Australia: Data Protection

The Australian Government's proposed digital duty of care reforms would extend online safety obligations far beyond social media platforms to encompass any business operating websites, digital platforms, or AI-enabled tools. Rather than simply responding to complaints, businesses would need to proactively identify foreseeable risks and implement safeguards, with substantial penalties for non-compliance reaching up to $109.2 million for companies. The exposure draft introduces a fundamental shift from reacti

The Australian Government's exposure draft proposes a proactive, systems-based digital duty of care for online service providers, requiring them to ensure a 'safe online environment' so far as reasonably practicable.

The Administrative Review Tribunal's decision on Bunnings' use of Facial Recognition Technology offers critical insights for Victorian government agencies collecting sensitive information through new technologies. This analysis examines how privacy governance failures, inadequate notification practices, and insufficient transparency led to regulatory breaches, and explores what public sector organisations must do to strengthen their compliance frameworks when implementing surveillance systems or collecting

Australia's privacy framework is undergoing its most significant transformation in nearly four decades with the release of the Privacy Amendment (Personal Data Protection) Bill 2026. The Bill introduces a new "fair and reasonable" test for handling personal information, establishes a controller-processor framework, and creates a right of erasure for large digital platforms. Core definitions including personal information, sensitive information, consent, and de-identification are being comprehensively overha

Australia's privacy laws are undergoing significant reform, with new automated decision-making transparency requirements commencing in December 2026 and further substantial changes under consideration. Businesses must prepare for enhanced regulatory scrutiny, increased litigation risk through the new statutory tort for serious privacy invasions, and potential expansion of obligations to small businesses and employee records.

Almost a year after the Government announced that it agreed or agreed in-principle with 106 of the 116 recommended reforms in the Attorney-General’s Department Privacy Act Review Report 2022...

A Queensland tribunal has ruled that an anaesthetist who photographed patients and clinical records without consent and published them in a self-authored book committed professional misconduct. The case examines the boundaries of patient confidentiality in an era of accessible publishing platforms and social media, particularly in regional healthcare settings where contextual details can lead to patient identification.

Australia's existing technology-neutral legal frameworks readily apply to AI systems, yet AI procurement contracts remain critical tools for managing developer risk. From copyright exposure in training data to privacy compliance and regulatory change mechanisms, organisations commissioning bespoke AI solutions must address unique challenges across the development lifecycle through carefully structured contractual protections.

In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures.