Canberra, September 2 Australia’s government has published its initial proposals for a second wave of reforms to the Privacy Act 1988, marking a continuation of efforts to modernize and strengthen privacy protections. The proposals, released for public consultation, focus on areas not covered by earlier reforms and address emerging challenges in data governance. The second wave of reforms includes measures targeting automated decision-making, a topic that has gained increasing attention as algorithmic systems become more prevalent.
The consultation paper explicitly notes that the reforms aim to align Australian law with international standards, including the European Union’s General Data Protection Regulation. One of the key proposals is the introduction of a direct right of action, allowing individuals to sue for privacy breaches without first lodging a complaint with the Office of the Australian Information Commissioner.
This shift could significantly alter the landscape of privacy enforcement in Australia, offering individuals greater autonomy in seeking redress for privacy violations. The government has also proposed a broader definition of ‘personal information’, which may include technical data such as IP addresses and location data. This expansion could have significant implications for how businesses handle data, particularly in sectors that rely heavily on user tracking and analytics.
The proposals also address the regulation of ‘dark patterns’—design techniques that manipulate user consent—highlighting a growing concern over how digital interfaces can be used to influence user behavior. Additionally, the consultation paper discusses the application of the Act to employee records, which are currently largely exempt from the provisions of the Privacy Act.
The Attorney-General’s Department is leading the consultation process, which will run for a set number of weeks and invite submissions from industry, civil society, and the public. The government has emphasized its intention to balance stronger privacy protections with the need to avoid undue regulatory burden on businesses, particularly small and medium enterprises. The proposals follow the release of the Privacy Act Review Report in February 2023, which made over 100 recommendations for reform.
The first wave of reforms, enacted via the Privacy and Other Legislation Amendment Act 2024, took effect in stages, with the new children’s code and the statutory tort commencing in late 2024 and early 2025. The second wave of reforms is expected to be introduced as legislation in 2025 or 2026, depending on the outcome of the consultation. The government has not provided specific dates for the close of the consultation or the introduction of legislation, but has indicated that it will continue to engage with stakeholders throughout the process.
