The federal government will appoint a dedicated privacy commissioner to deal with the increasing threat of data breaches, the attorney general has announced.
Mark Dreyfus revealed late on Tuesday evening that the Albanese government would also restore the Office of the Australian Information Commissioner (OAIC) to a three-commissioner structure, saying the appointments were necessary to deal with “the growing threats to data security and the increasing volume and complexity of privacy issues”.
“Australians rightly expect their privacy regulator to have the resources and powers to meet the ongoing challenges of the digital age and protect their personal information,” Dreyfus said.
“The large-scale data breaches of 2022 were distressing for millions of Australians, with sensitive personal information being exposed to the risk of identity fraud and scams.”
The role of the privacy commissioner is to ensure government agencies and large organisations – those with an annual turnover of more than $3m, with some exceptions – abide by the law when handling personal information.
Guardian Australia understands extra funding will be provided in the forthcoming federal budget for the OAIC to deal specifically with privacy-related data issues.
The expansion of the OAIC comes after the mass data breaches at Medibank and Optus last year, in which the personal details of 9.7m current and former customers of the health insurance firm and 9.8m customers of the telco were stolen by hackers.
Those incidents were followed by an even larger breach at Latitude Financial Services in March this year, with data of 14 million customers exposed in the attack, including driver’s licence numbers, passport numbers, and financial statements, and some information dating back to 2005.
After those breaches, the federal government increased the fines payable by companies for repeated or serious data breaches from $2.2m to $50m.
In February, in a sweeping review of Australian privacy law, the attorney general’s department recommended that companies only collect what personal data is reasonably necessary, destroy data when it is no longer required, and periodically review how long they hold personal information.
“The former Coalition government left Australia disgracefully unprepared for this challenge by failing to update privacy laws and scrapping the position of a standalone privacy commissioner,” Dreyfus said.
The Abbott Coalition government had defunded the OAIC, intending to abolish it, but failed to pass the necessary legislation in the Senate. As a consequence, two of the three original commissioner roles lapsed and their positions were not filled, and subsequent information commissioners juggled multiple roles.
The attorney general’s announcement on Tuesday restores the OAIC to its original structure of an information commissioner, a privacy commissioner and a freedom of information commissioner.
The current information commissioner, Angelene Falk, who is also holding the role of privacy commissioner, will step down from the latter when a privacy commissioner is appointed but remain the information commissioner and head of the OAIC.
Toni Pirani has been appointed as an interim freedom of information commissioner after the resignation of Leo Hardiman, while new FOI commissioner is recruited.
