Privacy and Surveillance Course (Australia): Lessons 2026

Lesson 1: The Privacy Act and the APPs

The main federal privacy law is the Privacy Act 1988 (Cth). It contains 13 Australian Privacy Principles (APPs). The Office of the Australian Information Commissioner (OAIC) oversees it.

Personal information is information or an opinion that could identify a person. Examples are a name, signature, address, phone number, date of birth, photographs, IP addresses, voice prints, facial recognition data and location data from a phone.

Sensitive information needs extra care. It includes a person's racial or ethnic origin, political opinions, religion, union membership, sexual orientation, criminal record, health or genetic information, and some biometric information. APP 3 sets higher standards for collecting it.

Who must follow the APPs

The APPs apply to Australian Government agencies and to organisations with an annual turnover of more than $3 million. Most small businesses ($3 million or less) are exempt, but some are still covered, including health service providers, businesses that trade in personal information, contractors providing services under a Commonwealth contract, and businesses related to a covered business. State and territory privacy laws may cover state agencies, councils and universities.

APP	What it means at work
APP 1	Be open about how information is handled and keep a privacy policy.
APP 3	Collect only what you need, with higher standards for sensitive information.
APP 5	Tell people about certain matters when you collect their information.
APP 6	Use or share information only for the reason it was collected, unless an exception applies.
APP 11	Protect information from misuse, loss and unauthorised access; destroy or de-identify it when it is no longer needed.
APP 12 and 13	Give people access to their information and correct it when needed.

Since 10 June 2025, a statutory tort lets a person sue in court for a serious invasion of privacy, such as intruding on their private space or misusing their information. The OAIC does not run this; claims go to the courts.

Lesson 2: CCTV and workplace surveillance

If an organisation is covered by the Privacy Act, personal information collected by its security cameras must be handled under the APPs. The OAIC says the organisation must:

Tell people that their image may be captured before they are recorded
Keep the recordings secure
Destroy or de-identify recordings when they are no longer needed

State and territory surveillance device laws also cover cameras. A camera run by a person in a private capacity, such as a home camera, is not covered by the Privacy Act, but state or territory laws may still apply.

Workplace surveillance laws

Some places have laws just for watching employees at work:

Place and law	Main rules
NSW: Workplace Surveillance Act 2005	Written notice to employees at least 14 days before surveillance starts. Cameras must be clearly visible, with signs at each entrance. A tracked vehicle must show a clear notice. No surveillance in change rooms, toilets or showers.
ACT: Workplace Privacy Act 2011	Employers must give written notice, usually at least 14 days before surveillance starts, and consult workers in good faith about it.
Victoria: Surveillance Devices Act 1999, s 9B	It is an offence to use optical or listening devices in workplace toilets, washrooms, change rooms or lactation rooms.

Lesson 3: Recording conversations and body-worn cameras

Body-worn cameras and phones can record sound as well as pictures. Recording a private conversation is controlled by state and territory surveillance or listening device laws, and these laws differ.

Queensland: under the Invasion of Privacy Act 1971, s 43, the listening device offence does not apply when the person using the device is a party to the conversation. Section 45 separately limits sharing or publishing that recording.
New South Wales: under the Surveillance Devices Act 2007, s 7, a party may record a private conversation if all principal parties consent. If only one party consents, the recording must be reasonably necessary to protect that party's lawful interests, or not made in order to share the conversation with people outside it.
Other states: in 2014 the Australian Law Reform Commission found that Queensland, Victoria and the Northern Territory allow a party to record, while the other states and territories have no such general exception. Laws can change, so check your state's current law and your employer's policy.

Cameras also have limits. In NSW, it is an offence to install or use an optical surveillance device where this involves entering premises or a vehicle without the owner's or occupier's consent.

Lesson 4: ID checks, logs and requests for information

Scanning and copying ID

The OAIC says a business may scan ID only when it is reasonably necessary for its activities. It should not scan ID if sighting it would be enough. It must tell people why it needs to scan and what happens if they do not agree, and it needs consent if the ID contains sensitive information. Some laws, such as liquor licensing or anti-money laundering laws, may require ID checks. Scanned data must be protected and destroyed or de-identified when no longer needed.

Logs and reports

Visitor logs, notebooks and incident reports hold personal information. Collect only what you need, keep them out of public view and store them securely.

Sharing information (APP 6)

Information collected for one purpose, the primary purpose, may be used or shared for another purpose only if an exception applies. The main exceptions are:

The person consents
The person would reasonably expect it and it is related to the primary purpose (directly related for sensitive information)
An Australian law or a court or tribunal order requires or authorises it
It is needed to lessen or prevent a serious threat to someone's life, health or safety, and getting consent is unreasonable or impracticable
It is reasonably necessary for enforcement activities of an enforcement body, such as the police

When an organisation shares information under the enforcement exception, it must make a written note of the use or disclosure (APP 6.5). If police ask for footage, follow your site's procedure and pass the request to the person authorised to release it.

Under APP 12, people can ask for their own personal information. Pass these requests to your supervisor or privacy officer.

Lesson 5: Data breaches and complaints

A data breach happens when personal information is lost or is accessed or disclosed without authorisation. Examples are a lost or stolen device holding personal information, or information given to the wrong person by mistake.

Under the Notifiable Data Breaches scheme, an organisation covered by the Privacy Act must notify the affected people and the OAIC when a breach is likely to result in serious harm. The notice to people must include steps they should take.

Your part

Report a lost notebook, phone, key card or USB stick to your supervisor straight away.
Tell your supervisor if you sent a report or footage to the wrong person.
Do not try to hide a mistake. Early reporting limits the harm.

Complaints

A person who thinks their information was mishandled must first complain to the organisation. If it does not respond within 30 days, or the person is unhappy with the reply, they can complain to the OAIC. Complaints to the OAIC must be in writing.

For disputes about a neighbour's camera, the OAIC suggests talking to the neighbour first, then a community justice or mediation centre, the police if safety is a concern, or the local council.