assess-australian-privacy-issues-l0cka

Assess Australian Privacy Issues

Produce a preliminary issue-and-law map for an Australian lawyer. Do not state that a duty applies until its threshold facts and current legislative text have been checked.

Read references/source-and-issue-method.md before starting. It defines the source hierarchy, legislation routing, issue taxonomy and treatment of Harvey Labs patterns.

Read references/current-commonwealth-privacy-map.md when Commonwealth privacy law is potentially relevant. Treat its dated entries as prompts requiring current verification.

Workflow

1. Protect the material and fix scope.
   • Ask for de-identified facts or the minimum necessary extracts. Do not request credentials, exploit code, unnecessary identifiers or complete client files.
   • Record the Australian jurisdiction or jurisdictions, relevant dates, entity types, sector, data subjects, data types, conduct and requested deliverable. Use today's Australia/Sydney date when no as-at date is given and say so.
   • State that case law is outside scope. Do not search for, cite, summarise or rely on cases, tribunal decisions or case-derived tests. Mark a request requiring them OUTSIDE SCOPE for that component.
2. Build a fact and applicability map.
   • Separate supplied facts, reasonable inferences, assumptions and missing facts. Never invent an entity, data flow, contract term or jurisdiction.
   • Identify possible roles and thresholds without deciding them silently: APP entity or exemption; Commonwealth, State or Territory body; health or other sector; controller-like or service-provider role; overseas actor; critical-infrastructure or regulated-entity status.
   • Identify collection, use, disclosure, security, access/correction, retention/destruction, direct marketing, automated decision-making, cross-border, vendor and incident-response issues raised by the facts.
   • Invoke $route-australian-privacy-jurisdiction whenever a State or Territory nexus is possible. Preserve its public/private, health, government-contractor, breach and surveillance distinctions.
3. Identify candidate law.
   • Use the trigger table in the reference. Treat it as an issue-spotting aid, not authority or a statement that every listed law applies.
   • Distinguish legislation, delegated legislation, regulator guidance, contractual requirements and voluntary standards. Do not present guidance or standards as legislation.
   • Keep foreign-law analysis outside scope. Record a foreign nexus only as a referral or separate-workstream issue.
4. Verify legislation.
   • For each Commonwealth candidate, invoke $check-commonwealth-legislation with the title, relevant provision and as-at date. Preserve its Register IDs, version period, currency flags and qualifications.
   • If the question spans legislative change, a future deployment date or more than one applicable compilation, invoke $trace-commonwealth-legislative-change and keep future or transitional law separate from law in force at the as-at date.
   • For each NSW candidate, invoke $check-nsw-legislation in the same way.
   • Whenever an APP may apply, invoke $check-australian-privacy-principles for the as-at date and decision horizon. Do not use a static APP list as authority.
   • If the APP result is APP FRAMEWORK CHANGE DETECTED – LEGAL CONTENT REVIEW REQUIRED, stop reuse of earlier APP analysis and identify each affected mapping for lawyer refresh. If it is APP FRAMEWORK NOT VERIFIED – DO NOT RELY, make no APP conclusion.
   • Invoke $assess-statutory-privacy-tort independently of APP coverage for surveillance, recording, scraping, profiling, inference, deepfakes, disclosure, publication or intimate, location, health or financial data.
   • Invoke $assess-automated-decision-transparency for automated or AI-assisted decisions, including any horizon crossing 10 December 2026.
   • Invoke $map-australian-cyber-incident-obligations for a suspected incident, cyber-extortion payment, outage or material control weakness.
   • If a legislation skill or official source is unavailable, do not fill the gap from memory, a search snippet or secondary commentary. Label it NOT VERIFIED and identify the exact follow-up check.
5. Analyse and report.
   • Apply verified text to stated facts provisionally. Expose threshold uncertainty and plausible alternatives.
   • Give each issue a practical consequence, missing fact and concrete next step. Do not assign false numerical risk scores.
   • Include favourable or compliant features as well as gaps when reviewing a document or program.