Freedom of Information, Privacy, and Data Protection in Australia: Access to Government Information and Individual Rights

Freedom of Information, Privacy, and Data Protection in Australia: Access to Government Information and Individual Rights

Introduction

Freedom of information, privacy, and data protection are essential components of Australia’s legal framework governing the relationship between individuals, government institutions, businesses, and the information they collect, hold, use, and disclose. These areas of law address two closely connected but sometimes competing objectives: the public’s right to obtain information about government activities and the individual’s right to have personal information handled lawfully and responsibly.

Freedom of information (FOI) legislation promotes transparency, accountability, and informed participation in public affairs. It enables individuals, journalists, researchers, businesses, and civil society organisations to request access to documents held by government agencies, subject to statutory exemptions and restrictions. Access to official records can reveal how administrative decisions are made, how public resources are allocated, and whether public authorities are complying with their legal responsibilities.

Privacy and data protection law address a different but equally important aspect of information governance. They regulate how personal information is collected, stored, accessed, used, disclosed, and retained. These rules seek to protect individuals against inappropriate information practices, unauthorised disclosure, identity-related risks, and certain forms of intrusive data processing. They also establish obligations for government agencies and private organisations that handle personal information.

In Australia, these legal fields are governed by a combination of Commonwealth legislation, State and Territory laws, regulatory frameworks, and judicial decisions. The principal Commonwealth legislation includes the Freedom of Information Act 1982 (Cth) and the Privacy Act 1988 (Cth). The former establishes the federal framework for public access to government documents, while the latter regulates the handling of personal information by Australian Government agencies and many private-sector organisations.

The Australian system is not entirely uniform. State and Territory governments operate their own freedom of information and privacy regimes, with different legislation, regulatory institutions, application procedures, and exemptions. Organisations operating across Australia may therefore need to comply with several overlapping legal frameworks.

Recent legislative reforms have also changed the Australian privacy landscape. The Privacy and Other Legislation Amendment Act 2024 introduced significant changes to the Privacy Act 1988, including a statutory tort for serious invasions of privacy, new regulatory powers, and additional protections relating to automated decision-making and the handling of personal information. These reforms reflect the increasing importance of data protection in an economy where digital platforms, artificial intelligence, online services, and large-scale information processing have become central to commercial and public administration.

Understanding freedom of information and privacy law in Australia therefore requires more than an examination of two separate statutes. It involves considering the constitutional and administrative foundations of government transparency, the legal meaning of personal information, the responsibilities of information holders, the rights of individuals, the powers of regulatory authorities, and the remedies available when legal obligations are breached.

This article examines the principal Commonwealth framework, its interaction with State and Territory legislation, and the wider legal principles governing access to public information and the protection of personal data.

1. The Legal Foundations of Freedom of Information and Privacy in Australia

1.1 The Development of Freedom of Information Legislation

The modern Australian freedom of information framework emerged from the principle that government administration should be subject to public scrutiny.

Traditionally, government records were treated primarily as administrative documents held by public authorities. Access was often determined by departmental discretion, subject to confidentiality requirements, public service conventions, and other legal restrictions.

The development of FOI legislation reflected a shift towards a more transparent model of government. Rather than treating access to official documents as an exceptional privilege, the legislation established a general statutory entitlement to request access, subject to specified exemptions.

The Commonwealth enacted the Freedom of Information Act 1982 (Cth), establishing a formal mechanism through which members of the public could request documents held by Commonwealth government agencies and ministers.

The legislation introduced several important principles:

• Government-held documents should generally be accessible unless a statutory exemption applies.
• Individuals should be able to obtain documents containing information about themselves.
• Public authorities should provide reasons for decisions refusing access.
• Administrative decisions concerning access should be subject to review.
• Government institutions should operate with greater transparency and accountability.

The FOI framework subsequently developed through legislative amendments, judicial interpretation, and the establishment of specialised oversight institutions.

An important reform occurred in 2010, when amendments strengthened the emphasis on proactive disclosure, simplified aspects of the access regime, and established the Office of the Australian Information Commissioner (OAIC) as a central Commonwealth oversight institution.

The resulting system recognises that government transparency is not limited to responding to individual applications. Public authorities are also expected to make appropriate information available proactively.

1.2 The Development of Australian Privacy Law

Australian privacy law developed alongside increasing public concern about the collection and use of personal information by government institutions and private organisations.

The growth of computerised databases, electronic communications, consumer profiling, financial information systems, and digital identification created new risks to individual privacy.

The Commonwealth responded by enacting the Privacy Act 1988 (Cth).

The legislation established a statutory framework governing the handling of personal information by Commonwealth public-sector agencies and, following subsequent amendments, many private-sector organisations.

An important development was the introduction of the National Privacy Principles in 2001, which extended privacy regulation to substantial parts of the private sector.

In 2014, the Australian Privacy Principles (APPs) replaced the Information Privacy Principles and National Privacy Principles, creating a consolidated framework for Commonwealth agencies and organisations covered by the Act.

The APPs regulate the entire information lifecycle, including collection, notification, use, disclosure, security, access, correction, and cross-border transfers.

The Privacy Act has since undergone further amendments, particularly in response to digital technology, online privacy concerns, data breaches, and the commercial use of personal information.

The Privacy and Other Legislation Amendment Act 2024 represents a significant stage in this development. It introduced a range of reforms intended to strengthen individual privacy protections and increase regulatory accountability.

1.3 The Relationship Between Freedom of Information and Privacy

Freedom of information and privacy law serve different purposes, but their operation frequently overlaps.

FOI law promotes access to government-held information. Privacy law protects personal information against inappropriate collection, use, and disclosure.

These objectives may sometimes conflict.

For example, a journalist may request access to government correspondence concerning a public procurement decision. The documents may contain information about public officials, private contractors, or individuals affected by the decision.

The FOI authority must determine whether disclosure serves the statutory access framework and whether any applicable exemption protects personal information or other confidential material.

Similarly, an individual may request access to a government document containing personal information about themselves. In such circumstances, privacy interests and FOI access rights may reinforce one another.

The Australian legal framework attempts to balance these interests through statutory exemptions, public-interest considerations, access rights, and privacy safeguards.

Neither transparency nor privacy is treated as an absolute principle in every circumstance. The legal outcome depends on the applicable legislation, the nature of the information, the identity of the requester, and the circumstances surrounding the proposed disclosure.

2. The Commonwealth Freedom of Information Act 1982

2.1 Purpose and Scope of the FOI Act

The Freedom of Information Act 1982 (Cth) is the principal legislative instrument governing access to documents held by the Australian Commonwealth government.

Section 3 identifies the objectives of the legislation. These include providing access to government information through publication and individual access rights, promoting participation in government processes, and increasing scrutiny and discussion of government activities.

The Act reflects an important democratic principle: information held by government is managed for public purposes and should not automatically be treated as the private property of the administration.

Section 11 establishes a legally enforceable right of access to documents held by Commonwealth agencies and official documents of ministers, subject to the statutory exemptions.

Importantly, the right of access is not restricted to Australian citizens or permanent residents. Any person may generally make an FOI request, regardless of nationality or residence.

Applicants are also not generally required to explain why they want the documents. The legislation provides that the right of access is not affected by the reasons given by the applicant or the agency’s beliefs about those reasons.

This feature distinguishes FOI access from certain administrative procedures in which applicants must demonstrate a personal interest or establish that they are directly affected by a decision.

The Act primarily concerns documents rather than an unrestricted right to demand explanations, create new documents, or require government agencies to answer general questions.

An applicant may request existing documents, including correspondence, reports, memoranda, records, databases, and other forms of recorded information falling within the statutory definition.

The scope of the Act is subject to important qualifications. Certain bodies and categories of documents are exempt or excluded, and the legislation does not automatically provide access to every record held by every public institution.

The current statutory framework should be read together with the OAIC’s Freedom of Information Guidelines, which explain the interpretation and administration of the Act. legislation.gov.au+2

2.2 Government Agencies and Ministers Covered by the Act

The Commonwealth FOI regime applies to agencies and ministers within the scope of the legislation.

Government departments, statutory authorities, and other covered Commonwealth bodies may be required to process FOI requests.

The Act also applies to official documents of ministers, subject to the relevant statutory definitions and exclusions.

However, the legislation contains exemptions for certain institutions and functions. These exclusions recognise that some governmental activities involve special confidentiality, security, or institutional requirements.

For example, particular intelligence and security bodies receive specific protection under the statutory framework.

The Act also contains special provisions concerning parliamentary and judicial institutions. Its application to courts and tribunals is generally connected to their administrative functions rather than the substantive conduct of judicial proceedings.

This distinction is important because access to government administrative records and access to judicial case files are governed by different legal arrangements.

A person seeking access to court documents may therefore need to use the applicable court rules and procedures rather than relying exclusively on the FOI Act.

2.3 The Right to Access Documents

Section 11 provides the general right of access, while section 11A establishes the framework for access following a valid request.

Where a document is not exempt, the agency or minister must generally provide access in accordance with the legislation.

The right is not limited to documents concerning the applicant personally.

A journalist may request correspondence relating to a public infrastructure project. A researcher may seek government reports concerning environmental policy. A business may request documents concerning a public procurement process. An individual may seek records concerning the administration of a government programme.

The legislation does not require the applicant to establish that the requested information is necessary for a legal proceeding or that the applicant has suffered a particular injury.

Nevertheless, the scope of the request must be sufficiently clear to enable the agency to identify the relevant documents.

A request that is too broad, ambiguous, or insufficiently specific may create practical difficulties and may require clarification.

2.4 Making a Freedom of Information Request

An FOI request must comply with the requirements of section 15 of the Act.

In general, a valid request should:

1. Be made in writing.
2. State that it is an application for access under the FOI Act.
3. Provide sufficient information to identify the requested documents.
4. Specify how notices and correspondence should be sent to the applicant.
5. Be submitted to the relevant agency or minister.

Applicants should identify the government institution most likely to hold the requested records.

For example, an application concerning immigration administration may be directed to the Department of Home Affairs, whereas a request concerning Commonwealth environmental policy may be directed to the relevant environmental department.

Where the applicant is uncertain which institution holds the information, the OAIC’s published guidance and agency FOI contact details can assist in identifying the appropriate recipient.

It is often useful to define the subject matter, relevant period, document types, and individuals or departments involved.

A carefully framed request may reduce processing delays and avoid unnecessary disputes about the scope of the application.

2.5 Time Limits for Processing Requests

The FOI Act establishes statutory timeframes for processing applications.

As a general rule, an agency or minister has 30 days to make an access decision.

However, the legislation allows certain extensions, including where consultation with third parties is required or where the applicant agrees to an extension.

Additional extensions may be available through the Information Commissioner in specified circumstances.

The calculation of the decision period is subject to the statutory rules governing the commencement, extension, and suspension of the relevant timeframe.

If an agency fails to make a decision within the applicable statutory period, the legislation provides consequences, including the possibility of treating the failure as a deemed refusal.

A deemed refusal does not necessarily mean that the agency has substantively examined the requested documents and concluded that they are exempt. It means that the statutory deadline has expired without a decision.

The applicant may then pursue the review mechanisms available under the Act.

2.6 Fees and Charges

The Commonwealth FOI system distinguishes between the right to make a request and the costs associated with processing or providing access.

There is generally no application fee for a standard FOI request under the Commonwealth framework.

However, charges may apply for certain processing activities, including searching for documents, decision-making, consultation, and providing access in particular formats.

The applicable charges are governed by the Freedom of Information (Charges) Regulations 2019 and the relevant provisions of the Act.

Applicants may be eligible for a reduction or waiver of charges in circumstances recognised by the legislation.

For example, charges may be reduced where disclosure would benefit the general public or a substantial section of the public.

Agencies must comply with the applicable notification and procedural requirements before imposing charges.

2.7 Access Formats and Edited Documents

Access may be provided in different forms, depending on the nature of the documents and the statutory requirements.

An agency may provide electronic copies, paper copies, or an opportunity to inspect documents.

Section 22 is particularly important because it allows access to edited copies where exempt or irrelevant material can be deleted without making the remaining document unintelligible.

This mechanism prevents the automatic withholding of an entire document merely because some passages are protected.

For example, a government report may contain:

• General policy analysis.
• Statistical information.
• Personal information about identifiable individuals.
• Confidential commercial material.

If the protected passages can be removed while preserving the meaningful content, the agency may provide an edited version.

This approach supports transparency while preserving legitimate confidentiality interests.

3. Exemptions and Restrictions on Access to Government Information

3.1 The General Principle of Disclosure and Its Exceptions

The FOI Act establishes a general right of access, but that right is subject to statutory exemptions.

The exemptions recognise that unrestricted disclosure may sometimes undermine national security, prejudice law enforcement, expose confidential information, interfere with legal proceedings, or unreasonably invade personal privacy.

The distinction between exempt documents and conditionally exempt documents is particularly important.

An exempt document is protected under the relevant statutory provision.

A conditionally exempt document is subject to a different test: access must generally be provided unless disclosure would, on balance, be contrary to the public interest.

The legislation therefore does not treat all confidentiality interests in the same way.

Some categories receive stronger protection, while others require an assessment of the competing public interests involved.

3.2 National Security, Defence, and International Relations

Section 33 protects documents whose disclosure could reasonably be expected to cause damage to the security, defence, or international relations of the Commonwealth.

The exemption recognises the need to protect sensitive government information concerning matters such as:

• Defence capabilities and military operations.
• Intelligence activities.
• National security assessments.
• Diplomatic communications.
• Sensitive international negotiations.
• Information received from foreign governments under confidentiality arrangements.

The application of this exemption requires consideration of the statutory criteria and the nature of the anticipated harm.

The fact that a document concerns defence or international relations does not necessarily mean that every part of it must remain confidential indefinitely.

The relevant legal question concerns the application of the exemption to the particular information.

3.3 Cabinet Documents

Section 34 protects certain Cabinet documents.

Cabinet is a central decision-making institution within Australia’s system of responsible government. Its deliberations frequently involve confidential policy discussions, ministerial advice, proposed legislative measures, and sensitive governmental decisions.

The exemption recognises the importance of preserving the confidentiality of qualifying Cabinet material.

However, not every document created by a government department automatically becomes a Cabinet document.

The statutory requirements must be satisfied, and the document must fall within the relevant categories established by the Act.

The protection of Cabinet documents also reflects the constitutional and political importance of collective ministerial responsibility.

3.4 Law Enforcement and Public Safety

Section 37 protects certain documents where disclosure could prejudice the enforcement of the law or the protection of public safety.

Examples may include information concerning:

• Active criminal investigations.
• Investigative methods.
• Law enforcement operations.
• Intelligence relating to suspected offences.
• Witness protection arrangements.
• Sensitive public safety measures.

The exemption is designed to prevent disclosure that could undermine investigations, expose confidential sources, facilitate criminal activity, or create identifiable risks to public safety.

Its application depends on the relevant statutory requirements and the anticipated consequences of disclosure.

3.5 Legal Professional Privilege

Section 42 protects documents subject to legal professional privilege.

Legal professional privilege protects certain confidential communications between lawyers and their clients made for the dominant purpose of providing or obtaining legal advice, or for use in existing or anticipated litigation.

The principle applies to government institutions as well as private individuals and commercial organisations.

For example, a government department may receive confidential legal advice from its internal legal advisers or external solicitors concerning the interpretation of legislation.

The existence of such advice does not automatically make every related document privileged. The relevant legal requirements must be satisfied.

The FOI exemption recognises that disclosure of privileged communications could undermine the confidentiality necessary for effective legal advice and the administration of justice.

3.6 Confidential Information and Commercial Interests

Section 45 protects certain documents containing material obtained in confidence.

Section 47 protects trade secrets and other commercially valuable information in circumstances specified by the legislation.

These exemptions may be relevant where government agencies hold information supplied by private businesses, contractors, commercial partners, or other organisations.

For example, a company participating in a government procurement process may provide technical or commercial information that qualifies for protection.

However, the mere fact that a business regards information as confidential does not automatically establish that the statutory exemption applies.

The legal requirements must be examined, including the nature of the information and the circumstances in which it was communicated.

3.7 Personal Privacy and Section 47F

Section 47F establishes a conditional exemption for documents whose disclosure would involve the unreasonable disclosure of personal information about an individual.

The provision recognises that government transparency must be balanced against the privacy interests of people mentioned in official records.

When assessing whether disclosure would be unreasonable, the decision-maker must consider relevant matters, including:

• Whether the information is already widely known.
• Whether the individual is publicly associated with the subject matter.
• Whether the information is available from public sources.
• Other relevant circumstances.

The provision is particularly important where FOI applications concern government employees, private individuals, complainants, witnesses, beneficiaries of public programmes, or people involved in administrative proceedings.

The exemption does not necessarily prevent access to the entire document.

Where personal information can be removed while preserving the meaningful content, section 22 may permit the release of an edited version.

3.8 Public-Interest Conditional Exemptions

Part IV of the FOI Act identifies several categories of conditionally exempt documents.

These include documents affecting Commonwealth-State relations, deliberative processes, certain financial and property interests, and personal privacy.

Under section 11A(5), access must generally be granted to a conditionally exempt document unless disclosure would, on balance, be contrary to the public interest.

The public-interest test is therefore central to the operation of the Commonwealth FOI system.

The assessment is not simply a matter of deciding whether disclosure would be convenient or inconvenient for the government.

It requires consideration of the public-interest factors recognised by the legislation, including the factors identified in section 11B.

Relevant considerations favouring disclosure include whether access would:

• Promote the objects of the FOI Act.
• Inform debate on a matter of public importance.
• Promote effective oversight of public expenditure.
• Reveal reasons for a government decision.
• Contribute to the administration of justice.

The Act also identifies certain factors that must not be taken into account when determining whether disclosure would be contrary to the public interest.

These include the possibility of embarrassment to the Commonwealth government or loss of confidence in the government.

This is an important safeguard because the FOI system is designed to facilitate scrutiny rather than protect government institutions from legitimate criticism.

The legal framework therefore recognises that transparency may serve the public interest even when disclosure is politically inconvenient.

The relevant provisions and exemptions are set out in Part IV of the Freedom of Information Act 1982 (Cth). legislation.gov.au+1

4. Proactive Government Disclosure and Open Government

4.1 The Information Publication Scheme

The Commonwealth FOI framework does not rely exclusively on individual applications.

Part II of the FOI Act establishes the Information Publication Scheme (IPS), which requires covered agencies to publish specified categories of information.

The scheme reflects the principle that government information should be made accessible proactively wherever appropriate.

The publication obligations extend to categories such as:

• Agency organisational structures.
• Functions and responsibilities.
• Information about public participation and consultation.
• Operational information.
• Reports and other documents required to be published.
• Information concerning the agency’s information holdings.

The scheme is intended to make government administration more transparent and reduce unnecessary reliance on formal FOI applications.

For individuals researching public institutions, the IPS can provide useful information before an application is submitted.

4.2 Disclosure Logs

Section 11C establishes the requirement for agencies and ministers to maintain disclosure logs containing details of certain documents released under FOI requests.

The purpose is to allow other members of the public to discover information that has already been released.

Disclosure logs can be particularly useful for journalists, academic researchers, civil society organisations, and individuals investigating government policy.

However, not every document released under the FOI Act must necessarily appear in a disclosure log.

The legislation provides exceptions, including circumstances involving personal information and other protected material.

4.3 Open Government and Public Accountability

The broader concept of open government involves more than the legal right to request documents.

It includes the publication of government data, accessible administrative information, consultation processes, public reporting, and institutional accountability.

Freedom of information supports these objectives by enabling independent examination of government decisions and the evidence underlying public policy.

For example, access to environmental assessments may help communities understand the reasoning behind infrastructure approvals.

Access to procurement documents may contribute to public scrutiny of government spending.

Access to administrative reports may reveal whether government programmes are being implemented consistently with their stated objectives.

Nevertheless, transparency must operate within the legal framework governing privacy, national security, commercial confidentiality, and other legitimate interests.

5. The Privacy Act 1988 and the Australian Privacy Principles

5.1 Purpose and Scope of the Privacy Act

The Privacy Act 1988 (Cth) is the principal Commonwealth statute governing the handling of personal information.

Its objects, set out in section 2A, include promoting the protection of individual privacy, encouraging responsible and transparent information practices, and providing a framework for nationally consistent regulation.

The Act regulates covered Commonwealth public-sector agencies and private-sector organisations.

Its scope is broader than government administration because modern personal information is held and processed by banks, insurers, telecommunications providers, retailers, technology companies, healthcare providers, and numerous other organisations.

The Act also regulates specific activities involving credit reporting and certain categories of personal information.

However, its application is not universal. Statutory thresholds, exemptions, and special rules determine whether a particular organisation or activity falls within its scope.

The Privacy Act 1988 should also be read together with applicable State and Territory privacy legislation and other sector-specific laws.

5.2 What Constitutes Personal Information?

Section 6 of the Privacy Act defines personal information broadly.

In general, personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable:

• Whether the information or opinion is true or not.
• Whether it is recorded in a material form or not.

The definition is deliberately broad because personal information can exist in many different forms.

Examples include:

• Names and residential addresses.
• Telephone numbers and email addresses.
• Dates of birth.
• Passport and identification details.
• Financial and banking information.
• Employment records.
• Medical and health information.
• Photographs and video recordings.
• Online identifiers and certain device-related information.
• Information concerning an individual’s activities, preferences, or behaviour.

Whether information constitutes personal information depends on whether an individual is identified or reasonably identifiable in the circumstances.

A dataset does not necessarily become anonymous merely because names have been removed. If individuals can still reasonably be identified by combining the remaining information with other available data, privacy obligations may continue to apply.

This is particularly relevant in digital environments where information from different sources can be combined to identify individuals.

5.3 Sensitive Information

The Privacy Act provides additional protections for sensitive information.

Under section 6, sensitive information includes categories such as:

• Racial or ethnic origin.
• Political opinions.
• Membership of political associations.
• Religious beliefs or affiliations.
• Philosophical beliefs.
• Membership of professional or trade associations.
• Membership of trade unions.
• Sexual orientation or practices.
• Criminal record information.
• Health information.
• Genetic information.
• Biometric information used for automated biometric verification or identification.
• Biometric templates.

Sensitive information receives stronger protection because its collection or misuse may create particularly significant risks to individual privacy, autonomy, and personal security.

For example, an organisation collecting health information or biometric identification data must consider the additional requirements applicable to sensitive information.

The distinction between personal information and sensitive information is therefore important when assessing the legality of collection, use, disclosure, and retention.

5.4 Organisations Covered by the Privacy Act

The Privacy Act applies to Australian Government agencies and many private-sector organisations defined as APP entities.

Private-sector organisations generally include businesses and other entities with annual turnover exceeding the statutory threshold of AUD 3 million, although the legislation also covers certain organisations below that threshold.

Specific categories of small businesses are covered regardless of turnover.

These include certain businesses providing health services, credit reporting bodies, organisations trading in personal information, and other categories identified by the legislation.

The Act also contains exemptions and special arrangements for certain activities and organisations.

For example, certain employee records handled by private-sector employers are exempt where the statutory requirements are satisfied.

Political parties and certain other bodies may also fall within specific exemptions.

These exceptions are important because the Privacy Act should not be understood as applying identically to every Australian organisation.

A business operating in Australia must examine its organisational status, activities, and the nature of the personal information it handles to determine the applicable legal obligations.

5.5 The Australian Privacy Principles

The Australian Privacy Principles are contained in Schedule 1 of the Privacy Act 1988.

There are 13 APPs, covering different stages of the personal information lifecycle.

They apply to APP entities and establish the principal standards governing the handling of personal information under Commonwealth privacy law.

The principles can be grouped into three broad areas:

1. Governance, transparency, and the quality of personal information.
2. Collection, use, disclosure, access, and correction.
3. Data security, identifiers, anonymity, and cross-border information transfers.

The APPs are not merely voluntary guidelines. They form part of the statutory framework and may be enforced by the Information Commissioner.

5.6 APP 1: Open and Transparent Management of Personal Information

APP 1 requires APP entities to manage personal information in an open and transparent manner.

Organisations must take reasonable steps to implement practices, procedures, and systems that ensure compliance with the APPs.

They must also maintain a clearly expressed and up-to-date privacy policy.

The policy should explain matters such as:

• What personal information the organisation collects.
• How it collects and holds that information.
• The purposes for which it is used.
• How individuals may access and correct their information.
• How privacy complaints can be made.
• Whether personal information is disclosed to overseas recipients.
• Any other information required by the APP framework.

The principle promotes transparency by requiring organisations to explain their information-handling practices.

5.7 APP 2: Anonymity and Pseudonymity

APP 2 generally requires organisations to provide individuals with the option of dealing anonymously or by using a pseudonym where practicable.

However, the principle does not require anonymity in every transaction.

For example, a financial institution may need to verify a customer’s identity to comply with legal requirements.

Similarly, a government agency may need identifying information to determine eligibility for a statutory benefit.

The principle recognises that some interactions require identification, while others can reasonably occur without collecting a person’s full identity.

5.8 APP 3: Collection of Solicited Personal Information

APP 3 regulates the collection of personal information actively requested by an APP entity.

An organisation may generally collect personal information only where it is reasonably necessary for one or more of its functions or activities.

Additional restrictions apply to sensitive information, which generally requires the individual’s consent unless a recognised statutory exception applies.

The principle seeks to prevent excessive or unnecessary collection.

For example, an online retailer may reasonably need a customer’s delivery address to fulfil an order. It would be more difficult to justify collecting unrelated sensitive personal information that has no reasonable connection with the transaction.

5.9 APP 4: Dealing with Unsolicited Personal Information

APP 4 addresses personal information received by an organisation without having been requested.

Where an organisation receives unsolicited personal information, it must determine whether it could have collected that information lawfully under APP 3.

If it could not have collected the information lawfully and the information is not contained in a Commonwealth record, it must generally destroy or de-identify it as soon as practicable, provided this is lawful and reasonable.

The principle is important in modern digital communications, where organisations frequently receive personal information through emails, attachments, online submissions, and other channels.

5.10 APP 5: Notification of Collection

APP 5 requires an organisation to take reasonable steps to notify an individual, or otherwise ensure that the individual is aware, of specified matters when personal information is collected.

These matters include:

• The identity and contact details of the organisation.
• The fact that personal information has been collected.
• The purposes of collection.
• The consequences of not providing the information.
• Any usual disclosures to other entities.
• Relevant access and correction rights.
• The organisation’s privacy complaint procedures.

This principle is central to informed information handling.

Individuals should generally understand why an organisation collects their information and how it intends to use it.

5.11 APP 6: Use and Disclosure of Personal Information

APP 6 regulates the use and disclosure of personal information.

An organisation generally may use or disclose personal information only for the primary purpose for which it was collected, unless a recognised exception applies.

Secondary use or disclosure may be permitted where:

• The individual has consented.
• The secondary purpose is related to the primary purpose and the individual would reasonably expect it.
• A specific statutory exception applies.
• Disclosure is required or authorised by law.
• Other recognised circumstances under the APP framework exist.

This principle is particularly important for businesses using customer databases for marketing, analytics, profiling, and commercial partnerships.

Collecting information for one purpose does not automatically authorise its use for every other commercial or operational activity.

5.12 APP 7: Direct Marketing

APP 7 regulates the use and disclosure of personal information for direct marketing.

The principle generally allows certain direct marketing activities where the relevant legal conditions are satisfied.

These conditions differ depending on whether the information is sensitive, whether it was collected directly from the individual, and whether the individual has a reasonable expectation of receiving marketing communications.

Individuals must also have appropriate opportunities to request that they no longer receive direct marketing communications.

APP 7 operates alongside other relevant Australian legislation, including the Spam Act 2003 (Cth), which regulates unsolicited commercial electronic messages.

The distinction is important: compliance with privacy requirements does not automatically establish compliance with electronic marketing laws.

5.13 APP 8: Cross-Border Disclosure

APP 8 regulates the disclosure of personal information to overseas recipients.

An Australian organisation may disclose personal information to an overseas recipient in circumstances permitted by the APP framework.

However, the organisation generally must take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information.

Under section 16C of the Privacy Act, an APP entity may, in specified circumstances, remain accountable for certain acts or practices of an overseas recipient as though they were acts or practices of the Australian entity.

This principle is particularly important for cloud computing, international outsourcing, global customer-management systems, and businesses using overseas data-processing providers.

The fact that information is stored outside Australia does not automatically remove it from the Australian privacy framework.

5.14 APP 9: Adoption, Use, or Disclosure of Government-Related Identifiers

APP 9 regulates the adoption, use, and disclosure of government-related identifiers.

These include certain identification numbers and codes assigned by government agencies.

The principle generally prevents organisations from adopting government identifiers as their own identifiers unless a statutory exception applies.

It also restricts the use and disclosure of such identifiers.

The purpose is to prevent government identification systems from becoming universal commercial tracking mechanisms and to reduce the risks associated with linking information across unrelated databases.

5.15 APP 10: Quality of Personal Information

APP 10 requires organisations to take reasonable steps to ensure that personal information collected is accurate, up to date, and complete.

Where an organisation uses or discloses personal information, it must take reasonable steps to ensure that the information is accurate, up to date, complete, and relevant for the intended purpose.

This principle is important because inaccurate information can produce serious consequences.

For example, incorrect financial information may affect credit decisions, inaccurate employment records may influence recruitment or disciplinary processes, and outdated personal details may interfere with government services.

5.16 APP 11: Security of Personal Information

APP 11 requires APP entities to take reasonable steps to protect personal information from:

• Misuse.
• Interference.
• Loss.
• Unauthorised access.
• Unauthorised modification.
• Unauthorised disclosure.

Organisations must also take reasonable steps to destroy or de-identify personal information when they no longer need it for a permitted purpose, subject to applicable legal retention requirements and exceptions.

The principle recognises that data security is not merely an IT issue. It is a legal responsibility associated with the collection and holding of personal information.

Appropriate security measures may include access controls, encryption, staff training, secure authentication, monitoring, system maintenance, and documented incident-response procedures.

The precise measures required depend on the nature and sensitivity of the information and the circumstances of the organisation.

5.17 APP 12: Access to Personal Information

APP 12 establishes the right of individuals to request access to personal information held about them by an APP entity.

An organisation must generally provide access upon request, subject to statutory exceptions.

Access may be refused in circumstances involving, for example:

• A serious threat to life, health, or safety.
• An unreasonable impact on another individual’s privacy.
• Certain legal proceedings or negotiations.
• Legally privileged material.
• Unlawful disclosure restrictions.

Where access is refused, the organisation must comply with the applicable requirements for explaining the decision.

APP 12 is important because individuals should not be entirely dependent on an organisation’s internal discretion when seeking information about themselves.

5.18 APP 13: Correction of Personal Information

APP 13 requires organisations to take reasonable steps to correct personal information where it is inaccurate, out of date, incomplete, irrelevant, or misleading.

An individual may request correction of information held by an APP entity.

Where the organisation refuses to correct the information, it must provide reasons and explain the available complaint mechanisms, subject to the statutory requirements.

In certain circumstances, an individual may request that a statement be associated with the relevant information to indicate that correction has been sought but refused.

This principle is important for ensuring that personal records remain reliable and do not perpetuate inaccurate information.

The 13 Australian Privacy Principles form the central operational framework of Commonwealth privacy law. legislation.gov.au+1

6. Sensitive Information, Health Records, and Special Privacy Protections

6.1 The Special Treatment of Sensitive Information

Sensitive information is subject to stricter collection requirements under the Privacy Act.

In general, APP 3 requires an organisation to obtain consent before collecting sensitive information unless a recognised exception applies.

The additional protection reflects the possibility that misuse of sensitive information may cause substantial harm, discrimination, reputational damage, or other serious consequences.

For example, information concerning an individual’s health, political opinions, religious beliefs, or biometric identity may expose aspects of personal life that are not necessary for ordinary commercial or administrative activities.

Organisations must therefore establish a lawful basis for collecting and handling such information and ensure that their practices comply with the relevant APP requirements.

6.2 Health Information and Medical Records

Health information is a particularly important category of sensitive information.

It includes information about an individual’s physical or mental health, disability, healthcare services, and other matters falling within the statutory definition.

The handling of health information is regulated by the Privacy Act at the Commonwealth level, together with applicable State and Territory health-record legislation.

Healthcare providers, hospitals, medical laboratories, insurers, digital health platforms, and other organisations may therefore be subject to overlapping obligations.

The legal framework addresses matters such as:

• Collection of medical information.
• Consent and permitted secondary uses.
• Disclosure to healthcare professionals and other recipients.
• Access to medical records.
• Correction of inaccurate information.
• Security and retention of health information.

The applicable legal requirements depend on the organisation, the nature of the information, and the jurisdiction in which the relevant activity takes place.

6.3 Credit Reporting and Financial Information

The Privacy Act contains a specialised framework for credit reporting.

Credit reporting bodies and credit providers handle information that can significantly affect an individual’s access to loans, credit cards, mortgages, and other financial services.

The legislation regulates the collection, use, disclosure, and correction of credit information.

It also establishes requirements concerning access to credit reports and the handling of inaccurate information.

This framework operates alongside other financial regulatory requirements and industry obligations.

6.4 Employee Records

The Privacy Act contains an employee records exemption that is particularly relevant to private-sector employment relationships.

The exemption applies to certain acts and practices of private-sector employers involving employee records directly related to a current or former employment relationship.

However, it is not a general exemption for every form of employment-related information.

The statutory conditions must be satisfied, and the exemption does not necessarily cover every external service provider or other organisation handling employee information.

For example, a payroll company processing employee information may be subject to privacy obligations even where the employer itself can rely on the employee records exemption.

This distinction is important when organisations outsource recruitment, payroll, human resources, or workforce-management functions.

7. Data Protection and Cybersecurity Obligations

7.1 Data Protection as a Legal Responsibility

Data protection involves the legal and organisational measures used to safeguard information against unauthorised access, misuse, alteration, disclosure, or destruction.

Under Australian privacy law, data security is primarily reflected in APP 11 and the broader statutory obligations imposed on APP entities.

The law does not prescribe one universal cybersecurity system suitable for every organisation.

Instead, it requires reasonable steps appropriate to the circumstances.

These may include:

• Information security policies.
• Risk assessments.
• Encryption and secure storage.
• Access restrictions and authentication controls.
• Staff training.
• Vendor and contractor management.
• Backup and recovery procedures.
• Monitoring and incident detection.
• Secure disposal of information.

The appropriate level of protection depends on the type of information, the risks associated with its processing, and the nature and size of the organisation.

7.2 Data Breaches and the Notifiable Data Breaches Scheme

The Notifiable Data Breaches (NDB) scheme is established under Part IIIC of the Privacy Act.

It requires covered entities to notify the OAIC and affected individuals when an eligible data breach occurs.

An eligible data breach generally involves unauthorised access to, unauthorised disclosure of, or loss of personal information held by an entity where a reasonable person would conclude that the incident is likely to result in serious harm to one or more individuals.

The scheme recognises that not every cybersecurity incident constitutes an eligible data breach.

For example, an attempted cyberattack that is successfully prevented may not involve unauthorised access or disclosure of personal information.

Similarly, an incident involving information that is effectively protected against access may not satisfy the statutory test.

The legal assessment must focus on the circumstances of the incident and the likelihood of serious harm.

7.3 Assessment of Suspected Data Breaches

Where an APP entity has reasonable grounds to suspect that an eligible data breach may have occurred, it must undertake a reasonable and expeditious assessment.

Under the statutory framework, the assessment must generally be completed within 30 days after the entity becomes aware of the relevant grounds for suspicion.

The purpose is to determine whether the incident meets the legal requirements for notification.

An effective assessment should consider:

1. What information was involved.
2. Whose information was affected.
3. Whether unauthorised access, disclosure, or loss occurred.
4. Whether the information was encrypted or otherwise protected.
5. Whether the incident creates a likelihood of serious harm.
6. Whether remedial action has prevented serious harm.

The entity must take appropriate steps to contain the incident and reduce the potential consequences.

7.4 Notification Requirements

Where an eligible data breach is established, the entity must prepare a statement for the OAIC and notify affected individuals as required by the Act.

The notification should provide sufficient information to explain the incident and enable affected individuals to take protective measures.

This may include information about:

• The nature of the data breach.
• The categories of personal information affected.
• The identity of the organisation responsible for the information.
• Recommended steps individuals can take to reduce potential harm.

Depending on the incident, individuals may need to change passwords, monitor financial accounts, contact relevant service providers, or take additional protective measures.

The notification obligation is not simply a matter of reputational management. It is a statutory responsibility intended to reduce the consequences of serious privacy incidents.

7.5 Consequences of Non-Compliance

Failure to comply with applicable privacy obligations may result in regulatory action by the OAIC.

Depending on the circumstances, consequences may include:

• Investigations.
• Formal determinations.
• Compliance requirements.
• Enforceable undertakings.
• Civil penalties.
• Other statutory enforcement measures.

The Privacy Act also contains mechanisms through which individuals may pursue complaints and seek remedies for certain privacy interferences.

The legal consequences depend on the relevant conduct, statutory provisions, and available enforcement mechanisms.

8. The Office of the Australian Information Commissioner

8.1 Establishment and Institutional Role

The Office of the Australian Information Commissioner (OAIC) is the principal independent Commonwealth regulator responsible for privacy protection and freedom of information oversight.

It operates under the Australian Information Commissioner Act 2010 (Cth), the Privacy Act 1988 (Cth), and the Freedom of Information Act 1982 (Cth).

The OAIC performs several important functions:

• Promoting and protecting individual privacy.
• Overseeing compliance with the Australian Privacy Principles.
• Investigating privacy complaints.
• Monitoring compliance with the Notifiable Data Breaches scheme.
• Reviewing certain FOI decisions.
• Investigating complaints concerning FOI administration.
• Promoting public awareness of information access and privacy rights.
• Providing guidance to government agencies and private-sector organisations.

The OAIC is particularly important because it combines responsibilities concerning both access to information and the protection of personal information.

Although these areas have different statutory foundations, they are closely connected in government administration and digital information management.

8.2 The Australian Information Commissioner

The Australian Information Commissioner is the principal officeholder responsible for the OAIC.

The Commissioner exercises statutory powers concerning privacy regulation, freedom of information oversight, investigations, determinations, and regulatory compliance.

The Commissioner may investigate alleged interferences with privacy, facilitate the resolution of complaints, and exercise enforcement powers where statutory requirements are satisfied.

The Commissioner also plays an important role in interpreting and promoting the practical application of the Australian Privacy Principles.

The office contributes to the development of national privacy standards by publishing guidance, regulatory policies, and explanatory materials.

8.3 The Privacy Commissioner

The Privacy Commissioner exercises functions under the Privacy Act.

These include investigating alleged interferences with privacy, handling complaints, monitoring compliance, and exercising relevant statutory enforcement powers.

The Commissioner may investigate the conduct of government agencies and private-sector organisations within the scope of the Act.

The role is particularly important where individuals believe that their personal information has been collected, used, disclosed, or secured unlawfully.

8.4 The Freedom of Information Commissioner

The Freedom of Information Commissioner performs functions relating to the administration of the Commonwealth FOI framework.

These responsibilities include reviewing access decisions, addressing complaints about FOI administration, and promoting consistent application of the legislation.

The Commissioner may also contribute to the development of guidance for agencies processing FOI applications.

The institutional arrangement provides a specialised mechanism for supervising the operation of the Commonwealth access-to-information system.

8.5 Investigations and Regulatory Powers

The OAIC possesses a range of investigative and regulatory powers.

Depending on the applicable legislation, the Commissioner may:

• Request information and documents.
• Investigate suspected privacy interferences.
• Examine the information-handling practices of regulated entities.
• Attempt to resolve complaints through conciliation.
• Make formal determinations.
• Accept enforceable undertakings.
• Seek or issue certain compliance measures.
• Pursue civil penalty proceedings in appropriate circumstances.

The Privacy and Other Legislation Amendment Act 2024 strengthened aspects of the Commissioner’s regulatory framework, including enforcement powers.

These developments reflect a broader shift towards treating privacy compliance as an enforceable legal responsibility rather than merely an internal organisational policy.

Official institutional resource: Office of the Australian Information Commissioner. OAIC+1

9. Individual Privacy Rights and Complaint Mechanisms

9.1 The Right to Complain About Privacy Interference

Individuals may complain where they believe an organisation or government agency has interfered with their privacy in breach of the applicable legislation.

A privacy complaint may concern:

• Unlawful collection of personal information.
• Use of personal information for an unauthorised purpose.
• Unauthorised disclosure.
• Inadequate protection of personal information.
• Failure to provide access to personal records.
• Refusal to correct inaccurate personal information.
• Non-compliance with applicable privacy obligations.

The available complaint mechanism depends on the identity of the organisation and the legal framework governing its activities.

Complaints concerning Commonwealth agencies and private-sector organisations covered by the Privacy Act generally fall within the OAIC’s jurisdiction.

Complaints concerning State and Territory public-sector bodies are generally handled under the relevant local privacy legislation and oversight arrangements.

9.2 Complaining to the Organisation First

Under the Commonwealth privacy complaint framework, individuals are generally expected to raise the issue with the organisation or agency responsible for handling their information before approaching the OAIC.

The organisation should ordinarily be given a reasonable opportunity to investigate and respond.

The OAIC considers approximately 30 days a reasonable period for an initial response in its published guidance.

If the organisation does not respond adequately, or the individual remains dissatisfied, a complaint may be submitted to the OAIC.

There are statutory requirements and circumstances in which the Commissioner may decline to investigate a complaint, including where the matter has already been adequately addressed or where the complaint is outside the relevant legal timeframe.

Generally, the Commissioner may decline to investigate matters where more than 12 months have elapsed since the complainant became aware of the relevant issue, although the legislation provides discretion and exceptions.

9.3 Investigation and Conciliation

The OAIC may initially examine whether a complaint falls within its jurisdiction and whether further investigation is justified.

Where appropriate, it may attempt to resolve the dispute through conciliation.

Conciliation is a process through which the parties are encouraged to reach an agreed resolution.

Possible outcomes may include:

• Correction of inaccurate information.
• Improved information-handling practices.
• An apology.
• A commitment to change organisational procedures.
• Other appropriate remedial measures.

If the complaint is not resolved, the Commissioner may proceed to a formal determination where the statutory requirements are satisfied.

This approach allows some privacy disputes to be resolved without immediately requiring formal court proceedings.

9.4 Determinations and Remedies

The Privacy Act provides the Commissioner with powers to make determinations following an investigation.

Depending on the circumstances, the Commissioner may determine that an interference with privacy has occurred and may require the respondent to take specified corrective action.

Available remedies may include:

• Requiring an organisation to take steps to prevent further interference.
• Requiring correction of personal information.
• Requiring the organisation to apologise.
• Requiring other appropriate remedial action.
• Awarding compensation for loss or damage where the statutory requirements are satisfied.

The precise scope of the Commissioner’s authority depends on the relevant provisions and the circumstances of the complaint.

An important distinction is that the OAIC’s complaint and determination process is separate from proceedings under the statutory tort for serious invasions of privacy, which are brought in court.

Official guidance: Lodging a Privacy Complaint with the OAIC. OAIC+1

10. The Privacy and Other Legislation Amendment Act 2024

10.1 Background and Purpose of the Reforms

The Privacy and Other Legislation Amendment Act 2024 (Cth) introduced significant reforms to Australian privacy law.

The legislation received Royal Assent on 10 December 2024 and commenced through a staged implementation process.

It progressed a number of proposals arising from the government’s review of the Privacy Act and responded to concerns about the increasing volume and complexity of personal information processing.

The reforms address several important areas:

• Stronger enforcement and regulatory powers.
• A statutory tort for serious invasions of privacy.
• Greater transparency concerning automated decision-making.
• Development of a Children’s Online Privacy Code.
• Additional protections concerning personal information.
• Changes to the regulatory framework governing digital privacy.

Not all provisions commenced simultaneously. Consequently, it is important to distinguish between reforms already in force and provisions scheduled to commence later.

10.2 Stronger Regulatory Enforcement

The 2024 reforms strengthened the OAIC’s enforcement framework.

The Commissioner received additional regulatory mechanisms intended to improve compliance and facilitate responses to privacy breaches.

The framework includes enhanced powers relating to investigations, compliance notices, and enforcement action.

These measures reflect the recognition that privacy violations can affect large numbers of individuals and may involve complex organisational structures.

A regulatory system relying exclusively on voluntary compliance and individual complaints may be insufficient where the relevant conduct is widespread or repeated.

The reforms therefore strengthen the ability of the Commissioner to respond to serious or systematic non-compliance.

10.3 Statutory Tort for Serious Invasions of Privacy

One of the most significant changes introduced by the 2024 legislation was the creation of a statutory tort for serious invasions of privacy.

The relevant provisions commenced on 10 June 2025.

Before this reform, individuals seeking compensation for privacy-related harm generally had to rely on other legal causes of action, depending on the circumstances. These could include breach of confidence, defamation, negligence, or other recognised legal claims.

The new statutory tort establishes a distinct civil cause of action.

An individual may bring proceedings against another person or organisation where the legal requirements are satisfied.

The tort addresses two principal forms of conduct:

1. Intrusion upon the individual’s seclusion.
2. Misuse of information relating to the individual.

However, not every privacy intrusion or disclosure automatically creates liability.

The claimant must establish the statutory elements, including:

• A reasonable expectation of privacy in all the circumstances.
• An intentional or reckless invasion of privacy.
• A sufficiently serious invasion.
• That the public interest in protecting the claimant’s privacy outweighs any countervailing public interest.

The legislation also provides defences and exemptions.

For example, consent and lawful authority may be relevant, while particular exemptions apply to specified institutional and professional activities, including certain journalistic circumstances.

10.4 Remedies Under the Statutory Tort

Where a claim is established, the court may grant remedies appropriate to the circumstances.

These may include:

• Compensatory damages.
• Damages for emotional distress.
• Exemplary damages where legally available.
• Injunctions.
• Orders requiring an apology.
• Other appropriate relief.

The statutory tort also establishes specific limitation periods.

Generally, proceedings must be commenced by the earlier of:

• One year after the plaintiff became aware of the invasion of privacy.
• Three years after the invasion occurred.

Special provisions apply to individuals who were under 18 when the alleged invasion occurred.

The statutory tort is important because it provides a direct judicial mechanism for addressing certain serious privacy violations, rather than relying exclusively on administrative complaints to the OAIC.

The OAIC does not directly administer this tort. Proceedings are brought before a court, and individuals considering such proceedings must assess the statutory requirements and available defences.

10.5 Automated Decision-Making and Transparency

The 2024 reforms also introduced additional transparency obligations concerning automated decision-making.

This development is particularly important because organisations increasingly use computer programs and algorithmic systems to make or substantially inform decisions affecting individuals.

Examples may include:

• Automated credit assessments.
• Eligibility determinations.
• Insurance assessments.
• Recruitment screening.
• Fraud detection.
• Automated risk assessments.
• Decisions concerning access to services.

The new APP 1.7–1.9 obligations require covered APP entities to include specified information in their privacy policies where they use computer programs in relevant decision-making processes.

The obligation applies where:

1. The entity has arranged for a computer program to make a decision or perform an activity substantially and directly related to making a decision.
2. The decision could reasonably be expected to significantly affect an individual’s rights or interests.
3. Personal information about the individual is used in the operation of the computer program.

The relevant provisions are scheduled to commence on 10 December 2026.

As of November 2026, this is an upcoming compliance obligation rather than an obligation that has already commenced.

The required privacy policy information concerns the kinds of personal information used and the kinds of decisions made through the relevant computer programs.

The reform is particularly significant for organisations using artificial intelligence and other automated systems in decisions that may affect employment, financial services, access to benefits, or other important interests.

However, the transparency obligation should not be confused with a general statutory right to receive a full explanation of every algorithmic decision or a universal right to human review.

Its scope is defined by the relevant APP provisions and should be distinguished from broader proposals for AI regulation.

10.6 Children’s Online Privacy

The 2024 reforms provide for the development of a Children’s Online Privacy Code.

The proposed code is intended to establish additional privacy protections for children using digital services.

This is particularly relevant to online platforms, social media services, digital applications, and other services that process children’s personal information.

The development of specialised rules reflects the recognition that children may have limited capacity to understand complex privacy notices, targeted advertising, behavioural profiling, and other forms of digital information processing.

The code is intended to address the particular risks associated with children’s online privacy and strengthen the standards expected of relevant service providers.

Its implementation must be understood within the staged commencement and regulatory development of the 2024 reforms.

10.7 Significance of the 2024 Reforms

The reforms represent a substantial development in Australian privacy law.

They strengthen the legal framework in three particularly important ways.

First, they expand the range of regulatory mechanisms available to the OAIC.

Second, they provide individuals with a new civil cause of action for serious invasions of privacy.

Third, they recognise the importance of transparency where automated systems use personal information to make significant decisions.

The reforms also illustrate how privacy law is adapting to technological developments that were not central to the original legislative framework of 1988.

Primary source: Privacy and Other Legislation Amendment Act 2024 (Cth). Additional guidance: OAIC – Statutory Tort for Serious Invasions of Privacy. legislation.gov.au+3

11. Privacy and Freedom of Information at State and Territory Level

11.1 The Federal Structure of Australian Information Law

Australia does not operate under a single comprehensive freedom of information and privacy statute applicable to every government institution.

The Commonwealth Privacy Act primarily regulates Commonwealth agencies and covered private-sector organisations. It does not generally regulate State and Territory government agencies in their public-sector capacity.

Similarly, the Commonwealth FOI Act applies principally to Australian Government ministers and agencies within its scope.

Each State and Territory has its own legislative arrangements governing access to government information.

This structure reflects the federal distribution of governmental authority and the existence of separate administrative institutions at Commonwealth and State levels.

As a result, an individual seeking access to information must identify which government institution holds the relevant documents and determine which legislation governs that institution.

11.2 New South Wales

New South Wales operates a statutory framework for information access and privacy.

The principal legislation includes:

• Government Information (Public Access) Act 2009 (NSW).
• Privacy and Personal Information Protection Act 1998 (NSW).
• Health Records and Information Privacy Act 2002 (NSW).

The Government Information (Public Access) Act is commonly referred to as the GIPA Act.

It establishes a system for accessing government information through proactive release, informal release, and formal access applications.

The legislation recognises that information held by government agencies should generally be accessible unless there is an overriding public interest against disclosure.

The NSW privacy framework regulates personal information handled by public-sector agencies and establishes specific protections for health information.

The NSW Information and Privacy Commission oversees important aspects of the framework.

11.3 Victoria

Victoria operates its own information access and privacy legislation.

The principal statutes include:

• Freedom of Information Act 1982 (Vic).
• Privacy and Data Protection Act 2014 (Vic).
• Health Records Act 2001 (Vic).

The Victorian FOI Act provides access rights concerning documents held by Victorian public-sector bodies.

The Privacy and Data Protection Act regulates personal information handled by Victorian public-sector organisations, while the Health Records Act establishes additional requirements for health information.

The Office of the Victorian Information Commissioner (OVIC) performs important regulatory and oversight functions.

11.4 Queensland

Queensland has developed a legislative framework combining information access and privacy regulation.

Important legislation includes:

• Right to Information Act 2009 (Qld).
• Information Privacy Act 2009 (Qld).

The Right to Information Act promotes proactive publication and access to government information.

The Information Privacy Act regulates the handling of personal information by Queensland public-sector agencies and establishes the relevant information privacy principles.

Queensland’s privacy framework underwent further legislative development in 2026, including changes to its Information Privacy Act framework. The applicable commencement and transitional provisions must therefore be considered when assessing particular rights or obligations.

The Office of the Information Commissioner Queensland performs important functions relating to information access and privacy oversight.

11.5 Western Australia

Western Australia has historically operated its own FOI legislation through the Freedom of Information Act 1992 (WA).

Its privacy framework underwent an important change in 2026 with the commencement of the Privacy and Responsible Information Sharing Act 2024 (WA) on 1 July 2026.

This legislation establishes a framework for the handling and sharing of personal information by covered Western Australian public entities.

The reform is particularly significant because Western Australia previously lacked a comprehensive general privacy statute equivalent to those operating in several other Australian jurisdictions.

The Office of the Information Commissioner Western Australia performs relevant oversight functions under the State framework.

11.6 South Australia

South Australia operates the Freedom of Information Act 1991 (SA).

This legislation establishes rights of access to documents held by South Australian government agencies, subject to statutory exemptions.

South Australia’s general public-sector privacy arrangements have historically relied on administrative information privacy principles and related legal instruments rather than a comprehensive privacy statute equivalent to the Commonwealth Privacy Act.

Specific privacy requirements may nevertheless arise under other legislation and sector-specific regulatory arrangements.

11.7 Tasmania

Tasmania operates the Right to Information Act 2009 (Tas), which provides access to information held by government bodies.

The State also has the Personal Information Protection Act 2004 (Tas), which regulates the handling of personal information by covered public-sector organisations.

The Tasmanian Ombudsman performs important oversight functions in relation to information access and privacy complaints.

11.8 Australian Capital Territory

The Australian Capital Territory operates a specific framework through:

• Freedom of Information Act 2016 (ACT).
• Information Privacy Act 2014 (ACT).

The FOI legislation provides access to government information, while the Information Privacy Act establishes principles governing the handling of personal information by ACT public-sector agencies.

The ACT Privacy Commissioner and the relevant human rights institutions perform oversight functions.

11.9 Northern Territory

The Northern Territory operates the Information Act 2002 (NT).

The legislation contains provisions governing access to government information and the handling of personal information.

It also establishes an institutional framework for the supervision of information access and privacy obligations.

The Office of the Information Commissioner Northern Territory performs relevant oversight functions.

11.10 Comparison of State and Territory Frameworks

Jurisdiction	Principal information access legislation	Principal privacy legislation
Commonwealth	Freedom of Information Act 1982	Privacy Act 1988
New South Wales	Government Information (Public Access) Act 2009	Privacy and Personal Information Protection Act 1998; Health Records and Information Privacy Act 2002
Victoria	Freedom of Information Act 1982	Privacy and Data Protection Act 2014; Health Records Act 2001
Queensland	Right to Information Act 2009	Information Privacy Act 2009
Western Australia	Freedom of Information Act 1992	Privacy and Responsible Information Sharing Act 2024
South Australia	Freedom of Information Act 1991	Administrative and sector-specific privacy arrangements
Tasmania	Right to Information Act 2009	Personal Information Protection Act 2004
ACT	Freedom of Information Act 2016	Information Privacy Act 2014
Northern Territory	Information Act 2002	Information Act 2002

The existence of different legislative frameworks means that the precise legal position may depend on the geographical location of the public authority, the nature of the information, and the identity of the organisation handling it.

The Commonwealth Privacy Act may also apply to certain private-sector health service providers operating across Australia, even where State public-sector health services are governed by different legislation.

For this reason, national businesses and organisations dealing with several public authorities should not assume that compliance with one privacy statute automatically satisfies all applicable legal obligations.

Official comparative resource: OAIC – State and Territory Privacy Legislation. OAIC+3

12. Cross-Border Data Transfers and International Privacy Considerations

12.1 International Data Flows

Modern Australian businesses frequently process personal information through international service providers.

Cloud computing, international payment systems, global customer databases, online advertising platforms, and outsourced information-processing services may involve the transfer of personal information outside Australia.

These arrangements create legal questions concerning the protection of personal information once it is handled by an overseas recipient.

The Privacy Act addresses these issues principally through APP 8 and section 16C.

12.2 APP 8 and Overseas Recipients

APP 8 generally requires an APP entity to take reasonable steps to ensure that an overseas recipient does not breach the APPs in relation to personal information disclosed to that recipient.

This obligation recognises that transferring information abroad does not necessarily eliminate the Australian organisation’s responsibility.

Section 16C may make the Australian entity accountable for certain acts or practices of the overseas recipient.

However, the Act recognises exceptions to this general approach.

These may apply where:

• The individual consents after being informed of the relevant consequences.
• The recipient is subject to a legally recognised privacy framework.
• Another statutory exception applies.
• The disclosure occurs under circumstances recognised by the Privacy Act.

The precise legal treatment depends on the nature of the transfer and the applicable statutory provisions.

12.3 International Privacy Standards

Australian privacy law operates within a broader international environment.

Important international reference points include:

• The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.
• The Council of Europe Convention 108 and its modernised framework.
• The European Union General Data Protection Regulation (GDPR).
• International human rights principles concerning privacy.

These instruments and frameworks influence international discussions about data protection and cross-border information transfers.

However, they do not automatically become Australian domestic law merely because they are internationally recognised.

For example, the GDPR may apply to an Australian business where the business falls within its territorial scope, including certain circumstances involving offering goods or services to individuals in the European Union or monitoring their behaviour there.

An Australian organisation may therefore need to comply with both Australian privacy law and the GDPR where the relevant jurisdictional requirements are met.

12.4 Data Processing Contracts and Overseas Service Providers

Organisations using overseas service providers should consider the contractual and operational arrangements governing personal information.

Relevant issues include:

• The location of data storage.
• The identity of entities accessing the information.
• Permitted purposes of processing.
• Security measures.
• Restrictions on onward disclosure.
• Breach notification arrangements.
• Data retention and deletion.
• Audit and compliance rights.

These considerations are especially important where an organisation uses cloud infrastructure, international software platforms, external payroll providers, or outsourced customer-support systems.

A contractual statement that a service provider will protect information does not automatically establish compliance with every Australian statutory obligation.

Organisations must also consider whether their actual practices satisfy the applicable legal requirements.

13. Privacy, Artificial Intelligence, and Emerging Technologies

13.1 Artificial Intelligence and Personal Information

Artificial intelligence systems increasingly process personal information in ways that create new privacy and data protection challenges.

AI systems may collect, analyse, infer, classify, and generate information concerning individuals.

For example, a business may use automated systems to assess customer behaviour, identify potential fraud, evaluate creditworthiness, screen employment applicants, or personalise services.

These activities may involve personal information even where the system does not directly display an individual’s name.

Under the Privacy Act, the relevant question is whether the information relates to an identified or reasonably identifiable individual and whether the organisation’s activities fall within the applicable statutory framework.

The use of AI does not automatically create an exemption from privacy obligations.

Organisations using AI must consider the relevant APP requirements, particularly those concerning collection, transparency, purpose limitation, security, and disclosure.

13.2 Automated Profiling

Automated profiling involves analysing information to make predictions or assessments about individuals.

Examples include predicting:

• Consumer preferences.
• Financial behaviour.
• Employment suitability.
• Insurance risks.
• Fraud probability.
• Access to particular services.

Such processing may create privacy risks where individuals are assessed through incomplete, inaccurate, or outdated information.

It may also create risks where an automated system uses sensitive personal information or produces outcomes that significantly affect an individual’s interests.

The Australian Privacy Principles provide a general framework for regulating the underlying collection and use of personal information.

The additional transparency obligations commencing in December 2026 will strengthen the disclosure requirements applicable to certain significant automated decisions.

13.3 Biometric Information and Facial Recognition

Biometric technology is increasingly used in identity verification, access control, security, and commercial services.

Examples include:

• Facial recognition.
• Fingerprint identification.
• Voice recognition.
• Iris scanning.
• Biometric authentication.

Biometric information may constitute sensitive information under the Privacy Act where it satisfies the relevant statutory definition.

Organisations using biometric technology must therefore consider the additional requirements governing the collection and handling of sensitive information.

The legal assessment should also consider whether the collection is reasonably necessary, whether consent is required, how information is secured, and whether it is disclosed to other entities.

13.4 Data Minimisation and Responsible Information Management

Data minimisation is an important principle of responsible information governance.

It involves limiting the collection and retention of personal information to what is reasonably necessary for legitimate purposes.

Although Australian privacy law does not use a single universal data-minimisation rule identical to that found in some overseas frameworks, several APP requirements support this approach.

APP 3 restricts the collection of personal information to what is reasonably necessary for an organisation’s functions or activities.

APP 11 requires reasonable steps to destroy or de-identify information that is no longer needed, subject to applicable exceptions.

Together, these provisions discourage unnecessary accumulation of personal information.

13.5 Privacy Impact Assessments

Privacy impact assessments (PIAs) are processes through which organisations identify and evaluate privacy risks associated with proposed projects, systems, or information-handling activities.

They may be particularly useful when an organisation introduces:

• A new digital service.
• A large personal information database.
• Facial recognition technology.
• Automated decision-making systems.
• International data-processing arrangements.
• New methods of collecting sensitive information.

The Privacy Act and OAIC guidance support privacy risk assessment as an important part of responsible information governance.

In some circumstances, the Commissioner also has statutory powers to direct an entity to undertake a privacy impact assessment.

A PIA can help identify potential legal issues before a system becomes operational and allow organisations to implement appropriate safeguards.

14. The Relationship Between Privacy Law, Freedom of Information, and Administrative Law

14.1 Information Rights and Administrative Accountability

Freedom of information and privacy law form part of the broader Australian administrative law framework.

Government agencies collect and hold substantial quantities of personal and non-personal information when exercising statutory functions.

Their decisions may affect individuals’ immigration status, financial entitlements, healthcare, employment, education, property interests, and access to public services.

FOI rights can help individuals understand the material held by government and examine the reasoning underlying administrative decisions.

Privacy law, meanwhile, regulates how the information used in those processes is collected and managed.

The two systems therefore contribute to administrative accountability from different perspectives.

14.2 Access to Personal Government Records

An individual may seek access to personal information held by a Commonwealth agency.

Depending on the circumstances, access may be available through:

• The agency’s ordinary administrative access procedures.
• A formal FOI request.
• A statutory access mechanism under another law.

The FOI Act expressly recognises access to documents containing information about the applicant, while the Privacy Act establishes relevant privacy protections and individual rights.

An individual seeking correction of a government record should also consider the relevant statutory amendment and annotation mechanisms.

It is important to identify the correct legal procedure because access rights and correction rights are not necessarily exercised through the same process.

14.3 Administrative Decisions and Reasons

Access to government documents may assist an individual in understanding an administrative decision.

For example, an individual affected by a government decision may wish to obtain:

• Internal assessment records.
• Relevant correspondence.
• Reports considered by the decision-maker.
• Administrative guidelines.
• Records of procedural steps.

However, the FOI Act does not replace statutory review rights or automatically extend the time available to challenge an administrative decision.

Where a decision is subject to internal review, merits review, or judicial review, the applicable deadlines and procedural requirements must be considered independently.

14.4 Privacy and Procedural Fairness

Privacy protection and procedural fairness may also interact.

Administrative decision-makers sometimes need to disclose relevant information to affected individuals so that they can respond to adverse material.

At the same time, they must consider whether the information contains protected personal information belonging to other people.

The legal framework therefore requires a balance between fair decision-making and the protection of confidential or sensitive information.

The precise requirements depend on the relevant statute, the nature of the decision, and the circumstances of the case.

15. Enforcement, Civil Liability, and Legal Remedies

15.1 Regulatory Enforcement Under the Privacy Act

The OAIC may exercise its regulatory powers where an organisation or government agency fails to comply with applicable privacy requirements.

Depending on the circumstances, the Commissioner may use:

• Investigations.
• Formal determinations.
• Enforceable undertakings.
• Compliance notices.
• Civil penalty proceedings.
• Other statutory enforcement mechanisms.

The availability of a particular measure depends on the nature and seriousness of the conduct and the relevant statutory requirements.

15.2 Civil Penalties

The Privacy Act provides civil penalty mechanisms for specified forms of non-compliance.

These include serious or repeated interferences with privacy and other conduct identified in the legislation.

The purpose of civil penalties is not limited to compensating affected individuals. They also serve regulatory and deterrent functions.

The statutory framework was strengthened through the 2024 reforms, which expanded the Commissioner’s enforcement toolkit.

15.3 Compensation and Individual Redress

Individuals affected by privacy violations may have access to different forms of legal redress depending on the circumstances.

These may include:

• A complaint to the OAIC.
• A determination under the Privacy Act.
• Compensation under an applicable statutory mechanism.
• Proceedings under the statutory tort for serious invasions of privacy.
• Other civil causes of action where their legal elements are satisfied.

It is important to distinguish between a regulatory breach and a private civil cause of action.

A finding that an organisation has failed to comply with a privacy obligation does not automatically mean that every affected individual has an independent right to damages.

The legal basis for compensation must be established under the applicable legislation or recognised cause of action.

15.4 Judicial Review of Regulatory Decisions

Decisions made by the OAIC may be subject to judicial review where the relevant legal requirements are satisfied.

Judicial review examines the legality of administrative action rather than simply reconsidering whether the decision was the most appropriate outcome.

A court may examine matters such as:

• Whether the Commissioner acted within statutory authority.
• Whether relevant legal requirements were observed.
• Whether procedural fairness was provided.
• Whether the decision involved a legally reviewable error.

The availability and form of review depend on the statutory framework and the nature of the decision.

This mechanism reinforces the principle that privacy regulators themselves remain subject to law.

16. Practical Compliance Responsibilities for Businesses and Government Agencies

16.1 Establishing a Privacy Governance Framework

Organisations subject to the Privacy Act should maintain a structured approach to privacy compliance.

This begins with identifying the personal information they collect and understanding the purposes for which it is processed.

A privacy governance framework should establish clear responsibilities for employees, managers, contractors, and service providers.

It should also provide procedures for dealing with privacy complaints, access requests, correction requests, and data breaches.

16.2 Maintaining an Appropriate Privacy Policy

APP entities must maintain an up-to-date privacy policy that explains their personal information practices.

A properly prepared policy should address:

• Categories of information collected.
• Collection methods.
• Purposes of processing.
• Disclosure practices.
• Overseas recipients.
• Data security arrangements.
• Access and correction procedures.
• Complaint mechanisms.
• Relevant automated decision-making practices, where the new transparency obligations apply.

The policy should reflect actual organisational practices rather than simply reproducing generic legal language.

16.3 Managing Third-Party Service Providers

Businesses often rely on external providers for information processing.

These may include cloud hosting companies, payroll providers, customer relationship management platforms, marketing services, analytics providers, and outsourced technical support.

Organisations should assess whether these providers have appropriate information security measures and whether the arrangements satisfy the requirements governing disclosure and overseas transfers.

Contracts should address permitted use, security, confidentiality, breach notification, retention, deletion, and access arrangements.

16.4 Responding to Access and Correction Requests

Organisations should maintain procedures for handling requests under APP 12 and APP 13.

Employees responsible for privacy compliance should be able to:

1. Identify the individual making the request.
2. Locate the relevant personal information.
3. Verify the scope of the request.
4. Assess whether a statutory exception applies.
5. Provide access or explain a lawful refusal.
6. Correct information where required.
7. Maintain appropriate records of the response.

These procedures should be documented and consistently applied.

16.5 Preparing for Data Breaches

An effective data breach response plan should identify who is responsible for managing an incident and establish procedures for containment, assessment, notification, and remediation.

Organisations should also train employees to recognise potential breaches and report incidents promptly.

Delayed internal reporting can make it more difficult to complete the statutory assessment within the required period.

The NDB scheme makes preparedness particularly important for organisations handling large quantities of personal or sensitive information.

16.6 Freedom of Information Compliance for Public Authorities

Commonwealth agencies must also maintain appropriate procedures for processing FOI requests.

These should include:

• Identifying documents within the agency’s control.
• Recording applications and statutory deadlines.
• Consulting relevant third parties where required.
• Assessing exemptions and conditional exemptions.
• Applying the public-interest test.
• Preparing edited documents where appropriate.
• Communicating decisions and review rights.
• Maintaining records of disclosure decisions.

Good FOI administration supports public confidence and reduces the risk of unlawful refusals or procedural disputes.

16.7 Preparing for Automated Decision-Making Transparency

Organisations using automated decision-making systems should review their practices before the December 2026 commencement date.

They should identify whether:

• A computer program makes or substantially informs decisions.
• The decisions may significantly affect individuals’ rights or interests.
• Personal information is used in the relevant process.
• The organisation must provide additional information in its privacy policy under APP 1.7–1.9.

This review is particularly important for financial institutions, insurers, digital platforms, recruitment businesses, and organisations using automated eligibility or risk assessment systems.

The objective is to ensure that privacy documentation accurately reflects the use of personal information in significant automated decisions.

Key Takeaways

1. Freedom of information: The Freedom of Information Act 1982 (Cth) establishes a legally enforceable right to access documents held by Commonwealth government agencies and ministers, subject to statutory exemptions.

2. Democratic transparency: FOI legislation promotes government accountability, public participation, scrutiny of administrative decisions, and access to information about public expenditure.

3. Privacy legislation: The Privacy Act 1988 (Cth) is the principal Commonwealth statute governing the collection, use, disclosure, storage, and protection of personal information.

4. Personal information: The statutory definition includes information or opinions about identified or reasonably identifiable individuals, whether true or false and whether recorded or unrecorded.

5. Sensitive information: Health information, biometric information, political opinions, religious beliefs, and other specified categories receive additional statutory protection.

6. Australian Privacy Principles: The 13 APPs establish requirements governing collection, transparency, use, disclosure, security, access, correction, and cross-border transfers.

7. Data security: APP 11 requires organisations to take reasonable steps to protect personal information against misuse, interference, loss, and unauthorised access or disclosure.

8. Data breaches: The Notifiable Data Breaches scheme requires notification of eligible breaches likely to result in serious harm to affected individuals.

9. Regulatory oversight: The OAIC is the principal Commonwealth regulator responsible for privacy protection and freedom of information oversight.

10. Individual remedies: Individuals may complain about privacy interference and, where the relevant legal requirements are satisfied, seek regulatory or judicial remedies.

11. 2024 privacy reforms: The Privacy and Other Legislation Amendment Act 2024 strengthened regulatory enforcement and introduced a statutory tort for serious invasions of privacy.

12. Statutory tort: Since 10 June 2025, individuals have had an additional civil cause of action for qualifying serious invasions of privacy.

13. Automated decision-making: New privacy policy transparency obligations concerning certain significant automated decisions commence on 10 December 2026.

14. State and Territory legislation: Each Australian State and Territory maintains its own information access and privacy framework, creating a system of overlapping legal obligations.

15. International data transfers: APP 8 regulates disclosures of personal information to overseas recipients and may preserve the accountability of Australian entities.

16. Emerging technology: Artificial intelligence, facial recognition, automated profiling, and cloud computing create new privacy challenges requiring organisations to examine their information-handling practices.

Frequently Asked Questions (FAQs)

1. What is freedom of information in Australia?

Freedom of information is a statutory right allowing individuals to request access to documents held by government institutions. At the Commonwealth level, this right is principally established by the Freedom of Information Act 1982 (Cth). The legislation promotes government transparency and accountability while protecting information covered by statutory exemptions.

2. Can foreigners request government documents under Australia’s FOI Act?

Yes. The Commonwealth FOI Act generally allows any person to request access to documents, regardless of nationality or residence. Applicants do not normally need to demonstrate Australian citizenship or explain why they want the information.

3. What information can be requested under the Commonwealth FOI Act?

Individuals may request documents held by covered government agencies and official documents of ministers. These may include reports, correspondence, administrative records, policy documents, statistical information, and other existing records. Access remains subject to statutory exemptions.

4. Can the Australian government refuse an FOI request?

Yes. The legislation contains exemptions protecting certain information, including national security material, Cabinet documents, confidential information, legally privileged communications, certain commercial information, and personal information whose disclosure would be unreasonable.

Some exemptions are conditional and require an assessment of whether disclosure would, on balance, be contrary to the public interest.

5. How long does an Australian government agency have to respond to an FOI request?

The general statutory decision period is 30 days, although extensions and other adjustments may apply under the legislation. If the agency does not make a decision within the applicable period, the Act provides for a deemed refusal in specified circumstances.

6. What is the difference between freedom of information and privacy law?

Freedom of information concerns access to documents held by government institutions. Privacy law regulates the collection, use, disclosure, storage, and protection of personal information.

The two areas may overlap when government documents contain personal information. In such circumstances, the applicable legislation requires a balance between transparency and individual privacy.

7. What is the Privacy Act 1988?

The Privacy Act 1988 (Cth) is the principal Commonwealth legislation regulating personal information. It applies to Australian Government agencies and many private-sector organisations, establishing statutory obligations concerning the handling and protection of personal information.

8. What are the Australian Privacy Principles?

The Australian Privacy Principles are 13 statutory principles contained in Schedule 1 of the Privacy Act. They regulate personal information management, including collection, transparency, use, disclosure, security, access, correction, and international transfers.

9. What is considered sensitive information in Australia?

Sensitive information includes specified categories such as racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, health information, genetic information, and certain biometric information.

The Privacy Act establishes additional requirements for collecting and handling these categories of information.

10. Can individuals access their personal information held by Australian organisations?

Yes. APP 12 generally provides individuals with a right to request access to personal information held about them by an APP entity, subject to statutory exceptions.

The organisation must respond in accordance with the applicable legal requirements and may refuse access only where a recognised exception applies.

11. Can individuals demand correction of inaccurate personal information?

Yes. APP 13 requires covered organisations to take reasonable steps to correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

Where a correction request is refused, the organisation must comply with the applicable requirements for explaining its decision and available complaint procedures.

12. What is the Notifiable Data Breaches scheme?

The Notifiable Data Breaches scheme is part of the Privacy Act 1988. It requires covered organisations and agencies to notify the OAIC and affected individuals when an eligible data breach is likely to result in serious harm.

The scheme promotes transparency and enables individuals to take protective action following serious information security incidents.

13. Which organisation regulates privacy and freedom of information at the Commonwealth level?

The Office of the Australian Information Commissioner (OAIC) is the principal independent Commonwealth regulator. It oversees privacy compliance, investigates complaints, reviews certain FOI decisions, and promotes responsible information management.

14. Can an individual receive compensation for a privacy violation in Australia?

Potentially, yes. Depending on the circumstances, individuals may obtain remedies through an OAIC determination or bring proceedings under an applicable civil cause of action.

Since 10 June 2025, the statutory tort for serious invasions of privacy has provided an additional route to judicial remedies, subject to its specific legal requirements.

15. What is the statutory tort for serious invasions of privacy?

It is a civil cause of action introduced by the Privacy and Other Legislation Amendment Act 2024. It covers qualifying intentional or reckless invasions of privacy involving intrusion upon seclusion or misuse of information.

The claimant must establish the statutory elements, including a reasonable expectation of privacy, sufficient seriousness, and that the public interest in protecting privacy outweighs any countervailing public interest.

16. Does Australian privacy law regulate artificial intelligence?

The Privacy Act applies to the handling of personal information by covered entities, including where that information is processed through artificial intelligence systems.

The APPs regulate relevant collection, use, disclosure, security, and other information-handling activities.

Additional transparency requirements concerning certain significant automated decisions commence on 10 December 2026.

17. Does Australia have one privacy law for the entire country?

No. The Commonwealth Privacy Act regulates federal agencies and many private-sector organisations, while State and Territory governments operate separate privacy frameworks for their public sectors.

Consequently, the legal requirements depend on the organisation, the information involved, and the relevant jurisdiction.

18. Does the Australian Privacy Act apply to businesses with overseas customers?

The Privacy Act may apply to foreign organisations and overseas activities where the statutory territorial and organisational requirements are satisfied.

Additionally, Australian organisations disclosing personal information to overseas recipients must consider APP 8 and the associated accountability requirements.

19. Can an Australian organisation store personal information overseas?

Yes, provided the relevant legal requirements are satisfied. APP 8 regulates certain disclosures to overseas recipients, while section 16C may preserve the Australian entity’s accountability for the overseas recipient’s conduct.

Organisations should assess their international processing arrangements, contractual safeguards, and applicable privacy obligations.

20. What is the difference between Australian privacy law and the GDPR?

The Australian Privacy Act and the European Union’s General Data Protection Regulation are separate legal frameworks.

Both regulate personal information, but they differ in scope, terminology, legal requirements, enforcement mechanisms, and individual rights.

The GDPR may also apply to Australian organisations where its territorial requirements are met. A business operating internationally may therefore need to comply with both regimes.

Conclusion

Freedom of information, privacy, and data protection are fundamental components of Australia’s modern legal system. Together, they establish the framework through which government transparency, individual privacy, administrative accountability, and responsible information management are maintained.

The Commonwealth FOI regime recognises that access to government information is an important democratic safeguard. By allowing individuals and organisations to examine official documents, it supports public scrutiny, informed participation, and accountability in government administration. At the same time, statutory exemptions protect legitimate interests involving national security, confidentiality, commercial information, legal privilege, and personal privacy.

The Privacy Act 1988 complements this framework by establishing legal obligations governing the handling of personal information. Its 13 Australian Privacy Principles regulate the collection, use, disclosure, security, access, and correction of personal information, creating responsibilities for both public authorities and covered private-sector organisations.

The development of Australian privacy law also demonstrates the increasing importance of protecting individuals in a digital economy. The 2024 legislative reforms, the introduction of a statutory tort for serious invasions of privacy, and the forthcoming transparency requirements concerning automated decision-making illustrate the continuing evolution of the legal framework.

Nevertheless, the Australian system remains characterised by a combination of Commonwealth and State legislation. Organisations and individuals must therefore identify the relevant jurisdiction and statutory regime before assessing particular information rights or obligations.

Ultimately, freedom of information and privacy protection should not be understood as opposing objectives. A well-functioning legal system must allow the public to examine the exercise of governmental power while ensuring that individuals retain meaningful protection against inappropriate interference with their personal information.

The Australian framework seeks to achieve this balance through enforceable access rights, statutory privacy principles, regulatory supervision, judicial remedies, and continuing legislative reform. These mechanisms are increasingly important as government institutions, businesses, and individuals become more dependent on digital information systems.

Further Reading and Primary Legal Sources

The following legislation, official regulatory materials, and institutional resources provide authoritative foundations for further research.

A. Commonwealth legislation

1. Freedom of Information Act 1982 (Cth) – Commonwealth access-to-information framework.
2. Privacy Act 1988 (Cth) – Principal Commonwealth privacy legislation.
3. Privacy and Other Legislation Amendment Act 2024 (Cth) – Recent privacy reforms.
4. Federal Register of Legislation – Official database of Commonwealth legislation.

B. Regulatory authorities and guidance

5. Office of the Australian Information Commissioner – Commonwealth privacy and FOI regulator.
6. Freedom of Information – OAIC – Access rights, statutory exemptions, and administrative guidance.
7. Australian Privacy Principles – Guidance on the 13 APPs.
8. Notifiable Data Breaches Scheme – Data breach assessment and notification requirements.
9. State and Territory Privacy Legislation – Comparative overview of Australian privacy regimes.
10. Statutory Tort for Serious Invasions of Privacy – Explanation of the 2025 reform.

C. Additional legislation and international standards

11. Freedom of Information (Charges) Regulations 2019 (Cth).
12. Spam Act 2003 (Cth).
13. Government Information (Public Access) Act 2009 (NSW).
14. Right to Information Act 2009 (Qld).
15. Privacy and Responsible Information Sharing Act 2024 (WA).
16. Privacy and Personal Information Protection Act 1998 (NSW).
17. Privacy and Data Protection Act 2014 (Vic).
18. Regulation (EU) 2016/679 – General Data Protection Regulation.
19. OECD, Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.

This article provides general legal and educational information about Australian freedom of information, privacy, and data protection law. It is not individual legal advice.