from them.
The relevant agencies appear to be bound by the Medicare and Pharmaceutical Benefits Programs Privacy Guidelines which were issued under s.135AA of the National Health Act in 2008 (and have been unchanged since). The Rules come within the purview of the Commissioner under s.135AB.
The Privacy Act granted the National Health and Medical Research Council the extraordinary power to issue its own guidelines. For these, see:
Attempts to force the Parliament to enact a Genetic Privacy and Non-Discrimination Bill failed in 1998, 2000, 2002, 2004 and 2008. It's unclear to what extent the Recommendations of the ALRC in 2003 have been implemented. The field may well be wide open for expropriation of genetic data by government agencies, by corporations such as insurance companies, family history companies and pathology services, and by all entities as employers.
Employers have a complete holiday from the Privacy Act by virtue of s.7B(3), on the pretext that employees' privacy is covered by other laws. It isn't.
Re Email, see here
Re Substance Abuse Testing, see here
Re Biometrics, see here
Re Genetics, it's unclear to what extent the 2003 Recommendations of the ALRC have been implemented. Employers may well have carte blanche to abuse their employees' privacy in this area
Workplace visual surveillance is authorised in several jurisdictions, and with seriously inadequate controls.
The Australian Government Security Vetting Agency (AGSVA) subcontracts security vetting processes for a remarkably high percentage of Clth goverment employees, direct contractors, and employees and contractors of contractors (>350,000 it seems, incl. temporary accounts payable clerks, plumbers and field workers, all in non-sensitive agencies). Baseline Vetting is moderately intrusive, and it gets progressively worse at Negative Vetting levels 1 and 2, and Positive Vetting. It appears that there may not be any parliamentary authority for these intrusions, and that the entire scheme may be predicated on the conditions of engagement imposed on employees and contractors.
There are ongoing endeavours to impose a single, lifelong identifier on every individual, called the Unique Student Identifier (USI). A system is in place, and appears to be being imposed using the usual monetary incentive/disincentive mechanism applied by government agencies. No enabling legislation appears to exist. A Student Identifiers Bill was introduced in 2013 but did not progress. So it is unclear what, if any, safeguards exists for this invasive and unapproved scheme.
There appears to be ongoing endeavours to achieve a centralised national scheme of records about every individual.
Various national and State/Territory occupational registers exist, generally subject to reasonable safeguards.
Incitement to violence is a criminal act called 'urging violence', under s.80.2A, B of the Criminal Code (Cth).
Bullying of a serious nature is at least theoretically subject to prosecution as assault.
Re harassment, see ALRC Report 123 (2014), s.15.
The generation of anxiety in a person, through an act that "offends, insults, humiliates or intimidates" on the basis of "race, colour or national or ethnic origin" is subject to regulation in some circumstances through the Racial Dicrimination Act s.18C-18D.
A phantom organisation called the National Statistical Service is a community of government agencies that expropriate personal data and make it available for research. It appears to be primarily ABS, with AIHW and AIFS – which are designated by another phantom organisation called the 'Cross Portfolio Data Integration Oversight Board', under an "interim accreditation scheme", as 'Data Linkage Integrating Authorities'. But every agency is invited to be involved and donate 'their' data-holdings about people. It appears that the 'National Statistical Service' is a backdoor mechanism being used to establish and maintain a Danish-style national databank containing everything available about every Australian resident.
In addition, the Australian Instutute of Family Studies (AIFS) appears to maintain at least one dataset which appears to contain data expropriated by the Dept of Social Security, and which appears to be highly privacy-intrusive, and which is accessed by many scores of organisations and many hundreds of researchers.
A vast amount of data, some effectively de-identified, some not, and some apparently identified, has been expropriated and consolidated in the Australian Data Archive, a resource available to social scientists. It is unclear under what, if any, authority it operates, and what safeguards apply.
In August 2016, the Census was converted was abruptly converted, without public consultation or even parliamentary debate, from an anonymous statistical survey of the population to a consolidated, longitudinal database of personally identified information, with data to be expropriated from agencies' administrative data holdings and added into the ABS-maintaned data warehouse. A larger breach of public trust is difficult to imagine. The public has been taught to avoid, obfuscate and falsify data that it provides to government agencies. See here.
ATM and EFTPOS transaction data appears to be readily available to law enforcement agencies. The tracking value has massively intensified since 2013, with the explosion in uptake of contactless card payments.
Austrac financial transaction tracking, and associated identification requirements:
The Privacy Act's Part IIIA was amended in 2012 to destroy the 1989 provisions that constrained the operations of credit bureaux, and to provide authorisation for credit bureaux to gather highly detailed personal data, and sell it back to lenders, subject to seriously inadequate regulatory mechanisms. The near-monopoly operator Veda was promptly taken over by US behemoth Equifax, ensuring a massive leap in the sale, rental and profile-consolidation of Australian consumers.
The international Passenger Movements System is operated by the Dept of Immigration, or whatever para-military title it may be operating under at any given time. This is linked with passenger name record (PNR) systems. For information on the appalling process and outcomes in relation to disclosure of passenger data, see APF submissions of 19 Sep 2011 and 27 Sep 2011.
The Dept of Immigration (replace with current name) operates a Movement Alert List (MAL). In late 2013, a Departmental document of mid-2011 – mirrored here – disclosed that the MAL contained an extraordinary "647 000 identities, of which 49 per cent are national security alerts of interest".
There have been considerable endeavours by Crimtrac, now ACIC, to stimulate the use of ANPR to build a national database for traffic surveillance.
A further element of the surveillance state and economy is vehicle monitoring, variously by manufacturers, by fleet-owners, and by insurers.
In ABC v Lenah Game Meats Pty Ltd (2002) 208 CLR 199, a majority of the High Court held that Australian courts were not prevented from finding that there is a tort (or legal cause of action) of unjustified invasion of privacy. But they did not find that it existed on the facts of the case before them. There has been no other significant sign of life in the 15 years since then.
See also the ALRC's Recommendation of a Privacy Cause of Action ALRC (2008b).
The Office of the Federal Privacy Commissioner's page on Other [Privacy-Relevant] Legislation
Andrew Nemeth's site on NSW Photo Rights, incl. privacy
Two papers on history and issues, Clarke (1998a-) and Clarke (1998b-)
AustLII's Australian Subject-Index for Privacy
AustLII's Australian (Commonwealth) Privacy and Surveillance Law Library
Greenleaf G.W. & Waters N. (Eds.) (1994-2006) 'Privacy Law & Policy Reporter', monthly, available from http://www.austlii.edu.au/au/journals/PLPR/
Gunning P. (2001) 'Central features of Australia's private sector privacy law' Privacy Law & Policy Reporter 7, 10 (May 2001) 189-199
Hughes G. (1991) 'Data Protection Law in Australia', Law Book Company, 1991
AMCRAN (2004) 'Terrorism Laws: ASIO, the Police and You', Australian Muslim Civil Rights Advocacy Network, 3rd ed., January 2007, at https://www.missionislam.com/conissues/books/Anti_Terror_Laws_3rd_Ed_English_2Up.pdf
| Personalia |
Photographs Presentations Videos |
Access Statistics |
 |
The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax. From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 65 million in early 2021. Sponsored by the Gallery, Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer |
Xamax Consultancy Pty Ltd ACN: 002 360 456 78 Sidaway St, Chapman ACT 2611 AUSTRALIA Tel: +61 2 6288 6916 |
Created: 31 May 2000 - Last Amended: 19 March 2020 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at www.rogerclarke.com/DV/PLawsClth.html
Mail to Webmaster - © Xamax Consultancy Pty Ltd, 1995-2022 - Privacy Policy