Section 120 — Privacy Act 2020: Liability for actions of employees, agents, and members of agencies

120 Liability for actions of employees, agents, and members of agencies (1) This section applies to processes and proceedings under this Act relating to the obligations under section 114 or 115 . (2) An employee or a member of an agency is not liable in those processes or proceedings if anything done or omitted by them results in the employer or agency failing to notify the Commissioner or an affected person (or their representative) or give public notice of a notifiable privacy breach. (3) For the purpose of those processes and proceedings, anything done or omitted by an employee or a member of an agency is to be treated as being done or omitted by the employer or agency. (4) For the purpose of those processes and proceedings, anything done or omitted by an agent of another agency is to be treated as being done or omitted by both the agent and the principal agency. (5) However, the extent of liability of an agent is affected by whether they hold personal information that is the subject of a notifiable privacy breach. See the definition of privacy breach in section 112 and see section 11 , which applies and which provides that information held by an agent is to be treated as being held by the principal agency unless section 11(3) applies.