December 2021 Modernising the regulatory framework Case study – modernising the regulation of privacy law in Australia For many years, the Privacy Commissioner was a member of the Australian Human Rights Commission and powers under the Privacy Act were broadly similar to those in federal discrimination law. Privacy regulation has undergone significant transformation since 2010, with a significant range of regulatory options now available under the Privacy Act, conferring powers on the Office of the Australian Information Commissioner (OAIC) and the Australian Information Commissioner. This includes application of some standard provisions in the Regulatory Powers (Standard Provisions) Act. The OAIC is both a complaints-handling body with conciliation functions, and a regulator with enforcement options. It is open to the OAIC to use a combination of regulatory powers to address a particular complaint or matter. Regulatory powers that allow the OAIC to work with an entity to facilitate compliance with privacy obligations, include powers to: request that entities develop a privacy code and apply to the Commissioner for it to be registered;8 direct an agency to give the Commissioner a privacy impact assessment;9 monitor and conduct assessments of information handling by entities;10 and direct entities to notify the Commissioner and individuals at risk of serious harm when data breaches occur.11 Regulatory powers that can be used to investigate and deal with alleged interferences with privacy include powers to: investigate a matter following a complaint or on the Commissioner’s own initiative;12 attempt to conciliate a complaint;13 conduct preliminary inquiries to determine whether to open an investigation;14 hold a hearing in response to a request from a complainant or respondent;15 require information or a document to be produced, or a person to attend before the Commissioner to answer questions under oath or affirmation;16 direct parties to attend a conference presided over by the Commissioner (failure to comply with the direction is an offence);17 and refer a complaint to an alternative complaint body.18 Enforcement powers include powers to: accept an enforceable undertaking relating to compliance with provisions, and initiate proceedings to enforce enforceable undertakings in court;19make a determination, and bring proceedings to enforce determinations in court (which entails a hearing de novo, with OAIC documentation in evidence);20 report to the Minister following an investigation, monitoring activity or assessment;21 seek an injunction including before, during or after an investigation or in the exercise of another regulatory power;22 and apply to the court for a civil penalty order in response to a breach of a civil penalty provision, which may result in the court ordering a respondent to pay pecuniary penalties.23 Having started from the same point as federal discrimination law, the growth of regulatory options in relation to privacy is instructive in (a) showing what is possible within a broadly similar complaints model; and (b) how outmoded the regulatory framework for federal discrimination law has become since 2000. 94 FREE AND EQUAL An Australian Conversation on Human Rights