# Submission on the Privacy Amendment (Personal Data Protection) Bill 2026

**Author:** Adrian Wedd  
**Date:** 6 September 2026  
**Consultation:** Attorney-General's Department — Privacy Reform consultation  
**Publication/confidentiality preference:** Publish with name

I support the Bill's objective fair-and-reasonable standard. Consent should not turn unfair handling into fair handling. Protections for derived sensitive information and sensitive proxies, precise geolocation tracking data, children's interests, and harm and proportionality deserve credit. Contextual de-identification prevents entities relabelling their own linkable information as anonymous. Trading consent adds protection within its scope.[1] The identification duty also limits technical grounds for refusing access, although it does not guarantee access.[2]

But the Bill also replaces separate limits with balancing factors, then switches that balance off in specified circumstances. It never expressly asks entities to confront the informational power of the profile they have already accumulated. A stronger general rule is being asked to carry more weight than its supporting safeguards reliably bear.

## 1. Don't replace purpose limits with a balancing factor

The Bill repeals APP 6. Proposed APP 3.2(b) asks whether handling “relates to one or more of the APP entity’s functions or activities”. That is different from compatibility with the purpose of collection. Expectations still matter, and APP 3 may prohibit reuse currently permitted on consent. Nevertheless, a balancing factor does not preserve a separate purpose restriction.[3]

Require a compatible further purpose, consent or an express statutory basis alongside APP 3, with strict necessity requiring that no equally effective, less intrusive means is available. Enact the paper's assurance that sensitive information collected under APP 4.3(d) is subsequently used or disclosed only to deliver the requested goods or services. Coordinate legal and safety exceptions, and consent or another statutory basis for a genuinely different purpose.[4] A person should not have to win a balancing dispute to enforce a purpose boundary the Act could state directly.

## 2. Keep compatible safeguards when the fairness test is switched off

APP 3.3 disapplies the fairness requirement for handling required or authorised by Australian law or court/tribunal order, permitted general situations and, for organisations, permitted health situations. APP 3.2's minimisation and child-interest factors then have no independent operation. Current APP 3.5's separate duty to collect by lawful and fair means is not retained.[5]

The gateways have their own conditions; urgent or compelled handling should not require another full balance. Preserve lawful and fair collection means, minimisation and children's best interests as a primary consideration so far as compatible with the exception. Where legislation expressly settles the issue, it should govern. Extend proposed subsection 16A(3)'s written-note model to exception reliance for ongoing consequential monitoring.[5] An exception should not excuse avoidable intrusion where discretion remains.

## 3. High-risk decisions should leave a record

The Bill does not expressly require a written APP 3 assessment before defined high-risk operations or after material change. Governance duties and the Commissioner's power to direct agency assessments matter, but do not supply that requirement.[6] Investigative powers cannot guarantee access to contemporaneous reasoning that was never recorded.

Build on subsection 33D(3)'s privacy impact assessment definition. Require proportionate assessments for combined-source or combined-purpose information used to inform decisions about access to, or terms for, goods or services; large-scale sensitive handling; and consequential or marketing profiling of children. Before deployment, entities would record purposes, alternatives, necessity, proportionality, cumulative holdings, risks and safeguards. Require reassessment when purpose, sensitivity, scale, model capability, affected population, recipients or foreseeable harm materially changes. Confine this obligation to defined risks, with clear thresholds applicable before deployment.

## 4. Assess the profile, not just the next piece of data

APP 3 can already capture combination risks. But it assesses an act, while informational power accumulates across acts. One data point can reveal much more when added to years of location, purchasing and browsing information. No factor expressly names the nature, volume and range of existing holdings.[7] If accumulated holdings matter to fairness, the Act should say so.

Add APP 3.2(h), addressing existing holdings and how the proposed act changes the entity's capacity to analyse, predict or influence the individual. Add a note to section 6FD reflecting the paper's contextual explanation: information about a class may relate to an identified or reasonably identifiable individual when used, or capable of use, to influence a decision affecting them.[7] The connection must be substantive; not every statistical model is personal information.

## 5. Let people object to the marketing use, not just the message

The replacement APP 7 reaches personalised onsite advertisements, including targeting someone as a class member. But its objection concerns communications. Current APP 7.6(b), (d) and 7.7(a) also let people stop use or disclosure facilitating other organisations' marketing. That protection is not repeated. A communication opt-out alone need not stop someone's information being used to build or measure audiences when no message reaches them; APP 3 still governs that use.[8]

Restore that control and extend the objection to handling for direct marketing, including related profiling and audience construction. Preserve only the suppression information needed to honour it. Retain a separate consent condition for using or disclosing sensitive information for direct marketing, coordinated with the collection and trading rules.[8] People should be able to refuse being used to build the machinery that decides who receives the messages.

## 6. Publicly available is not the same as voluntarily public

APP 4.3(b) excepts sensitive collection from consent where “the information is collected from a publicly available document”. It does not distinguish deliberate self-publication from third-party or involuntary exposure. Public availability alone should not remove this protection; the exception itself does not disapply APP 3 fairness.[9]

Confine it to information deliberately made public by the individual, preserving express routes for public registers, journalism, scrutiny of public conduct, research and independently justified public interests. Clarify whether it covers sensitive information derived from public material, including whether the timing rules in subsection 6AAA(3) produce different outcomes for intended and incidental derivation.[9] Entities should check publication provenance and the consent or exception basis before collecting.

The Bill can remain flexible while giving people clearer boundaries to enforce. Where it relies on judgment, that judgment should be reviewable. Where fairness is displaced, compatible safeguards should survive. And where systems gain power by accumulating information, the assessment should expressly confront that power.

## Drafting corrections

- Coordinate commencement of the research changes with the guidelines, or clarify “(if any)” in s 94B(1)(e), so the transition does not depend on an uncertain reading. (Bill s 2; Sch 5 items 2, 7, 10, pp 49, 51.)
- Correct the reference to nonexistent APP 14.4(c) in Sch 4 item 7. The written-notice duty is in APP 14.4(b)(ii). (Bill pp 45–47.)
- Change the references to “paragraph 4.2(a)” in APP 3.3 Note 2 and APP 4.6(a) Note 2 to 4.3(a). (Bill pp 13, 16.)
- Reconcile APP 11.4(a)'s “may include technical or organisational measures” with current APP 11.3's “include technical and organisational measures” and the paper's stated preservation of that requirement. (Bill p 40; Act APP 11.3; Paper p 30.)

## Source notes

“Bill” means the exposure draft *Privacy Amendment (Personal Data Protection) Bill 2026*. “Paper” means the Attorney-General's Department *Privacy Reform – Consultation Paper*. “Act” means the *Privacy Act 1988*, compilation C2026C00227, 4 June 2026. Bill and paper page references are printed pages. Proposed provisions are distinguished from current Act provisions below.

1. Bill Sch 1 item 9, s 6AAA(2)–(4), pp 4–5; item 12, ss 6FF, 6FE(f), 6FG, pp 6–7; Sch 2 item 10, APPs 3.1–3.3, 4.2, 4.6, pp 12–16. The fairness standard is subject to the Bill's exceptions; consent is not itself an exception. Trading is defined by proposed s 6FC (Sch 2 item 7, pp 10–11).
2. Bill Sch 3 item 22, APP 11.4(b), p 40; Sch 4 item 1, APP 12.3A, p 41. Identification is required for APPs 11.1–11.2; the access exception requires reasonable steps and applies only to the extent access remains unreasonable or impracticable due to technical impossibility or infeasibility.
3. Bill Sch 2 items 10–11, APPs 3.1–3.2 and repeal of APP 6, pp 12–13, 16; Act Sch 1, APPs 3.1–3.3, 6.1–6.3. Paper pp 11–12: original purposes remain relevant to fairness, but no express consent requirement is retained for unexpected or unrelated secondary uses.
4. Bill Sch 2 item 10, APPs 4.3(d), 4.4–4.5, p 15; Paper p 17, “Strictly necessary”. APP 4.4 conditions collection; it does not enact the paper's subsequent-use/disclosure restriction. APP 4.5 already excludes direct marketing from this strict-necessity exception.
5. Bill Sch 2 item 10, APPs 3.1(b), 3.2(d), (g), 3.3, pp 12–13; items 17–18, s 16A(1), (3), pp 17–21. Proposed s 16A(3) requires a note of use or disclosure under table item 10. Act Sch 1, APPs 3.4–3.5: the fair-means duty applies alongside sensitive-collection exceptions. APP 3.3 does not disapply lawfulness or all other privacy duties.
6. Bill Sch 2 item 10, APPs 3.1–3.2, 5.1–5.3, pp 12–13, 16; Sch 3 item 22, APPs 11.4–11.5, p 40; Act Sch 1, APP 1.2; s 33D(1), (3)–(4), pp 249–250. Section 33D permits the Commissioner to direct an agency assessment; the requested duty would expressly cover defined high-risk operations, including those of organisations. APP 11.5's regular evaluation concerns compliance with APPs 11.1–11.2.
7. Bill Sch 2 item 10, APPs 3.1–3.2, pp 12–13; Sch 1 item 12, s 6FD and Notes 1–2, p 6. Paper pp 4–5, “Relates to”: contextual influence on decisions is relevant, but a tenuous, remote, incidental or trivial connection is insufficient. The proposed factor and note are recommendations, not existing text.
8. Bill Sch 2 items 25, 27, definition of *direct marketing* and APPs 7.1–7.7, pp 23–24; Act Sch 1, APPs 6.7(a), 7.4–7.8. Current APP 7, rather than APP 6, supplies the marketing comparator. The proposed purpose-level objection extends the former facilitation right; it is not a claim that current law gives a general profiling veto. Other applicable marketing legislation remains relevant.
9. Bill Sch 2 item 10, APPs 3.3, 4.1, 4.3(b), pp 13–14; Sch 1 item 9, s 6AAA(2)–(4), pp 4–5; Act Sch 1, APPs 3.3–3.4; Paper pp 16–17. Current APP 3.4 has no general public-document exception. The derived-sensitive interaction is unresolved here; neither consent-free derivation nor its categorical exclusion is asserted.