Privacy Laws - States and Territories of Australia

This document is a partner to pages on Privacy Laws of the Australian Commonwealth, on Other Countries' Privacy Laws and on International Instruments

Introduction

This document provides access to Australian laws relevant to privacy, and to many resources that point to yet more laws. Australia is a federation of 6 States and 2 Territories. This document is concerned with laws of those 8 jurisdictions. A separate document provides access to laws that are relevant throughout the country.

Please advise us of improvements that should be made. The links in this page are reviewed periodically. Please advise any broken links to the APF Web-Team.

The remainder of this document presents laws of the States and Territories of Australia, as follows:

• N.S.W.
• Victoria
• Queensland
• Western Australia
• South Australia
• Tasmania
• A.C.T.
• Northern Territory

N.S.W.

• The primary legislation is the N.S.W. Privacy and Personal Information Protection Act 1998. Some additional resources may be found on the NSW Privacy site. But the limited privacy protections in N.S.W. have been under assault for some time, with the Premier seeking to fold the Privacy Commisisoner's Office in under the Ombudsman's Office, and, having failed to get that through a hostile upper house, appointing a Commissioner-of-convenience (a sometime Chief Censor) on rolling short-term contracts, and starving the Office of resources to the point of all-but closing it down.
• Health Records and Information Privacy Act 2002
• Workplace Surveillance Act 2005. This commenced 7 October 2005. It replaced the Workplace Video Surveillance Act 1998
• Summary Offences Act ss.21G-H, re 'filming for indecent purposes'
• Freedom of Information Act 1989
• Listening Devices Act 1984
• Access to Neighbouring Land Act 2000, esp. s.16 and s.26
• State Records Act 1998
• Criminal Records Act 1991 (Part 2 relates to Spent Convictions)
• Telecommunications (Interception) (New South Wales) Act 1987
• 'Computer Crimes': NSW Crimes Act at ss. 308-308I
• Local Court of New South Wales Practice Note 1 of 2008 re Identity theft prevention and anonymisation policy, which contains policy and recommendations to magistrates on how to suppress personal details from judgments and transcripts to minimize risks of identity theft and to protect privacy
• Andrew Nemeth's site on NSW Photo Rights, incl. privacy
• Note that most agencies' governing statutes include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy
• Historical Note: Following Attorney-General John Madison's reference and Prof. Bill Morison's 1973 Report, NSW adopted a novel and practical approach to learning about all dimensions of privacy through the NSW Privacy Committee Act 1975. But momentum was lost, and successive NSW Governments were privacy-hostile. The Act was rescinded in 1998, and the Committee was replaced with the present narrow, under-powered and under-resourced Commission

Victoria

• In 2006, Victoria became only the second Australian jurisdiction to provide a degree of generic protection of human rights in the form of the Charter of Human Rights and Responsibilities Act. Under s.13, "a person has the right (a) not to have his or her privacy, family, home or correspondence unlawfully or arbitrarily interfered with; and (b) not to have his or her reputation unlawfully attacked". The statutory protection is quite weak, and whether this will actually help at all in stemming the tide of privacy-invasive behaviour is unclear
• The primary legislation is the Information Privacy Act 2000, Additional information may be found on the site of the Victorian Privacy Commissioner
• An emergent tort of invasion of privacy was heralded by a County Court decision in 2007, Jane Doe v ABC and ors [2007] VCC 281. The ABC reported a woman's name as part of a radio news item about the sentencing of her husband, who was convicted of her rape. The Judge found that that the publication induced post traumatic stress disorder. It does not appear that the judgement has been published
• the Health Records Act 2001. This includes a set of Health Privacy Principles. The Act appears to apply to any organisation that holds what people normally understand by the term 'health information', i.e. it is not only relevant to health care institutions. Additional information may be found on the site of the Health Services Commissioner
• There is also a modern statute regulating devices that enable surveillance, including listening devices, optical surveillance devices, tracking devices and data surveillance devices: Surveillance Devices Act 1999
• Freedom of Information Act 1982
• Public Records Act 1973
• Telecommunications (Interception) (State Provisions) Act 1988
• There is no spent convictions law, but there is a Victoria Police Records Information Release Policy
• The Victoria Law Foundation's publication 'Private Lives'
• Note that most agencies' governing statutes include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy

Queensland

• It took a very long time for any privacy law to be enacted. A Parliamentary report was tabled in April 1998, but to no effect. In June 2008, the Solomon Report on the Right to Information made recommendations about both FOI and privacy. In December 2008, the Government invited submissions by 31 March 2009 in relation to a package of Bills and Regs (mirrors at 1, 2, 3 and 4). Despite an election intervening on 21 March, the package was passed in June 2009 and commenced on 1 July 2009
• The new statutes are:
  • Information Privacy Act 2009 and Regulation
  • Right to Information Act 2009 and Regulation
• The Office of Information Commissioner has existed since 2005, and the incumbent was appointed on 30 July 2009. But, nearly 8 months after passage of the Act, in mid-February 2010, there was still no sign of a Privacy Commissioner or staff
• An unenforceable code existed from 2001 to 2009, with limited impact. They were published as State Government Standard No. 42 (Sep 2001) and a special one – Standard No. 42A – for the Qld Dept of Health. None of the intended periodic reviews appears to have occurred (and the webmaster broke the link every time they reorganised the site)
• s.227A-227C of the Criminal Code was inserted in 2005 to regulate 'observations or [visual] recordings in breach of privacy'. Guidance is provided in the Queensland Courts Bench Handbook (see items 131A.1, 2, 3)
• Freedom of Information Act 1992
• Public Records Act 2002
• Criminal Law (Rehabilitation of Offenders) Act 1986 (spent convictions)
• Invasion of Privacy Act 1971 (Part 4 covers Listening Devices, Part 2 deals with Inspectors and Part 4A deals with invasion of the privacy of the home. The old provisions relating to credit reporting have been rescinded)
• Police Powers and Responsibilities Act 2000 (Chapter 4 deals with Covert Evidence Gathering Powers)
• There is no state telecommunications interception power, despite a Parliamentary Report tabled in December 1999
• Note that most agencies' governing statutes include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy
• Note too that Queensland is the only jurisdiction in Australia that has unequivocally recognised the existence of a tort of invasion of privacy, albeit only at the level of the District Court, in Grosse v Purvis [2003] QDC 151

Western Australia

• No data privacy laws of any significance appear to be in place
• An election commitment resulted in the release of a discussion paper in 2003, but nothing more. Privacy went unmentioned during the election campaign in early 2005. The Attorney-General tabled an extremely weak Information Privacy Bill in March 2007, but a series of scandals relating to Brian Burke's influence in Government have slowed everything down since then
• On the other hand, there is a modern statute regulating devices that enable surveillance, including listening devices, optical surveillance devices, tracking devices and data surveillance devices: Surveillance Devices Act 1998
• Freedom of Information Act 1992
• State Records Act 2000
• Spent Convictions Act 1988
• Telecommunications (Interception) Western Australia Act 1996
• Note that most agencies' governing statutes include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy

South Australia

• No privacy laws of any significance appear to be in place. A mere Cabinet Administrative Instruction of 1983/1989/1992 is supposed to be implemented, but these seldom have much impact. A Privacy Committee of S.A. exists, but it's unclear whether it actually does anything other than approve exemptions to the non-statutory principles! It's even unclear whether the Administrative Instruction applies to local government
• Freedom of Information Act 1991
• State Records Act 1997
• Listening and Surveillance Devices Act 1972
• Telecommunications (Interception) Act 1988
• There is no spent convictions law. A Discussion Paper released on 5 May 2004 has disappeared from the Web
• Note that most agencies' governing statutes include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy

---

Tasmania

• Until September 2005, no privacy laws of any significance were in place. A mere set of Information Privacy Principles existed
• The very weak Personal Information Protection Act 2004 commenced on 5 September 2005. It establishes a set of a set of 10 Personal Information Protection Principles (PIPPs). They apply to Tasmanian government agencies, but with many exemptions and exceptions. The Act empowers the existing Ombudsman to manage complaints. But in late November 2005 the Ombudsman's web-site didn't even mention privacy, and anyway the outcomes of complaints are unenforceable. It does not appear that this piece of legislation has improved the privacy of Tasmanians at all
• Freedom of Information Act 1991
• Archives Act 1983
• Annulled Convictions Act 2003 (spent convictions)
• Listening Devices Act 1991 and Regulations 1992
• Telecommunications (Interception) Tasmania Act 1999
• Note that most agencies' governing statutes include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy

A.C.T.

• The A.C.T. provides people with a right to not to have their privacy, family, home or correspondence interfered with unlawfully or arbitrarily (s.12 of the Human Rights Act 2004). This was the first such statute in Australian jurisdictions. Unfortunately, the Human Rights Commissioner has had higher priorities, and doesn't seem to have noticed or acted on the privacy aspect of human rights as yet
• The Territory chose to adopt the Commonwealth Privacy Act 1988. As a result, the Office of the Federal Privacy Commissioner is supposed to perform the functions of an A.C.T. Privacy Commissioner). The authority for that is the Australian Capital Territory Government Service (Consequential Provisions) Act 1994 (which followed on from the 1988 Act that imposed self-government on the Territory), in particular s.23, Schedule 2 and Schedule 3. Unfortunately, it's very difficult to find any evidence of this actually meaning anything in practice
• The Territory also adopted the Commonwealth Freedom of Information Act 1982 (as part of the original Act of 1988)
• A.C.T. Health Records (Privacy And Access) Act 1997
• Territory Records Act 2002
• Spent Convictions Act 2000
• Listening Devices Act 1992
• Note that agencies may have governing statutes that include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy

Northern Territory

• As befits a small jurisdicition, there is a combined FOI and privacy instrument called the Information Act 2002 (passed 8 November 2002). Among many other things, this created an Information Commissioner
• Additional information may be found on the site of the N.T. Information Commissioner
• There is also a modern statute regulating devices that enable surveillance, including listening devices, optical surveillance devices, tracking devices and data surveillance devices: Surveillance Devices Act 2000
• Criminal Records (Spent Convictions) Act 1992
• Telecommunications (Interception) Northern Territory Act 2001
• Note that most agencies' governing statutes include provisions that intentionally or incidentally provide privacy protections
• Note that the common law includes features that intentionally or incidentally protect privacy, including dimensions of privacy other than information privacy

Other Resources

The Office of the Federal Privacy Commissioner provides a Guide to State Privacy Laws, which may help orient you to what follows.

The Office of the Victorian Privacy Commissioner provides a comprehensive list of Privacy & Related Legislation in Australia.

Caslon Analytics:

• State and Territory regimes
• chronology of Australian privacy development

The Oz NetLaw Privacy Fact Sheet

Andrew Nemeth's site on NSW Photo Rights, incl. privacy

Allens Arthur Robinson's State Legislation page

Two papers on history and issues, Clarke (1998a-) and Clarke (1998b-)

AustLII's Australian Subject-Index for Privacy

Greenleaf G.W. & Waters N. (Eds.) (1994-) 'Privacy Law & Policy Reporter', monthly, available from http://www.austlii.edu.au/au/journals/PLPR/

Hughes G. (1991) 'Data Protection Law in Australia', Law Book Company, 1991

APF thanks its site-sponsor:

Created: 31 May 2000 - Last Amended: 20 February 2010 by Roger Clarke - Site Last Verified: 11 January 2009
© Australian Privacy Foundation Inc., 1998-2010  -   Mail to Webmaster
Site Map   -   This document is at This document is at http://www.privacy.org.au/Resources/PLawsST.html  -   Privacy Policy