Australia: Privacy Protection

A Queensland tribunal has ruled that an anaesthetist who photographed patients and clinical records without consent and published them in a self-authored book committed professional misconduct. The case examines the boundaries of patient confidentiality in an era of accessible publishing platforms and social media, particularly in regional healthcare settings where contextual details can lead to patient identification.

A recent Administrative Review Tribunal decision has clarified the boundaries of facial recognition technology use in Australian retail, examining Bunnings' controversial trial system that scanned customers to identify repeat offenders.

Businesses that qualify as APP entities under the Privacy Act 1988 (Cth), generally those with annual turnover above $3 million or those handling health information or fulfilling Commonwealth contracts, must comply with the Australian Privacy Principles, including maintaining a privacy policy, issuing privacy collection notices and notifying the OAIC of eligible data breaches.

Case highlights an inherent conflict within the Privacy Act: that is, safeguarding individuals' personal information alongside the legitimate operational needs of organisations performing their functions and activities.

The reform has been presented as a privacy and safety measure aimed at reducing identity theft and cyber-enabled risks.

NCAT's administrative oversight remains a critical tool for protecting one's personal information by providing an avenue to hold public agencies accountable.

The Act introduced a new tiered civil penalty process with medium-level and low-level penalties effective from 11 December 2024.

This landmark reform marks a significant expansion of individual privacy rights.

The case sets a new enforcement standard for privacy compliance, and provides valuable insights.