Personal information is in essence any information that allows
an individual to be personally identified.
The Privacy Act 1988 (Cth) ('Privacy
Act') regulates the handling of this
'personal information' by all Commonwealth public sector
agencies; as well as private sector organisations that have an
annual turnover of more than $3 million, are health service
providers or which otherwise trade in personal information
(together, 'Organisations'). The recent
introduction of a mandatory data breach notification regime in
Australia has been on the horizon for a number of years.
The road to mandatory data breach notification
In May 2013, the Commonwealth Labor government introduced the
Privacy Amendment (Privacy Alerts) Bill 2013 ('2013
Bill') to amend the Privacy Act to introduce a
mandatory data breach notification regime. Despite the 2013 Bill
having bipartisan support, it was not passed before the 2013
federal election and lapsed as a result.
