Privacy Act 1988 (+ reforms)

Australia's Privacy Act and its thirteen Australian Privacy Principles govern how organizations collect, use, and disclose personal information, with the Office of the Australian Information Commissioner enforcing. Penalties were raised in 2022 to the greater of A$50 million, three times the benefit obtained, or 30 percent of adjusted turnover. The 2024 reform act created a statutory tort for serious invasions of privacy from June 2025, introduced tiered civil penalties for less serious breaches, required transparency about automated decision-making, and directed the development of a Children's Online Privacy Code. The OAIC's determination against Bunnings over facial recognition and its guidance on tracking pixels signal where enforcement is heading. A second tranche, released as an exposure draft on August 31, 2026, would require every collection and use of personal information to be fair and reasonable, a test that consent alone would not satisfy.