"Personal Information" and Group Data under the Privacy Act 1988 (Cth)

Abstract

The Privacy Act 1988 (Cth) is focused on information that relates to identified or identifiable persons. If understood narrowly, this approach risks failure to acknowledge the importance of data relating to multiple persons (group data) and its appropriate control within the framework of data governance. There is an increasingly urgent need to address this risk. Indeed, the COVID-19 pandemic has already demonstrated how group data might have tangible impact: by shifting an understanding of priority and what constitutes a reasonable trade-off between individual and public interests. This article  considers the extent to which governance mechanisms could, through the vehicle of existing privac..