Introduction

11.1 The Privacy Act 1988 (Cth) does not regulate the handling of personal information by individuals for the purposes of, or in connection with, their personal, family or household affairs.^[1] This means that an individual acting in a personal capacity—for example, an individual who posts personal information about others on a personal ‘blog’—is not regulated by the Privacy Act. In addition, while the privacy principles apply when personal information is collectedby an agency or organisation for inclusion in a generally available publication, they do not apply to personal information that isheld in a generally available publication. This is because the Privacy Act only applies to information held in a record, and a generally available publication (such as a publicly available website) is not a ‘record’ for the purposes of the Privacy Act.^[2]

11.2 In this chapter, the ALRC first discusses whether the Privacy Act should regulate individuals acting in a personal capacity. It focuses on the regulation of one particular activity engaged in by individuals—namely, the publishing of personal information in the online environment. The ALRC then discusses whether the Privacy Act needs to be amended to address issues about the online publication of publicly available information.