Privacy Act 1988 for Mortgage Brokers

What the Privacy Act 1988 Does

The Privacy Act 1988 (Cth) sets federal rules for handling personal information. “Cth” means Commonwealth, distinguishing this Australian law from state or territory legislation.

The Act’s 13 Australian Privacy Principles (APPs) govern covered organisations and most Australian Government agencies, collectively called APP entities. The Office of the Australian Information Commissioner (OAIC) administers these privacy protections.

For a covered brokerage, the duties include these practical steps:

• Collect personal information only when reasonably necessary for the brokerage’s work, using lawful and fair methods.
• Explain the collection and how the brokerage handles the information through appropriate notices and a privacy policy.
• Use or disclose information for its collection purpose, unless an exception permits another purpose.
• Take reasonable steps to keep information accurate and secure. Destroy or de-identify information no longer needed when no legal retention requirement applies.
• Provide access and correction rights, subject to the Act’s exceptions.

The OAIC’s full APP text sets out those duties and their qualifications. Keep the corresponding process in the brokerage’s procedures, rather than relying on a privacy policy alone.

Yes, the Privacy Act 1988 remains in force. The Federal Register’s latest version is Compilation 104, incorporating commenced amendments through 2026. Its amendment history and uncommenced-amendment notes distinguish the law already operating from provisions waiting to start.

Who the Privacy Act Covers

The Privacy Act generally covers private organisations with annual turnover above $3 million, including companies. Most businesses at or below that threshold are exempt from the APPs unless an exception applies.

The OAIC’s small-business checklist identifies exceptions. They include certain businesses trading in personal information, businesses related to a covered organisation and businesses that opt in. Accreditation under the Consumer Data Right also brings a business within coverage.

Credit reporting requires a separate assessment. Part IIIA regulates consumer credit information, and small credit providers can have obligations regardless of turnover. Under section 6H, an agent processing an application or managing credit for a credit provider can itself be a credit provider while doing that work.

A mortgage broker isn’t automatically a credit provider simply because they help arrange a loan. The Act distinguishes a credit provider’s agent from an access seeker acting for the individual. Ask your adviser to classify the brokerage’s actual role and agreements, including its handling of credit reports.

Tax file number handling can also attract specific obligations even when the business is exempt from the APPs. Record the applicable duties separately from any aggregator or lender contract that requires additional controls.

Personal and Sensitive Information

Personal information is information or an opinion about an identified person, or someone reasonably identifiable in the circumstances. It can include an incorrect opinion and information that identifies someone only when combined with other records.

In a broker’s file, names and contact details are personal information. Payslips, bank transactions and notes about a client’s finances can also identify that person. The OAIC’s personal-information guidance explains the definition and its protected categories.

Sensitive information is a defined subset with extra protection. Broker examples include health information explaining a period without work, trade union membership shown on a payslip or biometric information used for automated identity verification.

Financial information needs strong protection, although income and account balances aren’t automatically “sensitive information” under the statutory definition. For an APP entity, collecting sensitive information generally requires consent as well as reasonable necessity, unless an exception applies.

Removing a client’s name doesn’t necessarily de-identify the file. A rare job, location and detailed transaction history might still identify the person.

The 2024 Amendments

The Privacy and Other Legislation Amendment Act 2024 introduced reforms with different start points. Its commencement table separates provisions already operating from delayed reforms.

The main changes relevant to a brokerage are these:

• Enforcement changes already in force add civil-penalty tiers and infringement notices for specified failures. The reforms also clarify that reasonable security steps include technical and organisational measures.
• A statutory tort for serious invasions of privacy commenced in 2025. This allows a qualifying court claim and can reach people or organisations outside ordinary APP coverage. The OAIC’s tort guidance explains the separate pathway and its limits.
• Automated-decision privacy-policy requirements have a 24-month transition and are awaiting commencement. They concern computer-assisted decisions using personal information that could significantly affect a person’s rights or interests. The OAIC’s transparency guidance gives the commencement point and required disclosures.
• The OAIC must develop and register a Children’s Online Privacy Code within 24 months of Royal Assent. The code’s scope concerns specified online services likely to be accessed by children. It doesn’t automatically impose the same duties on every business holding a dependant’s details.

For the computer-assisted decision requirements, use the separate automated decision-making guide. A brokerage can prepare its inventory of affected systems before the delayed provisions start.

How the Privacy Act Applies to AI Tools

Entering client information into an AI system is handling personal information, and the system’s design determines whether that involves use or disclosure. Sharing information with the provider can be a disclosure, while processing that stays under the brokerage’s control can be a use.

The OAIC’s commercial AI guidance requires attention to the collection purpose and any permitted secondary purpose. A provider’s ability to train models on prompts is a separate consideration from the broker’s reason for entering them.

Consider this hypothetical case. A broker pastes a client’s payslip into a public chatbot to draft a summary. The payslip includes identifying details and may reveal sensitive information, so the broker must assess the proposed handling before uploading it.

Use the minimum personal information needed. The OAIC recommends avoiding personal information, especially sensitive information, in publicly available chatbots. Assess the product’s retention and training terms, and explain permitted AI uses in the brokerage’s notices and policy.

If information goes to an overseas recipient, APP 8 can require reasonable steps to protect it and leave the brokerage accountable, subject to exceptions. The OAIC’s overseas disclosure guidance explains why overseas storage and disclosure need separate assessment.

Use the AI privacy guides for product-specific data handling and AI tools for mortgage brokers for the tools’ different jobs. Record the approved use and the information staff can enter before giving them access.

Data Privacy Laws in Australia

Australia’s privacy obligations come from several laws and rules, with the Privacy Act as the main federal framework for covered organisations. Data privacy means controlling how information about people is handled, including who can access it and for what purpose.

Consumer credit reporting sits within Part IIIA of the Privacy Act, supported by the Privacy Regulation and registered credit reporting code. It adds rules for consumer credit information, including permitted disclosures and correction processes.

The Consumer Data Right (CDR) has separate privacy safeguards and consent rules for its participants. The OAIC’s trusted-adviser guidance explains that a mortgage broker receiving data as a nominated trusted adviser isn’t automatically a CDR participant. Their applicable Privacy Act and professional duties still matter.

State and territory privacy regimes mainly concern their public sectors. Some also cover private-sector health information, so “government agencies only” isn’t a reliable description of every regime. The OAIC’s state and territory overview identifies the relevant authorities and exceptions.

Penalties and Complaints

Privacy breaches can lead to complaints, regulatory investigations and civil penalties. The response depends on the conduct and the provision breached.

A client generally complains to the brokerage first and allows 30 days for a response. An approved external dispute resolution scheme, such as the Australian Financial Complaints Authority, may be the next route before the OAIC. The OAIC complaint procedure sets out the sequence and written information required.

Courts can impose civil penalties for interference with privacy, with a higher tier for serious interference. For a company, the serious-interference maximum is the greatest of $50 million or three times the attributable benefit. If the benefit can’t be determined, the alternative is 30% of turnover for the statutory period.

The OAIC can also issue infringement notices for specified contraventions, including certain privacy-policy failures. Payment is an alternative to court proceedings for the alleged contravention, without admitting liability. These notices aren’t a general fixed fine for every data breach.

Where a breach meets the Notifiable Data Breaches scheme’s criteria, notification to affected people and the OAIC is a separate obligation. Put complaint handling and breach response into the brokerage’s procedures, and have its adviser confirm the duties for its activities and AI use.