Privacy Act changes give individuals a court claim for serious invasions of privacy and require covered brokerages to explain certain computer-assisted decisions. The privacy tort already operates. Automated-decision transparency has a separate commencement boundary, so prepare the relevant privacy-policy wording before it applies.
Start by separating laws already enacted from proposals still under consideration. A small brokerage can face the privacy tort even when the Australian Privacy Principles (APPs) do not apply to its business.
What Changed in the Privacy Act
The Privacy and Other Legislation Amendment Act 2024 changes enforcement, security obligations and privacy rights, with different provisions starting at different times. Its statutory commencement table sets the boundaries.
Enacted Changes Relevant to Brokerages
| Change | Commencement rule | Brokerage consequence |
|---|---|---|
| APP 11 clarification on security and disposal | Day after Royal Assent in 2024 | Reasonable steps expressly include technical and organisational measures |
| Additional penalty tiers and enforcement powers | Day after Royal Assent in 2024 | Failures below the serious-interference threshold can attract enforcement |
| Statutory tort for serious invasions of privacy | Deferred commencement in 2025, following the six-month statutory period | Individuals can bring a court claim where all elements are met |
| Automated-decision privacy-policy transparency | After the statutory 24-month deferral in 2026 | Relevant decisions after commencement require the prescribed policy information |
The security clarification reaches both system controls and workplace practices. For example, restricting access to client files needs staff procedures that keep access permissions current.
Reforms That Remain Proposed
The government’s second-tranche exposure draft consultation is separate from the enacted 2024 package. The draft includes a fair and reasonable handling test, changes to consent and a proposed erasure right directed at large digital platforms. A draft proposal does not create a present obligation for your brokerage.
Removal of the small business exemption has also been a reform proposal. The exemption remains part of the current framework. Do not treat the automated-decision commencement as a deadline that removes it.
The Office of the Australian Information Commissioner (OAIC) explains that small business coverage depends on more than turnover. Businesses with annual turnover of $3 million or less can still be covered through an exception, such as trading in personal information. Tax file number and credit-reporting rules can also apply separately.
Determine the coverage of your brokerage’s actual activities. A licensee or aggregator agreement can also require privacy practices, even where a statutory exemption applies.
The Statutory Tort for Serious Invasions of Privacy
The statutory tort for serious invasions of privacy lets an individual sue another person or organisation where the legal elements are met. It extends beyond APP entities, so a small business exemption does not itself prevent a claim.
The OAIC’s privacy tort explanation confirms that this court pathway operates separately from its complaint process. The OAIC does not directly administer the tort.
Under Schedule 2 of the Privacy Act, the claim requires all of the following elements.
- The defendant intrudes upon the individual’s seclusion or misuses information relating to them.
- A person in that individual’s position has a reasonable expectation of privacy in the circumstances.
- The invasion is intentional or reckless.
- The invasion is serious.
- The public interest in the individual’s privacy outweighs countervailing public interests.
Proof of financial loss is not required. A careless file-handling mistake does not automatically satisfy the intentional-or-reckless threshold. It can still raise other privacy obligations.
Defences include lawful authority and consent. The Act also provides defences for a reasonable belief that an invasion is necessary to address a serious threat to someone’s life, health or safety. Proportionate defence of persons or property and specified publication defences can apply. Separate exemptions also exist.
Consider a hypothetical employee who deliberately shares a client’s financial documents outside their authorised purpose. That conduct warrants urgent legal assessment. A court would still need to determine every element, any defence and the evidence. The example does not establish that a particular client has a valid claim.
If you face a demand or live dispute, preserve the relevant evidence and speak to a lawyer promptly. Court remedies can include damages and an injunction. A brokerage’s internal complaint response does not decide whether a court claim is available.
Automated Decision-Making Transparency
Automated decision-making uses a computer program to make a decision or perform work that materially contributes to it. The privacy-policy obligation applies where the statutory conditions are met, including an expected significant effect on an individual’s rights or interests.
The OAIC’s automated-decision resources give the commencement boundary and explain who must comply. APP entities must describe the kinds of personal information used, decisions made solely by the program and decisions the program substantially and directly helps make.
The APP 1 guidelines explain that human review does not automatically take a decision outside the rule. The test can reach software that recommends or guides a decision.
A customer relationship management (CRM) system that stores contact details is not automatically making a relevant decision. An artificial intelligence (AI) tool that drafts an administrative email is different from a system that ranks clients for access to assistance. Examine the decision, the personal information used and the effect on the person.
For a hypothetical brokerage screening process, record what happens when software flags an applicant as unsuitable for further assistance. Identify whether a broker independently assesses the underlying facts or routinely accepts the flag. Then assess the statutory conditions against that actual process.
Ask providers which inputs influence an output and what decision-related work the system performs. Record who arranged the process and who uses the result. Outsourcing the software does not automatically transfer the brokerage’s transparency obligation to the provider.
Penalties and OAIC Powers
The reforms create enforcement options for privacy failures at different levels. The penalty framework distinguishes serious interference, other interference and specified compliance failures.
Section 13G covers serious interference with privacy. Section 13H covers interference that does not need to meet that seriousness threshold. Section 13K identifies specified failures, including privacy-policy requirements and certain direct-marketing or correction obligations.
For eligible alleged breaches, the OAIC can issue an infringement notice. The compliance notice process can require action to remedy an alleged failure. These are distinct processes with their own conditions.
The 2024 package also adds monitoring and investigation powers, expands available court orders and enables minister-directed public inquiries. An individual court claim under the privacy tort is separate from regulatory action.
For a brokerage, an incomplete privacy policy can therefore create exposure without a major data breach. Give requests and notices an assigned owner, preserve the response evidence and act within the applicable deadline.
What Your Brokerage Should Change Now
Update the documents and processes your brokerage actually uses, then check that the client-facing wording matches what staff and software do.
- Review the privacy policy. Confirm coverage and describe the personal information your brokerage handles. Add the required automated-decision details before the relevant commencement, where the statutory conditions apply.
- Check AI and CRM tools. Map each tool from input to output and the decision it supports. Obtain provider explanations for decision-related functions and document the brokerage’s assessment of the transparency rule.
- Update the breach response plan. Name who contains an incident, preserves evidence and obtains legal advice. Keep regulatory notification decisions separate from the assessment of a possible privacy tort claim.
- Brief staff and check their understanding. Explain approved handling of client documents, access restrictions and the escalation route for a mistaken disclosure. Use a fictional file so training does not expose a real client’s information.
Review credit guides, collection notices and fact finds alongside the policy. A credit guide can point clients to your privacy information, but it does not replace the relevant collection notice. A fact find needs wording that reflects how the information is collected and used.
For example, if software uses a client’s income and liabilities to influence a consequential screening decision, compare that process with the published policy. A generic statement that the brokerage “uses technology” does not describe the information and decision categories required by the automated-decision rule.
Finish by tracing a fictional client file through collection, tool use and storage. Staff must be able to identify the applicable notice, explain any relevant automated process and locate the incident contact. Correct a mismatch in the workflow or the documents before using the revised process with clients.
