Online Safety Act 2021

If an entity:

holds personal information about an individual that was collected for the purpose of, or for purposes including the purpose of, taking reasonable steps to prevent age‑restricted users having accounts with an age‑restricted social media platform; and

uses or discloses the information otherwise than:

for the purpose of determining whether or not the individual is an age‑restricted user; or

in circumstances where paragraph 6.2(b), (c), (d) or (e) of the Australian Privacy Principles applies; or

with the consent of the individual, which must be in accordance with subsection (2);

an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

covered by section 13 of that Act.

An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.

For the purposes of subparagraph (1)(b)(iii):

the consent must be:

voluntary; and

informed; and

current; and

specific; and

unambiguous; and

the individual must be able to withdraw the consent in a manner that is easily accessible to the individual.

If an entity holds personal information about an individual that was collected for the purpose of, or for purposes including the purpose of, taking reasonable steps to prevent age‑restricted users having accounts with an age‑restricted social media platform, then:

the entity must destroy the information after using or disclosing it for the purposes for which it was collected; and

if the entity does not so destroy the information, the failure to destroy the information is taken to be:

an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

covered by section 13 of that Act.

An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.

In this section: