Australia

OAIC led by the Australian Information Commissioner. Powers include investigations, determinations, enforceable undertakings, and civil penalty proceedings.

Consent or reasonable necessity for primary purpose. Consent must be informed, voluntary, current, and specific. Reform proposals to strengthen consent requirements.

Rights to access and correction. No current right to erasure (reform underway). No data portability right yet. Right to complain to OAIC.

APP 8 requires reasonable steps to ensure overseas recipient complies with APPs. Transferor remains liable for overseas recipient's breaches.

Notifiable Data Breaches (NDB) scheme since 2018. Must notify OAIC and affected individuals of eligible data breaches likely to cause serious harm.

No mandatory DPO. However, APP entities must take reasonable steps to implement practices, procedures, and systems for compliance.

No specific age threshold in current law. Children's Privacy Code being developed as part of reforms. Age verification and parental consent mechanisms expected.

Substantially increased in 2022: up to AUD 50 million, 30% of turnover, or 3x benefit obtained. Previously capped at AUD 2.1 million. Active enforcement post-Optus and Medibank breaches.

My Health Records Act for health data, Consumer Data Right (CDR) for banking/energy, Telecommunications Act for metadata retention, Credit Reporting Code.

No specific cookie consent requirement. Spam Act covers commercial electronic messages but not cookie consent. Reform may introduce cookie/tracking provisions.

Voluntary AI Ethics Framework (8 principles). No specific legislation yet. Privacy Act reform may introduce rights regarding automated decisions.

No general data localisation requirement. Government data may be subject to hosting requirements under Hosting Certification Framework.

No direct equivalent. Privacy Act applies based on annual turnover threshold (AUD 3 million) with exemptions for small business.

APPs apply to Australian Government agencies. Freedom of Information Act provides access rights. National security agencies have some exemptions.