Australian data sovereignty guide for multinational companies

Alona Chumak

This article will review Australia’s data protection laws and sovereignty requirements and show you how InCountry can help you maintain compliance.

What is Australian data sovereignty?

Data sovereignty refers to the principle that the privacy laws governing a location will apply to all personal data stored within that location, regardless of where those data were initially generated or collected. 

In Australia, this simply means that all personal information stored within Australia is subject to Australia’s data privacy laws, regardless of the country where that personal information was collected.

What are the implications?

Organizations must ensure that the collection, processing, and storage of data comply with all applicable Australian data sovereignty requirements. Non-compliance can result in penalties as dictated by various data privacy laws. 

The ultimate goal of data sovereignty is to enhance data security for all personal information stored within Australia. Organizations must apply Australian data privacy laws to ensure this information is appropriately managed and protected against breaches.

Why is data sovereignty an important point in Australia?

There are several reasons why data sovereignty is critical in any country. This section will highlight five reasons why data sovereignty is a big deal in Australia. 

Ensure data privacy

As previously mentioned, the primary aim of data sovereignty is to guarantee comprehensive protection for all personal data stored within a nation’s borders. In Australia, this objective is pursued through robust data privacy legislation, including the Privacy Act of 1988 (amended in 2022), the My Health Records Act of 2012, the Critical Infrastructure Act of 2018, etc. These laws collectively strive to uphold the highest standards of data security and privacy.

National security

When sensitive data falls into the wrong hands, it can swiftly escalate into a national security issue, depending on the severity of the information. To prevent such risks, it is crucial to ensure full compliance with Australia’s data privacy laws, which are specifically designed to safeguard against these threats.

Easier legal processes

When data stored within Australia is subject to Australian laws, it simplifies legal processes related to data access, regulation, and protection. This is particularly important for compliance with regulatory requirements and responding to legal inquiries and disputes.

Promotes public trust

Ensuring data sovereignty fosters trust between the government, businesses, and the people. When businesses guarantee the secure management of personal information, individuals feel more comfortable sharing their data. Simultaneously, the public’s trust in the government grows as they see their information being protected and managed responsibly.

Risk mitigation

Australian data privacy laws are strict and adequately designed to reduce the possibility of data breaches. So, ensuring compliance with these principles helps mitigate the risk of data breaches.

These are key reasons why data sovereignty is essential in Australia. In the next section, we will review to whom these sovereignty requirements apply.

Who must comply with data sovereignty in Australia?

All organizations that collect, process, or store the personal information of Australian residents are subject to Australian government data sovereignty laws. It also applies to organizations that handle non-resident data if that data is stored within Australia. These organizations or institutions are in the following categories:

Government agencies

Government institutions at the federal, Regional, or local level that manage the personal information of Australian residents are obligated to comply with these regulations. 

Public sector organizations

Entities funded or controlled by the government, such as educational and healthcare institutions, must follow data sovereignty regulations as they manage a massive volume of data. Such entities include public schools (at all levels), Medicare, the National Disability Insurance Scheme (NDIS), and public hospitals like the Royal Melbourne Hospital.

Private sector companies

These are privately owned businesses operating in Australia. They are often the first category that comes to mind when we discuss data sovereignty, as they form a critical part of the Australian economy. As expected, they are also obligated to comply with the requirements of Australian data sovereignty.

Multinational corporations

These are huge companies, often valued at several billion dollars at the Australian Stock Exchange. They are also mandated to comply with Australia’s sovereignty requirements.

Cloud service providers

Cloud data sovereignty is a critical issue globally, and Australia is no exception. As cloud service providers offer storage solutions for businesses, they must adhere strictly to Australia’s data sovereignty regulations. Failure to comply with these requirements can result in severe penalties and legal consequences for non-compliance.

Note that this is a broad categorization of companies obligated to comply with Australian Data Sovereignty. Regardless of the industry they operate in or the type of service they provide, they are obligated to comply if they belong to any of the categories highlighted above.

Does Australian data need to be stored in Australia?

We will attempt to answer these questions through the lens of some critical data privacy laws and requirements in Australia.

While the Privacy Act does not explicitly prohibit cross-border data transfers, it requires businesses to ensure that overseas recipients handle data in compliance with the Australian Privacy Principles (APPs). The APPs are a list of 13 principles regarding the rights and responsibilities of individuals and organizations handling the personal information of Australians.

The My Health Records Act requires that My Health Record data be stored in Australia. This means the primary servers and data centers hosting this information cannot be located outside Australian borders. The act generally discourages the transfer of health information stored in the My Health Record system outside of Australia, ensuring that sensitive health data remains under Australian jurisdiction and protection.

However, there are a few circumstances where data transfers can be considered under the My Health Records Act 2012, and they are as follows:

  1. When it is necessary to provide healthcare to an individual;
  2. In cases of severe threats to public health or safety;
  3. For certain law enforcement activities.

Even under these particular circumstances, all cross-border data transfers must receive approval from the Secretary of the Department of Health before they can proceed.

Under the CDR, accredited data recipients must obtain explicit consent from consumers before transferring their data overseas. This consent must be informed, specific, and freely given. When data is transferred to a foreign country, the receiving organization must ensure that the data will receive protection equivalent to what is available under the Australian Privacy Principles (APPs) and the CDR framework. This includes ensuring that the data will be handled in a manner that complies with the relevant privacy and security standards.

Government agencies are required to store data within Australia to ensure compliance with local laws and regulations. This includes federal, state, and local government departments handling sensitive information related to national security, law enforcement, and citizen services.

Additionally, financial institutions must comply with the regulations set by the Australian Prudential Regulation Authority (APRA) and the Australian Securities and Investments Commission (ASIC). These regulations often require robust data protection measures, which include storing data domestically to mitigate risks associated with cross-border data transfers.

Australian data sovereignty laws

Similar to other countries with robust data sovereignty laws, Australia’s data sovereignty administration is shaped by a range of comprehensive privacy laws. In this section, we will examine the key Australian data sovereignty laws, including:

  1. The Privacy Act 1988.
  2. My Health Record Act of 2012.
  3. Consumer Data Right of 2022.

The Privacy Act 1988

The Privacy Act of 1988 is Australia’s earliest known data privacy law. It aims to enhance the security of Australian residents’ personal information by establishing standards for the proper handling of data throughout its lifecycle—from collection to processing and storage. The Act outlines guidelines for organizations on managing personal data responsibly and outlines appropriate penalties for non-compliance. 

Below are some key requirements of the Privacy Act:

Australian Privacy Principles (APPs)

The Act outlines 13 Australian Privacy Principles (APPs) that establish guidelines, rights, and responsibilities for the handling of personal information. These principles encompass a range of topics, including the transparent and open management of personal data, the options for anonymity and pseudonymity, the procedures for collecting requested personal information, the handling of unsolicited personal data, notifications regarding the collection of personal information, and the rules governing the use and disclosure of such information.

Data subject rights

The Privacy Act also secures the rights of Australian residents whose data will be collected, processed, and stored by businesses. Here are some of the rights secured by the Privacy Act:

Data breach notification

The Privacy Act includes a Notifiable Data Breaches (NDB) scheme. This scheme mandates that organizations inform affected individuals and the Office of the Australian Information Commissioner (OAIC) about data breaches that are likely to cause serious harm.

Cross-border data transfers

It mandates organizations to take reasonable steps to ensure that any overseas recipient of personal information does not violate the APPs. Additionally, organizations remain responsible for the personal information transferred abroad unless a specific exception applies.

Enforcement & penalties

The Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act. It has the authority to investigate complaints, conduct audits, and take enforcement actions when necessary. Organizations that violate the Privacy Act can incur substantial penalties, including fines. For severe or repeated privacy infringements, the OAIC can pursue civil penalties through the Federal Court.

My Health Records Act 2012

My Health Records Act 2012 is an important legislation in Australia that establishes and governs the My Health Record system. This is a national digital platform designed to securely store and share health information. This Act aims to improve healthcare quality and efficiency by facilitating better information sharing among healthcare providers. It also empowers consumers by granting them access to their health records, allowing them to play an active role in their healthcare decisions. Here are the main features and provisions of the Act:

Establishment of the health record system

The Act establishes the My Health Record system, providing individuals with a comprehensive digital health record. While individuals can register to create a My Health Record, the system transitioned to an “opt-out” model in 2018. This means that records are created automatically unless individuals opt out.

Control & access

Individuals have control over their My Health Record, including determining who can access it. They can set access controls and decide which healthcare providers can view their information. In addition, individuals can view their health information and manage aspects of their records, such as adding personal notes and emergency contact details.

Data on the health record system

The My Health Record system can include health summaries that detail an individual’s medical history, medications, and allergies. Pathology reports and diagnostic imaging results can also be uploaded to the system. Additionally, hospital discharge summaries, which provide an overview of the care received during a hospital stay and recommendations for follow-up care, are included. 

Privacy and security measures

Individuals can manage access to their My Health Record by setting controls that determine who can view their documents. In emergencies, healthcare providers can access records even if they are typically restricted. The system also keeps an audit trail of all access, enabling individuals to see who has viewed their information. The Act imposes penalties for unauthorized access or misuse of health records to ensure strict compliance with privacy regulations.

Responsibilities under the My Health Record Act

The Australian Digital Health Agency serves as the system operator, managing the My Health Record system and ensuring its secure and efficient operation. Healthcare providers are responsible for uploading relevant health information to the system and utilizing it to enhance patient care. 

The My Health Records Act 2012 represents a significant step towards a more integrated and efficient healthcare system in Australia. It emphasizes the importance of privacy, security, and consumer empowerment in managing health information.

The Consumer Data Right (CDR) of 2022

The Consumer Data Right (CDR) of 2022 builds on the original CDR framework and enhances consumer rights by granting greater access to and control over their data. Its key objectives include empowering consumers by allowing them to access the data held by businesses and authorizing secure data sharing with accredited third parties. The CDR aims to promote competition by making it easier for consumers to switch between service providers, ultimately leading to better products and services. 

Below are the key features of the CDR:

Data access and portability

Consumers can request access to their data from businesses and authorize its transfer to accredited third parties. This applies to financial, energy, and telecommunications data and will be extended to other sectors in the future.

Accredited Data Recipients (ADRs)

Only accredited organizations can receive consumer data, ensuring that data handling meets strict security and privacy standards.

Consumer consent

Consumers must provide explicit consent for data sharing, which must be informed, specific, and time-limited.

Privacy & security

The CDR enforces strict standards on the handling, storage, and transfer of data to protect consumer privacy and security. It also includes several privacy safeguards, requiring accredited data recipients to have a comprehensive privacy policy and to notify consumers of any data breaches.

Regulatory agencies

Two major agencies are responsible for ensuring compliance with the CDR: the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC). The ACCC oversees the implementation and enforcement of the CDR framework, ensuring compliance and addressing consumer complaints. The OAIC, an independent government agency, works alongside the ACCC to enforce privacy protections and manage data breaches related to the CDR, serving as Australia’s national data protection authority.

Data sovereignty requirements in Australia

Data sovereignty compliance is a critical issue for businesses worldwide, as non-compliance can lead to significant challenges and penalties. In this section, we will examine the data sovereignty requirements specific to Australia and their implications for businesses operating there.

APPs 8.1 of the Privacy Act 1988

The Australian Privacy Principles (APPs) govern the collection, use, disclosure, and storage of personal information, requiring organizations to handle personal data in compliance with Australian privacy standards. APP 8 specifically addresses the cross-border disclosure of personal information, mandating that before an entity shares personal data with an overseas recipient, it must take reasonable steps to ensure the recipient will manage the information following the APPs. Exceptions are made if the recipient is subject to laws or binding schemes that are substantially similar to the APPs.

Notifiable Data Breaches (NDB) scheme

The Notifiable Data Breaches (NDB) scheme is a part of the Privacy Act of 1988. It requires entities to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) about data breaches likely to result in serious harm. Organizations must provide timely notifications detailing the nature of the breach, the affected data, and the steps taken to mitigate damage.

Australian Signals Directorate (ASD) and IRAP Certification

The Australian Signals Directorate (ASD) manages cybersecurity standards and certifications to ensure data protection. The Information Security Registered Assessors Program (IRAP) certifies cloud service providers and other organizations, ensuring they meet stringent security requirements for handling Australian Government data. IRAP certification is a crucial component of compliance with data sovereignty requirements.

Australian Prudential Regulation Authority (APRA) guidelines

The Australian Prudential Regulation Authority (APRA) regulates the financial services industry, establishing standards for data protection and risk management. Prudential Standard CPS 234 mandates that financial institutions implement robust information security measures to protect data from unauthorized access and cyber threats. Compliance with CPS 234 is essential for meeting data sovereignty requirements in the financial sector.

Health data protection requirement

Healthcare providers must adhere to strict regulations for managing patient data, ensuring compliance with data sovereignty requirements. The My Health Records Act 2012 governs the My Health Record system, mandating that healthcare data be stored and processed within Australia to protect patient privacy and data security.

Government hosting certification framework

This framework offers guidelines for data hosting providers to meet Australian data sovereignty and security requirements. Government agencies must use certified hosting providers that comply with this framework, ensuring that sensitive data is stored and managed within Australia.

How InCountry helps companies stay compliant with Australian data sovereignty laws

A quick scan through this article will reveal a multitude of data sovereignty laws and requirements that your company needs to be familiar with and compliant with, where applicable. These laws can become a significant burden and distraction. Furthermore, the ever-evolving nature of these regulations adds an ongoing challenge for businesses striving to stay compliant.

At InCountry, we recognize these challenges and have committed ourselves to staying at the forefront of the latest legal developments and trends. This dedication ensures that our clients are always in compliance without the hassle of managing it themselves.

Beyond offering robust cloud data storage services, we provide top-notch data security infrastructure and a responsive customer service team dedicated to addressing your needs efficiently.

Contact us today to discuss your requirements and set your company on the path to seamless, stress-free compliance.