Initially foreshadowed in late 2022, and following community consultation which commenced in 2019, the WA Government announced yesterday that it is pressing ahead with the introduction of new privacy and responsible information-sharing (PRIS) laws designed to ensure the strong protection and safe handling of personal information held by the WA Government.
With a number of other States and Territories already having specific data privacy legislation, the new WA-specific data privacy legislation will fill the legislative gap in WA, while the inclusion of responsible information-sharing laws is described by the WA Government as an "Australian-first".
From a privacy law perspective, the key elements of the proposed new laws include:
- The introduction of Information Privacy Principles (IPPs) – It is envisaged that the IPPs will address the collection, use, disclosure and handling of personal information by the WA public sector.
- A mandatory data breach notification scheme – This will require a WA public sector organisation to notify the Information Commissioner of a serious data privacy breach involving personal information.
- Appointment of an Information Commissioner and Privacy Deputy Commissioner – The new PRIS laws will be overseen by a new body, the Office of Information Commissioner, headed by the Information Commissioner, a Privacy Deputy Commissioner, and an Information Access Deputy Commissioner (the latter representing a continuation of the current Freedom of Information Commissioner's function). The WA Government has said that the new Information Commissioner and Privacy Deputy Commissioner will be equipped with robust powers to consider and resolve privacy complaints.
The information-sharing component of the PRIS laws has been designed to balance the protection of personal information against the safe flow of WA Government information in order to deliver community benefits. The operation of the information-sharing laws will be overseen by a Chief Data Officer, who will lead and develop public sector capability for responsible information-sharing.
It had been anticipated that the introduction of the PRIS laws might be delayed pending the outcome of the Commonwealth Government's review of the Privacy Act 1988 (Cth). With proposed amendments to that Act set to be introduced as soon as August this year, there will be significant interest in whether the WA PRIS laws seek to incorporate any of the anticipated changes to the Privacy Act 1988 (Cth), in substance if not form.
WA Government agencies have been tasked with undertaking a PRIS assessment and readiness program in anticipation of the introduction of the new laws. With the introduction of the laws now imminent, efforts to ensure that the WA public sector is ready will need to continue.