Privacy Act 1988 (Cth), Reach Over Scraped Personal Information
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 January 1989.
A personal data rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Do not collect personal information, including personal information scraped from a public website, unless it is reasonably necessary for one or more of the entity's functions or activities.
- Do not use or disclose personal information collected for one purpose for another purpose, including model training, unless the individual consented or an Australian Privacy Principle 6.2 exception applies.
If you get it wrong
Private right of actionNo
Who enforces it
Enforcement body
Office of the Australian Information Commissioner (OAIC)
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Privacy Act 1988's definition of personal information carries no exception for information that is publicly accessible, so an APP entity (an Australian Government agency, or an organisation with an annual turnover over $3,000,000) that scrapes personal information from a public website, including for AI training, must still collect it only where reasonably necessary for its functions under Australian Privacy Principle 3.
It may use or disclose that information for another purpose only within the Australian Privacy Principle 6 exceptions. The entity must still have an Australian link for the Act to reach conduct outside Australia.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
Read the law
official consolidated Act text, Federal Register of Legislation