#
Financial, health and telecoms/online-safety overlays are well documented and actively enforced; employment and education sector-specific DP rules are an evidentiary gap.
Sub-modules (7)
Financial Sector OverlayGreen
Part IIIA credit reporting regime carries distinct, lower civil penalty caps than s13G.
Claims (1):
- Part IIIA of the Privacy Act (credit reporting) establishes a distinct set of civil penalty provisions of 500, 1000 or 2000 penalty units, separate from the general s13G serious-interference penalty.
Health Sector OverlayGreen
My Health Records Act 2012 provides a separate civil-penalty enforcement track administered by the Information Commissioner.
Claims (1):
- Under s79 of the My Health Records Act, the Information Commissioner may apply to a court for an order that a person who has contravened a civil penalty provision in that Act pay the Commonwealth a civil penalty, constituting a distinct health-sector enforcement track from the general Privacy Act regime.
Telecoms And EprivacyGreen
Online Safety Act 2021 Part 4A SMMA scheme operates alongside the Privacy Act, co-regulated by OAIC and eSafety.
Claims (1):
- Part 4A of the Online Safety Act 2021, introduced in November 2024, establishes the Social Media Minimum Age scheme, which operates alongside the Privacy Act, with the OAIC overseeing privacy-related compliance under s63F and eSafety overseeing broader compliance.
Employment DataRed
No dedicated employment-data privacy statute or code identified in this research pass.
Credit And ScoringGreen
Privacy (Credit Related Research) Rule 2024 permits de-identified credit-research data use by credit reporting bodies.
Claims (1):
- The Privacy (Credit Related Research) Rule 2024, a legislative instrument made under s20M of the Privacy Act applying from 12 July 2024, permits credit reporting bodies to use or disclose de-identified information for credit-related research subject to compliance with the Rule.
EducationRed
No education-sector-specific privacy statute identified in this research pass.
InsuranceAmber
Health insurers handling sensitive information face heightened APP 11.1 scrutiny, illustrated by the Medibank enforcement action.
Claims (1):
- The OAIC alleged Medibank failed to take reasonable steps to protect personal information given its size, resources, and the nature and volume of the sensitive and personal information it handled, illustrating heightened security expectations for health insurers.
Key findings (3)
- — source on file
- — source on file
- — source on file
Sectoral Watch
The 1 July 2026 expansion of AML/CTF obligations to Tranche 2 sectors — real estate, legal, accounting, conveyancing, and trust and company service providers — has a direct Privacy Act consequence: entities in these newly captured sectors must now comply with the Privacy Act in respect of their AML/CTF-related data handling, including small businesses that would otherwise fall under the Act's general small-business exemption. This is a sectoral overlay effect rather than a standalone privacy reform: the AML/CTF expansion itself is the primary regulatory event, with Privacy Act coverage of newly regulated small businesses following as a consequence of that expansion rather than as an independent privacy-law change.
The specific statutory provision that overrides the small-business exemption for these entities was not independently located this cycle, so the precise legal mechanism by which coverage is extended remains to be confirmed, though the practical effect — Privacy Act obligations now reaching small businesses in these sectors for their AML/CTF data handling — is reported with confidence.
Outlook
Locating the specific statutory provision effecting this exemption override would clarify the precise scope of newly covered small businesses' Privacy Act obligations. This sectoral overlay should be read alongside the AML/CTF Tranche 2 enrolment-enforcement activity being tracked separately, since the same population of newly regulated entities is subject to both AML/CTF enrolment duties and this Privacy Act coverage consequence.
Sources and claims (5)
- ProbableOffice of the Australian Information Commissioner — Part IIIA of the Privacy Act (credit reporting) establishes a distinct set of civil penalty provisions of 500, 1000 or 2000 penalty units, separate from the general s13G serious-interference penalty.observed
- ProbableOffice of the Australian Information Commissioner — Under s79 of the My Health Records Act, the Information Commissioner may apply to a court for an order that a person who has contravened a civil penalty provision in that Act pay the Commonwealth a civil penalty, constituting a distinct health-sector enforcement track from the general Privacy Act regime.observed
- ProbableOffice of the Australian Information Commissioner — Part 4A of the Online Safety Act 2021, introduced in November 2024, establishes the Social Media Minimum Age scheme, which operates alongside the Privacy Act, with the OAIC overseeing privacy-related compliance under s63F and eSafety overseeing broader compliance.observed
- ProbableOffice of the Australian Information Commissioner — The Privacy (Credit Related Research) Rule 2024, a legislative instrument made under s20M of the Privacy Act applying from 12 July 2024, permits credit reporting bodies to use or disclose de-identified information for credit-related research subject to compliance with the Rule.observed
- ProbableOffice of the Australian Information Commissioner — The OAIC alleged Medibank failed to take reasonable steps to protect personal information given its size, resources, and the nature and volume of the sensitive and personal information it handled, illustrating heightened security expectations for health insurers.observed