Can I have a say if the Privacy Commissioner makes new rules for companies?
Quick Summary
Yes, you will have a chance to provide feedback. If the Privacy Commissioner drafts new rules because your industry group failed to do so, the law requires them to release a draft and invite the public to submit their thoughts.
The situation
I am currently working as a junior administrator for a large logistics firm based in Melbourne, Victoria. Over the last six months, our company has been under scrutiny because we haven't quite met the expected standards for how we handle customer data and personal information. Back in January, I heard that the Privacy Commissioner had asked our industry group to come up with a specific set of guidelines or a code of practice to make sure everyone is playing fair with data. However, as of this morning, it seems that the industry group has either ignored the request or provided something that wasn't up to scratch, so the Commissioner is now stepping in to write the rules himself. I saw a notice on a government website today suggesting that a draft version of these new rules might be released soon. If the Commissioner actually starts drafting these rules because the industry failed to do it, do regular people or employees like me get a chance to look at the draft and send in our feedback? I want to know if there is a formal period where we can submit our thoughts or complaints about the proposed rules before they become official law, and how long we usually have to do that.
Detailed Analysis
Because your industry group did not comply with the request to create a code, the Privacy Commissioner has the power to step in and develop the rules himself[1]. This type of rule is known as a CR code (a set of industry-specific rules for handling data)[1].
Before these rules become official, the law provides a formal way for people like you to have your say. The Commissioner is legally required to "make a draft of the code publicly available"[1]. This means the draft version you saw on the government website is the document you can review.
Furthermore, the Commissioner must "invite the public to make submissions to the Commissioner about the draft"[1]. A submission is a formal written statement or opinion provided to a decision-maker. The law specifies that this invitation must happen "within a specified period (which must run for at least 28 days)"[1]. This means you will have a minimum of 28 days to look over the rules and send in your feedback or complaints. Finally, the Commissioner is required to "give consideration to any submissions made within the specified period"[1], meaning they must actually take your input into account before finalizing the rules.
It is worth noting that if the rules being developed are APP codes (Australian Privacy Principle codes, which are general privacy standards) rather than CR codes, the same public consultation process applies[2].
State, provincial, or local laws may add further rules regarding data privacy in Victoria; you should check Victorian-specific consumer or privacy regulations.
Statutory Citations
Legal Citation: Privacy Act 1988 § Section 26R — Development of CR code by the Commissioner
"Before registering the CR code... the Commissioner must: (a) make a draft of the code publicly available; and (b) invite the public to make submissions to the Commissioner about the draft within a specified period (which must run for at least 28 days); and (c) give consideration to any submissions made within the specified period."View Official Legislation →
Legal Citation: Privacy Act 1988 § Section 26G — Development of APP codes by the Commissioner—following a request
"Before registering the APP code... the Commissioner must: (a) make a draft of the code publicly available; and (b) invite the public to make submissions to the Commissioner about the draft within a specified period (which must run for at least 28 days); and (c) give consideration to any submissions made within the specified period."View Official Legislation →
Important Legal Disclaimer
General legal information, not formal legal advice. The information provided on LawAsked does not constitute formal legal advice and creates no attorney-client relationship. If you require legal assistance, please consult a licensed attorney in your jurisdiction.
Have a situation like this?
Ask the AI Lawyer app about your specific case.
Related Questions
- Can the Privacy Commissioner check up on how my data is being handled during an investigation?
- Can I sue a Commission member for making a mistake in my complaint?
- What happens if I can't make it to a meeting with the privacy regulator?
- Can the Privacy Commissioner force a government department to add a note to my records if they refuse to change them?
- How can I get more information about my privacy rights and help change the rules?