Privacy Review 2023-2024

The last 12 months have been a big year for privacy. The Australian Government introduced the first tranche of reforms to implement a number of the recommendations from the Attorney-General’s Department’s Privacy Act Review Report, with further reforms to follow; and the Office of the Australian Information Commissioner signalled an ongoing focus on regulatory action where it identifies non-compliance.

In this guide, we summarise key incidents and developments from the last year and highlight areas to watch in coming months.

Padlock denoting data privacy

Download guide

Lander & Rogers’ Digital Economy practice has been closely following key privacy developments in Australia, including the first tranche of privacy reforms introduced by the Australian Government.

Our Privacy Review 2023-2024 summarises major developments from the year in privacy.

Timeline of key events

13 September 2023
Administrative Appeals Tribunal publishes HYYL and Privacy Commissioner [2023] AATA 2961.

28 September 2023
Australian Government releases its response to the Privacy Act Review Report.

27 November 2023
Attorney-General the Hon Mark Dreyfus KC MP announces the appointment of Carly Kind as Privacy Commissioner, reinstating the standalone position.

22 February 2024
OAIC releases its Notifiable Data Breaches Report: July to December 2023.

21 May 2024
ACCC releases its eighth interim report for the Digital Platform Services Inquiry, shining a spotlight on the supply of data products and services by data firms in Australia.

27 May 2024
ASX releases its updated guidance on data breach continuous disclosure obligations for ASX-listed companies.

12 September 2024
Privacy and Other Legislation Amendment Bill 2024 introduced into Federal Parliament.

16 September 2024
OAIC releases its Notifiable Data Breaches Report: January to June 2024.

Privacy reform update: First tranche of Privacy Act reforms revealed

On 12 September 2024, the Attorney-General introduced the highly anticipated amendments to the *Privacy Act 1988* (Cth) to the Australian Federal Parliament.

Woman's face seen amidst digital lighting
Case study: Clearview AI Inc v Australian Information Commissioner

The recent findings of a review by the Administrative Appeals Tribunal into the practices of facial recognition software service Clearview provide valuable insights into the extra-territorial application of the Privacy Act.

Person using biometric facial recognition software to access a computer.
Case study: OAIC v Facebook

Proceedings against social media giant Facebook demonstrate that the jurisdiction of the OAIC extends even to companies located predominantly outside of Australia.

Person browsing and interacting with a social media platform on their mobile phone.
Case study: Facebook subsidiaries fined $20 million for misleading customers

On 26 July 2023, the Federal Court ordered two Facebook subsidiaries to each pay a pecuniary penalty of $10 million for engaging in misleading conduct in breach of the Australian Consumer Law.

Phone displaying a VPN screen.