EdLaw
Australia — Privacy Act 1988, APPs and the Children's Online Privacy Code
The Commonwealth privacy statute and its Australian Privacy Principles, plus s 26GC — the Children's Online Privacy Code duty inserted by the Privacy and Other Legislation Amendment Act 2024.
Applicability to EdTech
- The Children's Online Privacy Code will bind us (s 26GC(5)): it binds providers of social media services, relevant electronic services and designated internet services (Online Safety Act 2021 meanings) whose service is likely to be accessed by children — an education platform is squarely in that class (health services are carved out, education is not). The Commissioner must develop and register the code within 24 months of the December 2024 Royal Assent — i.e. by December 2026 (s 26GC(10)), after a ≥60-day public consultation (s 26GC(9)). Watch the OAIC consultation and be ready to comply at registration.
- APP 8 (cross-border disclosure): before disclosing personal information overseas, take reasonable steps to ensure the recipient complies with the APPs — with the accountability rule (s 16C, not extracted) making the discloser liable for the recipient's breaches. UK/US hosting of Australian school data runs through this.
- APP 11 (security): reasonable-steps protection from misuse, interference, loss and unauthorised access, plus destruction/de-identification when no longer needed (APP 11.2) — Australia's retention rule.
- No fixed digital-consent age: capacity-based, with OAIC guidance presuming capacity from 15. Private schools are APP entities; public schools sit under state privacy law (README-level note).
Contents
| Document | Covers |
|---|---|
| CHILDRENS-CODE-EN-APPS.md | s 26GC in full; Schedule 1 APP 8 and APP 11 |
Scope note: state education department cloud/security schedules (e.g. NSW DoE, Vic DET) are procurement instruments, not statutes — collect when an Australian tender lands. The 2024 amendment's statutory tort and doxxing offences are out of EdTech scope.
Enforcement
Office of the Australian Information Commissioner (OAIC, oaic.gov.au); civil penalties up to the greater of A$50m / 3× benefit / 30% adjusted turnover for serious interferences (s 13G, not extracted).
Related
- US COPPA — the US children's sibling
- UK ICO Children's Code (Tier 4 backlog) — the model s 26GC follows
Sources
- Federal Register of Legislation — Privacy Act 1988 (latest compilation)
- OAIC — Children's Online Privacy Code
Meta
Statute text in CHILDRENS-CODE-EN-APPS.md is reproduced verbatim from the authorised FRL compilation (C2026C00227, No. 104) by tools/frl-au/build_au.py; the FRL API's latest-compilation registerId is pinned, so verify fails as soon as a newer compilation is registered.