Out here, the safety net has a hole in it

Last week I left you sitting on a question, and I promised I'd be straight with you about the answer. Here it is again: if the federal Privacy Act doesn't reach the small operator down the road — the caravan park, the mechanic, the footy club with your phone number in a spreadsheet — does anything else? Does the state pick up the slack? Does the council?

I went looking for a yes. I really did. What I found is the reason this post has the title it does. (Same disclaimer as always: this is general information, not legal advice. I read the source documents; I'm not a solicitor.)

Let's start with the good news, because there is some.

Queensland does have its own privacy law. It's called the Information Privacy Act 2009, and it comes with its own set of rules — the Queensland Privacy Principles. So on paper, we're not relying on Canberra alone. There's a state law with our name on it.

Now here's the catch, and it's the whole ballgame: the Queensland law only binds the government side of the ledger. State departments, statutory bodies, and — keep this one in mind — local councils. That's who the Queensland Privacy Principles apply to. What they don't apply to is private business or the community sector. The shop, the tradie, the caravan park, the club — the state Act doesn't touch them.

So think about what that stacks up to. Last week we established that most small operators fall under the federal threshold and are exempt from the federal Act. This week the state law arrives, and it turns out it was only ever built to police the government, not the business next door. If the federal Act doesn't reach a private operator out here, there is no state law sitting behind it to catch them. Nothing. The safety net people assume is there — a second layer, a state backstop — simply isn't, not for private business in Queensland.

And this is where it stings a bit, because it's not the same everywhere in the country.

Down in New South Wales and Victoria, they've each got their own state health-records laws — New South Wales has one from 2002, Victoria one from 2001, and the ACT has its version too. So a private health provider down there answers to both the federal rules and a state law layered on top. Queensland doesn't have that. We sit in the same boat as the Northern Territory and Tasmania: no state private-sector health privacy law at all. For health specifically the gap is narrower — remember from last week that health providers are already covered federally no matter how small they are — but the broader shape is the point. In the southern states there's a habit of layering state protection on top of the federal Act. Up here, there's just the one law, with the hole in it we talked about last week.

So what about the council? That's the local layer, and it's worth a proper look, because there's actually a piece of genuinely fresh news here.

Your council is bound — as a Queensland agency under those state privacy principles — for the data it holds on you. Your rates record, your dog registration, the submission you sent in on some development application. That's covered. And it just got a set of teeth it didn't have before. Queensland brought in a mandatory data-breach scheme: if an agency has a serious breach of your personal information, it now has to tell you and the Information Commissioner. State agencies came under that scheme on the first of July last year. Local councils were given an extra year to get ready — which means they've only had to be complying since the first of July this year. So as of barely a month ago, if your regional council loses control of your data in a way that could seriously harm you, they're obligated to come clean about it. That's new, and it's real, and most people out here have no idea it exists.

But — and you knew a "but" was coming — that scheme covers agencies. The council, the department. It does not cover the private operator in town. There's no distinct "local" privacy law for the business on the main street. Their obligations are set by the federal Act, or by the exemption, full stop. The local layer, for business, turns out to be the thinnest one of all. And that gap isn't an accident I'm pointing at — it's the whole reason I started writing this series.

So let's put the ledger together. Federal law: one Act, with an exemption most small operators fall straight through. State law: real, but built for government, not business. Local: your council's on the hook for its own records now, but the shop isn't on the hook for anything a court could easily reach.

That's a fairly grim tally, and I'm not going to pretend otherwise. But it's not the end of the story — because something is changing, and there's one thing that landed last year that genuinely shifts the ground under your feet. That's next week: what's coming, what's already here, and what you can actually do about it — as a customer, and as a small operator who wants to do right by people.