The Privacy and Responsible Information Sharing Act 2024 (PRIS Act) received Royal Assent on 6 December 2024. Subject to decisions of government, it is anticipated that the privacy provisions will commence in 2026.
The interim privacy position for the Western Australian public sector is that agencies should ensure their actions are consistent with applicable Australian Privacy Principles, set out in Schedule 1 to the Privacy Act 1988 (Cth) with primary emphasis upon Principle 6 - “use or disclosure of personal information”.
Where agencies are operating under statutes that contain specific provisions about the use or sharing of data, they should continue to comply with these.
This position applies to personal information, as defined in the PRIS Act.
This definition is slightly wider than that under the Privacy Act 1988 (Cth) and Freedom of Information Act 1992 (WA). Agencies should keep this in mind, when following the interim privacy position.
Personal information —
(a) means information or an opinion, whether true or not, and whether recorded in a material form or not, that relates to an individual, whether living or dead, whose identity is apparent or can reasonably be ascertained from the information or opinion; and
(b) includes information of the following kinds to which paragraph (a) applies —
(i) a name, date of birth or address;
(ii) a unique identifier, online identifier or pseudonym;
(iii) contact information;
(iv) information that relates to an individual’s location;
(v) technical or behavioural information in relation to an individual’s activities, preferences or identity;
(vi) inferred information that relates to an individual, including predictions in relation to an individual’s behaviour or preferences and profiles generated from aggregated information;
(vii) information that relates to 1 or more features specific to the physical, physiological, genetic, mental, behavioural, economic, cultural or social identity of an individual.
