Regulatory Radar

Providers of apps, games, websites and other online services may wish to assess now whether their service is likely to be accessed by children, or primarily concerned with children's activities, since that assessment determines whether the Code will apply once registered. Where it is likely to apply, relevant documents to review include privacy policies, consent flows for targeted advertising, age assurance processes and deletion request procedures. Because the final Code must be registered by 10 December 2026 and a breach will amount to a breach of the Privacy Act carrying civil penalties, compliance work is worth starting well before that date rather than waiting for the final text.

Businesses that supply information to Commonwealth agencies, particularly material that could be commercially sensitive, may wish to note the clarified default under the updated FOI Guidelines, under which an agency's starting position is that documents released under FOI will be published on its disclosure log unless a specific exception applies. It may be worth considering, when providing sensitive material to an agency, whether to flag confidentiality concerns at the time of provision so the agency has a clear basis to consider whether an exception to disclosure log publication should apply.

Australian Government agencies subject to the Freedom of Information Act could use the review's findings to check whether their own disclosure log publication practices meet the 10 working day timeframe in section 11C, including after internal review decisions change what was originally released. Agencies may wish to compare their disclosure log governance and reporting arrangements against the better-practice features the OAIC identified, such as searchability and accessible formats. Private sector organisations are not directly covered by this review, though those that deal with government information requests, or that model their own transparency practices on government approaches, may still find the OAIC's observations a useful reference point.

Retailers using or considering facial recognition technology could test any existing or planned deployment against the updated guidance, with particular attention to whether a privacy impact assessment has been completed and documented, whether an exception to consent genuinely applies given the entity's specific security context, and whether customers have been properly notified. Given the Tribunal's findings turned on the particular threats faced by the retailer in question, businesses may want to document the specific risks their own stores face rather than relying on a general industry justification. Legal teams could also monitor the outcome of the separate Kmart review, since it may provide further guidance on notification obligations.

Organisations that outsource customer-facing functions involving personal information, such as call centre or contact centre services, may wish to review what personal information is accessible to those providers, what authentication and verification steps are required before access is granted, and what the outsourcing contract says about security standards, incident notification timeframes and audit rights. Because the OAIC examined both Qantas's own protections and its oversight of the third-party provider before reaching its conclusion, similar scrutiny of outsourced arrangements can be expected in any comparable large-scale breach, even where the findings do not ultimately support further regulatory action.

Entities covered by the Privacy Act may wish to test their data breach response plan against the 30 day assessment window used to determine whether notification to the OAIC and affected individuals is required, rather than waiting for an actual incident to reveal gaps in the process. Given that malicious or criminal attacks and social engineering remain the leading causes of notified breaches, it would also be worth reviewing staff awareness training and verification procedures for unusual requests to access or change account information, alongside the adequacy of current cyber incident detection and containment arrangements.