The main Australian statute dealing with privacy is the Privacy Act 1988 (Cth). While the Privacy Act applies to most Australian federal government agencies and most private organisations, it does not provide comprehensive privacy protection for Australians. The Privacy Act does not apply to a number of groups, including small businesses with an annual turnover of less than $3 million, political organisations, media organisations, and individual citizens acting in their personal, family or household affairs. For those bodies falling within the scope of the Privacy Act, they must abide by the 13 'Australian Privacy Principles' established by the Privacy Act.
The Telecommunications Act 1997 (Cth) ("Telco Act") also contains some data protection provisions. These provisions stipulate the way carriers, carriage service providers and other bodies must use and disclose personal information obtained during the supply of telecommunication services. It is an offence under the Telco Act for participants in the telecommunications industry – namely, carriers, carriage service providers, telecommunications contractors and their employees, and emergency call persons – to use or disclose certain information relating to communication carried by a carrier or carriage service provider, including the personal particulars of another person. Furthermore, the Telco Act requires carriers and carriage service providers to record certain disclosures of personal information.
The Privacy Act and Telco Act create a framework for the transparent collection, use and storage of personal information. Under this statutory regime, collectors of your personal information are supposed to notify you about particular matters, including what information is being collected, how it is collected, and how it will be used and disclosed. In theory, a person who wants to control the collection and use of their personal information could consult the relevant public disclosures made by each respective service provider and elect to use their preferred provider. In reality, however, people have limited options in terms of service providers and even less choice in negotiating the privacy terms of engagement with those providers. Consequently, consumers have little control over the collection and use of their personal information, except in circumstances where that personal information constitutes 'sensitive information' pursuant to the Privacy Act.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
