Navigating Privacy Laws: GDPR vs Australia Privacy Act

Aspect

GDPR

Article 3

APA 

Section 5,5B, 6

The APP entities include government agencies and private sector organizations with an annual turnover exceeding AUD 3 million, along with smaller entities in specific categories, such as health service providers and businesses trading in personal information.

The APA also applies to organizations with an Australian link. Entities considered to have an Australian link include an Australian citizen or a person with permanent residency in Australia, a partnership/trust/ body corporate formed or incorporated in Australia, or an unincorporated association whose central management and control are based in Australia.

• Both the GDPR and the APA have extraterritorial reach, thus, compelling international compliance.

Aspect

GDPR

Article 2, 4(2)

APA 

Section 3, 6C(4), 7B, 16

• anonymous data that cannot be linked to any individual;
• personal data used solely for personal or household activities, excluding business or professional purposes; and
• data processing by law enforcement or national security agencies.

• personal information handled for personal, family, or household purposes;
• acts by individuals outside of business activities; and
• employee records and journalistic practices.

• Thus, the GDPR has a broader material scope and provides a definition of  ‘processing’. In comparison, the APA  does not define ‘processing’. However, as per Section 3, it applies to the ‘collection, holding, use, correction or disclosure of personal information.

Term

GDPR

Article 4,9

APA 

Section 6, 26WA, APP11

Personal Information under APA

•  whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not.

Thus, while the GDPR focuses on specific identifiers and indirect identification, the APA takes a broader approach, including opinions as well as information.

Individuals have the right to withdraw their consent at any time, where consent is the legal basis for processing.

Express consent occurs when it is given clearly and explicitly, either verbally or in writing, such as by signing your name. On the other hand, implied consent is when an organization reasonably believes they have permission to handle non-sensitive personal information without explicit verbal or written consent.

Similar to the GDPR, consent can be withdrawn at any time.

Sensitive Information under the APA

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic data;
• biometric data processed solely to identify a human being;
• health-related data; or
• data concerning a person’s sex life or sexual orientation.

• racial or ethnic origin;
• political opinions, religious beliefs or affiliations;
• philosophical beliefs;
•  membership of a professional or trade association and unions;
• sexual orientation or practices; criminal record;
• health information
• genetic information
• biometric information used for automated biometric verification or biometric identification; or
• biometric templates.

• The GDPR’s definition of personal data includes both direct and indirect identifiers of individuals. The APA takes a broader approach, including information and opinions about identifiable individuals.
• GDPR mandates consent to be explicit, informed, and unambiguous. In contrast, the APA distinguishes between express consent (clearly given) and implied consent (reasonably inferred). Both laws address sensitive data/information, but the GDPR’s list is more focused, while the APA includes additional categories like criminal records.
• The GDPR defines pseudonymization as processing that separates data from an individual, with additional safeguards. The APA lacks a pseudonymization definition but uses ‘de-identified’ to describe data that no longer identifies an individual.
• GDPR clearly defines data controllers and processors with specific roles. The APA broadly uses the term ‘APP entities’ to cover all entities involved in data handling without distinct definitions for controllers and processors.

GDPR

APA 

Article 6

APP 3

• the data subject has given consent for specific purposes;
• it is necessary for the performance of a contract or to take steps prior to a contract at the data subject's request;
• it is needed to comply with a legal obligation;
• it is necessary to protect the vital interests of the data subject or another individual;
• it is required for tasks carried out in the public interest or under official authority; and
• it is necessary for the legitimate interests of the controller or a third party, provided these interests are not outweighed by the rights or interests of the data subject.

Additionally, collecting sensitive information requires the individual’s consent unless an exception applies.

GDPR

APA

Article 24, 32

APP 11

• pseudonymization and encryption of personal data;
• ensuring the confidentiality, integrity, availability, and resilience of processing systems;
• the ability to restore access to personal data promptly after an incident; and
• regular testing and evaluation of security measures.

The level of security should be determined based on the risks, particularly those involving accidental or unlawful destruction, loss, alteration, or unauthorized access to personal data.

GDPR

APA

Article 5(c)

APP 3

GDPR

APA

Article 12,13,14, Recital 39

APP 1.3, APP 1.4

• concise;
• transparent;
• easily accessible;
• written in clear language (especially if it pertains to children); and
• written or electronic form, or even orally upon request with appropriate identity verification.

The notice should include specific details based on whether the personal data is collected directly from individuals or indirectly from third parties. Moreover, when collecting data directly, the notice must disclose:

• the organization's identity;
• contact details of the data protection officer;
• purpose and legal basis for processing personal data;
• recipients of the data;
• details of any international transfers with appropriate safeguards;
• the period for which data will be stored;
• information about data subject rights and how to exercise them;
• the right to revoke consent at any time;
• the data subject's right to complain to a supervisory authority;
• the existence of automated decision-making, including profiling; and
• whether providing personal data is mandatory under legal or contractual obligations.

When personal data is obtained indirectly from third parties, the notice, in addition to the above information, must also include:

• Information about the categories and sources of data.
• Clarification if the data was obtained from publicly available sources, ensuring transparency and compliance with the GDPR requirements.

• the organization's name and contact details;
• types of personal information collected;
• collection and storage methods
• reasons for data collection;
• usage and disclosure of personal information;
• access and correction procedures
• complaint process for mishandling; and
• potential overseas disclosures and, if possible, the countries involved.

Moreover, Section 95B of the APA requires agencies entering into Commonwealth contracts (Commonwealth or an agency) to include provisions ensuring that contracted service providers do not engage in practices that would breach the APPs.

GDPR

APA

Article 12

APP 1

GDPR

APA

Article 21(2), Recital 47

Directive 2002/58/EU Article 13(1)(2)

APP 7

• must either obtain explicit consent from individuals, or
• demonstrate that the marketing activities fall within their legitimate interests.

Moreover, recipients must always be able to opt out of further communications, and every marketing message must include a clear opt-out option.

Organizations cannot use personal information for direct marketing unless certain conditions are met. There are:

• if the information was collected from the individual;
• the individual would reasonably expect it to be used; and
• a clear opt-out option is provided.

In addition, individuals have the right to opt out of marketing and request the source of their information, and organizations must promptly respond to these requests.

Permitted transfers include:

• Adequacy Decision: The EU Commission confirms the destination country offers adequate protection.
• Appropriate Safeguards: These include binding corporate rules, standard clauses, approved codes of conduct, certification mechanisms, or legal agreements between public authorities.
• Derogations: Allowed in specific cases, such as explicit consent, contractual necessity, public interest, legal claims, vital interests, or when data comes from a public register.

If the transfer cannot be based on adequacy requirements or appropriate safeguards and no derogations apply, transfers may still occur if they are non-repetitive, involve a limited number of data subjects, are necessary for compelling legitimate interests, and have suitable safeguards. The controller must notify both the supervisory authority and the data subject of the compelling legitimate interest.

Moreover, an APP entity that discloses personal information to an overseas recipient remains accountable for any actions or practices of the recipient that would violate the APPs unless certain exceptions apply (16C). Other legal grounds for data transfers include:

• compliance with Australian laws or court orders;
• explicit consent from the data subject, with acknowledgment of the lack of APP enforcement; or
• transfers by Commonwealth Government agencies under international agreements or for enforcement activities.

Furthermore, disclosure is permitted in the following circumstances:

• lessening or preventing a serious threat to life, health or safety;
• taking appropriate action in relation to suspected unlawful activity or serious misconduct;
• locating a person reported as missing;
• necessary for a diplomatic or consular function or activity; and
• necessary for certain defence force activities outside Australia.

• purposes of data processing;
• categories of data subjects and personal data;
• data retention periods;
• data transfers to third countries;
• time limits for the erasure of different data categories (if possible); and
• technical and organizational security measures in place to protect the data.

• descriptions of processing activities and purposes;
• assessment of necessity, proportionality, and risks; and
• strategies and safeguards to mitigate risks.

The data protection officer should be involved in the DPIA if one is appointed.

• identifying privacy risks;
• assessing compliance;
• engaging with affected parties to understand their privacy concerns and expectations; and
• implementing safeguards.

• processing is conducted by a public authority or body (excluding courts in their judicial capacity),
• core activities involve large-scale processing requiring regular and systematic monitoring of data subjects, or
• core activities involve large-scale processing of special categories of data or data related to criminal convictions and offenses.

The contact details of the DPO must be published and communicated to the supervisory authority.

• act only on the controller’s documented instructions.
• implement appropriate security measures.
• assist with data protection obligations, including responding to rights requests and conducting impact assessments.
• maintain records of processing activities.
• engage contracted sub-processors only and with the prior written agreement of the data controller.
• notify the controller of data breaches promptly.
• delete or return data after processing ends, unless legally required to retain it.
• provide information for GDPR compliance and support audits.

Consequently, third parties that process information are also responsible for implementing security measures and ensuring compliance with the APPs.

Articles 12, 13, and 14

 N/A

Article 15

(APP 12)

Article 16

APP 13

Article 17

APP 11.2

Article 18

Article 20

Article 21

APP 7

Article 22

Article 68

OAIC Website: Guide to Privacy Regulatory Action

Article 58

 Section 40

Article 58

 Part V

Article 83

Section 13G

Article 58

Section 52

Article 58

Section 28(2)

Article 78

Section 96

Article 60-67

OAIC Website: International Networks

• Both GDPR and the APA grant substantial investigatory authority, including on-site audits, though the GDPR provides a more detailed framework. The two legislations also offer a range of compliance actions.
• GDPR fines can be up to 4% of global turnover, making them generally higher than the APA's maximum penalties, which are based on benefits gained or turnover.
• Both regulations allow for public disclosure of enforcement actions, with the GDPR specifically covering sanctions and the APA encompassing broader regulatory activities.