Privacy Amendment Bill

Members, we now come to our final debate: clauses 1 to 3. This is the debate on clauses 1 to 3, “Title”, “Commencement”, and “Principal Act”. The question is that clauses 1 to 3 stand part.

Thank you, Mr Chair. Clauses 1 to 3 are very straightforward. Clause 1 is the title. The Act is called the “Privacy Amendment Act” because it amends the Privacy Act. Clause 2 is the commencement clause. This is subject to changes in the Amendment Paper to replace 1 June 2025 with 1 May 2026. That just gives agencies more time to prepare for those changes and get their systems in place. And clause 3 is the “Principal Act” clause—[Alarm sounds] Someone is very excited! The Act amends the Privacy Act 2020, and that’s what it does.

Thank you, Mr Chair. Thank you, Minister Meager, for that explanation. Can I just check—just for clarity—in terms of clause 2 on the commencement date, in terms of the fact that information privacy principle 3A is to come into force. My understanding is that this bill, as the name potentially suggests, was supposed to give a two-year leeway to be able to make some of that preparation, or, potentially, an 18-month - plus leeway to make some of the preparations, and now it’s been pushed out to 1 May 2026, as you have mentioned, on Amendment Paper 258.

However, I do want to check, considering that we’ve seen a number of bills being introduced in the House very recently where we have been given confidence by the Minister that the transition and changes can be done within a three-month period, we’re still technically within a three-month period to 1 June 2025. So what is holding, for example—if the Minister wouldn’t mind providing clarity—the agency or the Government or even the Privacy Commissioner back from actually imposing this on the day that we have here in the bill, as opposed to pushing it out to 14 months from now? Presumably, by having it come into force, it’s not an overtly onerous task to inform the relevant people or for the Office of the Privacy Commissioner to put out the required information and publicity to be able to have people make those changes.

Now, the reason I mention this in terms of the time frame is because I remember, when we moved from the Privacy Act 1993 to the Privacy Act 2020, that, although it was a substantial change, it was a very quick change for most people, with some leeway for them to be able to change certain requirements in terms of terms and conditions, disclaimers, and all of those without having any sort of a disciplinary action being done because of that transition period. None the less, the Act went into force within a very short period of time.

So, yes, the main question is: why didn’t the Minister—or via, you know, advice from officials—decide to stick to the existing time line?

Thank you, Mr Chair. I think it’s worth clarifying that when we talk about agencies, we don’t necessarily restrict that to Government agencies. The Act defines the agency as sort of, essentially, any individual organisation that collects information. So this will have an impact on a wide range of agencies, including those who have an exception but then will now need to consider whether or not the practices that they undertake will fit within that exception or whether or not they will need to slightly amend what they are doing.

So it was the view of the Minister of Justice that giving those agencies additional time—rather than three months, give them a year—to assist in their efforts to comply—I’m getting a number of updates there—the agencies, for example, will need to have an awareness of their data flows, the recipients, and intended uses of the personal information they collect. If they don’t have sufficient awareness to comply, their privacy officer and/or lawyers will need to assess the required level of compliance. So we want to try and avoid some of that upfront compliance cost causing any issues just from the fact that we’ve given them three months rather than a year to bring this into force. So we think a year is appropriate.

Of course, our friend the Privacy Commissioner and their office—they need some time to develop guidance on how this might be interpreted or implemented. So giving the Privacy Commissioner a significant amount of time to pull together some really good, robust, strong guidance on this would be a good thing, so why rush them over the next three months, when we could give them slightly more time to consider that?

I move, That debate on this question now close.

The question is that the Minister’s amendment to clause 2, set out on Amendment Paper 258, be agreed to.

Amendment agreed to.

Clause 2 as amended agreed to.

Clause 3 agreed to.

Bill to be reported with amendment.

House resumed.

Madam Speaker, the committee has considered the Privacy Amendment Bill and reports it with amendment. I move, That the report be adopted.

Motion agreed to.

Report adopted.