In a swift follow up to an
announcement on September 28, 2016 by the Commonwealth
Attorney-General, a bill has been introduced into the Senate to
amend the Privacy Act 1988 (Cth) (Privacy Act) to introduce
prohibitions on the re-identification of de-identified government
information. A copy of the Privacy Amendment (Re-Identification
Offence) Bill 2016 (Cth) (Re-identification Bill) is available
here, along with a copy of the explanatory memorandum.
The Re-identification Bill prohibits the re-identification or
attempted re-identification of de-identified information released
by, or on behalf of, Commonwealth Government agencies, as well as
prohibiting the disclosure of any such re-identified personal
information. If the Re-identification Bill is passed in its present
form, re-identification of previously de-identified government
information will be a criminal offence that can incur up to two
years in prison or a fine of A$21,600. Alternatively, the same
conduct can be the subject of a civil penalty of up to A$108,000
for individuals or up to A$540,000 for bodies corporate. The new
offences in the Re-identification Bill will operate retrospectively
from 29 September 2016 (the day after the initial
The Re-identification Bill also includes secondary obligations
for entities which re-identify previously de-identified government
information to notify the Commonwealth agency that originally
released that information, and not to otherwise disclose that
re-identified information, with civil penalties of up to A$36,000
for individuals and up to A$180,000 for body corporates applying
for a breach of these obligations.
The Re-identification Bill includes exceptions for:
a government agency acting in connection with the performance
of the agency's function or activity or as required by law or
entities providing services to Commonwealth agencies for the
purpose of meeting their contractual obligations to the agency that
originally released the de-identified information;
entities that enter into agreements with the Commonwealth
agency that originally released the de-identified information to
perform functions or activities on behalf of that agency, where the
act is done in accordance with that agreement; and
acts done in accordance with a ministerial exemption (which the
relevant section contemplates could be used to cover cryptology or
information security researchers).
What does this mean for you?
Any person or entity working with de-identified government
information now needs to take extra care to ensure that this
information is not re-identified, even inadvertently. Anyone
undertaking cryptology or information security research relating to
de-identified government data should consider whether to apply for
a ministerial exemption to permit their activity, particularly if
the de-identified personal information included in the government
data being worked on has only been encrypted or masked in a way
that could be decrypted or revealed in the course of research
Prior to the announcement of the Re-identification Bill, there
some concern that it could impair legitimate security research,
which now appears to be well-founded given the need for researchers
to specifically apply for an exemption covering their activities.
We will continue to monitor the progress of the Re-identification
Bill in this regard.
The timing of the Commonwealth Government's other major
proposed privacy reform, the introduction of a mandatary data
breach notification scheme, is still unclear at this time. As
mentioned in our previous
legal update, the bill for the introduction of such a scheme is
scheduled for introduction to and passage by the Commonwealth
Parliament by December 1, 2016. As the introduction of the
Re-Identification Bill shows, privacy reform remains high on the
Government's legislative agenda.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
For the many medium and large sized businesses that the mandatory notification affects, advance preparation will be key.
Some comments from our readers… “The articles are extremely timely and highly applicable” “I often find critical information not available elsewhere” “As in-house counsel, Mondaq’s service is of great value”
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).