Information Privacy and Other Legislation Amendment Bill 2023
Bill Story
The journey of this bill through Parliament, including debate and recorded votes.
Referred to Education, Employment and Training Committee
Vote on a motion
The motion was rejected.
A formal vote on whether to accept a proposal — this could be the bill itself, an amendment, or another motion.
▸Show individual votesHide individual votes
Ayes (37)
Noes (51)
That the amendment be agreed to
The motion passed.
▸Show individual votesHide individual votes
Ayes (50)
Noes (32)
Vote on a motion
The motion was agreed to.
A formal vote on whether to accept a proposal — this could be the bill itself, an amendment, or another motion.
▸Show individual votesHide individual votes
Ayes (50)
Noes (38)
That the motion, as amended, be agreed to
The motion passed.
▸Show individual votesHide individual votes
Ayes (50)
Noes (32)
As Attorney-General and bill sponsor, defended the bill as providing improved privacy protections for Queenslanders and implementing recommendations from multiple reviews. Highlighted the nation-leading proactive release of cabinet documents and mandatory data breach notification scheme.
“We make no excuse on this side of the House for taking the time to get things right. We are committed to getting it right and we are proud that Queensland will be nation leading in implementing proactive release.”— 2023-11-29View Hansard
Plain English Summary
Overview
This bill strengthens how Queensland government agencies protect and handle personal information. It requires agencies to notify people when data breaches occur, creates consistent privacy principles across government, and gives the Information Commissioner stronger powers to investigate privacy issues. It also streamlines how people can access and correct their personal information held by government.
Who it affects
All Queenslanders whose personal information is held by government agencies, plus government workers responsible for handling personal data. People seeking access to government information will find the process simpler.
Data breach notification
Government agencies must now notify you and the Information Commissioner if they experience a data breach likely to cause serious harm. Agencies have 30 days to assess suspected breaches and must maintain registers of all eligible data breaches.
- Agencies must notify affected individuals when data breaches are likely to cause serious harm
- Assessment of suspected breaches must be completed within 30 days
- Agencies must publish data breach response policies and maintain breach registers
- Local councils have 12 months extra to prepare for the new requirements
Privacy standards
Queensland adopts new Queensland Privacy Principles based on national standards, replacing the previous dual system. This creates consistent rules for how all government agencies collect, use, store and disclose personal information.
- Single set of Queensland Privacy Principles replaces the previous IPPs and NPPs
- Personal information definition aligned with Commonwealth Privacy Act
- Agencies must publish clear privacy policies explaining how they handle personal information
- New rules for how agencies can use personal information for research and statistics
Information Commissioner powers
The Information Commissioner gains significant new powers to proactively investigate privacy breaches, monitor agency compliance with data breach requirements, and enter agency premises to inspect data handling practices.
- Information Commissioner can investigate potential privacy breaches on their own initiative
- New authorised officers can enter agency premises to inspect data handling systems
- Commissioner can issue compliance notices to agencies and contracted service providers
- Annual reporting on privacy matters transferred from Minister to Information Commissioner
Accessing government information
Changes make it easier to apply for access to government information and to correct your personal information. Applications no longer require approved forms, and processing timeframes have been clarified.
- No approved form required for access or amendment applications - written requests accepted
- All personal information access and amendment applications now handled under the RTI Act
- Processing period extended by 5 business days for postal applications
- Departments and Ministers now have the same disclosure log requirements as other agencies
Cabinet transparency and computer crime
The bill supports an administrative scheme for regular release of Cabinet documents while protecting Ministers from civil liability. It also increases penalties for computer hacking offences committed by public officers.
- Protections for proactive release of Cabinet documents without affecting public interest immunity
- Ministers protected from civil liability when releasing information in good faith
- Computer hacking penalty increased from 2 to 3 years imprisonment
- Computer hacking reclassified as misdemeanour with no time limit on prosecution