Information Privacy and Other Legislation Amendment Bill 2023
Plain English Summary
Overview
This bill modernises Queensland's information privacy and right to information laws. It introduces mandatory data breach notifications so agencies must tell you if your personal information is compromised, replaces the old dual privacy principles with a single set of Queensland Privacy Principles aligned with federal law, and supports the proactive release of Cabinet documents for greater government transparency.
Who it affects
Every Queenslander whose personal information is held by a government agency, local council, or university benefits from stronger data breach protections. People making freedom of information requests get a simpler, cheaper process for accessing their own records.
Key changes
- Government agencies must notify you and the Information Commissioner if a data breach is likely to cause you serious harm, and must assess breaches within 30 days
- A single set of Queensland Privacy Principles replaces two separate sets of principles, aligning Queensland with federal privacy standards
- Accessing your own personal information through a freedom of information request is now free, and applications can be made in writing rather than on a specific form
- The Information Commissioner gains new powers to investigate privacy breaches on their own initiative, audit agencies, and appoint officers to inspect data handling practices
- Cabinet documents will be proactively published, with legal protections to ensure redacted information remains exempt and Ministers are shielded from civil liability for good-faith disclosures
- The maximum penalty for public officers misusing restricted computers increases from 2 to 3 years imprisonment, with no time limit on prosecution
Bill Story
The journey of this bill through Parliament, including debate and recorded votes.
▸Committee12 Oct 2023View Hansard
Referred to Education, Employment and Training Committee
The Education, Employment and Training Committee examined the Information Privacy and Other Legislation Amendment Bill 2023 and recommended it be passed. The committee made three recommendations, including a unanimous call to limit time extensions for data breach assessments to what is reasonably required. The committee also raised concerns about the impact of excluding letters patent entities on First Nations peoples' rights to access personal and family data, prompting the government to remove that exclusion entirely during consideration in detail.
Key findings (5)
- The bill aligns Queensland's definition of 'personal information' with the Commonwealth Privacy Act and introduces a single set of Queensland Privacy Principles.
- The mandatory data breach notification scheme would have substantial resourcing impacts on the Office of the Information Commissioner, local councils, and universities.
- The Local Government Association of Queensland raised concerns that most councils lack the budget and workforce to implement mandatory data breach notification requirements.
- The Queensland Human Rights Commission identified that excluding letters patent entities from the Information Privacy Act and Right to Information Act would limit cultural rights of Aboriginal and Torres Strait Islander peoples under the Human Rights Act 2019.
- The government agreed to remove the proposed letters patent exclusion to allow further consideration and avoid unintended consequences for First Nations peoples' access to personal and family data.
Recommendations (3)
- The committee recommends that the Information Privacy and Other Legislation Amendment Bill 2023 be passed.
- The committee unanimously recommends that the proposed new section 49 in clause 33 be amended to require that any extension of time must be only for an amount of time reasonably required for the assessment to be conducted.
- The committee recommends that the Attorney-General clarify whether the proposed amendment to definitions in the IP Act and RTI Act would impact on the rights and entitlements of First Nations peoples and other Queenslanders in respect of their ability to access personal and family data held by letters patent entities, and on truth-telling and treaty processes; and whether there are alternative, less restrictive and reasonably available ways to achieve the same purpose.
Committee report tabled
▸Second Reading28 Nov 2023View Hansard
Vote on a motion
Vote on the KAP disallowance motion to reverse fisheries regulations restricting Spanish mackerel commercial catch from 578 to 165 tonnes and reducing recreational possession limits. Unrelated to the Information Privacy or Public Records bills. The motion was defeated 37-51, with LNP, KAP and PHON voting in favour and ALP and Greens opposed.
The motion was rejected.
A formal vote on whether to accept a proposal — this could be the bill itself, an amendment, or another motion.
▸Show individual votesHide individual votes
Ayes (37)
Noes (51)
▸15 members spoke15 support
As Attorney-General, delivered the reply speech defending the bill's reforms including mandatory data breach notification, proactive release of cabinet documents, and privacy framework alignment with the Commonwealth. Addressed opposition criticism about delays and moved extensive government amendments during Consideration in Detail.
“Proactive release will commence in the first quarter of 2024 and the publication of the updated Cabinet Handbook will occur before at the discretion of the Premier.”— 2023-11-29View Hansard
As Attorney-General, introduced the bill and outlined key reforms including mandatory data breach notification, single Queensland Privacy Principles, and proactive release of cabinet documents. Foreshadowed amendments to remove letters patent exclusion and address committee recommendations.
“This bill demonstrates this government's commitment to accountability and transparency by clarifying, strengthening and updating the Right to Information Act 2009, the Information Privacy Act 2009, the Criminal Code and other legislation.”— 2023-11-28View Hansard
Indicated the LNP would not oppose the bill, acknowledging it represents a comprehensive effort to modernise Queensland's information privacy framework while noting stakeholder concerns about costs.
“The LNP will not oppose the bill as it represents a comprehensive effort to modernise Queensland's information privacy framework.”— 2023-11-28View Hansard
Confirmed the LNP would not oppose the bill but criticised the government for taking over six years to implement review recommendations. Raised concerns about the impact of mandatory data breach notification on small regional councils and the delayed proactive release of cabinet documents.
“We have a Premier who has often talked about and often quoted the fact that she was elected on openness, transparency and accountability. We are here discussing two bills that have come about because of review after review into the accountability, the transparency and the lack of integrity from this government.”— 2023-11-28View Hansard
Supported the bill as committee chair, noting the importance of data protections given the rise in notifiable data breaches and that Queensland was getting protections in place ahead of the Commonwealth.
“It is important to note that, although the Commonwealth is on the path, we have been able to get there quicker and will be able to provide Queenslanders with more protection.”— 2023-11-28View Hansard
Supported both bills, noting the significant consultation undertaken and the need to modernise records management given technological advances since 2002.
“When we consider the advancements in technology, especially around how we communicate with each other, so much has changed.”— 2023-11-28View Hansard
As a committee member, supported the bill's alignment of Queensland's privacy legislation with Commonwealth legislation and the balance between privacy rights and service delivery.
“I was pleased by departmental staff briefings and evidence given by the Information Commissioner as well as stakeholders who put forward that they think that this bill finds a good balance between the natural tension, as they described it, that exists between the need for government officers to provide wraparound services against the personal rights of privacy of individuals.”— 2023-11-28View Hansard
As committee member, did not oppose the bill but raised concerns about the impact of mandatory data breach notification on small regional councils, noting they attract only four per cent of funding but deliver about 30 per cent of services.
“I urge the government to be accommodating with local governments and to take note of the genuine concerns that the Local Government Association of Queensland has expressed on behalf of its members about the costs of implementing and managing this scheme.”— 2023-11-28View Hansard
Spoke specifically to the amendments to the Coal Mining Safety and Health Act 1999 to update the union name from CFMMEU to Mining & Energy Union QLD District Branch, ensuring industrial safety and health representatives can continue to access sites.
“Ensuring that this is reflected in the Coal Mining Safety and Health Act 1999 is important because it removes any ambiguity when it comes to the act and ensures industrial safety and health representatives are able to access sites.”— 2023-11-28View Hansard
Supported the bill as a committee member, noting the importance of legislation moving with the times on data breaches, but raised concerns about the onerous requirements placed on smaller regional councils.
“We all live in an age where information is being gathered and stored in the cloud or somewhere else. Data breaches have become something that we deal with on a daily, weekly and nightly basis.”— 2023-11-28View Hansard
Supported both bills, noting the importance of having the right mechanisms in place for information protection and the recognition of First Nations peoples' knowledge and history in the Public Records Bill.
“We live in a day and age where we have access to a wide range of information every day and, if anything, there is no escaping information.”— 2023-11-28View Hansard
As committee member, supported the bill but raised concerns about the cost and workforce challenges for small regional councils in implementing mandatory data breach notification.
“Cybersecurity is everyone's responsibility. It is a very important matter for all levels of government.”— 2023-11-28View Hansard
Supported both bills, noting the welcome of the Office of the Information Commissioner and the important change from 'transfer' to 'disclose' for overseas personal information handling.
“Hidden amongst the amendments is a subtle change to section 33 of the Information Privacy Act, which regulates the transfer of personal information to entities outside Australia.”— 2023-11-28View Hansard
Supported both bills as making critical reforms to the way information is collected, used, accessed, stored and disclosed by Queensland public sector agencies.
“Protecting privacy is paramount. It is essential and key to ensuring our basic dignity, safety and self-determination.”— 2023-11-28View Hansard
Did not oppose the bill but strongly criticised the government for taking 17 months since the Coaldrake report to act, and for obstructing right to information requests. Raised concerns about the impact of privacy requirements on local councils' ability to install CCTV.
“Getting information from this state government is like pulling hen's teeth. It is my view—and it is a view that journalists and members of the public have also indicated they hold—that the state government has a deliberate position to make the provision of information as difficult as possible.”— 2023-11-28View Hansard
▸In Detail28 Nov 2023 – 29 Nov 2023View Hansard
Government amendments Nos 1 to 50 to the Information Privacy and Other Legislation Amendment Bill, comprising technical and clarifying changes including: amending commencement provisions; inserting a new part amending the Coal Mining Safety and Health Act 1999 to update the definition of 'union'; correcting typographical errors; more comprehensively excluding APP entities subject to the Commonwealth Privacy Act 1988; refining data breach notification provisions to require timely assessment completion and inter-agency notification; allowing authorised officers to exercise powers via audio visual link; and expanding the Information Commissioner's performance monitoring functions.
Government amendment No. 51 to the long title of the Information Privacy and Other Legislation Amendment Bill, inserting a reference to the Coal Mining Safety and Health Act 1999 to reflect the new transitional provision added by the amendments.
That the amendment be agreed to
Vote on an amendment to the government motion about LNP cuts and the public service, unrelated to the bill debate.
The motion passed.
▸Show individual votesHide individual votes
Ayes (50)
Noes (32)
Vote on a motion
Government motion to suspend standing orders to allow an assistant minister to move a motion about LNP cuts and the public service, unrelated to the bill debate.
The motion was agreed to.
A formal vote on whether to accept a proposal — this could be the bill itself, an amendment, or another motion.
▸Show individual votesHide individual votes
Ayes (50)
Noes (38)
That the motion, as amended, be agreed to
Final vote on the government motion about LNP cuts and the public service, as amended, unrelated to the bill debate.
The motion passed.
▸Show individual votesHide individual votes
Ayes (50)
Noes (32)
Referenced Entities
Legislation
Organisations
Programs & Schemes
Sectors Affected
Classified using AGIFT/ANZSIC Australian government standards