Schools are mass collectors of data, much of it very sensitive. Details of children enrolled in classes, their medical and pyschological issues are enthusiastically collected. Phone numbers and addresses of parents, guardians and other relatives are provided to schools. Today the Auditor General in New South Wales released a report highlighting the problems with the current system in NSW schools.

It is very much a mixed report card.  While the department has structures and policies in place there is a very imperfect implementation and monitoring.  There is a real problems with apps schools use with much sensitive data accessible by third party providers.

The department states there were 491 suspected data breach matters resolved from 2023 to 2025 that involved student information:

• • 435 matters were assessed as being a data breach but not an eligible data breach
  • 6 matters met the threshold to constitute an eligible data breach
  • 1 matter was assessed as a non-department data breach
  • 35 matters were assessed as not being a data breach
  • 12 were not data breaches but involved related queries from schools
  • 2 were duplicate

In 83% of cases the suspected data breaches in 2024–25 were the result of human error, such as access control errors, email errors, permission-to-publish errors and staff misconduct. Other causes included loss or theft (7%), system faults (5%) or cyber incidents (3%).

Incidents

• The personal mobile phones of 2 department staff were compromised through SIM-swap attacks that compromised both their personal and department accounts. The threat actor accessed the personal information of students, staff and
• This breach was classified and handled as an eligible data breach, and the department notified affected individuals (with the help of ID Support NSW) and the The department advised it took other actions in response to the breach including:
  • moving staff members who fell victim to the attack from text message multi-factor authentication to Microsoft authenticator with passkeys
  • completing an internal audit to ascertain and revise down the extent of the personal information accessed by the threat actor
  • engaging external service providers to ensure the department had met the regulatory requirements under the privacy legislation
  • implementing phishing-resistant multi-factor authentication software for all employees (currently within the pilot phase).

Unauthorised disclosure of information

• A school shared photos of 3 students on its Facebook page without parental consent and despite enrolment forms indicating no permission. After a family raised concerns via email, the school removed the
• A staff member used the school’s third-party school administration system to send text messages to parents about their child’s absence from school. Instead of the text messages going only to the children’s parents, they went to the children’s emergency contacts and other children’s parents. After identifying this breach, the school reverted the settings on the third-party school administration system to their correct
• A community member found volumes of school paper records containing student information dumped at a building construction site. The department recovered and digitised the records.

The snapshot of the report provides:

Key findings

The department has established a range of controls to manage the security and privacy of student information

Over the last 3 years, the department has strengthened its controls by uplifting cyber security capability, centrally contracting key third-party IT vendors, developing specific policy frameworks, and providing professional learning and centralised supports for schools.

Technical responsibilities have been allocated to school principals without sufficient departmental oversight

The department does not clearly define the specific risks to student information that schools must manage, nor provide clear operational guidance or proactive support to monitor how legislative and policy requirements are met in practice at the school level. With principals relying on their own judgement and capacity, practices are inconsistent and in some cases non-compliant. Read the rest of this entry »

The Five Eyes is a grouping of the United States, Australia, United Kingdom, New Zealand and Canada which collaborates on signals and military intelligence and most recently, cyber defence. Last Friday the Five Eyes issued a statement about dealing with cyber risk.

The AI shift in cyber risk: why leaders must act now

As the leaders of the Five Eyes cyber security agencies, we are united in our call to action: the evolving landscape of artificial intelligence (AI) is rapidly transforming cyber risk, and we must act swiftly to remain ahead.

A call to action

While Al will help us improve cyber defence over time, it also accelerates the speed, scale, and sophistication of cyber threats.

Frontier Al models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months.

In this environment, cyber resilience is integral to advancing business continuity, market confidence, and long-term value. We urge leaders to:

• • understand and assess risk, readiness and accountability
  • prioritize foundational cyber security practices and controls
  • empower cyber leaders with authority and resources
  • stay actively engaged as threats and guidance evolve

Success will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy. Those that do not will face growing operational and strategic disadvantage.

The urgency is clear

AI is not a future consideration – it is already here.

It lowers barriers for malicious actors and increases the speed and complexity of attacks, shrinking the window between vulnerability discovery and exploitation ever more quickly. At the same time, AI offers powerful tools to strengthen defence.

A whole-of-organization and whole-of-society response is required

Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility. Boards and executives should ensure cyber resilience is in place and works under pressure. It is not enough to have controls. Leaders must be confident those controls will perform during a real incident. This requires reassessing long-standing trade-offs and using AI deliberately to strengthen defence – not just improve efficiency.

Key Actions for Leaders

Core principles:

• • Secure-by-design and secure-by-default must become standard practice – not an
  • Resilience cannot depend on a single solution or Defence in depth remains essential.
  • As AI systems evolve, new and previously unknown vulnerabilities will emerge, including zero-day vulnerabilities.

Breaches will occur. Preparedness helps you contain them quickly and prevent escalation into major operational and financial crises.

Practical actions

These actions are not new, but are now urgent to reduce not only technical risk, but also operational, financial and reputational exposure:

1. 1. Reduce your attack surface: Limit unnecessary system access and external Challenge whether systems need to be exposed at all and isolate those that do not.
   2. Accelerate patching processes: AI is shortening the time between vulnerability discovery and exploitation. Delays in patching increase risk, especially for operational systems with long update cycles. Prioritise security updates accordingly to manage risks.
   3. Address legacy systems: Unsupported systems are easy They are not just technical debt, they are strategic liabilities.
   4. Review and strengthen identity and access controls: Limit who can access critical Enforce strong authentication and regularly review permissions.
   5. Prepare for incidents before they happen: Test response plans, train and prepare teams, and assume breaches will occur. Focus on fast containment and recovery.

Use AI to strengthen defence

Adversaries are already using AI to move faster and more effectively. Defenders must do the same.

Organizations that integrate AI tools into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to incidents – reducing both the cost and impact of incidents.

Success will not come from having the most tools. It will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy.

We must act now

The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years. We must act before and be prepared to adapt and withstand evolving threats.

Cyber resilience is not an IT issue – it is central to operational continuity and market trust. Leaders who act now will reduce exposure, strengthen resilience, and build confidence with customers, partners, and investors. Those who delay will face growing and avoidable risk.

The above statement may be unusual and significant but the thrust of the recommendations and the concerns raised have been well known by practitioners involved with cyber security and privacy.

Frontier AI models have been identified as being adept at identifying software vulnerabilities and developing exploits on the hacking side of the ledger and with defensive activities such as patching.

The recent development of cyber-related capabilities of the latest generation of AI models, especially Anthropic’s Mythos and OpenAI’s GPT 5.4-Cyber, democratises the hacking.  Sophisticated data breaches which were previously only undertaken by skilled hackers can now to be handled by those with less expertise.

On June 2, 2026, President Trump signed an Executive Order on Promoting Advanced Artificial Intelligence Innovation and Security  to establish  a framework for secure development of frontier AI models and an “AI cybersecurity clearinghouse” to facilitate vulnerability coordination and remediation, among other initiatives. That was followed by National Security Presidential Memorandum 11, on June 5, 2026, direcdting e military, intelligence agencies, and relevant federal departments to accelerate the adoption of AI for national security applications.

It is critical to review and respond to changing cybersecurity risks. New risks and challenges will arise and organisations need to consider how to respond to and protect against threats operating at the speed and scale of advanced AI.

Notwithstanding the changing landscape fundamental governance principles and underlying controls will continue to be key risk mitigators.  That will apply even if organisations incorporate AI capabilities,including the use of agentic AI, into their cyber defenses.

In reviewing cyber defences approach the exercise methodically which means:

Determine whether existing risk management protocals align with  AI-related cyber risks: Frontier AI models accelerate and scale vulnerability discovery.  That can mean decision time frames are compressed and the scope fo threats increase.  Organisations that provide and maintain Read the rest of this entry »

The Privacy Commissioner recently completed an investigation into Medmate Australia. The issue was the use of tracking pixels and their use of collecting information without consent between April 2021 and 9 December 2024.  It is a very detailed analysis of a means of data collection which has not been the subject of consideration by the regulator before.  

FACTS

Medmate is a:

• corporation which was registered in Australia in 2018.
• wholly owned subsidiary of Medmate Group Pty Ltd (ACN 628 464 255).
• provider of a wide range of health services including:
  • telehealth consults,
  • online prescriptions, medical certificates, mental health support and weight loss program. Medmate owns and operates the Website, which advertises and details the services it offers and provides a means by which individuals may request telehealth appointments or purchase prescriptions.

The OAIC’s published its guidance on the application of the Privacy Act to tracking pixels in November 2024 and then undertook a preliminary scan of 50 health service provider websites and their use of tracking pixels [20]. That is both good policy and good practice.

On 9 December 2024, the Commissioner commenced an investigation under s 40(2) into Medmate’s use of tracking pixels on the Website for the period of April 2021 until 9 December 2024. 

Regarding its use of pixels Medmate:

• commenced use of:
  • tracking pixels from April 2021;
  •  the Meta Pixel on 21 April 2021 [36].
• engaged external media agencies to manage its use of tracking pixels on its Website [37].
• did not undertake any privacy impact assessments prior to the deployment of tracking pixels [38].
• utilised tracking pixels for :
  1. advertising and analytics;
  2. tracking the success of campaigns and conversions;and
  3. identifying user behaviour trends to streamline operations, improve patient engagement and enhance the provision of healthcare services through website and app improvements [39].
• as of 9 December 2024, Medmate had 2 active tracking pixels on the Website;
  • the Meta Pixel  – page view, which tracks when an individual views a page on the Website (and includes Base Pixel Data). Purchase, which tracks when an individual completes a purchase on the Website, parameters also included order ID, value and currency.
  • TikTok Pixel [40] – Page view tracks when an individual views a page on the Website (and includes Base Pixel Data). View content tracks when an individual views content or a specific product including telehealth, express consult and medical certificate. It enables full URLs, hashed email address and phone numbers to be transmitted to TikTok when individuals browse the Website. The full URLs transmitted via the TikTok Pixel included, in some circumstances, health conditions or medication sought, based on an individual’s actions.

DECISION

A tracking pixel is a tracking tool that permits granular user surveillance across the internet and social media platforms. It allows brands to pay a premium to third-party platforms to deploy the right ad to the right person at the right time [4].

The use of tracking pixels without appropriate due diligence risks contravention of the Privacy Act and the APPs [8]. 

Tracking pixels take various forms including tiny, transparent images that can be embedded by entities on webpages via a broad range of HTML and JavaScript code [9] which function to collect information about individuals’ activities on a webpage.

Social media platforms  offer entities platform specific tracking pixels for integration and use [10].

A tracking pixel operates by:

• by serving as an external channel to the Pixel Provider; with
• having HTML or JavaScript code containing a URL pointing to the Pixel Provider’s server so that when an individual loads a webpage containing a tracking pixel, their browser triggers a request to the Pixel Provider’s server; and then
• having the request transmit information collected by the tracking pixel to the Pixel Provider’s server;
• the Pixel Provider’s server records the information in its log files [11].

Entities that embed Read the rest of this entry »

Generative Artificial Intelligence (GenAI) poses two major challenges/threats to organisations privacy obligations; namely the proper use and storage of personal information. The first challenge is that by using personal information of others in conjunction the GenAI it is likely that that personal information will find its way into the mass of data collected and used by GenAI in training itself. It could easily be used to assist another party using GenAI. That is a data breach. The second problem with GenAI is that it is supercharging hackers in locating weaknesses in cyber security.

The PDPC noted that the Advisory Guidelines was organized across three stages of the Gen AI lifecycle.

First, the development stage.  The PDPC addressed the application of the publicly available exception to web-scraped datasets.  Organisations are required to provide AI-specific notifications, rather than general notifications, when seeking consent to use personal data for Gen AI model training and fine-tuning.

The deployment stage.  There are Read the rest of this entry »

AI is a topical on all levels and all industries. The advantages, dangers, winners and losers. AI is particularly effective in detecting cyber weaknesses. Together with quantum computing it threatens to up end modern cyber defences. But it can also be used to enhance cyber security. Hence yesterday’s Executive order by the President of the United States titled Promoting Advance Artifical Intelligence Innovation and Security.

The Executive Order mandates that the Secretary of Homeland Security, through the Cybersecurity and Infrastructure Security Agency (CISA), must:

• issue directives to expedite the cyber defense of civilian federal systems;
• expand federal programs that utilize AI-enabled defensive tools; and
• facilitate access to cybersecurity services for state and local authorities, as well as critical infrastructure operators like rural hospitals and community banks.

The Secretary of the Treasury, the National Security Agency (NSA), and CISA will create a voluntary AI cybersecurity “clearinghouse” to coordinate the identification and remediation of software vulnerabilities.

The Director of the Office of Management and Budget (OMB) will  evaluate federal grant programs to identify funding for advanced AI vulnerability detection.

The Executive Order requires the creation of a benchmarking process to evaluate the cyber capabilities of AI models and determine which should be classified as a ‘covered frontier model.’ It outlines a voluntary framework for AI developers to:

• collaborate with the Federal Government to identify if models under development meet the frontier model criteria;
• grant the government access to these models for up to 30 days prior to their public release; and
• partner with the government to select trusted entities for early access to promote secure innovation.

The Attorney General (AG) is directed to prioritise the enforcement of federal criminal laws against individuals who use AI to gain unauthorized access to or damage computer systems. This priority includes cases where AI agents are employed to unlawfully access data for criminal purposes or to breach public and private information technology systems.

The Executive Order provides:

By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered:

Section 1.  Purpose.  The United States continues to lead the world in Artificial Intelligence (AI) because of the enormous talent and innovation of our AI industry, and because we refuse to stifle this innovation with overly burdensome regulation.  My Administration has unleashed tremendous technological growth and economic investment in AI by slashing the bureaucratic constraints that the prior administration placed on America’s AI developers and researchers, and by instead encouraging AI innovation and accelerating responsible AI adoption across government and industry. 

Advanced AI capabilities make our Nation stronger, but also introduce new national security considerations that require coordinated action across executive departments and agencies (agencies), and components.  As these capabilities evolve, my Administration will continue to work closely with industry to ensure that the best and most secure technology is deployed rapidly to confront any and all threats to our country.  We will continue to lead an America First cybersecurity effort that enhances both our national security and our global AI dominance.

It is the policy of the United States to promote AI innovation and security by working collaboratively with the private sector to modernize government and private sector information systems and harden them against external threats; to protect American ingenuity and intellectual property from exploitation and theft by adversaries; and to cultivate America’s advanced AI-enabled capabilities.

Sec. 2.  Upgrading American Systems for Advanced AI.  (a)  Within 30 days of the date of this order, the Committee on National Security Systems shall prioritize the cyber defense of National Security Systems, as defined in 44 U.S.C. 3552(b)(6)(A), by taking appropriate and expeditious action consistent with the purpose of this order. Read the rest of this entry »

I was long an avid attender of the offerings of the Melbourne International Film Festival (“MIFF”) over a 2 1/2 week period. When I started attending tickets were printed out and the program was an insert in the Age and at the box office. No longer. It is all very digital now. And the MIFF has a large database, which included my details. On Monday the MIFF emailed me about a privacy incident. It has apparently affected 26,000 customers.  The means of access was through a third party provider, here a ticketing platform.

The email stated:

We are writing to inform you of a privacy incident that has affected the personal information of a small proportion of MIFF customers.

If you did not receive a separate notification email, your information was not affected.

We understand that news like this may be concerning, and we sincerely apologise for any worry or inconvenience this incident may cause. Protecting the information entrusted to us is extremely important, and we are taking this matter very seriously.

What happened

On 29 May, MIFF’s ticketing provider, Ferve, identified unauthorised access to its ticketing system. As soon as the activity was detected, access to the system was temporarily suspended while investigations commenced.

On 30 May, further unauthorised access to the Ferve ticketing system occurred, and some customers received emails or SMS messages sent directly through the system without authorisation.

MIFF and Ferve are continuing to investigate the incident, determine the full scope of the impact and implement additional security measures to help prevent a similar incident from occurring in the future. Read the rest of this entry »

The Privacy Commissioner has released the 2026 survey into Australian Community Attitudes to Privacy. The Privacy Commissioner conducts  a survey annually.  As with previous years it reveals that Australians value their privacy and are concerned about modern practices which interfere with that privacy.  Not surprisingly the concerns are greater now than 5 years ago and the trust lower.

The Commissioners’ foreward provides:

Australians’ expectations about privacy continue to sharpen as the information ecosystem becomes more complex, data-intensive and difficult to navigate. The 2026 Australian Community Attitudes to Privacy Survey (ACAPS) points to a community that places a high value on privacy, but does not consistently experience privacy protections as workable in practice. Trust is uneven across sectors, and wariness of emerging technologies is increasing, particularly in terms of fairness, accountability and the practical ability to exercise rights. Australians want greater transparency, more proportionate collection of personal information, and a fairer go when using digital services.

The right to privacy and the right to access information are protected and promoted by the Office of the Australian Information Commissioner (OAIC). The ACAPS findings go to broader issues beyond privacy such as information access and encompass the full range of the OAIC’s regulatory 2025-26 priorities, which include a focus on rebalancing power and information asymmetries, and rights preservation in new and emerging technologies. This survey builds on the cross-jurisdictional 2025 Information Access Study, which showed Australians expect accountability, transparency, and clear access to government information – particularly where technology such as artificial intelligence (AI) is being used to support automated decisions.

Just as technology is proving to be a means to rapidly transmit information its deployment is impacting public trust. This is because data handling is arguably not keeping pace with community expectations, and hampering Australians’ engagement in the digital economy. Greater confidence in how personal information is handled would increase Australians’ willingness to use digital services or programs that require sharing personal information. Around two-thirds (68%) say they would be more likely to use such digital services if they felt their data was handled fairly and responsibly.

ACAPS shows that while 93% say protecting personal information is important to them and 87% say they are more concerned about privacy than 5 years ago, many do not feel able to act on that concern day-to-day. Consent is often experienced as a gateway: 65% say sharing information rarely or never feels like a genuine choice and 68% say the same about consent. A substantial proportion of the community (78%) report very little or no real control over how their personal information is collected and used, and 52% say they accept sharing because they might otherwise miss out on essential services or opportunities. This points to persistent power and information asymmetries not addressed by notice and consent alone.

Australians also draw clear fairness boundaries. Only 10% say organisations’ real-world data practices are usually fair, while 35% say they are mostly or always unfair. Fairness concerns appear to concentrate around disproportionate collection, limited or unrealistic opt-out, and situations where benefits are perceived to flow mainly to organisations. There is strong rejection of practices associated with data brokerage and advertising technology, alongside expectations for stronger limits on collection, retention and secondary uses. Australians feel that when an entity collects their personal information for one reason, it is often not fair or reasonable for them to use it for another reason. For example, 93% say it is not fair and reasonable for an entity to use the personal information they collected to provide a product or service to train AI models. The survey also indicates a strong boundary around using personal information to train AI systems after a service they have received has ended (71% say this is unacceptable), reinforcing the importance of purpose limitation and lifecycle controls.

Expectations are clear for new and emerging technologies. AI is a widely recognised privacy risk (69%), trust in AI companies is low (4%), and acceptance of AI uses involving personal information appears contingent on protections that make high impact uses transparent and contestable. Australians most frequently prioritise a right to human review (81%), limits on how personal information is retained by third-party providers (80%), and being told when AI is being used (79%). This underscores the importance of the forthcoming automated decision-making (ADM) transparency obligation, which will require regulated entities to disclose the use of AI and ADM in their privacy policies from December 2026.

As the government sector expands its use of technology to inform decision making and deliver services, preservation of information access rights is increasingly important.

This emphasis on transparency was mirrored in the 2025 Information Access Study that found a significant majority of Australians (86%) also agree that the government must publicly report on any technology used to inform freedom of information decision-making (including AI and automated decision-making). The OAIC’s January 2026 report into ADM highlighting transparency obligations under the FOI Act shows that much needs to be done to ensure Australians are aware of how their information is used by government agencies. As a responsive regulator, the OAIC is focused on strengthening the information governance of the Australian Public Service and ensuring timely access to government information. In providing the ADM Report and guidance to government agencies, the OAIC recognises the efficiency and productivity gains that can be delivered through technology to a community that is confident to engage with digital services and better equipped to exercise related rights, including seeking a review of a government agency decision.

ACAPS highlights the gap between formal rights and lived experience. Two in 5 Australians (40%) say they do not really know what data organisations hold about them or how to access it, and only 11% say they can easily access their data and request corrections or deletion. Even where concerns arise, action is not assured: 64% had concerns in the past year, but 52% did not raise them, often because they felt it would not make a difference (56%), would be too hard or time-consuming (51%), or they did not know how (40%). This reinforces the importance of clear, timely and accessible pathways for access and redress.

Australians demand transparency, both in understanding their privacy rights, how their information is used, and in embracing their right to access that information. Improving transparency will strengthen the community’s already active engagement with these systems and safeguard a healthy, informed and vibrant democracy.

Some of the findings are:

• 93% say protecting personal information is important to them, and 87% say they are more concerned about their privacy than they were 5 years ago
• Almost all respondents (98%) say organisations that collect, use or share personal information should be responsible for protecting privacy even if no immediate harm occurs, with 86% viewing this responsibility as very strong.
• Around two-thirds (68%) say they would be more likely to use digital services requiring personal information if they believed their data was handled fairly and responsibly
• Nearly all (96%) say some conditions should be in place before AI is used
• Around 7 in 10 Australians (71%) consider it somewhat or very uncomfortable for organisations to use personal information originally provided for a service to train AI systems after that service has been completed.
• Acceptance is lowest for automated eligibility or risk-based decisions, such as loan approvals or benefit eligibility, with only one-quarter (25%) viewing this as acceptable
• 78% report very little or no control over how their personal information is collected and used
• regarding consent, 65% say sharing information rarely or never feels like a genuine choice and 68% say the same about 52% say they accept sharing because they might otherwise miss out on essential services or opportunities
• Around 9 in 10 Australians (92%) say data collection can be acceptable under certain conditions, particularly where:
  • the purpose is clear (69%),
  • consent or opt-in is available (68%),
  • collection is limited to what is necessary (66%), and
  • the ability to opt out of non-essential collection (61%).
• 73% (vs 64% in 2023) experienced a privacy concern in the past 12 months
• The most common concerns were being unable to unsubscribe from marketing (41% vs 25% in 2023) and having information used for unsolicited direct marketing (38% vs 21% in 2023)
• Among those who experienced a concern, 70% (vs 55% in 2023) reported more scams/spam, 46% (vs 53% in 2023) reported loss of trust and 39% reported loss of control
• Around three-quarters (77%) of Australians whose data was involved in a breach experienced at least one form of harm, while exposure to scams and spam increased and was the most common impact (62% vs 52% in 2023).
• Only 10% say organisations’ real-world practices are usually fair, while 35% say they are mostly or always unfair
• Around 9 in 10 say it is not fair and reasonable to use personal information for selling/trading personal information (96% vs 87% in 2023), online tracking, profiling and targeted advertising to children (96% vs 89% in 2023) or other vulnerable individuals (95% vs 88%), unnecessary location tracking (94% vs 87%), training AI models/products (93%), significant AI-informed decision (91% vs 70%), differential pricing (91%), or targeted advertising based on sensitive data (91% vs 84% in 2023). Around 7 in 10 (71%) consider it unacceptable for organisations to use personal information provided for a service to train AI systems after the service has been completed
• Individuals view the provision of basic identifiers to access a service as reasonable, but 92% say there are some types of information organisations should never collect. Information about sexual orientation (72%) and biometrics (71%) feel excessive or unjustified in most situations, regardless of the organisation or purpose
• Trust remains highest for health service providers (74%) and government agencies (68%), but has fallen across insurance, telecommunications, technology, retail and real estate sectors since Trust is lowest for social media companies (3% vs 14% in 2023), data brokers and AI companies (4%).
• 40% do not really know what data organisations hold about them or how to access it, while 11% say they can easily access their data and request corrections or deletion
• 64% had concerns in the past year, but 52% did not raise them. Among non-complainants, 56% said it would not make a difference, 51% said it would be too hard/time-consuming, and 40% did not know how. Among those who did complain, only 9% said the issue was resolved to their satisfaction
• Confidence in privacy complaint handling varies by sector, with banks and financial institutions (46%), health services (42%) and government agencies (41%) rated highest, and very low confidence in online retailers (4%) and social media platforms (3%).
• 93% support a legal right to request deletion of personal information, and there is strong support for extending equivalent privacy obligations to currently exempt sectors
• The biggest privacy risks identified by Australians include:
  • data breaches (82%, up from 74% in 2023)
  • organisations not storing personal information securely (77%, up from 60% in 2023)
  • scammers attempting to access personal information (75%, up from 71% in 2023)
  • organisations sending information overseas (70%, up from 50% in 2023)
  • concern about AI systems using personal information (69%, up from 43% in 2023).

  Together, these findings suggest that perceived privacy risks are linked to weaknesses in organisational systems, poor information handling and security by organisations, and harmful actions by outside parties.

Read the rest of this entry »

Last Friday, 28 May 2026, the New South Wales Parliamentary Research Service has released a Report, NSW privacy law and the new tort of serious invasion of privacy. It is authored by Barbara McDonald, Professor Emerita of the University of Sydney Law School. Professor McDonald conducted the Australian Law Reform Commission enquiry into digital privacy which was published as the Serious Invasions of Privacy and the Digital Era in 2014.

Key aspects of the Report are:

Concept of privacy

• It is generally used to refer to privacy of information, privacy of communications and personal privacy, with the last aspect being the most general and undefined in scope.
• The right to privacy is recognised in the Universal Declaration of Human Rights and the International Covenant of Civil and Political Rights 1966 (ICCPR), which was ratified by Australia in 1980.⁴ Article 17 of the ICCPR provides that:

1. 1. No one should be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.
   2. Everyone has the right to the protection of the law against such interference or attacks.

• Ultimately, privacy underpins individuals’ ability to live fulfilled lives by allowing them to develop autonomy, forge family and other relationships, develop independent thoughts and opinions, obtain assistance when necessary, and communicate with others on matters of social, personal and democratic importance.
• Personal privacy encompasses bodily privacy and privacy in physical places.
  • Bodily privacy underpins physical safety, integrity and personal dignity.
  • Privacy in physical spaces underpins personal security and safety as well as freedom of movement and association.
  • Personal privacy may also be said to encompass the rights to a family life which are recognised in international covenants
• Informational privacy refers to privacy over information or data, in whatever form, about a person, including their relationships, their activities and their movements. It:
  • may or may not be classed as confidential information, depending on the circumstances. It includes health information and personal financial information.
  • overlaps with other aspects of privacy as disclosure of private information about a person can affect their relationships, dignity, security and freedoms.
• Communications privacy:
  • refers to all manners and forms in which a person or entity may communicate with others, and may include draft or unsent communications.
  • overlaps with informational and personal privacy due to the human interaction involved in, and the content of communications. Examples might relate to personal correspondence between people in a relationship or closed group, or between a professional advisor and patient or client. The digital revolution and technological advances providing new ways to communicate have also opened up new ways to invade communications and other aspects of privacy

Existing privacy laws

• the common law of Australia has not kept up with the law developed elsewhere. Further, the absence of Australia-wide human rights legislation such as in the United Kingdom or New Zealand has no doubt meant that the springboard for the courts to develop private remedies is also absent.

• Bodily privacy is protected in the common law by the torts of trespass to the person (which includes battery, involving non-consensual physical interference) and assault (which involves threats of imminent violence). These tort actions provide no protection against indirect interferences such as visual snooping or photography or filming of a person without consent, nor against the use or communication of such footage

• Any unlawful entry is a trespass to land. While there is implied permission to enter for a range of lawful purposes, an entry for a purpose outside those lawful purposes will be treated as trespass and a person in breach of the entry conditions may become a trespasser. Media crews have been sued for trespass in such cases
• A limitation of existing law is that only the occupier with exclusive possession could sue for trespass
• The tort of private nuisance protects an occupier’s quiet enjoyment of their land and premises from a substantial interference caused by the extraordinary activities of a neighbour or other person outside the land
• Confidential information–information imparted under an obligation to keep it confidential–has long been protected by the courts, ever since Prince Albert obtained an injunction to stop the publication of descriptions of Queen Victoria’s private etchings of their family life which had been entrusted just for personal copies to be made
• Where photography is taken in an intimate context it is an actionable breach of confidence, remedied by an injunction and/or damages, to communicate those images or recordings to third parties without consent
• the law on confidential information may not necessarily protect private information fully: it may not have been imparted under an obligation to keep it confidential; it may have become publicly or widely known (and yet still be private in nature); and the law on breach of confidence is usually more concerned with preventing misuse or disclosure than remedying injured feelings after the breach
• The Telecommunications Interception and Access Act 1979 (Cth) applies to communications using telecommunications. Section 7 prohibits the interception of a communication passing over a telecommunications system and makes it unlawful to authorise or permit or enable another person to intercept such a communication. It only applies to interceptions during the passage of communications over a network. It does not, for example, apply by placing a tape recorder beside the telephone receiver (although state legislation may then apply
• in NSW is the Surveillance Devices Act 2007 (NSW) which provides important, but not complete, protection for personal and communication privacy. This Act provides that a person must not knowingly install, use or maintain a listening device to overhear, record, monitor or listen to a private conversation. Among the exceptions is where all principal parties consent to the recording.  A private conversation is defined as a conversation carried on in circumstances that may reasonably be taken to indicate that any of the parties’ desire to be heard only by themselves or by someone to whom they have given consent. It does not include a conversation in which the parties ought reasonably to expect that it may be overheard by someone else
• With regard to optical devices, a person must not knowingly install, use or maintain an optical surveillance device on or within premises or a vehicle to record visually or observe the carrying on of an activity where that involves entry on the premises or a vehicle without the consent of the owner or occupier or interference with the vehicle
• The Privacy Act 1988 (Cth) regulates the use of personal information by Commonwealth and other government entities, commercial entities or corporations with an annual turnover of more than $3 million, and small business entities that deal in personal or health information. Other small business entities holding personal information are not regulated by the Act. Personal information is defined as ‘information or opinion about an identified individual, or an individual who is reasonably identifiable, whether or not true and whether or not in material form’. Information about an individual may come within the definition even though it is not, in fact, what would be considered to be private or confidential information.
• The Privacy Commissioner, as a member of the Office of the Australian Information Commissioner (OAIC), is charged with overseeing and enforcing the operation of the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs) contained in that Act
• The consequence of an entity not complying with, for example, the Australian Privacy Principles or other provisions of the Privacy Act 1988 may be an adverse determination by the Commissioner. The entity may seek a review of that determination by the Administrative Review Tribunal or commence judicial review proceedings. Orders to enforce the Commissioner’s determination may be made by the Federal Court of Australia
• The limitations of privacy legislation are that is the lack of a private or direct remedy in the courts for an individual who has been adversely affected by a breach of the legislation, rather than the indirect and time-taking route of seeking a determination to be enforced in federal courts. Importantly, this omission also reduces the availability of class actions which may be a more economical route than individual actions for a group of people adversely affected by a breach
• There is an exemption for media organisations for acts and practices carried out ‘in the course of journalism’; with the latter term not being defined. To be protected by this exemption, the media organisation must show itself to be bound by a code of practice, a form of self-regulation. It has been commented that the ‘level of protection [of personal privacy] that these codes provide in practice is questionable.’That will continue to be so, given that the exemption for journalists and media organisations under the new tort, as discussed in the next section, does not depend on their compliance with industry codes of conduct

Read the rest of this entry »