Senate

Regulatory Powers (Standardisation Reform) Bill 2016 (Extract Only)

Explanatory Memorandum

(Circulated by authority of the Attorney-General, Senator the Honourable George Brandis QC)

Schedule 13 - Privacy Act 1988

General Outline

1519. The Privacy Act 1988 regulates the handling of personal information about individuals. This includes the collection, use, storage and disclosure of personal information, and access to and correction of that information. Article 17 of the International Covenant on Civil and Political Rights (the 'ICCPR') provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence. Australia gives effect to Article 17 of the ICCPR through the Privacy Act, which gives individuals rights in relation to how organisations and agencies handle personal information, both online and offline.

1520. Current Part VIB of the Privacy Act establishes a framework that allows civil penalty orders to be sought from a court in relation to contraventions of civil penalty provisions. Current Division 3B of Part IV of the Privacy Act creates a framework for accepting and enforcing undertakings relating to compliance with provisions of that Act. Current section 98 of the Privacy Act deals with the use of injunctions to enforce provisions of that Act.

1521. This Schedule amends the Privacy Act to apply the standard civil penalty, enforceable undertaking and injunction provisions of the Regulatory Powers Act. Application of these provisions does result in a minor expansion of the current regulatory powers framework of the Privacy Act due to the acquisition of section 93 of the Regulatory Powers Act; however that provision is necessary to ensure that failure to comply with an obligation does not excuse a person from meeting that obligation. The other provisions gained by alignment with the Regulatory Powers Act, which are not currently in the Privacy Act, are merely procedural matters in relation to civil penalty provisions. This Schedule also modifies the operation of the Regulatory Powers Act to retain an existing power in the Privacy Act.

1522. Part 4 of the Regulatory Powers Act creates a framework for the use of civil penalties to enforce civil penalty provisions. Subsection 78(2) of the Regulatory Powers Act states that, in order for Part 4 of the Regulatory Powers Act to operate, a civil penalty provision must be made enforceable under that Part by another Act (a triggering Act). When a triggering Act applies Part 4 of the Regulatory Powers Act, it must identify the authorised person or persons and relevant court or courts that may exercise powers under that Part (see sections 80 and 81 of the Regulatory Powers Act). The triggering Act must also express whether the authorised person may delegate his or her powers and functions in relation to the civil penalty provisions of the triggering Act (see subsection 80(3) of the Regulatory Powers Act). If civil penalty provisions of the triggering Act apply in external Territories or offshore areas, the triggering Act should identify whether Part 4 of the Regulatory Powers Act extends to any external Territories.

1523. Part 6 of the Regulatory Powers Act creates a framework for accepting and enforcing undertakings relating to compliance with provisions of an Act. Subsection 110(2) of the Regulatory Powers Act states that, in order for Part 6 of the Regulatory Powers Act to operate, a provision of an Act or legislative instrument must be made enforceable under that Part by a triggering Act. When a triggering Act applies Part 6 of the Regulatory Powers Act, it must identify the authorised person or persons and the relevant court or courts that may exercise powers under Part 6 of the Regulatory Powers Act (see sections 112 and 113 of the Regulatory Powers Act). It must also express whether the authorised person or persons may delegate his or her powers and functions under Part 6 of the Regulatory Powers Act in relation to the enforceable undertakings provisions of the triggering Act (see subsection 112(3) of the Regulatory Powers Act). If provisions of the triggering Act are subject to enforceable undertakings and apply in external Territories or offshore areas, the triggering Act should identify whether Part 6 of the Regulatory Powers Act extends to any external Territories.

1524. Part 7 of the Regulatory Powers Act creates a framework for the use of injunctions to enforce provisions of an Act. Subsection 117(2) of the Regulatory Powers Act states that, in order for Part 7 of the Regulatory Powers Act to operate, a provision of an Act or legislative instrument must be made enforceable under that Part by a triggering Act. When a triggering Act applies Part 7 of the Regulatory Powers Act, it must identify an authorised person or persons and a relevant court or courts that may exercise powers under Part 7 of the Regulatory Powers Act (see sections 119 and 120 of the Regulatory Powers Act). A triggering Act must also express whether an authorised person or persons may delegate his or her powers and functions under Part 7 of the Regulatory Powers Act in relation to provisions subject to an injunction under the triggering Act (see subsection 119(3) of the Regulatory Powers Act). If provisions of the triggering Act are subject to an injunction and apply in external Territories or offshore areas, the triggering Act should identify whether Part 7 of the Regulatory Powers Act extends to any external Territories.

Comparison of Provisions

Privacy Act 1988

1525. The below table identifies the corresponding provisions of the Regulatory Powers Act (applied by item 7) for the provisions of the Privacy Act that are repealed by items 6, 7 and 8.

Current provision in the Privacy Act Provision Provision as amended by this Schedule Applicable provision (Regulatory Powers Act)
Civil penalty provisions Part VIB Part 4-Civil penalty provisions
Relevant courts 80W(1) Retained N/A (see new subsection 80U(3) of the Privacy Act)
Ancillary contravention of civil penalty provisions 80V Retained 92
Civil penalty orders 80W Retained 82
Civil enforcement of penalty 80X Retained 83
Conduct contravening more than one civil penalty provision 80Y Retained 84
Multiple contraventions 80Z Retained 85
Proceedings may be heard together 80ZA Retained 86
Civil evidence and procedure rules for civil penalty orders 80ZB Retained 87
Contravening a civil penalty provision is not an offence 80ZC Repealed N/A
Civil proceedings after criminal proceedings 80ZD Retained 88
Criminal proceedings during civil proceedings 80ZE Retained 89
Criminal proceedings after civil proceedings 80ZF Retained 90
Evidence given in proceedings for civil penalty order not admissible in criminal proceedings 80ZG Retained 91
N/A (Continuing contraventions of civil penalty provisions) N/A Gained 93
N/A (State of mind) N/A Gained 94
N/A (Mistake of fact) N/A Gained 95
N/A (Exceptions etc. to civil penalty provisions - burden of proof) N/A Gained 96
N/A (Civil penalty provisions contravened by employees, agents or officers) N/A Gained 97
Enforceable undertakings Division 3B, Part IV Part 6-Enforceable undertakings
Relevant courts 33F(1) Retained N/A (see new subsection 80V(3) of the Privacy Act)
Commissioner may accept undertakings 33E Retained 114
Commissioner may publish the undertaking on the Commissioner's website 33E(5) Retained through modification to the Regulatory Powers Act N/A (see new subsection 80V(4) of the Privacy Act)
Enforcement of undertakings 33F Retained 115
N/A (A relevant court may order that a person who has breached an enforceable undertaking pay the Commonwealth an amount up to the amount of any financial benefit that the person obtained directly or indirectly, and that is reasonably attributable to the breach) N/A Gained 115(2)(b)
Injunctions 98 Part 7-Injunctions
Relevant courts 98 Retained N/A (see new subsection 80W(3) of the Privacy Act)
Grant of injunctions 98(1);

98(2)

Retained 121
Interim injunctions 98(3) Retained 122
Discharging or varying injunctions 98(4) Retained 123
Certain limits on granting injunctions not to apply 98(5);

98(6)

Retained 124
No undertakings as to damages 98(7) Retained 122(2)
Other powers of a relevant court unaffected 98(8) Retained 125

Part 1 - Amendments

Item 1 - Subsection 6(1) (definition of civil penalty order )

1526. Item 1 repeals the definition of civil penalty order in subsection 6(1) of the Privacy Act. That definition is no longer necessary, as this Schedule amends the Privacy Act to apply the standard provisions of the Regulatory Powers Act, and civil penalty order is defined in section 4 of that Act.

1527. It is not necessary to substitute a new definition of civil penalty order in subsection 6(1) of the Privacy Act, as that definition is only relevant for the purposes of civil penalty provisions, and is not applied in any other provision of that Act. Where the phrase 'civil penalty order' is used in a provision external to current Part VIB of the Privacy Act, that phrase is amended to 'civil penalty order [that] has been made under subsection 82(3) of the Regulatory Powers Act' or 'civil penalty under the Regulatory Powers Act' (see items 4, 5 and 9 below).

Item 2 - Subsection 6(1) (definition of civil penalty provision )

1528. Item 2 repeals the definition of civil penalty provision in subsection 6(1) of the Privacy Act, and substitutes a new definition to direct the reader to the Regulatory Powers Act, which defines civil penalty provision in section 4 of that Act.

Item 3 - Subsection 6(1)

1529. Item 3 amends subsection 6(1) of the Privacy Act to insert a definition of Regulatory Powers Act. That definition provides that a reference to the Regulatory Powers Act is a reference to the Regulatory Powers (Standard Provisions) Act 2014.

Item 4 - Subparagraph 25(1)(a)(i)

1530. Item 4 repeals current subparagraph 25(1)(a)(i) of the Privacy Act and substitutes a new subparagraph 25(1)(a)(i) of that Act.

1531. Current subparagraph 25(1)(a)(i) of the Privacy Act provides that the Federal Court or the Federal Circuit Court may order an entity to compensate a person for loss or damage (including injury to the person's feelings or humiliation) suffered by the person if a civil penalty order has been made against the entity for a contravention of a civil penalty provision (other than section 13G of the Privacy Act).

1532. New subparagraph 25(1)(a)(i) of the Privacy Act provides that the Federal Court or the Federal Circuit Court may order an entity to compensate a person for loss or damage (including injury to the person's feelings or humiliation) suffered by the person if a civil penalty order has been made under subsection 82(3) of the Regulatory Powers Act against the entity for a contravention of a civil penalty provision of the Privacy Act (other than section 13G of the Privacy Act).

1533. Item 4 clarifies that, due to the amendments made by item 7 below, a civil penalty order is made under the Regulatory Powers Act.

1534. Item 4 is consequential to the amendments made by item 7 below, which repeals current Part VIB of the Privacy Act and applies the standard civil penalty, enforceable undertakings and injunctions provisions of the Regulatory Powers Act.

Item 5 - Subparagraph 25A(1)(a)(i)

1535. Item 5 repeals current subparagraph 25A(1)(a)(i) of the Privacy Act and substitutes a new subparagraph 25A(1)(a)(i) of that Act.

1536. Current subparagraph 25A(1)(a)(i) of the Privacy Act provides that section 25A of that Act applies if a civil penalty order has been made against an entity for a contravention of a civil penalty provision (other than section 13G of the Privacy Act).

1537. New subparagraph 25A(1)(a)(i) of the Privacy Act provides that section 25A of that Act applies if a civil penalty order has been made under subsection 82(3) of the Regulatory Powers Act against an entity for a contravention of a civil penalty provision of the Privacy Act (other than section 13G of the Privacy Act).

1538. Item 5 clarifies that, due to the amendments made by item 7 below, a civil penalty order is made under the Regulatory Powers Act.

1539. Item 5 is consequential to the amendments made by item 7 below, which repeals current Part VIB of the Privacy Act and applies the standard civil penalty, enforceable undertakings and injunctions provisions of the Regulatory Powers Act.

Item 6 - Division 3B of Part IV

1540. Item 6 repeals current Division 3B of Part IV of the Privacy Act, which creates a framework for accepting and enforcing undertakings relating to compliance with provisions of that Act.

1541. This item is consequential to the amendments made by item 4 below, which inserts new 'Division 2-Enforceable undertakings' of new 'Part VIB-Enforcement' of the Privacy Act, and applies the standard enforceable undertakings provisions in Part 6 of the Regulatory Powers Act to the Privacy Act.

Item 7 - Part VIB

1542. Item 7 repeals current Part VIB of the Privacy Act and substitutes new 'Part VIB-Enforcement', which includes new 'Division 1-Civil penalties', new 'Division 2-Enforceable undertakings' and new 'Division 3-Injunctions'. This item applies the provisions of Part 4 of the Regulatory Powers Act for the use of civil penalties to enforce the civil penalty provisions of the Privacy Act, and Part 6 of the Regulatory Powers Act for accepting and enforcing undertakings relating to provisions of the Privacy Act. Item 7 also applies the provisions of Part 7 of the Regulatory Powers Act for the use of injunctions to enforce provisions of the Privacy Act.

Civil penalty provisions

1543. Current Divisions 1, 2 and 3 of Part VIB of the Privacy Act provide for provisions in relation to civil penalty orders, and include sections 80U, 80V, 80W, 80X, 80Y, 80Z, 80ZA, 80ZB, 80ZC, 80ZD, 80ZE, 80ZF and 80ZG of the Privacy Act. Those sections are no longer necessary, as this Schedule amends the Privacy Act to apply the standard civil penalty provisions of the Regulatory Powers Act. The comparison table provided at paragraph 1526 above identifies the corresponding provisions of the Regulatory Powers Act for the provisions of the Privacy Act that are repealed by this item.

1544. New Division 1 of Part VIB of the Privacy Act directs the reader to Part 4 of the Regulatory Powers Act, which provides for provisions in relation to civil penalty orders (see the note to new subsection 80U(1) of the Privacy Act). New section 80U of the Privacy Act outlines matters in relation to authorised applicants, relevant courts and the extension of matters to external Territories.

1545. New subsection 80U(1) of the Privacy Act states that each civil penalty provision of that Act is enforceable under Part 4 of the Regulatory Powers Act, which ensures that Part 4 of the Regulatory Powers Act operates for the purposes of all civil penalty provisions in the Privacy Act. Item 7 also inserts a note at the end of new subsection 80U(1) of the Privacy Act, which directs the reader to Part 4 of the Regulatory Powers Act.

1546. New subsection 80U(2) of the Privacy Act identifies the Commissioner (defined in the Privacy Act as the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010) as the authorised applicant in relation to the civil penalty provisions of that Act. This will enable the Commissioner to seek an order from a relevant court that a person, who is alleged to have contravened a civil penalty provision, must pay the Commonwealth a pecuniary penalty (that is, a 'civil penalty order'). New subsection 80U(2) of the Privacy Act preserves the effect of current subsection 80W(1) of that Act, which is repealed by this item.

1547. New subsection 80U(3) of the Privacy Act identifies the Federal Court of Australia and the Federal Circuit Court of Australia as a relevant court for the purposes of Part 4 of the Regulatory Powers Act, as that Part applies to the civil penalty provisions of the Privacy Act. New subsection 80U(3) of the Privacy Act reflects existing arrangements under that Act in relation to courts, and preserves the effect of current subsection 80W(1) of the Privacy Act, which is repealed by this item.

1548. New subsection 80U(4) of the Privacy Act extends the application of Part 4 of the Regulatory Powers Act, as that Part applies to the civil penalty provisions of the Privacy Act, to every external Territory. New subsection 80U(4) of the Privacy Act reflects existing arrangements under that Act (see section 5A of the Privacy Act).

1549. Application of the standard civil penalty provisions of the Regulatory Powers Act does result in a minor expansion of the current regulatory powers framework of the Privacy Act. The comparison table provided at paragraph 1526 above identifies the provision of the Regulatory Powers Act that is gained through alignment with that Act, and which does not currently exist in the Privacy Act (see section 93 of the Regulatory Powers Act, which is discussed below).

1550. Section 93 of the Regulatory Powers Act provides that if an act or thing is required under a civil penalty provision to be done within a particular period or before a particular time, the obligation to do that act or thing continues until that act or thing is done, even if the period has expired or the time has passed. This section further provides that a person commits a separate contravention of the civil penalty provision in respect of each day during which the contravention occurs, including the day the civil penalty order is made (or any later day). This provision is necessary to ensure that failure to comply with an obligation does not excuse a person from meeting that obligation.

1551. The comparison table provided at paragraph 1526 above also identifies other provisions gained through alignment with the Regulatory Powers Act, which are not currently in the Privacy Act, that are merely procedural in nature and set out matters in relation to state of mind, mistake of fact, burden of proof and vicarious liability (see sections 94, 95, 96 and 97 of the Regulatory Powers Act, which are discussed below).

1552. Section 94 of the Regulatory Powers Act provides that it is not necessary to prove a person's state of mind in civil penalty proceedings under that Act. Subsections 94(2) and (4) of the Regulatory Powers Act clarify that this does not apply to ancillary contravention of civil penalty provisions, or where the relevant provision expressly provides otherwise. Subsection 94(3) of the Regulatory Powers Act provides that subsection 94(1) of that Act does not affect the operation of section 95 of that Act.

1553. Section 95 of the Regulatory Powers Act provides that a person cannot be held liable for a civil penalty order if his or her actions arose from a legitimate mistake of fact.

1554. Section 96 of the Regulatory Powers Act provides that, in proceedings for a civil penalty order against a person for a contravention of a civil penalty provision, a person bears an evidential burden where that person wishes to rely on any exception, exemption, excuse, qualification or justification provided by the law creating the civil penalty provision.

1555. Section 97 of the Regulatory Powers Act provides that a body corporate is responsible for the actions of an employee, agent or officer of that body corporate, who is acting within the actual or apparent scope of his or her employment, or within his or her actual or apparent authority.

1556. Alignment with the Regulatory Powers Act will also repeal current section 80ZC of the Privacy Act. Current section 80ZC of the Privacy Act provides that a contravention of a civil penalty provision is not an offence. That section is no longer necessary, as the provision does not add anything beyond the established common law principle, and its inclusion is no longer in line with current drafting standards.

Enforceable undertakings

1557. Current Division 3B of Part IV of the Privacy Act provides for provisions in relation to enforceable undertakings and includes sections 33E and 33F of that Act. Those sections are no longer necessary, as this Schedule amends the Privacy Act to apply the standard enforceable undertakings provisions of the Regulatory Powers Act. The comparison table provided at paragraph 1526 above identifies the corresponding provisions of the Regulatory Powers Act for the provisions of the Privacy Act that are repealed by item 6 above.

1558. New section 80V of the Privacy Act directs the reader to Part 6 of the Regulatory Powers Act, which provides for provisions in relation to enforceable undertakings (see the note to new subsection 80V(1) of the Privacy Act). New section 80V of the Privacy Act outlines matters in relation to authorised persons, relevant courts, publication on the Commissioner's website and the extension of matters to external Territories.

1559. New subsection 80V(1) of the Privacy Act provides that the provisions of the Privacy Act are enforceable under Part 6 of the Regulatory Powers Act, which ensures that Part 6 of the Regulatory Powers Act operates for the purposes of all provisions in the Privacy Act. Item 7 also inserts a note at the end of new subsection 80V(1) of the Privacy Act, which directs the reader to Part 6 of the Regulatory Powers Act.

1560. New subsection 80V(2) of the Privacy Act identifies the Commissioner (defined in the Privacy Act as the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010) as the authorised applicant in relation to the provisions mentioned in new subsection 80V(1) of that Act. This will enable the Commissioner to accept and enforce undertakings relating to compliance with provisions of the Privacy Act. New subsection 80V(2) of the Privacy Act preserves the effect of current section 33E of that Act, which is repealed by item 6 above.

1561. New subsection 80V(3) of the Privacy Act identifies the Federal Court of Australia and the Federal Circuit Court of Australia as a relevant court for the purposes of Part 6 of the Regulatory Powers Act, as that Part applies to the provisions of the Privacy Act. New subsection 80V(3) of the Privacy Act reflects existing arrangements under that Act in relation to courts, and preserves the effect of current subsection 33F(1) of the Privacy Act, which is repealed by item 6 above.

1562. New subsection 80V(4) of the Privacy Act modifies the operation of Part 6 of the Regulatory Powers Act, and provides that the Commissioner may publish an undertaking given in relation to a provision of that Act on the Commissioner's website. It is necessary to retain the Commissioner's power to publish in order to promote compliance with the obligations of the Privacy Act. New subsection 80V(4) of the Privacy Act preserves the effect of current subsection 33E(5) of that Act, which is repealed by item 6 above.

1563. New subsection 80V(5) of the Privacy Act extends the application of Part 6 of the Regulatory Powers Act, as that Part applies to the provisions of the Privacy Act, to every external Territory. New subsection 80V(5) of the Privacy Act reflects existing arrangements under that Act (see section 5A of the Privacy Act).

1564. Application of the standard enforceable undertakings provisions of the Regulatory Powers Act does not result in an expansion of the current regulatory powers framework of the Privacy Act. The comparison table provided at paragraph 1526 above identifies the provision that is gained through alignment with the Regulatory Powers Act, which is not currently in the Privacy Act, that is merely procedural in nature and sets out matters in relation to an order by a relevant court in relation to a breach of an enforceable undertaking (see paragraph 115(2)(b) of the Regulatory Powers Act, which is discussed below).

1565. Paragraph 115(2)(b) of the Regulatory Powers Act provides that a relevant court may order that a person who has breached an enforceable undertaking pay the Commonwealth an amount up to the amount of any financial benefit that the person obtained directly or indirectly, and that is reasonably attributable to the breach.

Injunctions

1566. Current section 98 of the Privacy Act creates a framework for the use of injunctions under that Act, and is no longer necessary, as this Schedule amends the Privacy Act to apply the standard injunctions provisions of the Regulatory Powers Act. The comparison table provided at paragraph 1526 above identifies the corresponding provisions of the Regulatory Powers Act for section 98 of the Privacy Act, which is repealed by item 8 below.

1567. New section 80W of the Privacy Act directs the reader to Part 7 of the Regulatory Powers Act, which provides for provisions in relation to injunctions (see the note to new subsection 80W(1) of the Privacy Act). This new section outlines matters in relation to authorised persons, relevant courts and the extension of matters to external Territories.

1568. New subsection 80W(1) of the Privacy Act provides that the provisions of that Act are enforceable under Part 7 of the Regulatory Powers Act. New subsection 80W(1) of the Privacy Act ensures that Part 7 of the Regulatory Powers Act operates for the purposes of all provisions in the Privacy Act. Item 7 also inserts a note at the end of new subsection 80W(1) of the Privacy Act, which directs the reader to Part 7 of the Regulatory Powers Act.

1569. New subsection 80W(2) of the Privacy Act identifies the Commissioner (defined in the Privacy Act as the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010), or any other person, as an authorised person in relation to the provisions subject to injunctions under the Privacy Act. This will enable an authorised person to use injunctions to enforce the provisions of the Privacy Act. New subsection 80W(2) of the Privacy Act preserves the effect of current section 98 of that Act, which is repealed by item 8 below.

1570. New subsection 80W(3) of the Privacy Act identifies the Federal Court of Australia and the Federal Circuit Court of Australia as a relevant court for the purposes of Part 7 of the Regulatory Powers Act, as that Part applies to the provisions of the Privacy Act. New subsection 80W(3) of the Privacy Act reflects existing arrangements under that Act in relation to courts, and preserves the effect of current section 98 of the Privacy Act, which is repealed by item 8 below.

1571. New subsection 80W(4) of the Privacy Act extends the application of Part 7 of the Regulatory Powers Act, as that Part applies to the provisions of the Privacy Act, to every external Territory. New subsection 80W(4) of the Privacy Act reflects existing arrangements under that Act (see section 5A of the Privacy Act).

1572. Application of the standard injunctions provisions of the Regulatory Powers Act does not result in an expansion of the current regulatory powers framework of the Privacy Act.

Item 8 - Section 98

1573. Item 8 repeals current section 98 of the Privacy Act, which creates a framework for the use of injunctions under that Act.

1574. This item is consequential to the amendments made by item 7 above, which inserts new 'Division 3-Injunctions' of new 'Part VIB-Enforcement' of the Privacy Act and applies Part 7 of the Regulatory Powers Act for the use injunctions to enforce the provisions of the Privacy Act.

Item 9 - Section 99A

1575. Item 9 inserts 'under the Regulatory Powers Act (as it applies in relation to the civil penalty provisions of this Act)' after the every occurrence of 'civil penalty order' in current section 99A of the Privacy Act, which provides for matters in relation to the conduct of directors, employees and agents.

1576. Current section 99A of the Privacy Act provides for matters in relation to the conduct of directors, employees and agents.

1577. Item 9 clarifies that, due to the amendments made by item 7 above, a civil penalty order is made under the Regulatory Powers Act.

1578. Item 9 is consequential to the amendments made by item 7 above, which repeals current Part VIB of the Privacy Act and applies the standard civil penalty, enforceable undertakings and injunctions provisions of the Regulatory Powers Act.

Part 2 - Application and Saving Provisions

Item 10 - Application and saving provision-civil penalties

1579. Item 10 provides for the application of the amendments in this Schedule in relation to civil penalties, and makes it clear that the amendments apply in relation to contraventions of civil penalty provisions occurring on or after the commencement of this Schedule.

1580. This item also provides that Part VIB of the Privacy Act, as in force immediately before the commencement of this Schedule, continues to apply on and after that commencement in relation to contraventions of civil penalty provisions occurring before the commencement of this Schedule.

Item 11 - Application and saving provision-enforceable undertakings

1581. Item 11 provides for the application of the amendments in this Schedule in relation to enforceable undertakings, and makes it clear that the amendments apply in relation to undertakings given on or after the commencement of this Schedule.

1582. This item also provides that Division 3B of Part IV of the Privacy Act, as in force immediately before the commencement of this Schedule, continues to apply on and after that commencement in relation to the following:

a.
an undertaking given before the commencement of this Schedule
b.
an application for an order made, but not decided, under current subsection 33F(1) of the Privacy Act before the commencement of this Schedule, and
c.
an order made under current subsection 33F(2) of the Privacy Act before, on or after the commencement of this Schedule as a result of an application made before that commencement.

Item 12 - Application and saving provision-injunctions

1583. Item 12 provides for the application of the amendments in this Schedule in relation to injunctions, and makes it clear that the amendments apply in relation to contraventions occurring on or after the commencement of this Schedule.

1584. This item also provides that section 98 of the Privacy Act, as in force immediately before the commencement of this Schedule, continues to apply on and after that commencement in relation to contraventions occurring before the commencement of this Schedule.


View full documentView full documentBack to top