Mr McCLELLAND (11:46 PM) —by leave—I move opposition amendments (17), (18), (19) and (25):

18BH Review of operation of approved privacy codes

18BI Review of decisions under an approved privacy code

18 BJ Powers of the Commissioner in respect of applications for review

55C Privacy Commissioner may issue Breach Notice

55D Offence of serious privacy breach

Penalty: 500 penalty units

These amendments substantially boost the powers of the Privacy Commissioner. Labor believes that the key role of the Privacy Commissioner in supervising the developing private sector privacy jurisdiction has been undersold. The Privacy Commissioner should exercise a supervisory role over industry complaint bodies set up to administer the approved industry codes. If this does not occur, there is a risk that the codes will be applied differently across different industry sectors. Indeed, it is important to note that there will be many instances of overlapping codes, for instance, affecting banks which may be the subject of one industry code yet may be participating in Internet activity which is regulated by another code. So the danger of having different interpretations is very real. If that occurs, it will diminish the overall confidence that Australians have, and indeed those wishing to trade with Australia have, in the protection of privacy within our shores.

The Privacy Commissioner should also have appropriate powers of audit and inspection, as I have indicated, to properly monitor the operation of the industry codes. One of the concerns raised by industry groups was that they did not wish to see decisions of industry codes reviewable under the administrative decisions judicial review mechanism currently provided for in the bill. Industry code processes operate in an informal fashion, which the Attorney-General has indicated and with which we agree. The burden of being subject to review, which concentrates on matters of form and procedure rather than substance and merit, was identified as undesirable. For this reason, our amendments would remove the right of administrative decisions judicial review from decisions of industry code adjudicators and, instead, provide the Privacy Commissioner with a supervisory jurisdiction over the code adjudicators. Where a person is unsatisfied with a decision obtained from an industry code adjudicator under an industry code, there will be an automatic right of appeal to the Privacy Commissioner, who will be able to set aside the decision of the adjudicator and make a fresh decision. As it is the experience of the current industry adjudicators that most complaints are resolved satisfactorily, we believe it is unlikely to result in a flood of claims or appeals to the Privacy Commissioner from unsatisfied applicants. It will also address the concerns that having multiple adjudicators applying multiple codes will lead to different interpretations being placed on similar provisions.

Finally, these amendments establish the offence of serious privacy breach. We say that you have to be realistic. There will always be unscrupulous operators who will attempt to exploit personal information for profit, regardless of the applying law. The bill provides no real deterrent for those companies which break the rules again and again. Accordingly, there is a real risk that companies which ruthlessly exploit personal information for profit will go unpunished. As is the case in so many areas, it is often the actions of a few that affect the reputations of many.

Our amendments will create an offence of serious privacy breach to ensure that business takes seriously their privacy obligations. The offence will be triggered only in circumstances in which the usual civil remedy offered by the Privacy Commissioner and enforceable by the Federal Court is not sufficient to address the problem. For instance, I gave the example that disclosing the personal details of someone's subscription to a surfing magazine, or whatever it might be, may not itself give rise to much compensation, but the invasion of that publisher's records might be so intense as to justify a penalty. The penalty proceedings which we have proposed will be available only after the Privacy Commissioner has issued to the noncomplying company a breach notice which specifies the nature of the noncompliance, provides the offending company with a warning of this course of action and offers the company an opportunity to make appropriate rectification and restorative measures. So it is very much a penalty of last resort but one which we say must be there to give some force and effect that this privacy regime is fair dinkum.