EdLaw
Australia — Privacy Act 1988, APPs and the Children's Online Privacy Code
The Commonwealth privacy statute and its Australian Privacy Principles, plus s 26GC — the Children's Online Privacy Code duty inserted by the Privacy and Other Legislation Amendment Act 2024.
Applicability to EdTech
- The Children's Online Privacy Code will bind us (s 26GC(5)): it binds providers of social media services, relevant electronic services and designated internet services (Online Safety Act 2021 meanings) whose service is likely to be accessed by children — an education platform is squarely in that class (health services are carved out, education is not). The Commissioner must develop and register the code within 24 months of the December 2024 Royal Assent — i.e. by December 2026 (s 26GC(10)), after a ≥60-day public consultation (s 26GC(9)). Watch the OAIC consultation and be ready to comply at registration.
- APP 8 (cross-border disclosure): before disclosing personal information overseas, take reasonable steps to ensure the recipient complies with the APPs — with the accountability rule (s 16C, not extracted) making the discloser liable for the recipient's breaches. UK/US hosting of Australian school data runs through this.
- APP 11 (security): reasonable-steps protection from misuse, interference, loss and unauthorised access, plus destruction/de-identification when no longer needed (APP 11.2) — Australia's retention rule.
- No fixed digital-consent age: capacity-based, with OAIC guidance presuming capacity from 15. Private schools are APP entities; public schools sit under state privacy law (README-level note).
Contents
| Document | Covers |
|---|---|
| CHILDRENS-CODE-EN-APPS.md | s 26GC in full; Schedule 1 APP 8 and APP 11 |
Scope note: the state education departments' supplier-facing rules are departmental policies, not statutes, and sit at state level: NSW Cyber security procedures, Victoria Software and Administration Systems (ST4S), Queensland Non-departmental ICT service providers. The 2024 amendment's statutory tort and doxxing offences are out of EdTech scope.
Enforcement
Office of the Australian Information Commissioner (OAIC, oaic.gov.au); civil penalties up to the greater of A$50m / 3× benefit / 30% adjusted turnover for serious interferences (s 13G, not extracted).
Licence
The corpus reproduces sections 26GC and APPs 8 and 11 of the Privacy Act 1988 (Cth) from the authorised compilation C2026C00227 on the Federal Register of Legislation.
Commonwealth legislation is Crown copyright, and the corpus reproduces it under the Federal Register of Legislation's licence. The terms of use (legislation.gov.au/terms-of-use, read 2026-10-01) say: "With the exception of the Commonwealth Coat of Arms, and where otherwise noted, all content on the Federal Register of Legislation (the Legislation Register) is provided under Creative Commons Attribution 4.0 International (the CC BY 4.0 licence). This licence allows you to share (copy and redistribute in any medium or format) and to adapt (remix, transform, and build upon) content for any purpose, even commercially." The conditions are: "you provide a link to the relevant pages on the Legislation Register or, if multiple pages are involved, a link to the Legislation Register home page; and you attribute the content to the Federal Register of Legislation, provide a link to the CC licence, and indicate if any changes were made. You may do so in any reasonable manner, but not in any way that suggests we endorse you or your use." For changed content the attribution must read: "Based on content from the Federal Register of Legislation at [full date of download]. For the latest information on Australian Government legislation please go to https://www.legislation.gov.au."
Conditions, and how this corpus meets them:
- Link to the relevant pages: Sources links the compilation on the Legislation Register.
- Attribute the content, with the prescribed words: the fact document names the Federal Register of Legislation and compilation C2026C00227 in its opening citation line and Meta. The prescribed wording, for the download of 6 September 2026, is: "Based on content from the Federal Register of Legislation at 6 September 2026. For the latest information on Australian Government legislation please go to https://www.legislation.gov.au."
- Link to the licence: CC BY 4.0.
- Indicate changes: the provision text is unchanged; the changes are the selection of provisions, the Markdown layout and the added anchors, described in Meta.
- No endorsement: the corpus does not claim that the Office of Parliamentary Counsel endorses it.
The OAIC page linked from Sources is cited, not reproduced; the Children's Online Privacy Code itself is not yet registered and is not in the corpus.
Related
- US COPPA — the US children's sibling
- UK ICO Children's Code (Tier 4 backlog) — the model s 26GC follows