Privacy relief set for small business

Small businesses are expected to be exempted under a shake-up of privacy laws amid rising industry concerns over soaring insolvencies and the ongoing cost-of-living crisis.

Attorney-General Mark Dreyfus. Picture: NewsWire / Martin Ollman

Small businesses are expected to retain their exemptions under Anthony Albanese’s shake-up of privacy laws amid rising industry concerns over soaring insolvencies and the cost-of-living crisis.

Attorney-General Mark Dreyfus recently flagged that under instruction from the Prime Minister he would bring forward legislation in August to overhaul the Privacy Act and “protect Australians from doxxing – the malicious use of personal and private information”.

After Mr Dreyfus last year announced the most significant reshaping of the privacy regime since the 1980s, small and large industry groups urged the government to not remove exemptions for up to 2.5 million small businesses.

The Australian understands while the government has not landed on a final position, sources close to discussions believe the final legislation will take into account the cost and resources impact on small businesses.

Business leaders have warned of economy-wide implications and the need for significant investment if privacy exemptions for small businesses with turnovers under $3m were removed.

Under current rules, small businesses are not obligated to keep personal information secure or notify customers of data breaches.

The government last year flagged an impact analysis of the proposed privacy shake-up, consideration of a support package, and a transition period giving small businesses time to prepare.

In September last year, Mr Dreyfus said the government would “work with the small business sector, as well as employer and employee representatives, on enhanced privacy protections for private sector employees and for small businesses”.

He pledged his department would consult with community and business groups, media organisations and government agencies to “inform the development of legislation … in this term of parliament”.

A spokesman for Mr Dreyfus on Monday would not confirm exemptions for small businesses but said the government was “committed to stronger privacy protections for Australians”.

“The government’s privacy reforms are being finalised,” the spokesman said.

“The reforms will build on legislation passed in 2022, which significantly increased penalties for repeated or serious privacy breaches, and provided the Australian Information Commissioner with greater powers to address privacy breaches.”

Industry leaders have not been officially informed about whether small businesses will or won’t be captured under the shake-up of privacy laws. Modernising the privacy regime is considered crucial in protecting personal information following a series of high-profile cyber breaches and hacking events.

Council of Small Business Organisations Australia chief executive Luke Achterstraat said with “10-year highs in business insolvencies, it is the worst possible time to introduce more compliance costs onto a sector largely in survival mode”.

“Small businesses seek to do the right thing in regards to privacy and data obligations. However, we need to make sure small and particularly micro businesses are not lassoed with more red tape because of a few high-profile cases (like Medibank),” Mr Achterstraat said.