Farewell Australian Privacy Principle 6?

If the Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft is passed as is, it will require organisations to completely reconsider how they use personal information. The long standing test for use and disclosure in Australian Privacy Principle (APP) 6 - which restricted the use or-disclosure of PI to the primary purpose of collection or a permitted secondary purpose, will be repealed and replaced by the 'fair and reasonable' test in the new APP 3.

This morning I was privately bemoaning the work I would need to do inside my skull to amend my mental model of the Privacy Act, a legislative regime that I think about and have worked with every day for over 15 years.

But if the primary/secondary purpose test goes, I don't think I would mourn the loss. The primary/secondary purpose test has always been a bit grey and fuzzy. It has always been a challenge for organisations to identify when a secondary purpose was sufficiently 'related' to the primary purpose of collection to enable valid reuse. Further, the test encouraged 'bundling' of purposes - users signing up for a service found themselves being required to accept numerous purposes as a condition of service, only disclosed in general terms in a 4000 word privacy policy on a different page of the website - "it's not 'reuse', it's one of our 17 'primary' purposes of collection"! This particular strategy is part of why the OAIC's Community Attitudes to Privacy Survey routinely finds that 2/3rds of Australians don't feel like they have any insight into or choice about how their data is used.

The introduction of the fair and reasonable test will require organisations to take a fresh look at how they are using and disclosing personal information - and be ready and able to justify how that use is acceptable. The intent here is clear - the onus should be on the organisations collecting the data, not on the individuals to perform detailed investigations into each service they use. Individuals should be able to trust organisations with their data - not only that they will keep it secure (which is hard enough in the current environment), but that the use will be appropriate.

This, of course, may present additional labour for organisations. Privacy Impact Assessments will take on increased importance. 'Checkbox' style assessments may need more consideration my privacy staff - the fair and reasonable test requires a detailed consideration of the circumstances, and may not always be cut and dried. More work will need to be done on transparency, and on demonstrable consent. But, ultimately, organisations are the only ones with the time, money and staffing to do this work, and the ones reaping the monetary benefits - unlike individuals, who would need to devote ~46 (unpaid) hours a year just to read the privacy policies of the online services that they use to participate in our digitally-enabled society.

Beyond that, this shift may provide the impetus for organisations to actually do some much needed privacy and data governance remediation. I’ve seen numerous clients with vast hoards of unstructured, poorly understood or entirely dark data, kept ‘just in case’. Sweeping assumptions about the consent of customers, even where those customers signed up 10 years ago under a long decomissioned privacy policy, and the products and the underlying technologies have evolved by leaps and bounds since then. A significant over-reliance on privacy policies that can only be understood by customers with law degrees, and that organisations know, for a fact, that none of their customers read anyway. These are all problems that are required to be fixed under the current law anyway - but fresh reform process often gain the attention of the Risk and Compliance community and can help spur remediation projects.

It's a far reaching and transformational proposal – but it could result in significant benefits for the public, and (after a lot of work) better processes and improved governance for organisations.

Many of us in the privacy community are either discussing or furiously drafting submissions right now, and it remains to be seen how the government will proceed. Submissions are open until 18 September 2026. If you want to discuss the reform process, or require assistance with preparing a submission, please reach out to me.