What the Privacy Act reforms change

The statutory tort for serious invasions of privacy sits in Schedule 2 to the Privacy Act 1988 (Cth), inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth) and commenced on 10 June 2025. It requires the invasion to be intentional or reckless and to be serious, and an individual sues directly, with no complaint to the Information Commissioner first.

Schedule 1 added a mid-tier civil penalty and a low-tier penalty enforceable by infringement notice. For a serious or repeated interference the ceiling, set by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), is the greater of A$50 million, three times the benefit obtained, or 30 per cent of adjusted turnover.

Australian Privacy Principle 11.1 has required technical and organisational measures since December 2024, on the 2024 Act's amendment.

The Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic) require an adult's health record to be kept for seven years from the last service, and a child's until that person turns 25, so a signed note is unlikely to be deletable at a patient's request.

Consultation audio, interim transcripts, unsigned drafts and processing logs sit outside the clinical record and carry no equivalent retention mandate, so an erasure right lands there first. A right to request erasure, agreed in principle in the Government Response of September 2023, needs further legislation.

Health information is sensitive information under section 6(1) of the Privacy Act 1988 (Cth), and Australian Privacy Principle 3.3 requires consent before it is collected, subject to limited exceptions. Recording a consultation is a collection in its own right, so the consent covers the recording. A short spoken script at the start of the consult, with the patient's answer noted in the record, meets that requirement and the proposed fair and reasonable test.

Australian Privacy Principle 1.7, inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), commences on 10 December 2026. It requires a privacy policy to set out the kinds of personal information used in those decisions, and the duty runs on the policy alone, with no approval step and no separate register.

A scribe drafts a note that the clinician corrects and signs, so the decision affecting the patient is made by the clinician. The disclosure still reaches triage scoring, recall selection and appointment allocation.

APP 11.1 binds the practice for the information it holds, and engaging a vendor does not move that obligation. Put these to any scribe vendor in writing.

• Where audio, transcripts and drafts are stored, and where the backups are held.
• How long each artefact is retained, what deletes it, and whether deletion is automatic or run on request.
• Whether patient content is used beyond the practice's own documentation, including model training.
• Which encryption, access control, multi-factor authentication and audit logging controls are in place, and who assessed them.
• What the vendor does during a notifiable data breach, and how fast it tells the practice.

The Notifiable Data Breaches scheme sits in Part IIIC of the Privacy Act 1988 (Cth). Section 26WH requires all reasonable steps to complete the assessment within 30 days, and that clock starts at the suspicion of an eligible data breach. An eligible data breach is notified to the Information Commissioner and to affected individuals under sections 26WK and 26WL.