Mark Dreyfus
The federal government is proposing to impose $50 million fines on companies for serious or repeated privacy breaches.
Under planned changes to the Privacy Act, the maximum fine for data breaches will rise from $2.2 million to up to $50 million, 30 per cent of adjusted turnover or three times the value of any benefit obtained through the misuse of information, whichever is the greater amount.
The Bill, proposed by Attorney-General Mark Dreyfus, will come in addition to a comprehensive review of the Privacy Act that will be completed this year, with recommendations expected for further reform.
The federal government’s proposal follows two of Australia’s most high-profile cyber hacks, Optus and Medibank, the latter of which saw 200 gigabytes of sensitive information stolen, including medical details, stolen.
According to Attorney-General's office, the Bill will provide the Australian Information Commissioner (AIC) with greater powers to resolve privacy breaches.
It will also muscle up the Notifiable Data Breaches scheme, which the department said will “ensure the Australian Information Commissioner has comprehensive knowledge and understanding of information compromised in a breach to assess the risk of harm to individuals”.
The Bill will also give the AIC and the Australian Communications and Media Authority greater information-sharing powers.
“I look forward to supporting from across the Parliament for this Bill, which is an essential part of the Government's agenda to ensure Australia's privacy framework is able to respond to new challenges in the digital era,” Attorney-General Dreyfus said.
