Tranche 1 Passes: The Privacy Act Gets a Tort, a Children's Code and ADM Notices

It is Wednesday, 11 December 2024, and somewhere in Australia a privacy policy is waking up. It was last edited in 2019 by someone who has since left the company. It lives at /privacy, linked from the footer in eleven-pixel grey type, between "Careers" and a cookie icon nobody has ever clicked on purpose. It has not been read by a human since the intern proofread it, and the intern skimmed.

Yesterday, the Governor-General gave Royal Assent to the Privacy and Other Legislation Amendment Act 2024. At midnight, most of it switched on. Since this morning, that sleepy privacy policy can, in principle, earn its owner an infringement notice from the Australian Information Commissioner without anyone going near a court. Australians also have a new statutory tort for serious invasions of privacy on the way, the Information Commissioner must write a Children's Online Privacy Code, and a doxxing offence now carries up to seven years in prison.

If your first reaction was to open /privacy in a new tab and stare at it, I understand. Put the kettle down. Nothing is on fire. Most of what changed is a power the regulator now holds or a duty that starts in 2026. But the Privacy Act has grown teeth you can count, and you should know which ones bite now.

Some context for how long this has taken. The Attorney-General released the Privacy Act Review Report in February 2023, with 116 proposals. In September 2023, the government agreed to 38 of them, agreed "in principle" to 68 and noted 10. I wrote about the review and then the government's response at the time, with what I can only describe as optimism. The Attorney-General calls what passed last month "a first tranche of recommendations", and "just the first stage". So this is a slice, not the whole wheel.

Here is the plan. First, how a law actually switches on, because the dates in this Act are where most of the confusion will come from. Then the four things that matter most to anyone who runs a website, an app or a data team: the new penalty ladder, the statutory tort (which, I am delighted to report, starts with Tasmanian possums), the transparency duty for automated decisions, and the Children's Online Privacy Code. Then what tranche 1 left out, a made-up product manager working through it all, and a checklist for this week.

Let's get into it.

Part 1: How a Law Switches On

You already know the difference between a thing being decided and a thing being in effect. Your council votes for a new bin day in March, and the truck changes in July.

Laws work the same way, with more Latin. A bill passes both Houses of Parliament. Then the Governor-General signs it, which is called Royal Assent, and it becomes an Act. Then each part of the Act commences, which is the lawyer's word for "starts to apply". Those can all be different days.

The timeline, briefly

The Privacy and Other Legislation Amendment Bill 2024 had a short, busy life. According to Parliament's record of the bill:

• 12 September 2024: introduced in the House of Representatives.
• 6 November: passed by the House.
• 14 November: the Senate Legal and Constitutional Affairs Legislation Committee tabled its report, recommending the bill pass with 10 recommendations for amendments.
• 28 November: passed by the Senate, with 35 government amendments.
• 29 November: the House agreed to those amendments, and the bill "finally passed both Houses".
• 10 December: Royal Assent. It is now Act No. 128 of 2024.

It passed in the last sitting week of the year, in the same rush as the social media minimum age law for under-16s. That is a different law, and I will keep them apart, because people are already blending the two at barbecues.

The commencement table

Every modern Commonwealth Act opens with a commencement table: a list of its parts in one column, and in the next column, a rule for when each one starts. This is where this Act gets interesting, because it has four different start rules.

1. The day after Royal Assent. That covers most of Schedule 1 (the privacy reforms, Parts 1 to 14) and Schedule 3 (the doxxing offences). Assent was 10 December, so these commenced today, 11 December 2024.
2. On a day fixed by Proclamation, or after six months. That is Schedule 2, the statutory tort. The government can switch it on by Proclamation. If it does not within six months of assent, it switches itself on the day after that period ends. So the tort is coming no later than 10 June 2025.
3. The day after a 24-month period. That is Schedule 1, Part 15, the automated decision rules. Count 24 months from 10 December 2024 and take the next day: 10 December 2026.
4. A 24-month deadline for the code. The Children's Online Privacy Code is not on the commencement table, because the Act does not write the code. It tells the Information Commissioner to develop and register it within 24 months of assent, so by December 2026.¹

So, as of this morning: the new penalties, enforcement powers and doxxing offences are live, the tort is pending, and the automated decision duty and the children's code are two years out. That list decides what you do this week and what goes in next year's plan.

Part 2: The Penalty Ladder

Before 2022, the biggest fine under the Privacy Act was $2.22 million. Then came the Optus and Medibank breaches, and in November 2022 Parliament raised the maximum for serious or repeated interferences with privacy to the greatest of $50 million, three times the benefit obtained, or, if the benefit cannot be worked out, 30 per cent of a company's adjusted turnover for the relevant period.

That is a very big stick. It had one problem: it was the only stick. Picture a ladder with one rung, at the top, fifty million dollars up. To use it, the regulator had to go to court and prove the interference was serious or repeated. For a privacy policy that does not say how to make a complaint, nobody is climbing that ladder. Tranche 1 adds rungs underneath it.

Penalty units, the currency of fines

Commonwealth laws rarely write fines in dollars. They write them in penalty units, a unit of account whose dollar value the government indexes from time to time. As of the Parliamentary Library's Bills Digest in November 2024, one penalty unit is $330. For these civil penalties and for infringement notices, a company faces five times the individual amount, because the general Commonwealth rules multiply the units for a body corporate.²

With that in hand, here are the rungs, from the top down.

Rung 1: Section 13G, "serious"

Section 13G is the 2022 penalty, with the same maximums. Tranche 1 tidies it up. It now applies to an interference with privacy that is serious. "Repeated" is no longer a separate trigger. Instead, it joins a list of things a court may weigh when it decides whether an interference was serious:

• the kinds of information involved, and how sensitive it is;
• the consequences, or potential consequences, for the person;
• how many people were affected;
• whether a person affected was a child or a person experiencing vulnerability;
• whether the act was done repeatedly or continuously;
• whether the entity failed to put in place the practices, procedures and systems it needed, in a way that contributed to the interference.

That last factor belongs above every data team's desk. The court can ask whether your mess was preventable.

Rung 2: Section 13H, the new mid-tier

Section 13H is new. It covers an act or practice that is an interference with the privacy of an individual. It does not need to be serious. The maximum is 2,000 penalty units for an individual and, per the Digest, 10,000 penalty units for a body corporate: $660,000 and $3.3 million.

A new section 13J closes a gap that used to make the regulator's life hard. If the Commissioner sues under 13G and the court finds an interference but decides it was not serious, the court can order the penalty under 13H instead. The case does not fall to pieces because the judge picked a different adjective.

Rungs 3 and 4: Section 13K and infringement notices

Section 13K is the bottom of the ladder, and it is the rung most likely to touch an ordinary business. It lists specific, checkable obligations in the Australian Privacy Principles (APPs), including:

• APP 1.3: you must have a privacy policy;
• APP 1.4: the policy must contain certain things, such as how a person can complain;
• APP 2.1: people may deal with you anonymously or with a pseudonym, where that is practical;
• APP 7: a simple way to opt out of direct marketing, and drawing people's attention to it;
• APP 13.5: dealing properly with requests to correct personal information;

plus a data breach statement that does not contain what the law requires. The Digest gives the court maximum for a 13K breach as 200 penalty units, or $66,000. That is the individual figure. By the same five-times rule that turns 2,000 units into 10,000 for section 13H, a company faces up to 1,000 units, or $330,000.

But the important change is the next one. A 13K breach is now subject to an infringement notice. An infringement notice is a fine the regulator issues itself, like a parking ticket. You can pay it, or you can contest it, and then the regulator has to go to court. Under the general Commonwealth rules, the Digest says the amount for one alleged contravention is 12 penalty units for an individual ($3,960) and 60 for a body corporate ($19,800). The Act as passed sets a higher amount for a listed corporation: 200 penalty units per alleged contravention, which is $66,000 each.³

The Act as passed also gives the Commissioner a gentler tool for the same breaches: a compliance notice, which tells an entity what to fix and by when, with a civil penalty if it does not.

So a privacy policy that has no complaints section is no longer a theoretical problem. It is a $19,800 ticket for an unlisted company, and a $66,000 ticket per contravention for a listed one.⁴ And the rungs are not evenly spaced.

max_tokensPOST./v1/messages

Who can climb the ladder

Only the regulator, mostly. A penalty is paid to the Commonwealth, not to the people whose privacy was interfered with. Tranche 1 adds one route for them. A new section 80UA lets the Federal Court or the Federal Circuit and Family Court make extra orders once a civil penalty contravention is proven: for example, that the entity pay compensation to affected people, take steps to repair the harm, or publish a statement about what it did. A person who suffered loss can apply for such an order within six years of the contravention.

Note the word "once". Someone first has to prove the contravention, and in practice that is the Commissioner. That is not a general right for individuals to sue. Hold that thought until Part 7.

Privacy Commissioner Carly Kind described the new penalty regime, when the bill was introduced, as something that "will add significantly to our enforcement toolkit". Regulators do not usually say "toolkit" about things they plan to leave in the drawer.

Part 3: The Tort, or How Privacy Law Started With Possums

A tort is a civil wrong that lets one person sue another for compensation. You know the common ones without the word: negligence when someone's carelessness hurts you, trespass when someone walks into your house, defamation when someone publishes a lie about you. Most torts were built by judges, case by case, over centuries.

Privacy was the one Australian judges never quite built. And the case that best shows why is a Tasmanian one.

The Rocherlea possums

A company called Lenah Game Meats ran a brush tail possum processing facility at Rocherlea, in Tasmania, licensed as an export abattoir. Persons unknown broke in and installed hidden cameras. The footage of the possums being stunned and killed, lawful but grim, ended up with the ABC, which planned to broadcast it. Lenah sought an injunction.

In 2001, the High Court decided ABC v Lenah Game Meats. The ABC won. Along the way, the judges talked a great deal about whether Australia had a tort of invasion of privacy, and declined to settle it. Chief Justice Gleeson wrote that "the lack of precision of the concept of privacy is a reason for caution in declaring a new tort". Justices Gummow and Hayne said an old 1937 racecourse case, Victoria Park Racing v Taylor, which many had read as shutting the door on privacy, "does not stand in the path" of such a tort. So the door was open, and nobody walked through it.⁵

That left Australia in an odd place for two decades. A company could not rely on privacy (it was a possum abattoir, after all), and nobody else could be sure that they could. The Australian Law Reform Commission was asked to "design a statutory cause of action for serious invasions of privacy", and tabled its answer, Report 123, on 3 September 2014. The Privacy Act Review proposed the tort "in the form recommended by the ALRC", and the government agreed in principle. Meanwhile, the Bills Digest notes, a Victorian court recognised a common law privacy tort in 2024, though whether that survives an appeal is unclear.

So, after the possums, a decade of law reform reports and one adventurous County Court, Parliament has written the tort down. Schedule 2 of the Act inserts it into the Privacy Act as a new Schedule 2 with its own rules, to be read separately from the rest of the Act. Commissioner Kind said it would "fill a gap in our privacy landscape", and the phrase "fill a gap" has, for once, done its job.

stop_reasoneval:.pass

The five elements

The tort has two ways in. The defendant must have invaded the plaintiff's privacy by:

• intruding upon their seclusion, which includes physically intruding into their private space, or watching, listening to or recording their private activities or affairs; or
• misusing information that relates to them, which includes collecting, using or disclosing it.

Then clause 7(1) sets five elements. The plaintiff must show all of them:

1. An invasion, by one or both of those two routes.
2. A reasonable expectation of privacy. A person in the plaintiff's position would have expected privacy, "in all of the circumstances". The court can look at the means used (including any device or technology), the purpose, the person's age, job or cultural background, whether they invited publicity, where an intrusion happened, and, for information, whether it was about intimate, family, health or financial matters and whether it was already public.
3. Intent or recklessness. The invasion was intentional or reckless.
4. Seriousness. The court can consider how much offence, distress or harm to dignity it was likely to cause a person of ordinary sensibilities, whether the defendant knew or should have known that, and, if it was intentional, whether it was motivated by malice.
5. The public interest balance. The public interest in the plaintiff's privacy outweighed any countervailing public interest, such as freedom of expression, freedom of the media, open justice, public health and safety, national security, or preventing crime and fraud.

Two more rules matter. The invasion is "actionable without proof of damage", so you do not need to show you lost money. And if the information was misused, it does not matter whether it was true.

The element that matters most for business

Element 3 is the one I want you to notice. The fault bar is intent or recklessness. Carelessness is not enough. During the Senate inquiry, submitters debated whether it should extend to negligent acts. It did not.

A data breach caused by a forgotten test server with no password is, on most facts, negligence: nobody meant it, and nobody knowingly ran the risk. That is a matter for the regulator and the penalty ladder, not this tort. But an employee who looks up an ex-partner's address in the customer database, a business that secretly records customers in a fitting room, or a company that knows a data sale is likely to expose a person's health condition and goes ahead: those are much closer to intentional or reckless. "Reckless" takes its meaning from the Criminal Code, where, roughly, you are aware of a substantial risk and it is unjustifiable to take it.⁶

Defences, exemptions and money

There are defences: the invasion was required or authorised by law or a court order; the plaintiff consented; the defendant reasonably believed it was necessary to prevent a serious threat to someone's life, health or safety; or it was incidental to a lawful defence of persons or property and proportionate. Where the invasion was a publication, some defamation defences apply too.

There are also exemptions: journalists collecting, preparing or publishing journalistic material (a "journalist" works professionally and is bound by professional standards or a code), law enforcement bodies and intelligence agencies, government agencies acting in good faith within their functions, and anyone under 18.

On money: the court may award damages, including for emotional distress, but not aggravated damages. Exemplary damages are possible only in exceptional circumstances. Damages for non-economic loss plus any exemplary damages are capped at the greater of $478,550 and the defamation cap. The court can also order an account of profits, an apology, a correction, the destruction of material, or a declaration that the defendant seriously invaded the plaintiff's privacy. An apology is not an admission of liability, which is the law's way of saying "please do say sorry".

And the clock: an adult must sue within one year of becoming aware of the invasion, and within three years of it happening, whichever comes first. A court can extend that, up to six years. If the plaintiff was under 18 at the time, they have until their 21st birthday.

So, as of today, the tort is enacted but not yet in force. It will start on a day fixed by Proclamation, and no later than 10 June 2025.

page_viewtool_use

Part 4: Automated Decisions: Three Gates and a Paragraph

You get decisions from machines every week without calling them that. Your card is declined at the supermarket because a fraud model did not like the pattern. A car insurance website gives you a quote in nine seconds. A rental application vanishes into a portal and comes back "unsuccessful". In each case, a computer program either made the decision or did the heavy part of it, using information about you.

That is automated decision-making (ADM). In Australia the term is not abstract, because of Robodebt. The Royal Commission into the Robodebt Scheme delivered its report on 7 July 2023. Its recommendation 17.1 asked the Commonwealth to consider "a consistent legal framework in which automation in government services can operate", including plain-language information on websites that explains when automated decision-making is used and how it works.

Tranche 1 is not that framework. It does something smaller and broader: it puts a transparency duty in the Privacy Act, and it applies to private businesses as well as government. In the Act, it is three new subclauses of APP 1, and it applies to decisions made from 10 December 2026.

The three gates

APP 1.7 applies when three conditions are all true. I find it easiest to think of them as gates:

1. The program. The entity has arranged for a computer program to make a decision, or to do a thing that is "substantially and directly related to making" a decision.
2. The stakes. The decision "could reasonably be expected to significantly affect the rights or interests of an individual".
3. The data. Personal information about that individual is used by the program to make the decision or do the related thing.

APP 1.9 fills in the edges. Refusing or failing to make a decision counts as a decision. The effect can be good or bad for the person; a decision to approve you counts as much as a decision to refuse you. And it gives examples of decisions that may affect someone's rights or interests: granting or refusing a benefit under a law, a decision that affects a person's rights under a contract, and a decision that affects a person's access to "a significant service or support".

Gate 1 is wider than it looks. The program does not have to make the final call. If a fraud score decides which orders a person reviews, and the reviewer approves almost everything the score passes, the score is very arguably doing a thing "substantially and directly related" to the decision. A rubber stamp on top of a model does not take the model out of APP 1.7.

Gate 2 is where the arguments will happen. A product recommendation widget probably does not significantly affect anyone's rights. A credit limit, an insurance price, tenancy screening and account suspension probably do. A gate has to be opened by all three keys.

utm_source=SELECT

What goes in the policy

If all three gates open, APP 1.8 says the privacy policy must contain:

• the kinds of personal information used in those programs;
• the kinds of decisions made solely by those programs; and
• the kinds of decisions where a program does a thing substantially and directly related to the decision.

Look at the word that repeats: kinds. This is not a right to an explanation of your decision, and it is not a duty to publish the model, its features or its weights. It is a paragraph in a privacy policy that says, in effect, "we use your transaction history and device information in software that can block your account, and in software that flags applications for our staff to review". It is a long way from the Robodebt recommendation to publish business rules for expert scrutiny.

Here is the catch for anyone who thinks a paragraph is easy. To write it honestly, you need an inventory: every program that makes or shapes a significant decision, and the personal information each one uses. Many organisations could not produce that list in a week. Many have a vendor tool somewhere that nobody on the current team set up.⁷

And this paragraph has a ticket attached. The Act as passed adds APP 1.7 to the section 13K list. So from December 2026, a privacy policy that should describe automated decisions and does not is an infringement-notice matter, on the bottom rung of the ladder from Part 2.

Part 5: The Children's Online Privacy Code

aria-labelgtm.js

An APP code is a set of binding rules that says how the Australian Privacy Principles apply to a particular sector or activity. The principles are written broadly, so a code makes them specific. Once registered, a code is a legislative instrument, and the entities it binds must follow it.

The new section 26GC tells the Information Commissioner to write one about online privacy for children. In the Act, a child is anyone who has not reached 18.

Who it binds

The code binds an APP entity that:

• provides a social media service, a "relevant electronic service" or a "designated internet service", as the Online Safety Act 2021 defines those terms;
• runs a service that is "likely to be accessed by children"; and
• is not providing a health service.

The code can also name other entities to bind, and name entities it does not bind. The three Online Safety Act terms are broad. The OAIC says the code "will apply to social media and a wide range of other internet services likely to be accessed by children, including apps, websites and messaging platforms", and on the bill's passage it stressed that the code would cover "not only social media platforms but any online services likely to be accessed by children".

"Likely to be accessed by children" is the phrase to watch. A gaming site is obviously in. A homework help site is in. But so might be a sneaker store, a music streaming app or a fast food ordering app, if enough under-18s use it. The Act lets the Commissioner write guidelines on how to tell.

One important limit: the code binds APP entities. A business under the small business exemption is generally not an APP entity, so the code does not reach it unless something else brings it in.

How it will be written

The Commissioner must publish a draft, take public submissions for at least 60 days, and consult the eSafety Commissioner and the National Children's Commissioner. The Commissioner may also consult children themselves, children's welfare groups and industry. The government is giving the OAIC $3 million over three years to do it, and the code must be registered within 24 months of assent: by December 2026. As of today, there is no draft.

The OAIC has said where it is looking. It intends to align the code, "to the extent possible", with the UK's Age Appropriate Design Code. That code has 15 standards, among them: the best interests of the child come first; settings must be "high privacy" by default; geolocation should be off by default; and nudge techniques should not push children to give more data or weaken their settings. The OAIC has also floated one concrete example: privacy policies and collection notices tailored for children, using "graphics, video and audio content, rather than relying solely on words".

Nobody knows the content of the Australian code yet. But if you run a service children use, the UK standards are the best public guide to the questions you will be asked. High-privacy defaults and location off by default are the two I would start on, because they are also good practice for adults and they are the hardest to retrofit once a product depends on the data.⁸

Not the social media ban

The same week, Parliament passed a separate law that bans social media use by under-16s on some platforms. The code is about how services handle children's personal information; the minimum age law is about whether some services can let under-16s have accounts at all. Two laws, two timelines.

Part 6: Doxxing, Data Breaches and the Smaller Changes

Some of tranche 1 is not about marketing or analytics at all, and you should still know it is there.

Doxxing is now a crime

Doxxing is releasing someone's personal details online to menace or harass them. The Act adds two offences to the Criminal Code, in force since today. Using a carriage service (which in practice means the internet or a phone network) to make available personal data of one or more people, in a way reasonable persons would regard as menacing or harassing towards them, carries up to six years' imprisonment. If the person does it because of their belief that a group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin, the maximum is seven years.

"Personal data" here is anything that lets a person be identified, contacted or located, including a name, photo, phone number, email address, online account, home address, work address, place of education or place of worship. The government's consultation on doxxing followed an incident this year in which, as the Digest describes it, details of almost 600 Jewish writers, artists and academics in a WhatsApp group were published.

The rest of the slice

The other changes, briefly:

• Security, made explicit. A new APP 11.3 says the "reasonable steps" to protect personal information include "technical and organisational measures". It always meant that; now it says so.
• A white list for overseas transfers. The government can now prescribe countries and binding schemes whose protections are "at least substantially similar" to the APPs, so disclosures to them no longer need the usual APP 8.1 steps. The OAIC calls it a "white list". As of today, no country is on it.
• Data breach declarations. After an eligible data breach, the Minister can make a declaration that lets named entities collect, use and share specific kinds of personal information to reduce the risk of harm to the people affected. Similar rules tighten emergency declarations.
• Public inquiries and codes on demand. The Minister can direct the Commissioner to run a public inquiry into a privacy matter, or to develop an APP code (a temporary one if it is needed urgently).

Part 7: What Tranche 1 Left Out

This is a first slice, and it is worth being exact about what it is not, partly because I said otherwise.

In May 2023, writing about the review, I told you individuals would get "a direct route to courts for relief" when an organisation breached their privacy. That was one of the review's proposals. Tranche 1 does not deliver it. You cannot sue a company today for breaching an APP. You can, by mid-2025 at the latest, sue under the tort if an invasion was serious and intentional or reckless. And you can apply for compensation orders under section 80UA after the regulator proves a contravention. Those are both real. Neither is a general right of action. Consider this my correction, made with a slightly sheepish cup of tea.⁹

Other big proposals that are not in tranche 1:

• The small business exemption stays. The Digest notes that "more controversial proposals" such as removing it were not implemented. Most small businesses remain outside the Privacy Act.
• No "fair and reasonable" test. The review proposed that any handling of personal information must be fair and reasonable, whatever the consent form says. Commissioner Kind said the OAIC was "eagerly awaiting the second tranche", and named that test as part of it.
• No new definitions. "Personal information" and "consent" keep their current wording. That matters for anyone in analytics and advertising, because whether a cookie ID or a hashed email is "personal information" is still argued on the old definition. (If you need the consent refresher, here is my piece on consent management.)
• No targeting rules. The proposals on targeted advertising and direct marketing that I covered in October 2023 are not here.

Business groups welcomed the absence of new burdens. The Greens' Senator David Shoebridge reportedly called it an "extraordinarily unambitious proposal", and Digital Rights Watch asked for a timetable for "the remaining 100+ reforms". On passage, Commissioner Kind said the measures had a "long gestation", that some had been campaigned for "for more than a decade", and that "more needs to be done of course".

As of December 2024, no second tranche bill has been introduced. My advice is to plan for it rather than wait for it. The proposals are public, and the government has agreed to most of them in principle.

Part 8: Tomasz Spends a Week With the Act

GPC:.1await

Meet Tomasz. Tomasz is a product manager at an online retailer in Hobart that sells outdoor gear across Australia, well above the small business threshold. (Tomasz is made up. The wind on the Hobart waterfront is not.) The company has a website, an app, a loyalty programme, a buy-now-pay-later option run by a partner, and a fraud tool that automatically cancels orders it scores as high risk. Its privacy policy is the one from the start of this article.

Wednesday: the bottom rung

Tomasz opens the privacy policy with the APP 1.4 list beside it. It names the kinds of information collected, but it does not say how a customer can complain, or how they can ask to correct their details. Under section 13K, each of those can now draw an infringement notice. He also checks the marketing emails: the unsubscribe link works, but the SMS campaigns have no opt-out instruction at all. That is APP 7 territory.

What each system records: the policy's edit history (last change 2019), the email platform's unsubscribe log, and nothing at all for SMS opt-outs. He logs both gaps with a date. The fixes take an afternoon.

Thursday: the tort test

Tomasz asks the customer service lead who can look up a customer's full details. Answer: all 40 staff, with no audit log. Nobody has done anything wrong. But if one of them one day looks up a former partner's address and passes it on, that is the kind of intentional misuse the tort is aimed at, and the company's systems would make it easy and invisible.

He books two changes: role-based access to addresses and order history, and an access log the security team reviews. The log does not prevent anything on its own. It does make "we had no idea" a much harder thing to say, and it is the sort of "practices, procedures and systems" a court can weigh under section 13G.

Friday: the three gates

Tomasz runs the fraud tool through APP 1.7. Gate 1: the tool cancels orders itself, so yes. Gate 2: cancelling a paid order and freezing a loyalty account affects a customer's rights under a contract, which APP 1.9 gives as an example, so yes. Gate 3: it uses order history, delivery address, device data and payment details, so yes. All three gates open, so from December 2026 the privacy policy must describe it.

Then he asks around, and finds two more: the buy-now-pay-later partner's approval check at checkout, and a loyalty-tier script that a contractor wrote in 2021. He starts an ADM register, one line per program: what decision, solely automated or a step towards one, what personal information, who owns it. The policy paragraph will be written from that register, not from memory.

Monday: the children question

The company sells school camp gear, and its analytics show a steady share of visitors aged 13 to 17, mostly in January. Is the site "likely to be accessed by children"? Nobody knows yet, because the code and guidelines do not exist. Tomasz writes down what he does know: the app asks for location access by default, and the loyalty sign-up collects date of birth and does nothing with it. He adds "review defaults against the UK code" to next quarter's plan.

Tuesday: the report

Tomasz writes one page for the leadership team. It has three columns: "now" (policy fixes, SMS opt-out, access controls), "by mid-2025" (tort in force; review sensitive-data uses), and "by December 2026" (ADM register and policy paragraph; children's code). His manager asks whether this is all urgent. Tomasz says, "The first column is a ticket now. The rest is a calendar." His manager goes to make a cup of tea, which in my experience is how leadership signals agreement.

What to Do This Week

1. Read your privacy policy against APP 1.4. Check it says what information you collect and why, how people can access and correct it, how to complain and how you handle complaints, and whether you send information overseas and where. Those gaps are now on the infringement-notice rung.
2. Test every opt-out. Email, SMS, push and post. Each direct marketing message needs a simple way to opt out, and the message must point it out. Then check that the opt-out actually stops the next send.
3. Check your correction and anonymity paths. Can a person ask you to correct their details, and does someone answer? Can people deal with you without giving their name where that is practical?
4. Review who can see what. Find every system where staff can look up a person's details. Limit access by role and switch on access logging. This is the best single control against the kind of intentional misuse the tort is about.
5. Start an ADM register. List every program that makes, or does a key step in, a decision that could significantly affect a person: credit, pricing, eligibility, fraud blocks, account suspensions, tenancy or job screening. Note the personal information each one uses and whether a human really reviews it. Include vendor tools.
6. Ask whether children use your service. Look at your analytics and your audience honestly. If the answer is "probably", read the UK Age Appropriate Design Code's 15 standards now, and start with privacy-high defaults and location off by default.
7. Write a two-year calendar. Put the tort's latest start date (10 June 2025), the ADM start date (10 December 2026) and the children's code deadline (December 2026) into whatever planning tool your team actually opens.

Final Thoughts

Back to that privacy policy at /privacy, between "Careers" and the cookie icon. Yesterday it was a document nobody read. Since this morning it is a document the regulator can fine you for, without a court, if it leaves out the parts the law requires.

That is the shape of tranche 1. It does not change what most businesses may do with personal information. It changes how cheaply the regulator can act when they get the basics wrong, it gives people a tort for the serious, deliberate cases, and it starts two clocks: one for automated decisions and one for children. The thread through all of it is evidence. A policy you can show is complete, an access log you can show is reviewed, an ADM register you can show is current: each one is cheap now and expensive to reconstruct later.

So this week, read the policy, test the opt-outs and start the register. The second slice of the wheel will come, and it will be easier to take if you are not still finishing the first.

Now, if you'll excuse me, my tea has been waiting since about the second reading, and it is very much past its commencement date.

Notes

1. The Act's commencement table also has a third column for the actual dates, but the Act says that column "is not part of this Act". It is there for convenience, and the law is the rule in the second column. Lawyers find this comforting. Everyone else finds it slightly unsettling. ↩

2. The Privacy Act borrows its civil penalty and infringement notice machinery from the Regulatory Powers (Standard Provisions) Act 2014, a general Commonwealth law, rather than building its own. That is where the default infringement notice amounts come from. ↩

3. The higher amount applies to a "listed corporation" within the meaning of the Corporations Act 2001. If one notice covers several alleged contraventions, the amount is 200 penalty units multiplied by the number of contraventions. ↩

4. Like a parking ticket, an infringement notice is an allegation, not a finding. Paying it ends the matter without a court deciding that you broke the law. Unlike a parking ticket, it cannot be blamed on someone else borrowing the car. ↩

5. In fairness to the Rocherlea possums, they were never the plaintiffs. The privacy claim, such as it was, belonged to the abattoir, and whether a company can have privacy at all was one of the questions the High Court had to consider. ↩

6. Under section 5.4 of the Criminal Code, a person is reckless about a result if they are aware of a substantial risk that it will occur and, in the circumstances known to them, it is unjustifiable to take the risk. The tort borrows that meaning. ↩

7. I wrote about the people side of this in a guide to bias in AI. An ADM register is also the first thing you need to check a model for bias, because you cannot audit a model you do not know you have. ↩

8. High-privacy defaults are also the change that most often meets internal resistance, because the data collected by default tends to feed somebody's dashboard. Find that dashboard first, and ask whether anyone still reads it. ↩

9. Sheepish tea is a Lapsang souchong, brewed slightly too long, drunk standing up. I do not recommend it, but it pairs well with a correction. ↩