Summary of the Australian Privacy Principles
-
APP 1 requires that APP entities (see ‘Entities to which the Privacy Act applies’, above) take reasonable steps to implement practices, procedures and systems to ensure they comply with the APPs. APP 1 also requires every APP entity to have a clear policy about the entity’s management of personal information that addresses a list of prescribed matters. The policy must be made available free of charge and in an appropriate form (e.g. by publishing on the entity’s website). Prescribed matters include:
the kinds of personal information that the entity collects and holds;
how the entity collects and holds personal information;
the purposes for which the information is collected, held, used and disclosed;
how an individual may access and, if necessary, correct the information;
how an individual can complain about the entity’s use of the information; and
whether the entity is likely to disclose the information to overseas recipients and, if so, the countries in which such recipients are likely to be located (if it is practicable to specify those countries in the policy).
-
APP 2 states that individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with an APP entity unless it is impracticable, or where the law permits the APP entity to deal with individuals who have identified themselves.
-
APPs 3, 4 and 5 cover the collection of personal information. APP 3 states that an APP entity must only collect personal information by lawful and fair means, and must (where reasonable and practicable) collect personal information about an individual directly from that individual. Further, an APP entity must not collect personal information unless the information is reasonably necessary for one or more of its functions or activities (in the case of a government agency, collection is also permitted where the information is directly related to one of those functions or activities). The entity must demonstrate that a reasonable person who is properly informed would agree that the collection is necessary.
The APP guidelines describe decisions where an entity’s collection of information was not reasonably necessary (e.g. a bank’s collection of a person’s marital status in order to open a bank account).
In addition, ‘sensitive information’ may generally only be collected if the individual about whom the information relates has consented to the collection.
There are limited exceptions where consent is not required to collect sensitive information, including where the collection of the information is required by law, or to prevent a serious threat to health or safety. There is also an exception permitting not-for-profit organisations to collect sensitive information if it relates solely to the members of the organisation, or to people who have regular contact with it for the purpose of its activities. Also, private sector organisations can collect health information from an individual in certain circumstances in connection with providing a health service.
APP 4 states that if an APP entity receives personal information that it has not sought from an individual, it must first determine whether or not it could have collected the information under APP 3 if it had sought the information. If not, the entity must destroy or de-identify the information.
APP 5 requires that, when an entity collects personal information about an individual, it must take reasonable steps to notify the individual or otherwise ensure they are aware of certain matters, including:
the organisation’s identity and contact details;
the fact that the entity has collected the information;
any law that requires the information to be collected;
the purposes for which the information is collected;
the consequences for the person if the information is not collected;
the organisations to which the information is usually disclosed;
how the individual can access and, if necessary, correct the information;
how the individual can complain about the entity’s use of the information; and
whether the entity is likely to disclose the information to overseas recipients and, if practicable, the countries where they are located.
Often, entities will notify individuals about the above by providing a privacy notice at the time of collection, such as on a form used to collect personal information, or in a script read over the telephone.
APP 5 recognises that in some cases it may be ‘reasonable’ to take limited, or even no steps to provide notice or to ensure awareness of APP 5 matters. The APP guidelines give examples of when it may in fact be unreasonable; for example, if notification may pose a serious threat to an individual’s health and safety, or to public health or safety.
-
APP 6 regulates organisations’ use and disclosure of personal information. APP 6 states that an entity should only use (or disclose) personal information for the purpose for which it was collected.
An entity can use or disclose personal information about an individual for another purpose if:
the individual consents; or
the individual would reasonably expect the organisation to use or disclose the information for a secondary purpose, and the secondary purpose is related to the primary purpose (or directly related in the case of sensitive information).
An example of a related secondary purpose is where an entity collects personal information to provide a service and uses that information to evaluate or improve that particular service.
An entity may also be able to disclose personal information for some secondary purposes related to the public interest (e.g. law enforcement, public safety, research purposes and emergency situations).
-
APP 7 concerns the circumstances in which an entity can use personal information for direct marketing. The term ‘direct marketing’ is not defined in the Privacy Act; however, the Explanatory Memorandum to the Privacy Act states that it involves ‘communicating directly with a consumer to promote the sale of goods and services to the consumer’.
The APP guidelines state that direct marketing can be through ‘a variety of channels, including telephone, SMS, mail, email and online advertising’.
APP 7 prohibits private sector organisations from using personal information for direct marketing except in certain limited circumstances; if personal information has been collected directly from an individual, direct marketing is only permitted where:
the individual would reasonably expect the information to be used for the purpose of direct marketing; and
the entity includes a simple means to opt out of the direct marketing communications (and the individual has not made a request to opt out). The APP guidelines give further information about how these requirements should be interpreted.
Additional restrictions apply to using personal information for direct marketing if the individual would not reasonably expect their personal information to be used for direct marketing, or if the personal information was collected from a third party.
Sensitive information can only be used for direct marketing with the individual’s consent. Consent must be obtained even if the individual and the organisation have a pre-existing relationship.
An individual can ask an organisation to stop direct marketing or stop facilitating it. The organisation must stop the direct marketing within a reasonable period and must not charge for doing so.
An individual can ask an organisation to identify the source of personal information it uses or discloses for direct marketing; the organisation must disclose the source unless it can show it is unreasonable or impracticable to do so.
APP 7 generally applies only to private sector organisations; however, it can apply to the Australian Government agencies named in the FoI Act (Cth) (sch 2) and its regulations.
There are also exceptions to the prohibition on direct marketing in APP 7, such as where direct marketing is necessary for an entity to fulfil its obligations under a government contract.
Other laws containing specific provisions regarding direct marketing (such as the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth)) override the more general rules in APP 7.
-
APP 8 covers the disclosure of personal information outside of Australia. It is particularly relevant in light of the increased use of information technology services that disclose or transfer personal information to overseas recipients (e.g. outsourcing and cloud computing).
Subject to certain exceptions, before an APP entity makes personal information available to a third party located outside of Australia, the entity must take reasonable steps to ensure that the overseas recipient does not breach the APPs. This usually involves the APP entity entering into an enforceable contract with the recipient requiring them to handle the information in accordance with the APPs. An APP entity may be deemed liable for a breach committed by the overseas recipient (even if the entity took reasonable steps to ensure the overseas entity complied with the APPs).
Where an APP entity discloses personal information to an overseas recipient, it must also comply with APP 6. Disclosure of personal information is permitted with an individual’s consent provided they have been expressly informed that if they consent, APP 8 will not apply.
An APP entity may disclose personal information to an overseas recipient without complying with APP 8, where the disclosure is required/authorised by Australian law or by a court or tribunal. An example of a law that may require/authorise disclosure to an overseas recipient is the Mutual Assistance in Criminal Matters Act 1987 (Cth). An example of a permitted disclosure to a foreign government is under the Anti-Money Laundering and Counter-terrorism Financing Act 2006 (Cth).
-
APP 9 limits the use of government-related identifiers (e.g. passport, Medicare and driver licence numbers) by private sector organisations.
The purpose of APP 9 is to ensure that government-related identifiers do not become universal identifiers, and to prevent government-related identifiers from being used for disproportionate data-matching. As such, APP 9 generally prohibits an entity from adopting a government-related identifier as its own identifier for distinguishing individuals.
There are exceptions where using an identifier is reasonably necessary for certain purposes, such as verifying the identity of an individual. An individual cannot consent to the adoption, use or disclosure of their government-related identifier.
Some government-related identifiers are regulated by other laws that restrict the way entities collect, use or disclose the particular identifier (see ‘Tax file numbers’ and ‘Healthcare identifiers’, below).
-
APP 10 requires APP entities to take reasonable steps to ensure that the personal information they collect, use and disclose is accurate, up-to-date and complete. The reasonable steps required depend on a range of factors, such as:
the use to which the information is put;
any direct impacts for the individual if the information is inaccurate or incomplete; and
the resources required to ensure the quality of the information over time.
-
APP 11 concerns the security of personal information held by APP entities. It requires APP entities to take reasonable steps to protect the personal information they hold from misuse, interference and loss and from unauthorised access, modification and disclosure. The term ‘holds’ extends beyond the possession of a record to include records an APP entity has the right or power to deal with. For example, where an entity has outsourced storage of its records to a third party but retains the right to deal with the information.
Further, an APP entity must take reasonable steps to destroy or de-identify information it no longer needs. This requirement does not apply to personal information contained in a Commonwealth record, or if a court or tribunal requires the information to be retained. Commonwealth information is dealt with under the Archives Act 1983 (Cth). A more detailed discussion of the requirements of APP 11 can be found in the OAIC’s Guide to Securing Personal Information (published June 2018) (available at www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-securing-personal-information).
-
APP 12 states that an APP entity must, upon request, give an individual access to any personal information that the entity holds about them. An entity ‘holds’ personal information if it has possession or control over it. The information does not have to be in the physical possession of the entity (e.g. where it has outsourced storage of the information but retains control over it).
All APP entities must allow individuals to request access to their personal information for free. Australian Government agencies must also provide access for free. In contrast, private sector organisations may charge for providing access, but the charge cannot be excessive. The APP guidelines suggest that a charge is excessive if it exceeds the actual cost of giving access.
APP 12 sets time periods within which entities must respond to requests for access. Australian Government agencies must respond to requests within 30 days of the request. Private sector organisations must deal with requests within a reasonable time.
APP entities must take reasonable steps to give access, which may mean providing access through an agreed intermediary, such as a legal representative, or a health practitioner. If the entity refuses access on the basis of an exception, the individual is entitled to receive a written notice outlining the reasons for the refusal and how they can complain about the refusal.
There are several exceptions to APP 12 that permit an entity to refuse access to personal information. These exceptions differ depending on whether the entity is a private sector organisation or an Australian Government agency. This is because agencies have responsibilities to provide access to information under other Commonwealth legislation, such as the FoI Act (Cth). The intention of APP 12 is that individuals should rely on the FoI Act (Cth) as the primary way to seek access to their personal information held by agencies. APP 12 lists several grounds upon which an agency can refuse access, which cross-reference the FoI Act (Cth) and other Commonwealth legislation.
However, a request for access under APP 12 is a matter to be decided under the Privacy Act, not the FoI Act (Cth), and so the agency is still obliged to provide reasons for the refusal, and an individual is entitled to complain to the Privacy Commissioner.
Private sector organisations can also refuse access in some circumstances – for example, if:
it would be unlawful to provide the information;
it would have an unreasonable impact on the privacy of another individual;
it would pose a serious and imminent threat to the life or health of any individual;
the request is frivolous or vexatious; or
giving access would reveal evaluative information in connection with a commercially sensitive decision (in which case the entity’s reasons for refusal may include an explanation for the commercially sensitive decision).
APP 13 requires an APP entity to take reasonable steps to correct any personal information it holds if it is satisfied that the information is out of date, inaccurate, incomplete, irrelevant or misleading, or if an individual requests the information to be corrected. On request from the individual, the entity must also communicate the correction to third parties to whom it has previously disclosed the information.
If an entity refuses to correct the information, it must explain (in writing) the refusal and how the individual can complain about this refusal. The entity may also have to inform users of the information that the individual believes to be incorrect.
For government agencies, APP 13 operates alongside the right to amend or annotate personal information under Part V of the FoI Act (Cth).
-
Since 22 February 2018, APP entities have been subject to a NDB Scheme in the Privacy Act. The scheme requires APP entities to notify the Information Commissioner, and in most cases the individuals affected, of any data breach that is likely to result in serious harm to any individuals whose personal information is involved. The notification to individuals must include recommendations about steps individuals should take to respond to the breach. Failure to notify the Information Commissioner of a data breach is deemed to be an interference with privacy and triggers the Information Commissioner’s existing enforcement powers.
Some of the bulk cyber-security data breaches that gain traction in media reports are managed under the NDB Scheme, depending on whether the entity responsible for the breach is subject to the Privacy Act. This does not mean that individuals directly affected are precluded from bringing a privacy complaint, or a representative privacy complaint under the representative privacy complaint provisions of the Privacy Act.
A range of useful resources are available to individuals to manage the risks and impacts of data breaches, particularly identity theft. See for example the E-Safety Commissioner resources at www.esafety.gov.au/key-issues/staying-safe/identity-theft.
For more information about the NDB Scheme, see www.oaic.gov.au. Note that under the scheme, organisations (including all state and territory public sector organisations) that are tax file number (TFN) recipients are also subject to the scheme.
Summary of the Australian Privacy Principles
Chapter: 12.2: Privacy and your rights
Contributor: Melanie Casley, Senior Privacy Consultant, Salinger Privacy
Current as of: 1 September 2024
Law Handbook Page: 998
Next Section: Privacy and credit reporting
