Law · Australia (Commonwealth)
Australia: Privacy Act 1988
The Privacy Act 1988 governs how organisations handle personal information in Australia, with facial images and templates treated as sensitive information that normally needs consent. The Information Commissioner found Clearview AI in breach in 2021, a finding that survived tribunal review. Reforms passed in late 2024 added a statutory tort for serious invasions of privacy, doxxing offences and a tiered penalty system, while a second tranche of reforms remained pending in 2026.
Updated November 6, 2026 · 5 min read · reviewed November 6, 2026
- AUD 50M
- Maximum civil penalty, or three times the benefit, or 30 percent of turnover
- 14 Oct 2021
- OAIC determination against Clearview AI
- 10 Jun 2025
- Statutory tort for serious invasion of privacy commences
2022 enforcement amendments
OAIC
2024 Amendment Act
What does the Privacy Act cover?
The Act applies to Australian Government agencies and to private organisations with annual turnover above AUD 3 million, plus smaller businesses in listed categories. The 13 Australian Privacy Principles (APPs) set the rules: collect only what is reasonably necessary (APP 3), tell people what you collect (APP 5), use it for the purpose collected (APP 6), keep it secure and destroy it when no longer needed (APP 11). Biometric information used for automated verification or identification, and biometric templates, are sensitive information, which under APP 3.3 may be collected only with consent and where reasonably necessary for the organisation's functions.
The Act reaches foreign organisations with an "Australian link". The Administrative Appeals Tribunal held in May 2023 that Clearview AI, which had no office in Australia, was nevertheless carrying on business there by repeatedly collecting images from Australian servers. That finding is what gives the Act its reach over offshore face search engines.
Who enforces it?
The Office of the Australian Information Commissioner (OAIC) investigates, issues determinations and, since 2022, can seek large civil penalties in the Federal Court. The eSafety Commissioner handles image-based abuse removal under the separate Online Safety Act 2021, with 24-hour removal notices. The two regimes overlap when a face search surfaces an intimate image: the Privacy Act for the data handling, eSafety for the removal.
-
1989-01-01
Privacy Act commences
Initially covering Commonwealth agencies; extended to the private sector from 2001.
-
2014-03-12
Australian Privacy Principles
A single set of principles replaces the earlier public and private sector rules; biometrics defined as sensitive information.
-
2021-10-14
Clearview AI determination
The Commissioner finds Clearview collected Australians' facial images and templates without consent, by unfair means, and without taking reasonable steps to notify.
-
2022-12-13
Enforcement amendments
Maximum penalty for serious interference rises to the greater of AUD 50 million, three times the benefit, or 30 percent of adjusted turnover.
-
2023-05-08
Tribunal confirms jurisdiction
The AAT holds Clearview was carrying on business in Australia; Clearview withdraws from the proceedings in August 2023.
-
2024-08-21
OAIC closes the Clearview matter
The Commissioner decides not to take further action; the 2021 determination and its declarations stand.
-
2024-12-10
Privacy and Other Legislation Amendment Act 2024
Royal Assent. Statutory tort, doxxing offences, tiered penalties, children's online privacy code, automated-decision transparency.
-
2025-06-10
Privacy tort commences
Serious invasions of privacy become actionable without proof of damage.
What did the 2024 reforms add?
| Provision | Effect | Commencement |
|---|---|---|
| Statutory tort for serious invasion of privacy | A person can sue for intrusion upon seclusion or misuse of private information where the invasion is serious, intentional or reckless, and the public interest in privacy outweighs countervailing interests | 10 June 2025 |
| Doxxing offences (Criminal Code) | Releasing personal data online in a menacing or harassing way: up to six years; seven where the target is chosen for race, religion, sex, sexual orientation, gender identity, intersex status, disability or nationality | Royal Assent, 10 December 2024 |
| Tiered civil penalties | Mid-tier penalties up to AUD 3.3 million for interferences that are not serious; infringement notices for administrative breaches | Royal Assent |
| Children's Online Privacy Code | OAIC to develop a code for services likely to be accessed by children | Code due within 24 months |
| Automated decisions | Privacy policies must disclose automated decisions that significantly affect individuals | 24 months after Royal Assent |
What does it mean for face search?
The OAIC v Clearview AI determination is the Australian benchmark: scraping Australians' photos from the web and computing biometric templates from them collected sensitive information without consent, breached APP 3 and APP 5, and the "publicly available" character of the photos did not help. The same reasoning applies to any consumer face search engine indexing Australians, including PimEyes, FaceCheck.ID and FaceSearch, though no determination against a consumer engine had been published by November 2026. Since June 2025 an individual whose face has been indexed and exposed in a seriously intrusive way can also sue in tort, without waiting for the regulator.
| Situation | Position |
|---|---|
| You search your own face | Your consent covers the engine's handling of your upload for that search. |
| You search another person and publish or threaten with the result | Potential doxxing offence since December 2024 and a privacy tort claim since June 2025, on top of stalking and image-based abuse laws. |
| An engine indexes Australians' faces from the open web | Per the Clearview determination, collection of sensitive information without consent; exposure to civil penalties up to AUD 50 million or more. |
What is pending?
The second tranche of reforms recommended by the Attorney-General's 2023 review, including a fair-and-reasonable test, a right to erasure and removal of the small-business exemption, had not been introduced as of 6 November 2026. The OAIC has signalled that biometrics and facial recognition remain a priority, and its 2024 Bunnings determination on in-store facial recognition is on appeal.
Questions
Is face search legal in Australia?
Searching your own face raises no Privacy Act issue. Building a face index from Australians' public photos without consent was found to breach the Act in the Clearview case, and the finding stands. Using results to harass can be a doxxing offence or a privacy tort.
What is the maximum penalty?
For a serious or repeated interference with privacy, the greater of AUD 50 million, three times the benefit obtained, or 30 percent of adjusted turnover, since December 2022.
Can I sue a face search engine myself?
Since 10 June 2025, yes, under the statutory tort for serious invasion of privacy, if the invasion was serious, intentional or reckless, and the public interest favours privacy. Damages are capped at the defamation cap for non-economic loss.
Did Clearview pay a fine in Australia?
No. The 2021 determination ordered it to stop and delete; the OAIC decided in August 2024 not to pursue the matter further. The determination remains in force.
Sources
- 1.OAIC, Statement on Clearview AI (21 August 2024) (checked November 6, 2026)
- 2.Lander and Rogers, Case study: Clearview AI v Australian Information Commissioner (checked November 6, 2026)
- 3.Lavan, A new privacy tort, doxxing offence and more: the Privacy and Other Legislation Amendment Bill 2024 (checked November 6, 2026)
- 4.Privacy Act 1988 (Federal Register of Legislation) (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Case OAIC v Clearview AI (Australia) OAIC v Clearview AI: Australia's 2021 determination, the 2023 tribunal decision affirming it, and the August 2024 decision not to pursue further action.
- Organisation Office of the Australian Information Commissioner (OAIC) Australia's privacy regulator: its powers under the Privacy Act, the Clearview AI determination and the 2024 decision not to pursue it, and how to complain.
- Engine Clearview AI Clearview AI: the law-enforcement face search built on scraped web images, its 100-billion-image claim, who may use it, and fines and orders from seven countries.
- Term Biometric data Biometric data defined: identifying data from a face, fingerprint, iris or voice, when a photo becomes biometric data, and the GDPR, BIPA and DPDP rules.
- Directory Removing intimate images shared without consent, by country Intimate image removal routes in 11 countries: the law, where to report, the platform deadline and the helpline, from the US and UK to India and Brazil.
- Law Canada: PIPEDA, the federal private-sector privacy law Canada's PIPEDA and face search: consent for facial images, the 2021 Clearview findings, the provincial orders upheld on appeal, and Bill C-36 tabled in June 2026.
Cite this entry
FaceSearch Wiki editors. "Australia: Privacy Act 1988". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/laws/australia-privacy-act/