Australia's Privacy Act 1988 governs covered entities' handling of personal information under the Privacy Principles. For payments, it covers transparent collection, secure processing, access and correction, disclosures and cross-border transfers, alongside breach notifications.
TL;DR:
- 13 Privacy Principles govern covered personal-data collection, use, security and access.
- Payment customer and transaction information is covered where it is personal information.
- Eligible breaches can require notification; statutory coverage and exemptions still matter.
Summary
Who the Privacy Act covers
The Privacy Act 1988 applies to most Australian Government agencies and covered private-sector organisations, collectively described as APP entities. Coverage includes organisations above the statutory turnover threshold and specified other organisations, with exemptions and additional rules that must be considered. A payment firm’s size, activities and legal position therefore matter; the use of payment technology is not itself the coverage test. The Office of the Australian Information Commissioner administers the privacy framework.
Personal information through a payment journey
The 13 Australian Privacy Principles govern matters including transparent handling, collection, use and disclosure of personal information. In a payment relationship, customer identification, contact details and transaction information can be relevant where they identify or reasonably identify an individual. The principles concern the handling of that information, rather than only whether a payment is successfully authorised. Connecting the data to the purpose for which it is collected is central to understanding privacy responsibilities across the customer journey.
Security, access and cross-border handling
The APP framework addresses reasonable security measures and individuals’ access and correction rights, alongside conditions governing disclosure, including disclosure overseas. A payment operation may involve processors, cloud services and counterparties in several locations, making the roles and actual information flow relevant. The Act’s privacy requirements sit alongside financial-crime and payment obligations; collecting information for one legal purpose does not automatically settle every question about subsequent use, disclosure or retention.
Breach response and specialised provisions
The Act also contains the Notifiable Data Breaches scheme and specialised provisions for matters such as consumer credit reporting and tax file numbers. Whether a breach is notifiable depends on the applicable statutory conditions, so every technical incident should not be described as automatically requiring the same notice. OAIC’s APP and breach guidance provide the practical detail. For a payment product, the relevant assessment therefore combines entity coverage, the personal information involved and the particular handling or incident being examined.
Keywords
- Australia privacy
- Privacy Act
- personal information
- APPs
- credit reporting
- data security
- breach notification
- access rights
- correction requests
- coverage exemptions