Privacy law reform for
APP entities (agencies)
Protecting information rights – advancing information policy
Privacy Awareness Week
www.oaic.gov.au
Asia Pacific Privacy Authorities
What does the Privacy Act cover?
Privacy Act 1988 provides for the protection of an
individual’s personal information
Privacy Act contains provisions that deal with:
–
–
–
–
‘personal information’
‘sensitive information’ (such as health information)
tax file numbers
credit information
Privacy law reform — outline
• Privacy Amendment (Enhancing Privacy Protection)
Act 2012
• New Australian Privacy Principles (or APPs)
• Enhanced powers of the Commissioner
• How to prepare for the changes
Australian Privacy Principles
• 13 new APPs to replace IPPs and NPPs
– Single set of principles which apply to both
public and private sectors
– Government agencies and private sector
organisations are referred to as ‘APP entities’
– Structured to reflect the information life
cycle — collection, use and disclosure, quality
and security, access and correction
– Permitted general situation
APP 1 — Open and transparent
management of personal information
• Agencies must have a clearly expressed
and up to date privacy policy
• Agencies must take reasonable steps to implement
processes that will ensure that the agency complies
with the APPs
APP 2 — Anonymity and
pseudonymity
• Allows individuals to interact with agencies by not
identifying themselves
• Permits the individual to use a pseudonym
• Exceptions apply, such as where it is impracticable
for the agency to deal with an unidentified individual
APP 3 – Collection of personal and
sensitive information
• Outlines obligations relating to the collection of
personal and sensitive information
• Collection must be ‘reasonably necessary’ for, or
‘directly related’ to, one or more of an agency’s
functions or activities
• Higher standards for collection of sensitive
information. Some exceptions apply
APP 4 — Dealing with unsolicited
personal information
• New principle for handling unsolicited personal
information
• Establish if the information could have been
collected under APP 3
• Destroy or de-identify the information if it could not
have been collected under APP 3
APP 5 — Notification of collection
• Outlines the matters an agency must inform an
individual about when the agency collects their
personal information. These matters include:
–
–
–
–
–
–
–
Information about an agency’s APP policy
Who the agency is and how to contact it
The purpose(s) of the collection
Any collections from third parties
Consequences of non-collection
Complaint handling process
Potential overseas disclosure
APP 6 — Use or disclosure
• Deals with use and disclosure of personal
information
• Different obligations apply to the use or disclosure of
sensitive information. This is new for agencies
• New limited exceptions, to permit use or disclosure
for secondary purpose:
– Locate missing person
– Establish, exercise or defend a legal equitable claim
– Confidential alternative dispute resolution
APP 7 – Direct marketing
• Prohibits organisations from using or disclosing
personal information for direct marketing purposes,
except in specified circumstances
• Contracted service providers for Commonwealth
contracts are permitted to use or disclose personal
information for the purpose of direct marketing if
certain conditions are met
APP 8 – Cross border disclosure
• Introduces an accountability approach for crossborder disclosure
• Agencies must take reasonable steps to ensure
overseas recipients do not breach APPs
• Agencies may be accountable for a breach of APPs by
overseas recipients
• Exceptions apply
APP 9 — Adoption, use or disclosure
of government related identifiers
• Prohibits an organisation from adopting, or using a
government related identifier
• Generally replicates the exceptions under National
Privacy Principle 7, with some additions
• An agency may be required to comply with APP 9
under s7A
APP 10 — Quality
• Requires agencies to take reasonable steps to ensure
personal information it collects, uses or discloses is:
– Accurate
– Up-to-date
– Complete
• Agencies should ensure that personal information
that it uses or discloses is also relevant for the
purpose of the use or disclosure
APP 11 — Security
• Inclusion of ‘interference’
– an agency must take reasonable steps to protect personal
information it holds from misuse, interference and loss,
and from unauthorised access, modification or disclosure
• New destruction requirements
– the agency must take such steps as are reasonable in the
circumstances to destroy the information or to ensure the
information is de-identified
– Some exceptions eg information contained in a
Commonwealth record
APP 12 — Access
• Agencies required to respond to requests for access
of personal information within 30 days
• Exceptions apply – Freedom of Information Act 1982
or other legislation
• Access should be provided in the requested manner
(where reasonable and practicable)
• Individual not to be charged
• Written reasons for the refusal and complaint
mechanism
APP 13 — Correction
• Agencies required to take ‘reasonable steps’ to
correct personal information to ensure it is accurate,
up-to-date, complete, relevant and not misleading, if:
– agency satisfied it needs to be corrected, or
– individual requests correction
• Agency to respond to request within 30 days
• Individual not to be charged
• Statement required if agency refuses to correct and
individual requests statement
• Written reasons for refusal and complaint mechanism
Commissioner’s new powers
• Performance assessments
• Code making powers
• Ability to make a determination to
resolve OMIs
• Enforceable undertakings
• Civil penalty orders
• Ability to direct Privacy Impact
Assessment to be conducted
OAIC guidance and resources
Stay in touch
• Information Contact Officer Network
– Join ICON: icon@oaic.gov.au
• Privacy law reform breaking news available
– Web & RSS: oaic.gov.au
• Follow us on social media
– Twitter: twitter.com/OAICgov and during PAW #2013PAW
– Facebook: facebook.com/OAICgov
– YouTube: youtube.com/user/OAICgov