Australian Information Security Acts and Amendments an open room discussion of the impacts and obligations of current legislative regulatory changes

Open discussion of the obligations and impacts associated with the (recent 2024; and continuing to 2025) changes in Australia Federal and State Legislation, in matters of Cyber Security and Privacy Bills and Acts.

This includes:

• Cyber Security Package 2024 (Passed November 2024. Awaiting royal assent to come into force.)

Contained in three separate Bills, for measures proposed by the 2023-2030 Australian Cyber Security Strategy:

\> Cyber Security Act 2024,

\> Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (SOCI Amendment Act), and

\> Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024

In summary this includes:

- Mandatory Ransomware Payment Reporting: (annual turnovers above AUD 3million) must disclose ransomware payments within 72Hours but does not prohibit payments.

- IoT Security Standards: New standard for Australian IoT devices (security cameras and access card monitoring) to be in line with international security standards to reduce vulnerabilities.

- Enhanced Protections for Data and Critical Infrastructure: Updates to laws such as the Privacy Act 1988 and the Security of Critical Infrastructure Act 2018 aim to fortify the security of critical infrastructure assets and reports and improve data management. The SOCI amendments also allow regulators to compel to remedy against significant risks.

- Liability Protections: The new rules offer businesses "no-fault" protections when reporting cyber incidents, encouraging greater transparency without the fear of legal consequences

- A ‘limited use’ obligation restricts how cyber security information voluntarily provided can be used and disclosed, and obligation for how ASD is to protect the information provided during a cybersecurity incident for a permitted purpose.

- A Cyber Incident Review Board (CIRB) will be established to conduct (“no fault”) post-incident reviews

- Certain freedom of information (FOI) exemptions to provide industry with the legal assurance for response to cybersecurity incidents.

Recommendations made ensure that businesses and their policies align with regulatory expectations and mandatory obligations in sharing and reporting on incidents, including sharing potentially sensitive information and cooperating in government associated post-incident reviews.

• Privacy and Other Legislation Amendment Bill 2024: (Assented-to 10 Dec 2024)

Amends the: Privacy Act 1988 and 7 other Acts to protect the privacy of individuals personal information, including expanding the Information Commissioner’s powers, facilitating information sharing in emergency situations or following eligible data breaches, requiring the development of a Children’s Online Privacy Code, providing protections for overseas disclosures of personal information, and transparency about automated decisions which use personal information; and Criminal Code Act 1995 for offenses targeting the release of personal data using a carriage service in a manner that would be menacing or harassing (known as ‘doxxing’).

• Online Safety Amendment (Social Media Minimum Age) Act 2024:

(Note: not into assent until 11 December 2025)

State base Privacy Bills such as for Western Australia:

• Privacy and Responsible Information Sharing Bill 2024 - Bill 158: Western Australia: [PRIS WA] (Assented-to 6 Dec 2024)

• Guidance on privacy and the use of commercially available AI products: [Provided Oct 2024]

As provided by the OAIC.