My reading of it is convoluted. I believe you've heard Kent Roach, and I concur with Kent and Craig Forcese in their testimony that it's a bit of a dog's breakfast. Nobody is entirely clear, because the act uses very general terms—“will comply with” laws unnamed.
Then you read the green paper. I don't want to quote it right now because I don't want to delay us, but essentially it says we can share information subject to any prohibitions in law without naming those laws.
The suggestion is that the Privacy Act is there to protect people's privacy. You read the green paper and find that it says the Privacy Act has a number of exceptions, and rightly so. One is lawful authority: the police can come.... Then the green paper says that SCISA is considered to be a lawful authority.
Essentially, the Privacy Act is nullified by that reading. If that's the legal interpretation that government lawyers and staff have of SCISA, then I'd say the Privacy Act protections are not there.