In October 2021, the Australian federal government released draft legislation (the Online Privacy Bill(1)) to amend the Privacy Act 1988 (Cth) (Privacy Act), including both a framework for an “Online Privacy Code” (OP Code) to impose higher levels of regulation on online platforms, and more general strengthening of the Act’s enforcement provisions. It also released a Discussion Paper(2) with 70 proposals – often just “options” – for a more extensive review of the Act.

The OP Bill and Discussion Paper proposals, when both completed, could become the most extensive proposed changes to the Privacy Act since the inclusion of the private sector in 2000. Since 2000, modest changes have been made by re-wording of principles(3) and some enforcement improvements(4) (2014), data breach notification (2018) and COVIDSafe provisions (2020). However, Australia’s laws still fall far short of what the GDPR considers “adequate”,(5) and whether the gap will be bridged remains unknown.