PRIVACY ACT 1988
- Reprinted as at 30 April 1992 (HISTACT CHAP 102 #DATE 30:04:1992)
*1* The Privacy Act 1988 as shown in this reprint comprises Act No.
119, 1988 amended as indicated in the Tables below.
Table of Acts
Act Date Date of Application, saving,
Number of Assent commencement or transitional
and year provisions
Privacy Act 1988
119, 1988 14 Dec 1988 1 Jan 1989
(see Gazette 1988, No. S399)
Law and Justice Legislation Amendment Act 1989
11, 1990 17 Jan 1990 Parts 1 and 3
(ss. 1, 2, 6 and 7):
Royal Assent Ss. 8-10:
17 July 1990
Ss. 12, 13 and 51 (1) (b),
(2): 17 Jan 1990 (see s.
2 (5))
Remainder: 14 Feb 1990 -
Defence Legislation Amendment Act 1990
75, 1990 22 Oct 1990 S. 5: Royal Assent (a) -
Privacy Amendment Act 1990
116, 1990 24 Dec 1990 25 Sept 1991 S. 25 (ad. by
136, 1991, s. 21)
as
amended
by
Law and Justice Legislation Amendment Act 1991
136, 1991 12 Sept 1991 Part 4 (s. 21):
24 Sept 1991 (b) -
Data-matching Program (Assistance and Tax) Act 1990
20, 1991 23 Jan 1991 23 Jan 1991 -
Crimes Legislation Amendment Act 1991
28, 1991 4 Mar 1991 S. 74 (1): Royal Assent (c) -
Industrial Relations Legislation Amendment Act 1991
122, 1991 27 June 1991 Ss. 4 (1), 10 (b) and 15-20:
1 Dec 1988
Ss. 28 (b)-(e), 30 and 31:
10 Dec 1991 (see Gazette
1991, No. S332)
Remainder: Royal Assent -
Law and Justice Legislation Amendment Act 1991
136, 1991 12 Sept 1991 Part 3 (ss. 10-20): (d) -
Social Security Legislation Amendment Act (No. 4) 1991
194, 1991 13 Dec 1991 S. 74 (Part 2 of Schedule 5):
(e) -
(a) The Privacy Act 1988 was amended by section 5 only of the
Defence Legislation Amendment Act 1990, subsection 2 (1) of
which provides as follows:
"(1) Subject to this section, this Act commences on the day on
which it receives the Royal Assent."
(b) The Privacy Amendment Act 1990 was amended by Part 4
(section 21) only of the Law and Justice Legislation Amendment
Act 1991, subsection 2 (3) of which provides as follows:
"(3) Part 4 commences on 24 September 1991."
(c) The Privacy Act 1988 was amended by subsection 74 (1) only
of the Crimes Legislation Amendment Act 1991, subsection 2 (1)
of which provides as follows:
"(1) Subject to this section, this Act commences on the
day on which it receives the Royal Assent."
(d) The Privacy Act 1988 was amended by Part 3 (sections 10-
20) only of the Law and Justice Legislation Amendment Act 1991,
subsection 2 (2) of which provides as follows:
"(2) Part 3 commences immediately after the commencement of
the Privacy Amendment Act 1990."
The Privacy Amendment Act 1990 came into operation on 25
September 1991.
(e) The Privacy Act 1988 was amended by section 74 (Part 2 of
Schedule 5) only of the Social Security Legislation Amendment
Act (No. 4) 1991, subsection 2 (13) of which provides as
follows:
"(13) Part 2 of Schedule 5 is taken to have commenced
immediately after the commencement of the Data-matching Program
(Assistance and Tax) Act 1990."
The Data-matching Program (Assistance and Tax) Act 1990 came
into operation on 23 January 1991.
Table of Amendments
Provision affected How affected
S. 3 am. No. 116, 1990
S. 5A ad. No. 116, 1990
S. 6 am. No. 11, 1990; No. 116, 1990; Nos. 28
and 136, 1991
S. 7 am. Nos. 75 and 116, 1990
S. 8 am. No. 116, 1990; No. 28, 1991
Ss. 9-11 am. No. 28, 1991
S. 11A ad. No. 116, 1990
S. 11B ad. No. 116, 1990
am. No. 136, 1991
S. 12A ad. No. 116, 1990
S. 13 am. No. 116, 1990; Nos. 20 and 194, 1991
S. 17 am. No. 116, 1990
Ss. 18A, 18B ad. No. 116, 1990
Part IIIA (ss. 18C-18V) ad. No. 116, 1990
Ss. 18C-18G ad. No. 116, 1990
S. 18H ad. No. 116, 1990
am. No. 136, 1991
S. 18J ad. No. 116, 1990
Ss. 18K, 18L ad. No. 116, 1990
am. No. 136, 1991
S. 18M ad. No. 116, 1990
rs. No. 136, 1991
Ss. 18N-18Q ad. No. 116, 1990
am. No. 136, 1991
Ss. 18R-18U ad. No. 116, 1990
S. 18V ad. No. 116, 1990
am. No. 136, 1991
S. 22 rs. No. 122, 1991
S. 25 am. No. 122, 1991
S. 27 am. No. 20, 1991
S. 28 am. No. 116, 1990
S. 28A ad. No. 116, 1990
Ss. 29, 30 am. No. 116, 1990
S. 31 am. No. 20, 1991
S. 32 am. No. 116, 1990; No. 20, 1991
S. 36 am. No. 11, 1990
S. 49 am. No. 116, 1990
S. 52 am. No. 116, 1990
Heading to Div. 4 of
Part V am. No. 116, 1990
S. 60 am. No. 116, 1990
S. 68 am. No. 116, 1990
S. 99 am. No. 11, 1990
S. 99A ad. No. 116, 1990
PRIVACY ACT 1988 - TABLE OF PROVISIONS
TABLE
TABLE OF PROVISIONS
Section
PART I-PRELIMINARY
1. Short title
2. Commencement
3. Saving of certain State and Territory laws
4. Act to bind the Crown
5. Interpretation of Information Privacy Principles
5A. Extension to external Territories
PART II-INTERPRETATION
6. Interpretation
7. Acts and practices of agencies etc.
8. Acts and practices of, and disclosure of information to,
staff of agency etc.
9. Collectors
10. Record-keepers
11. File number recipients
11A. Credit reporting agencies
11B. Credit providers
12. Application of Information Privacy Principles to agency
in possession
12A. Act not to apply in relation to State banking or
insurance within that State
PART III-INFORMATION PRIVACY
13. Interferences with privacy
14. Information Privacy Principles
INFORMATION PRIVACY PRINCIPLES
Principle 1
Manner and purpose of collection of personal information
Principle 2
Solicitation of personal information from individual concerned
Principle 3
Solicitation of personal information generally
Principle 4
Storage and security of personal information
Principle 5
Information relating to records kept by record-keeper
Principle 6
Access to records containing personal information
Principle 7
Alteration of records containing personal information
Principle 8
Record-keeper to check accuracy etc. of personal information
before use
Principle 9
Personal information to be used only for relevant purposes
Principle 10
Limits on use of personal information
Principle 11
Limits on disclosure of personal information
15. Application of Information Privacy Principles
16. Agencies to comply with Information Privacy Principles
17. Guidelines relating to tax file number information
18. File number recipients to comply with guidelines
18A. Code of Conduct relating to credit information files and
credit reports
18B. Credit reporting agencies and credit providers to comply
with Code of Conduct
PART IIIA-CREDIT REPORTING
18C. Certain credit reporting only to be undertaken by
corporations
18D. Personal information not to be given to certain persons
carrying on credit reporting
18E. Permitted contents of credit information files
18F. Deletion of information from credit information files
18G. Accuracy and security of credit information files and
credit reports
18H. Access to credit information files and credit reports
18J. Alteration of credit information files and credit reports
18K. Limits on disclosure of personal information by credit
reporting agencies
18L. Limits on use by credit providers of personal information
contained in credit reports etc.
18M. Information to be given if an individual's application
for credit is refused
18N. Limits on disclosure by credit providers of personal
information contained in reports relating to credit
worthiness etc.
18P. Limits on use or disclosure by mortgage insurers or trade
insurers of personal information contained in credit
reports
18Q. Limits on use by certain persons of personal information
obtained from credit providers
18R. False or misleading credit reports
18S. Unauthorised access to credit information files or credit
reports
18T. Obtaining access to credit information files or credit
reports by false pretences
18U. Application of section 4B of Crimes Act
18V. Application of this Part
PART IV-PRIVACY COMMISSIONER
Division 1-Privacy Commissioner
19. Privacy Commissioner
20. Terms and conditions of appointment
21. Remuneration of Commissioner
22. Leave of absence
23. Outside employment
24. Resignation
25. Termination of appointment
26. Acting Commissioner
Division 2-Functions of Commissioner
27. Functions of Commissioner in relation to interferences
with privacy
28. Functions of Commissioner in relation to tax file numbers
28A. Functions of Commissioner in relation to credit reporting
29. Commissioner to have regard to certain matters
Division 3-Reports by Commissioner
30 Reports following investigation of act or practice
31. Report following examination of proposed enactment
32. Report following monitoring of certain activities
33. Exclusion of certain matters from reports
Division 4-Miscellaneous
34. Provisions relating to documents exempt under the Freedom
of Information Act 1982
Division 4-Miscellaneous
35. Direction where refusal or failure to amend exempt
document
PART V-INVESTIGATIONS
Division 1-Investigation of complaints and investigations
on the Commissioner's initiative
36. Complaints
37. Principal executive of agency
38. Matters to be considered in determination of
representative complaints
39. Individual complaints not precluded by representative
complaints
40. Investigations
41. Circumstances in which Commissioner may decide not to
investigate or may defer investigation
42. Preliminary inquiries
43. Conduct of investigations
44. Power to obtain information and documents
45. Power to examine witnesses
46. Directions to persons to attend compulsory conference
47. Conduct of compulsory conference
48. Complainant and certain other persons to be informed of
various matters
49. Investigation under section 40 to cease if certain
offences may have been committed
50. Reference of matters to other authorities
51. Effect of investigation by Auditor-General
Division 2-Determinations following investigation of complaints
52. Determination of the Commissioner
53. Service of determination
Division 3-Review and enforcement of determinations relating to
alleged breaches of Information Privacy Principles
54. Application of Division
55. Obligations of respondent agency
56. Obligations of principal executive of agency
57. Compensation and expenses
58. Review of determinations
59. Enforcement of determination against agency
Division 4-Enforcement of determinations relating to tax
file numbers or credit reporting
60. Application of Division
61. Compensation and expenses
62. Proceedings in Federal Court
63. Legal assistance
Division 5-Miscellaneous
64. Commissioner not to be sued
65. Failure to attend etc. before Commissioner
66. Failure to give information etc.
67. Protection from civil actions
68. Power to enter premises
69. Restrictions on Commissioner obtaining personal
information and documents
70. Certain documents and information not required to be
disclosed
PART VI-PUBLIC INTEREST DETERMINATIONS ABOUT
CERTAIN ACTS AND PRACTICES
71. Interpretation
72. Power to make, and effect of, determinations
73. Application by agency
74. Publication of application
75. Draft determination
76. Conference
77. Conduct of conference
78. Determination of application
79. Making of determination
80. Determination disallowable
PART VII-PRIVACY ADVISORY COMMITTEE
81. Interpretation
82. Establishment and membership
83. Functions
84. Leave of absence
85. Removal and resignation of members
86. Disclosure of interests of members
87. Meetings of Advisory Committee
88. Travel allowance
PART VIII-OBLIGATIONS OF CONFIDENCE
89. Obligations of confidence to which Part applies
90. Application of Part
91. Effect of Part on other laws
92. Extension of certain obligations of confidence
93. Relief for breach etc. of certain obligations of
confidence
94. Jurisdiction of courts
PART IX-MISCELLANEOUS
95. Medical research guidelines
96. Non-disclosure of private information
97. Annual report
98. Injunctions
99. Delegation
99A. Conduct of directors, servants and agents
100. Regulations
PART X-AMENDMENTS OF OTHER ACTS
101. Amendments of other Acts
SCHEDULE 1
AMENDMENTS OF OTHER ACTS
SCHEDULE 2
INTERIM GUIDELINES CONCERNING THE COLLECTION, STORAGE, USE AND
SECURITY OF TAX FILE NUMBER INFORMATION
PRIVACY ACT 1988 - LONG TITLE
SECT
An Act to make provision to protect the privacy of
individuals, and for related purposes
PRIVACY ACT 1988 - PREAMBLE
SECT
WHEREAS Australia is a party to the International Covenant on Civil and
Political Rights, the English text of which is set out in Schedule 2 to the
Human Rights and Equal Opportunity Commission Act 1986:
AND WHEREAS, by that Covenant, Australia has undertaken to adopt such
legislative measures as may be necessary to give effect to the right of
persons not to be subjected to arbitrary or unlawful interference with their
privacy, family, home or correspondence:
AND WHEREAS Australia is a member of the Organisation for Economic
Co-operation and Development:
AND WHEREAS the Council of that Organisation has recommended that member
countries take into account in their domestic legislation the principles
concerning the protection of privacy and individual liberties set forth in
Guidelines annexed to the recommendation:
AND WHEREAS Australia has informed that Organisation that it will
participate in the recommendation concerning those Guidelines:
BE IT THEREFORE ENACTED by the Queen, and the Senate and the House of
Representatives of the Commonwealth of Australia, as follows:
PRIVACY ACT 1988 - PART I
PART I-PRELIMINARY
PRIVACY ACT 1988 - SECT 1
Short title
SECT
1. This Act may be cited as the Privacy Act 1988.*1*
SEE NOTES TO FIRST ARTICLE OF THIS CHAPTER .
PRIVACY ACT 1988 - SECT 2
Commencement
SECT
2. This Act commences on a day to be fixed by Proclamation.*1*
SEE NOTES TO FIRST ARTICLE OF THIS CHAPTER .
PRIVACY ACT 1988 - SECT 3
Saving of certain State and Territory laws
SECT
3. It is the intention of the Parliament that this Act is not to affect the
operation of a law of a State or of a Territory that makes provision with
respect to interferences with the privacy of persons (including such a law
relating to credit reporting or the use of information held in connection with
credit reporting) and is capable of operating concurrently with this Act.
PRIVACY ACT 1988 - SECT 4
Act to bind the Crown
SECT
4. (1) This Act binds the Crown in right of the Commonwealth, of each of the
States, of the Northern Territory and of Norfolk Island.
(2) Nothing in this Act renders the Crown in right of the Commonwealth, of a
State, of the Northern Territory or of Norfolk Island liable to be prosecuted
for an offence.
(3) Nothing in this Act shall be taken to have the effect of making the
Crown in right of a State, of the Northern Territory or of Norfolk Island an
agency for the purposes of this Act.
PRIVACY ACT 1988 - SECT 5
Interpretation of Information Privacy Principles
SECT
5. For the purposes of the interpretation of the Information Privacy
Principles, each Information Privacy Principle shall be treated as if it were
a section of this Act.
PRIVACY ACT 1988 - SECT 5A
Extension to external Territories
SECT
5A. This Act extends to all external Territories.
PRIVACY ACT 1988 - PART II
PART II-INTERPRETATION
PRIVACY ACT 1988 - SECT 6
Interpretation
SECT
6. (1) In this Act, unless the contrary intention appears:
"agency" means:
(a) a Minister;
(b) a Department;
(c) a body (whether incorporated or not), or a tribunal, established or
appointed for a public purpose by or under a Commonwealth enactment, not
being:
(i) an incorporated company, society or association;
(ii) an organisation within the meaning of the Conciliation and
Arbitration Act 1904 or a branch of such an organisation; or
(iii) a body corporate constituted under subsection 6 (1) of the
Legal Practitioners Ordinance 1970 of the Australian Capital Territory;
(d) a body established or appointed by the Governor-General, or by a
Minister, otherwise than by or under a Commonwealth enactment;
(e) a person holding or performing the duties of an office established by or
under, or an appointment made under, a Commonwealth enactment, other than a
person who, by virtue of holding that office, is the Secretary of a
Department;
(f) a person holding or performing the duties of an appointment, being an
appointment made by the Governor-General, or by a Minister, otherwise than
under a Commonwealth enactment;
(g) a federal court and a court of the Australian Capital Territory; and
(h) the Australian Federal Police;
"bank" means:
(a) the Reserve Bank of Australia; or
(b) a bank within the meaning of the Banking Act 1959; or
(c) a person who carries on State banking within the meaning of paragraph 51
(xiii) of the Constitution;
"building society" means a society registered or incorporated as a building
society, co-operative housing society or similar society under a law relating
to such societies that is in force in a State or Territory;
"Code of Conduct" means the Code of Conduct issued under section 18A;
"commercial credit" means a loan sought or obtained by a person, other than
a loan of a kind referred to in the definition of "credit" in this
subsection;
"Commissioner" means the Privacy Commissioner;
"Commissioner of Police" means the Commissioner of Police appointed under the
Australian Federal Police Act 1979;
"Commonwealth enactment" means:
(a) an Act other than:
(i) the Northern Territory (Self-Government) Act 1978; or
(ii) an Act providing for the administration or government of an
external Territory;
(b) an Ordinance of the Australian Capital Territory;
(c) an instrument (including rules, regulations or by-laws) made under an
Act to which paragraph (a) applies or under an Ordinance to which paragraph
(b) applies; or
(d) any other legislation that applies as a law of the Commonwealth (other
than legislation in so far as it is applied by an Act referred to in
subparagraph (a) (i) or (ii)) or as a law of the Australian Capital Territory,
to the extent that it operates as such a law;
"Commonwealth officer" means a person who holds office under, or is employed
by, the Commonwealth, and includes:
(a) a person appointed or employed under the Public Service Act 1922;
(b) a person (other than a person referred to in paragraph (a)) permanently
or temporarily employed by, or in the service of, an agency;
(c) a member of the Defence Force; and
(d) a member, staff member or special member of the Australian Federal
Police;
but does not include a person permanently or temporarily employed in the
Public Service of the Northern Territory or of Norfolk Island;
"consent" means express consent or implied consent;
"corporation" means a body corporate that:
(a) is a foreign corporation;
(b) is a trading corporation formed within the limits of Australia or is a
financial corporation so formed; or
(c) is incorporated in a Territory, other than the Northern Territory;
"credit" means a loan sought or obtained by an individual from a credit
provider in the course of the credit provider carrying on a business or
undertaking as a credit provider, being a loan that is intended to be used
wholly or primarily for domestic, family or household purposes;
"credit card" means any article of a kind commonly known as a credit card,
charge card or any similar article intended for use in obtaining cash, goods
or services by means of loans, and includes any article of a kind commonly
issued by persons carrying on business to customers or prospective customers
of those persons for use in obtaining goods or services from those persons by
means of loans;
"credit information file", in relation to an individual, means any record
that contains information relating to the individual and is kept by a credit
reporting agency in the course of carrying on a credit reporting business
(whether or not the record is a copy of the whole or part of, or was prepared
using, a record kept by another credit reporting agency or any other person);
"credit provider" has the meaning given by section 11B, and, for the
purposes of sections 7 and 8 and Parts III, IV and V, is taken to include a
mortgage insurer and a trade insurer;
"credit report" means any record or information, whether in a written, oral
or other form, that:
(a) is being or has been prepared by a credit reporting agency; and
(b) has any bearing on an individual's:
(i) eligibility to be provided with credit; or
(ii) history in relation to credit; or
(iii) capacity to repay credit; and
(c) is used, has been used or has the capacity to be used for the purpose of
serving as a factor in establishing an individual's eligibility for credit;
"credit reporting agency" has the meaning given by section 11A;
"credit reporting business" means a business or undertaking (other than a
business or undertaking of a kind in respect of which regulations made for the
purposes of subsection (5C) are in force) that involves the preparation or
maintenance of records containing personal information relating to individuals
(other than records in which the only personal information relating to
individuals is publicly available information), for the purpose of, or for
purposes that include as the dominant purpose the purpose of, providing to
other persons (whether for profit or reward or otherwise) information on an
individual's:
(a) eligibility to be provided with credit; or
(b) history in relation to credit; or
(c) capacity to repay credit;
whether or not the information is provided or intended to be provided for the
purposes of assessing applications for credit;
"credit reporting complaint" means a complaint about an act or practice
that, if established, would be an interference with the privacy of the
complainant because:
(a) it breached the Code of Conduct; or
(b) it breached a provision of Part IIIA;
"credit reporting infringement" means:
(a) a breach of the Code of Conduct; or
(b) a breach of a provision of Part IIIA;
"credit union" means a society or other body of persons that is registered
or incorporated as a credit union or credit society under a law relating to
credit unions or credit societies that is in force in a State or Territory;
"current credit provider", in relation to an individual, means a credit
provider who has given, to the individual, credit that has not yet been fully
repaid or otherwise fully discharged;
"Defence Force" includes the Naval Reserve Cadets, the Australian Cadet
Corps and the Air Training Corps;
"Department" means a Department within the meaning of the Public Service Act
1922, other than:
(a) the Department of the Senate;
(b) the Department of the House of Representatives;
(c) the Department of the Parliamentary Library;
(d) the Department of the Parliamentary Reporting Staff; and
(e) the Joint House Department;
"eligible communications service" means a postal, telegraphic, telephonic or
other like service, within the meaning of paragraph 51 (v) of the
Constitution;
"Federal Court" means the Federal Court of Australia;
"file number complaint" means a complaint about an act or practice that, if
established, would be an interference with the privacy of the complainant:
(a) because it breached a guideline issued under section 17; or
(b) because it involved an unauthorised requirement or request for
disclosure of a tax file number;
"financial corporation" means a financial corporation within the meaning of
paragraph 51 (xx) of the Constitution;
"foreign corporation" means a foreign corporation within the meaning of
paragraph 51 (xx) of the Constitution;
"Freedom of Information Act" means the Freedom of Information Act 1982;
"generally available publication" means a magazine, book, newspaper or other
publication that is or will be generally available to members of the public;
"individual" means a natural person;
"individual concerned", in relation to personal information or a record of
personal information, means the individual to whom the information relates;
"Information Privacy Principle" means any of the Information Privacy
Principles set out in section 14;
"intelligence agency" means:
(a) the Australian Security Intelligence Organization;
(b) the Australian Secret Intelligence Service; or
(c) the Office of National Assessments;
"IPP complaint" means a complaint about an act or practice that, if
established, would be an interference with the privacy of the complainant
because it breached an Information Privacy Principle;
"loan" means a contract, arrangement or understanding under which a person
is permitted to defer payment of a debt, or to incur a debt and defer its
payment, and includes:
(a) a hire-purchase agreement; and
(b) such a contract, arrangement or understanding for the hire, lease or
renting of goods or services, other than a contract, arrangement or
understanding under which:
(i) full payment is made before, or at the same time
as, the goods or services are provided; and
(ii) in the case of a hiring, leasing or renting of goods-an
amount greater than or equal to the value of the goods is paid as a deposit
for the return of the goods;
"medical research" includes epidemiological research;
"mortgage credit" means credit provided in connection with the acquisition,
maintenance or improvement of real property, being credit in respect of which
the real property is security;
"mortgage insurer" means a corporation that carries on a business or
undertaking (whether for profit, reward or otherwise) that involves providing
insurance to credit providers in respect of mortgage credit given by credit
providers to other persons;
"Ombudsman" means the Commonwealth Ombudsman;
"personal information" means information or an opinion (including
information or an opinion forming part of a database), whether true or not,
and whether recorded in a material form or not, about an individual whose
identity is apparent, or can reasonably be ascertained, from the information
or opinion;
"record" means:
(a) a document;
(b) a database (however kept); or
(c) a photograph or other pictorial representation of a person;
but does not include:
(d) a generally available publication;
(e) anything kept in a library, art gallery or museum for the purposes of
reference, study or exhibition;
(f) Commonwealth records as defined by subsection 3 (1) of the Archives Act
1983 that are in the open access period for the purposes of that Act;
(g) documents placed by or on behalf of a person (other than an agency) in
the memorial collection within the meaning of the Australian War Memorial Act
1980; or
(h) letters or other articles in the course of transmission by post;
"representative complaint" means a complaint under subsection 36 (2);
"Secretary", in relation to a Department, has the same meaning as in the
Public Service Act 1922;
"serious credit infringement" means an act done by a person:
(a) that involves fraudulently obtaining credit, or attempting fraudulently
to obtain credit; or
(b) that involves fraudulently evading the person's obligations in relation
to credit, or attempting fraudulently to evade those obligations; or
(c) that a reasonable person would consider indicates an intention, on the
part of the first-mentioned person, no longer to comply with the
first-mentioned person's obligations in relation to credit;
"solicit", in relation to personal information, means request a person to
provide that information, or a kind of information in which that information
is included;
"staff of the Ombudsman" means the persons appointed or employed for the
purposes of section 31 of the Ombudsman Act 1976;
"State" includes the Northern Territory;
"tax file number" means a tax file number as defined in Part VA of the
Income Tax Assessment Act 1936;
"tax file number information" means information (including information
forming part of a database), whether compiled lawfully or unlawfully, and
whether recorded in a material form or not, that records the tax file number
of a person in a manner connecting it with the person's identity;
"trade insurer" means a corporation that carries on a business or
undertaking (whether for profit, reward or otherwise) that involves providing
insurance to credit providers in respect of commercial credit given by credit
providers to other persons;
"trading corporation" means a trading corporation within the meaning of
paragraph 51 (xx) of the Constitution;
"use", in relation to information, does not include mere disclosure of the
information, but does include the inclusion of the information in a
publication.
(2) For the purposes of this Act, an act or practice breaches an Information
Privacy Principle if, and only if, it is contrary to, or inconsistent with,
that Information Privacy Principle.
(3) For the purposes of this Act, an act or practice breaches a guideline
issued under section 17 if, and only if, it is contrary to, or inconsistent
with, the guideline.
(3A) For the purposes of this Act, an act or practice breaches the Code of
Conduct if, and only if, it is contrary to, or inconsistent with, the Code of
Conduct.
(4) The definition of "individual" in subsection (1) shall not be taken to
imply that references to persons do not include persons other than natural
persons.
(5) For the purposes of this Act, a person shall not be taken to be an
agency merely because the person is the holder of, or performs the duties of:
(a) a prescribed office;
(b) an office prescribed by regulations made for the purposes of
subparagraph 4 (3) (b) (i) of the Freedom of Information Act 1982;
(c) an office established by or under a Commonwealth enactment for the
purposes of an agency;
(d) a judicial office or of an office of magistrate; or
(e) an office of member of a tribunal that is established by or under a law
of the Commonwealth and that is prescribed for the purposes of this paragraph.
(5A) For the purposes of the definition of "credit reporting business" in
subsection (1), information concerning commercial transactions engaged in by
or on behalf of an individual is not to be taken to be information relating to
an individual's:
(a) eligibility to be provided with credit; or
(b) history in relation to credit; or
(c) capacity to repay credit.
(5B) In considering whether a business or undertaking, carried on by a
credit provider that is a corporation, is a credit reporting business within
the meaning of this Act, the provision of information by the credit provider
to corporations related to it is to be disregarded.
(5C) The regulations may provide that businesses or undertakings of a
specified kind are not credit reporting businesses within the meaning of this
Act.
(6) For the purposes of this Act, the Department of Defence shall be taken
to include the Defence Force.
(7) Nothing in this Act prevents a complaint from:
(a) being both a file number complaint and an IPP complaint; or
(b) being both a file number complaint and a credit reporting complaint.
(8) For the purposes of this Act, the question whether corporations are
related to each other is determined in the same manner as the question whether
corporations, within the meaning of the Companies Act 1981, are related to
each other would be determined under that Act.
PRIVACY ACT 1988 - SECT 7
Acts and practices of agencies etc.
SECT
7. (1) Except so far as the contrary intention appears, a reference in this
Act (other than section 8) to an act or to a practice is a reference to:
(a) an act done, or a practice engaged in, as the case may be, by an agency,
a file number recipient, a credit reporting agency or a credit provider other
than:
(i) an agency specified in Schedule 1 or 2 to the Freedom of
Information Act 1982;
(ii) a federal court or a court of the Australian
Capital Territory;
(iii) a Minister;
(iv) the National Crime Authority; or
(v) a Royal Commission;
(b) an act done, or a practice engaged in, as the case may be, by a federal
court, a court of the Australian Capital Territory or an agency specified in
Schedule 1 to the Freedom of Information Act 1982, being an act done, or a
practice engaged in, in respect of a matter of an administrative nature;
(c) an act done, or a practice engaged in, as the case may be, by an agency
specified in Part II of Schedule 2 to the Freedom of Information Act 1982,
other than an act done, or a practice engaged in, in relation to a record in
relation to which the agency is exempt from the operation of that Act;
(d) an act done, or a practice engaged in, as the case may be, by a Minister
in relation to the affairs of an agency, not being an act done, or a practice
engaged in, in relation to an existing record; or
(e) an act done, or a practice engaged in, as the case may be, by a Minister
in relation to a record that is in the Minister's possession in his or her
capacity as a Minister and relates to the affairs of an agency;
but does not include a reference to an act done, or a practice engaged in, in
relation to a record that has originated with, or has been received from:
(f) an intelligence agency;
(g) the Defence Intelligence Organisation or the Defence Signals Directorate
of the Department of Defence; or
(h) the National Crime Authority.
(2) Except so far as the contrary intention appears, a reference in this Act
(other than section 8) to an act or to a practice includes, in the application
of this Act otherwise than in respect of the Information Privacy Principles
and the performance of the Commissioner's functions under section 27, a
reference to an act done, or a practice engaged in, as the case may be, by an
agency specified in Schedule 2 to the Freedom of Information Act 1982 other
than:
(a) an intelligence agency;
(b) the Defence Signals Directorate or the Joint Intelligence Organisation
of the Department of Defence; or
(c) the National Crime Authority.
(3) Except so far as the contrary intention appears, a reference in this Act
to doing an act includes a reference to:
(a) doing an act in accordance with a practice; or
(b) refusing or failing to do an act.
(3A) For the purposes of this Act, an act is only to be taken to have been
done, and a practice is only to be taken to have been engaged in, by a credit
provider that is not a corporation if the act is done, or the practice is
engaged in, in the course of, or for the purposes of, banking (other than
State banking not extending beyond the limits of the State concerned) carried
on by the credit provider.
(4) For the purposes of paragraphs 27 (1) (b), (c), (d), (e), (g), (k), (m)
and (n), of subsection 31 (2) and of Part VI, this section has effect as if a
reference in subsection (1) of this section to an act done, or to a practice
engaged in, included a reference to an act that is proposed to be done, or to
a practice that is proposed to be engaged in, as the case may be.
PRIVACY ACT 1988 - SECT 8
Acts and practices of, and disclosure of information to,
staff of agency etc.
SECT
8. (1) For the purposes of this Act:
(a) an act done or practice engaged in by, or information disclosed to, a
person employed by, or in the service of, an agency, file number recipient,
credit reporting agency or credit provider in the performance of the duties of
the person's employment shall be treated as having been done or engaged in by,
or disclosed to, the agency, recipient, credit reporting agency or credit
provider;
(b) an act done or practice engaged in by, or information disclosed to, a
person on behalf of, or for the purposes of the activities of, an
unincorporated body, being a board, council, committee, sub-committee or other
body established by or under a Commonwealth enactment for the purpose of
assisting, or performing functions in connection with, an agency, shall be
treated as having been done or engaged in by, or disclosed to, the agency;
and
(c) an act done or practice engaged in by, or information disclosed to, a
member, staff member or special member of the Australian Federal Police in the
performance of his or her duties as such a member, staff member or special
member shall be treated as having been done or engaged in by, or disclosed to,
the Australian Federal Police.
(2) Where:
(a) an act done or a practice engaged in by a person, in relation to a
record, is to be treated, under subsection (1), as having been done or engaged
in by an agency; and
(b) that agency is not the record-keeper in relation to that record;
that act or practice shall be treated as the act or the practice of the
record-keeper in relation to that record.
PRIVACY ACT 1988 - SECT 9
Collectors
SECT
9. (1) An agency that collects personal information shall be treated, for
the purposes of this Act, as a collector in relation to that information.
(2) Subject to subsection (3), where personal information is collected by a
person:
(a) in the course of the person's employment by, or in the service of, an
agency other than the Australian Federal Police; or
(b) as a member, staff member or special member of the Australian Federal
Police in the performance of his or her duties as such a member, staff member
or special member;
then, for the purposes of this Act:
(c) if paragraph (a) applies-the agency first referred to in that paragraph;
and
(d) if paragraph (b) applies-the Australian Federal Police;
shall be treated as a collector in relation to that information.
(3) Where personal information is collected by a person for the purposes of
the activities of, an unincorporated body, being a board, council, committee,
sub-committee or other body established by or under a Commonwealth enactment
for the purpose of assisting, or performing functions connected with, an
agency, that agency shall be treated, for the purposes of this Act, as a
collector in relation to that information.
PRIVACY ACT 1988 - SECT 10
Record-keepers
SECT
10. (1) Subject to subsections (4) and (5), an agency that is in possession
or control of a record of personal information shall be regarded, for the
purposes of this Act, as the record-keeper in relation to that record.
(2) Subject to subsections (3), (4) and (5), where a record of personal
information is in the possession or under the control of a person:
(a) in the course of the person's employment in the service of or by an
agency other than the Australian Federal Police; or
(b) as a member, staff member or special member of the Australian Federal
Police in the performance of his or her duties as such a member, staff member
or special member;
then, for the purposes of this Act, the record-keeper in relation to that
record shall be taken to be:
(c) if paragraph (a) applies-the agency first referred to in that paragraph;
and
(d) if paragraph (b) applies-the Australian Federal Police.
(3) Where a record of personal information is in the possession or under the
control of a person for the purposes of the activities of, an unincorporated
body, being a board, council, committee, sub-committee or other body
established by or under a Commonwealth enactment for the purpose of assisting,
or performing functions connected with, an agency, that agency shall be
regarded, for the purposes of this Act, as the record-keeper in relation to
that record.
(4) Where:
(a) a record of personal information (not being a record relating to the
administration of the Australian Archives) is in the custody of the Australian
Archives; or
(b) a record of personal information (not being a record relating to the
administration of the Australian War Memorial) is in the custody of the
Australian War Memorial;
the agency by or on behalf of which the record was placed in that custody or,
if that agency no longer exists, the agency to whose functions the contents of
the record are most closely related, shall be regarded, for the purposes of
this Act, as the record-keeper in relation to that record.
(5) Where a record of personal information was placed by or on behalf of an
agency in the memorial collection within the meaning of the Australian War
Memorial Act 1980, that agency or, if that agency no longer exists, the agency
to whose functions the contents of the record are most closely related, shall
be regarded, for the purposes of this Act, as the record-keeper in relation to
that record.
PRIVACY ACT 1988 - SECT 11
File number recipients
SECT
11. (1) A person who is (whether lawfully or unlawfully) in possession or
control of a record that contains tax file number information shall be
regarded, for the purposes of this Act, as a file number recipient.
(2) Subject to subsection (3), where a record that contains tax file number
information is in the possession or under the control of a person:
(a) in the course of the person's employment in the service of or by a
person or body other than an agency;
(b) in the course of the person's employment in the service of or by an
agency other than the Australian Federal Police; or
(c) as a member, staff member or special member of the Australian Federal
Police in the performance of his or her duties as such a member, staff member
or special member;
then, for the purposes of this Act, the file number recipient in relation to
that record shall be taken to be:
(d) if paragraph (a) applies-the person's employer;
(e) if paragraph (b) applies-the agency first referred to in that paragraph;
and
(f) if paragraph (c) applies-the Australian Federal Police.
(3) Where a record that contains tax file number information is in the
possession or under the control of a person for the purposes of the activities
of, an unincorporated body, being a board, council, committee, sub-committee
or other body established by or under a Commonwealth enactment for the purpose
of assisting, or performing functions connected with, an agency, that agency
shall be treated, for the purposes of this Act, as the file number recipient
in relation to that record.
PRIVACY ACT 1988 - SECT 11A
Credit reporting agencies
SECT
11A. For the purposes of this Act, a person is a credit reporting agency if
the person is a corporation that carries on a credit reporting business.
PRIVACY ACT 1988 - SECT 11B
Credit providers
SECT
11B. (1) For the purposes of this Act, but subject to subsection (2), a
person is a credit provider if the person is:
(a) a bank; or
(b) a corporation (other than an agency):
(i) that is a building society; or
(ii) that is a credit union; or
(iii) a substantial part of whose business or undertaking is the
provision of loans (including the provision of loans by issuing credit cards);
or
(iv) that carries on a retail business in the course of which it
issues credit cards to members of the public in connection with the sale of
goods, or the supply of services, by the corporation; or
(v) that:
(A) carries on a business or undertaking involving the
provision of loans (including the provision of loans by issuing credit cards);
and
(B) is included in a class of corporations determined
by the Commissioner to be credit providers for the purposes of this Act; or
(c) a person:
(i) who is not a corporation; and
(ii) in relation to whom paragraph (b) would apply if
the person were a corporation.
(2) For the purposes of this Act, a corporation that would, but for this
section, be a credit provider is not to be regarded as a credit provider if it
is included in a class of corporations declared by the regulations not to be
credit providers.
(3) A determination under sub-subparagraph (1) (b) (v) (B) is to be made by
notice in writing published in the Gazette.
(4) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.
(5) Subject to subsection (6), while a person is acting as an agent of a
credit provider in performing, on behalf of the credit provider, a task that
is necessary:
(a) in processing an application for a loan; or
(b) in managing:
(i) a loan given by the credit provider; or
(ii) an account maintained by any person with the
credit provider;
the first-mentioned person:
(c) is taken, for the purposes of this Act, to be another credit provider;
and
(d) is subject to the same obligations under this Act as any other credit
provider.
(6) Nothing in this Act prevents such an agent of a credit provider
disclosing to the credit provider, in the agent's capacity as such an agent, a
report (within the meaning of subsection 18N (9)) to which section 18N
applies.
(7) The reference in subsection (5) to the management of a loan does not
include a reference to any act relating to the collection of payments that are
overdue in respect of the loan.
PRIVACY ACT 1988 - SECT 12
Application of Information Privacy Principles to agency in possession
SECT
12. For the purposes of this Act, where an agency has possession but not
control of a record of personal information, the Information Privacy
Principles apply in relation to that agency to the extent only of the
obligations or duties to which that agency is subject, otherwise than by
virtue of the operation of this Act, because it is in possession of that
particular record.
PRIVACY ACT 1988 - SECT 12A
Act not to apply in relation to State banking or insurance
within that State
SECT
12A. Where, but for this section, a provision of this Act:
(a) would have a particular application; and
(b) by virtue of having that application, would be a law with respect to, or
with respect to matters including:
(i) State banking not extending beyond the limits of
the State concerned; or
(ii) State insurance not extending beyond the limits
of the State concerned;
the provision is not to have that application.
PRIVACY ACT 1988 - PART III
PART III-INFORMATION PRIVACY
PRIVACY ACT 1988 - SECT 13
Interferences with privacy
SECT
13. For the purposes of this Act, an act or practice is an interference with
the privacy of an individual if, and only if, the act or practice:
(a) in the case of an act or practice engaged in by an agency (whether or
not the agency is also a file number recipient, credit reporting agency or
credit provider)-breaches an Information Privacy Principle in relation to
personal information that relates to the individual;
(b) in the case of an act or practice engaged in by a file number recipient
(whether or not the file number recipient is also an agency, credit reporting
agency or credit provider)-breaches a guideline under section 17 in relation
to tax file number information that relates to the individual;
(ba) constitutes a breach of Part 2 of the Data-matching Program (Assistance
and Tax) Act 1990 or the guidelines in force under that Act;
(c) involves an unauthorised requirement or request for disclosure of the
tax file number of the individual; or
(d) in the case of an act or practice engaged in by a credit reporting
agency or credit provider (whether or not the credit reporting agency or
credit provider is also an agency or file number recipient)-constitutes a
credit reporting infringement in relation to personal information that relates
to the individual.
PRIVACY ACT 1988 - SECT 14
Information Privacy Principles
SECT
14. The Information Privacy Principles are as follows:
INFORMATION PRIVACY PRINCIPLES
Principle 1
Manner and purpose of collection of personal information
1. Personal information shall not be collected by a collector for inclusion
in a record or in a generally available publication unless:
(a) the information is collected for a purpose that is a lawful purpose
directly related to a function or activity of the collector; and
(b) the collection of the information is necessary for or directly related
to that purpose.
2. Personal information shall not be collected by a collector by unlawful or
unfair means.
Principle 2
Solicitation of personal information from individual concerned
Where:
(a) a collector collects personal information for inclusion in a record or
in a generally available publication; and
(b) the information is solicited by the collector from the individual
concerned;
the collector shall take such steps (if any) as are, in the circumstances,
reasonable to ensure that, before the information is collected or, if that is
not practicable, as soon as practicable after the information is collected,
the individual concerned is generally aware of:
(c) the purpose for which the information is being collected;
(d) if the collection of the information is authorised or required by or
under law-the fact that the collection of the information is so authorised or
required; and
(e) any person to whom, or any body or agency to which, it is the
collector's usual practice to disclose personal information of the kind so
collected, and (if known by the collector) any person to whom, or any body or
agency to which, it is the usual practice of that first-mentioned person, body
or agency to pass on that information.
Principle 3
Solicitation of personal information generally
Where:
(a) a collector collects personal information for inclusion in a record or
in a generally available publication; and
(b) the information is solicited by the collector;
the collector shall take such steps (if any) as are, in the circumstances,
reasonable to ensure that, having regard to the purpose for which the
information is collected:
(c) the information collected is relevant to that purpose and is up to date
and complete; and
(d) the collection of the information does not intrude to an unreasonable
extent upon the personal affairs of the individual concerned.
Principle 4
Storage and security of personal information
A record-keeper who has possession or control of a record that contains
personal information shall ensure:
(a) that the record is protected, by such security safeguards as it is
reasonable in the circumstances to take, against loss, against unauthorised
access, use, modification or disclosure, and against other misuse; and
(b) that if it is necessary for the record to be given to a person in
connection with the provision of a service to the record-keeper, everything
reasonably within the power of the record-keeper is done to prevent
unauthorised use or disclosure of information contained in the record.
Principle 5
Information relating to records kept by record-keeper
1. A record-keeper who has possession or control of records that contain
personal information shall, subject to clause 2 of this Principle, take such
steps as are, in the circumstances, reasonable to enable any person to
ascertain:
(a) whether the record-keeper has possession or control of any records that
contain personal information; and
(b) if the record-keeper has possession or control of a record that contains
such information:
(i) the nature of that information;
(ii) the main purposes for which that information is
used; and
(iii) the steps that the person should take if the
person wishes to obtain access to the record.
2. A record-keeper is not required under clause 1 of this Principle to give
a person information if the record-keeper is required or authorised to refuse
to give that information to the person under the applicable provisions of any
law of the Commonwealth that provides for access by persons to documents.
3. A record-keeper shall maintain a record setting out:
(a) the nature of the records of personal information kept by or on behalf
of the record-keeper;
(b) the purpose for which each type of record is kept;
(c) the classes of individuals about whom records are kept;
(d) the period for which each type of record is kept;
(e) the persons who are entitled to have access to personal information
contained in the records and the conditions under which they are entitled to
have that access; and
(f) the steps that should be taken by persons wishing to obtain access to
that information.
4. A record-keeper shall:
(a) make the record maintained under clause 3 of this Principle available
for inspection by members of the public; and
(b) give the Commissioner, in the month of June in each year, a copy of the
record so maintained.
Principle 6
Access to records containing personal information
Where a record-keeper has possession or control of a record that contains
personal information, the individual concerned shall be entitled to have
access to that record, except to the extent that the record-keeper is required
or authorised to refuse to provide the individual with access to that record
under the applicable provisions of any law of the Commonwealth that provides
for access by persons to documents.
Principle 7
Alteration of records containing personal information
1. A record-keeper who has possession or control of a record that contains
personal information shall take such steps (if any), by way of making
appropriate corrections, deletions and additions as are, in the circumstances,
reasonable to ensure that the record:
(a) is accurate; and
(b) is, having regard to the purpose for which the information was collected
or is to be used and to any purpose that is directly related to that purpose,
relevant, up to date, complete and not misleading.
2. The obligation imposed on a record-keeper by clause 1 is subject to any
applicable limitation in a law of the Commonwealth that provides a right to
require the correction or amendment of documents.
3. Where:
(a) the record-keeper of a record containing personal information is not
willing to amend that record, by making a correction, deletion or addition, in
accordance with a request by the individual concerned; and
(b) no decision or recommendation to the effect that the record should be
amended wholly or partly in accordance with that request has been made under
the applicable provisions of a law of the Commonwealth;
the record-keeper shall, if so requested by the individual concerned, take
such steps (if any) as are reasonable in the circumstances to attach to the
record any statement provided by that individual of the correction, deletion
or addition sought.
Principle 8
Record-keeper to check accuracy etc. of personal information
before use
A record-keeper who has possession or control of a record that contains
personal information shall not use that information without taking such steps
(if any) as are, in the circumstances, reasonable to ensure that, having
regard to the purpose for which the information is proposed to be used, the
information is accurate, up to date and complete.
Principle 9
Personal information to be used only for relevant purposes
A record-keeper who has possession or control of a record that contains
personal information shall not use the information except for a purpose to
which the information is relevant.
Principle 10
Limits on use of personal information
1. A record-keeper who has possession or control of a record that contains
personal information that was obtained for a particular purpose shall not use
the information for any other purpose unless:
(a) the individual concerned has consented to use of the information for
that other purpose;
(b) the record-keeper believes on reasonable grounds that use of the
information for that other purpose is necessary to prevent or lessen a serious
and imminent threat to the life or health of the individual concerned or
another person;
(c) use of the information for that other purpose is required or authorised
by or under law;
(d) use of the information for that other purpose is reasonably necessary
for enforcement of the criminal law or of a law imposing a pecuniary penalty,
or for the protection of the public revenue; or
(e) the purpose for which the information is used is directly related to the
purpose for which the information was obtained.
2. Where personal information is used for enforcement of the criminal law or
of a law imposing a pecuniary penalty, or for the protection of the public
revenue, the record-keeper shall include in the record containing that
information a note of that use.
Principle 11
Limits on disclosure of personal information
1. A record-keeper who has possession or control of a record that contains
personal information shall not disclose the information to a person, body or
agency (other than the individual concerned) unless:
(a) the individual concerned is reasonably likely to have been aware, or
made aware under Principle 2, that information of that kind is usually passed
to that person, body or agency;
(b) the individual concerned has consented to the disclosure;
(c) the record-keeper believes on reasonable grounds that the disclosure is
necessary to prevent or lessen a serious and imminent threat to the life or
health of the individual concerned or of another person;
(d) the disclosure is required or authorised by or under law; or
(e) the disclosure is reasonably necessary for the enforcement of the
criminal law or of a law imposing a pecuniary penalty, or for the protection
of the public revenue.
2. Where personal information is disclosed for the purposes of enforcement
of the criminal law or of a law imposing a pecuniary penalty, or for the
purpose of the protection of the public revenue, the record-keeper shall
include in the record containing that information a note of the disclosure.
3. A person, body or agency to whom personal information is disclosed under
clause 1 of this Principle shall not use or disclose the information for a
purpose other than the purpose for which the information was given to the
person, body or agency.
PRIVACY ACT 1988 - SECT 15
Application of Information Privacy Principles
SECT
15. (1) Information Privacy Principles 1, 2, 3, 10 and 11 apply only in
relation to information collected after the commencement of this Act.
(2) Information Privacy Principles 4 to 9, inclusive, apply in relation to
information contained in a record in the possession or under the control of an
agency, whether the information was collected before, or is collected after,
the commencement of this Act.
PRIVACY ACT 1988 - SECT 16
Agencies to comply with Information Privacy Principles
SECT
16. An agency shall not do an act, or engage in a practice, that breaches an
Information Privacy Principle.
PRIVACY ACT 1988 - SECT 17
Guidelines relating to tax file number information
SECT
17. (1) The Commissioner shall, by notice in writing, issue guidelines
concerning the collection, storage, use and security of tax file number
information.
(2) A guideline issued under subsection (1) is a disallowable instrument for
the purposes of section 46A of the Acts Interpretation Act 1901.
(3) In its application under subsection (2) of this section, section 48 of
the Acts Interpretation Act 1901 applies to guidelines issued under subsection
(1) as if paragraph (1) (b) of section 48 were omitted and the following
paragraph substituted:
"(b) shall, subject to this section, take effect:
(i) on the first day on which the guidelines are no
longer liable to be disallowed, or to be deemed to be disallowed, under this
section; or
(ii) if the guidelines make provision for their
commencement after the day referred to in subparagraph (i), in accordance with
that provision; and".
(4) Until the first guidelines take effect for the purposes of subsection
(1), the interim guidelines set out in Schedule 2 have effect, for the
purposes of any provision of this Act other than subsection (1), (2) or (3),
as if they were guidelines issued under subsection (1).
PRIVACY ACT 1988 - SECT 18
File number recipients to comply with guidelines
SECT
18. A file number recipient shall not do an act, or engage in a practice,
that breaches a guideline issued under section 17.
PRIVACY ACT 1988 - SECT 18A
Code of Conduct relating to credit information files and
credit reports
SECT
18A. (1) The Commissioner must, by notice published in the Gazette, issue a
Code of Conduct concerning:
(a) the collection of personal information for inclusion in individuals'
credit information files; and
(b) the storage of, security of, access to, correction of, use of and
disclosure of personal information included in individuals' credit information
files or in credit reports; and
(c) the manner in which credit reporting agencies and credit providers are
to handle disputes relating to credit reporting; and
(d) any other activities, engaged in by credit reporting agencies or credit
providers, that are connected with credit reporting.
(2) Before issuing the Code of Conduct, the Commissioner must, to the extent
that it is appropriate and practicable to do so, consult with government,
commercial, consumer and other relevant bodies and organisations.
(3) In preparing the Code of Conduct, the Commissioner must have regard to:
(a) the Information Privacy Principles and the provisions of Part IIIA; and
(b) the likely costs to credit reporting agencies and credit providers of
complying with the Code of Conduct.
(4) The Code of Conduct is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.
PRIVACY ACT 1988 - SECT 18B
Credit reporting agencies and credit providers to comply with Code of
Conduct
SECT
18B. A credit reporting agency or credit provider must not do an act, or
engage in a practice, that breaches the Code of Conduct.
PRIVACY ACT 1988 - PART IIIA
PART IIIA-CREDIT REPORTING
PRIVACY ACT 1988 - SECT 18C
Certain credit reporting only to be undertaken by corporations
SECT
18C. (1) A person must not use an eligible communications service in the
course of carrying on a credit reporting business unless the person is a
corporation.
(2) A person must not:
(a) in the course of trade or commerce:
(i) between Australia and places outside Australia; or
(ii) among the States; or
(iii) between a State and a Territory; or
(iv) among the Territories; or
(b) in the course of banking (other than State banking not extending beyond
the limits of the State concerned); or
(c) in the course of insurance business (other than insurance business
relating to State insurance not extending beyond the limits of the State
concerned); or
(d) in a Territory;
carry on a credit reporting business unless the person is a corporation.
(3) A person must not act on a corporation's behalf in the course of
carrying on a credit reporting business unless the person is a corporation.
(4) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $30,000.
PRIVACY ACT 1988 - SECT 18D
Personal information not to be given to certain persons carrying on
credit reporting
SECT
18D. (1) A person must not use an eligible communications service to give to
a person carrying on a credit reporting business personal information in
circumstances to which this section applies unless the last-mentioned person
is a corporation.
(2) A person must not:
(a) in the course of trade or commerce:
(i) between Australia and places outside Australia; or
(ii) among the States; or
(iii) between a State and a Territory; or
(iv) among the Territories; or
(b) in the course of banking (other than State banking not extending beyond
the limits of the State concerned); or
(c) in the course of insurance business (other than insurance business
relating to State insurance not extending beyond the limits of the State
concerned); or
(d) in a Territory;
give to a person carrying on a credit reporting business personal information
in circumstances to which this section applies unless the last-mentioned
person is a corporation.
(3) A corporation must not give to a person carrying on a credit reporting
business personal information in circumstances to which this section applies
unless the last-mentioned person is a corporation.
(4) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $12,000.
(5) For the purposes of this section, personal information is to be taken to
be given to a person in circumstances to which this section applies if the
person to whom the information is given is likely to use the information in
the course of carrying on a credit reporting business.
PRIVACY ACT 1988 - SECT 18E
Permitted contents of credit information files
SECT
18E. (1) A credit reporting agency must not include personal information in
an individual's credit information file unless:
(a) the inclusion of the information in the file is reasonably necessary in
order to identify the individual; or
(b) the information is a record of:
(i) both:
(A) a credit provider having sought a credit report in
relation to an individual in connection with an application for credit or
commercial credit made by the individual to the credit provider; and
(B) the amount of credit or commercial credit sought
in the application; or
(ii) a mortgage insurer having sought a credit report
in connection with the provision of insurance to a credit provider in respect
of mortgage credit given by the credit provider to the individual; or
(iii) a trade insurer having sought a credit report in
connection with the provision of insurance to a credit provider in respect of
commercial credit given by the credit provider to the individual or another
person; or
(iv) a credit provider having sought a credit report
in connection with the individual having offered to act as guarantor in
respect of a loan or an application for a loan; or
(v) a credit provider being a current credit provider
in relation to the individual; or
(vi) credit provided by a credit provider to an
individual, being credit in respect of which:
(A) the individual is at least 60 days overdue in
making a payment, including a payment that is wholly or partly a payment of
interest; and
(B) the credit provider has taken steps to recover the
whole or any part of the amount of credit (including any amounts of interest)
outstanding; or
(vii) a cheque, for an amount not less than $100, that:
(A) has been drawn by the individual; and
(B) has twice been presented and dishonoured; or
(viii) court judgments made against the individual; or
(ix) bankruptcy orders made against the individual; or
(x) the opinion of a credit provider that the individual has, in
the circumstances specified, committed a serious credit infringement; or
(c) the information is included in a statement provided by the individual
under subsection 18J (2) for inclusion in the file; or
(d) the information is included in a note included in the file under
subsection 18F (4) or 18K (5).
(2) A credit reporting agency must not include in an individual's credit
information file personal information recording the individual's:
(a) political, social or religious beliefs or affiliations; or
(b) criminal record; or
(c) medical history or physical handicaps; or
(d) race, ethnic origins or national origins; or
(e) sexual preferences or practices; or
(f) lifestyle, character or reputation.
(3) The Commissioner may determine, in writing, the kinds of information
that are, for the purposes of paragraph (1) (a), reasonably necessary to be
included in an individual's credit information file in order to identify the
individual.
(4) Where the Commissioner so determines, information that is not of a kind
so determined is to be taken not to be information that is permitted to be
included in an individual's credit information file under paragraph (1) (a).
(5) A determination is to be made by notice published in the Gazette.
(6) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.
(7) A credit reporting agency must not open a credit information file in
relation to an individual unless it has information, concerning the
individual, to include in the file that is information of a kind referred to
in paragraph (1) (b).
(8) A credit provider must not give to a credit reporting agency personal
information relating to an individual if:
(a) a credit reporting agency is prohibited, under subsection (1), from
including the information in the individual's credit information file; or
(b) the credit provider does not have reasonable grounds for believing that
the information is correct; or
(c) the credit provider did not, at the time of, or before, acquiring the
information, inform the individual that the information might be disclosed to
a credit reporting agency.
PRIVACY ACT 1988 - SECT 18F
Deletion of information from credit information files
SECT
18F. (1) A credit reporting agency must delete from an individual's credit
information file maintained by the credit reporting agency any personal
information of a kind referred to in paragraph 18E (1) (b) within 1 month
after the end of the maximum permissible period for the keeping of personal
information of that kind.
(2) For the purposes of subsection (1), the maximum permissible periods for
the keeping of personal information of the kind referred to in paragraph 18E
(1) (b) are as follows:
(a) in the case of information of a kind referred to in subparagraph (i),
(ii), (iii) or (iv) of that paragraph-the period of 5 years commencing on the
day on which the credit report concerned was sought;
(b) in the case of information of a kind referred to in subparagraph (v) of
that paragraph-the period of 14 days commencing on the day on which the credit
reporting agency is notified under subsection (5) that the credit provider
concerned is no longer a current credit provider in relation to the individual
concerned;
(c) in the case of information of a kind referred to in subparagraph (vi) of
that paragraph-the period of 5 years commencing on the day on which the credit
reporting agency was informed of the overdue payment concerned;
(d) in the case of information of a kind referred to in subparagraph (vii)
of that paragraph-the period of 5 years commencing on the day on which the
second dishonouring of the cheque occurred;
(e) in the case of information of a kind referred to in subparagraph (viii)
of that paragraph-the period of 5 years commencing on the day on which the
court judgment concerned was made;
(f) in the case of information of a kind referred to in subparagraph (ix) of
that paragraph-the period of 7 years commencing on the day on which the
bankruptcy order concerned was made;
(g) in the case of information of a kind referred to in subparagraph (x) of
that paragraph-the period of 7 years commencing on the day on which the
information was included in the credit information file concerned.
(3) Where:
(a) a credit reporting agency has been given information that an individual
is overdue in making a payment in respect of credit provided by a credit
provider; and
(b) the individual ceases to be overdue in making the payment or contends
that he or she is not overdue in making the payment;
the credit provider must, as soon as practicable, inform the credit reporting
agency that the individual has ceased to be overdue in making the payment, or
contends that he or she is not overdue in making the payment, as the case may
be.
(4) On being informed that the individual is no longer overdue in making the
payment, or that the individual contends that he or she is not overdue in
making the payment, the credit reporting agency must include in the
individual's credit information file a note to that effect.
(5) Where a credit provider ceases to be a current credit provider in
relation to an individual, the credit provider must, as soon as practicable,
notify that fact to any credit reporting agency that was previously informed
that the credit provider was a current credit provider in relation to the
individual.
PRIVACY ACT 1988 - SECT 18G
Accuracy and security of credit information files and
credit reports
SECT
18G. A credit reporting agency in possession or control of a credit
information file, or a credit provider or credit reporting agency in
possession or control of a credit report, must:
(a) take reasonable steps to ensure that personal information contained in
the file or report is accurate, up-to-date, complete and not misleading; and
(b) ensure that the file or report is protected, by such security safeguards
as are reasonable in the circumstances, against loss, against unauthorised
access, use, modification or disclosure, and against other misuse; and
(c) if it is necessary for the file or report to be given to a person in
connection with the provision of a service to the credit reporting agency or
credit provider, ensure that everything reasonably within the power of the
credit reporting agency or credit provider is done to prevent unauthorised use
or disclosure of personal information contained in the file or report.
PRIVACY ACT 1988 - SECT 18H
Access to credit information files and credit reports
SECT
18H. (1) A credit reporting agency in possession or control of an
individual's credit information file must take reasonable steps to ensure that
the individual can obtain access to that file.
(2) A credit provider, or a credit reporting agency, in possession or
control of a credit report containing personal information concerning an
individual must take all reasonable steps to ensure that the individual can
obtain access to that report.
(3) An individual's rights of access under this section may also be
exercised by a person (other than a credit provider, mortgage insurer or trade
insurer) authorised, in writing, by the individual to exercise those rights on
the individual's behalf in connection with:
(a) an application, or a proposed application, by the individual for a loan;
or
(b) the individual having sought advice in relation to a loan.
PRIVACY ACT 1988 - SECT 18J
Alteration of credit information files and credit reports
SECT
18J. (1) A credit reporting agency in possession or control of a credit
information file, or a credit provider or credit reporting agency in
possession or control of a credit report, must take reasonable steps, by way
of making appropriate corrections, deletions and additions, to ensure that the
personal information contained in the file or report is accurate, up-to-date,
complete and not misleading.
(2) Where:
(a) a credit reporting agency in possession or control of a credit
information file, or a credit provider or credit reporting agency in
possession or control of a credit report, does not amend personal information
contained in that file or report, by making a correction, deletion or
addition, in accordance with a request by the individual concerned; and
(b) the individual requests the credit reporting agency or credit provider
to include in that file or report a statement provided by the individual of
the correction, deletion or addition sought;
the credit reporting agency or credit provider must take reasonable steps to
include the statement in the file or report within 30 days after being
requested to do so.
(3) Where the credit reporting agency or credit provider considers a
statement included pursuant to subsection 18J (2) to be of undue length in the
circumstances, the credit reporting agency or credit provider may refer the
statement to the Commissioner for such reduction as is considered appropriate
and, if the statement is altered, the statement as altered is to be included
in the file or report.
PRIVACY ACT 1988 - SECT 18K
Limits on disclosure of personal information by credit reporting
agencies
SECT
18K. (1) A credit reporting agency in possession or control of an
individual's credit information file must not disclose personal information
contained in the file to a person, body or agency (other than the individual)
unless:
(a) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of assessing an application
for credit made by the individual to the credit provider; or
(b) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of assessing an application
for commercial credit made by a person to the credit provider, and the
individual to whom the report relates has specifically agreed to the report
being given to the credit provider for that purpose; or
(c) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of assessing whether to
accept the individual as a guarantor in respect of:
(i) a loan provided by the credit provider to a person
other than the individual; or
(ii) a loan for which an application has been made by
a person other than the individual to the credit provider;
and the first-mentioned individual has specifically agreed, in writing, to the
report being given to the credit provider for that purpose; or
(d) the information is contained in a credit report given to a mortgage
insurer for the purpose of assessing:
(i) whether to provide insurance to, or the risk of
providing insurance to, a credit provider in respect of mortgage credit given
by the credit provider to the individual; or
(ii) the risk of the individual defaulting on mortgage
credit in respect of which the mortgage insurer has provided insurance to a
credit provider; or
(e) the information is contained in a credit report given to a trade insurer
for the purpose of assessing:
(i) whether to provide insurance to, or the risk of
providing insurance to, a credit provider in respect of commercial credit
given by the credit provider to the individual or another person; or
(ii) the risk of a person defaulting on commercial
credit in respect of which the trade insurer has provided insurance to a
credit provider;
and the individual to whom the report relates has specifically agreed, in
writing, to the report being given to the trade insurer for that purpose; or
(f) the credit reporting agency has, at least 30 days before the disclosure,
received information of a kind referred to in subparagraph 18E (1) (b) (vi),
and the information is contained in a credit report given to a credit provider
referred to in the credit information file as a credit provider who is a
current credit provider in relation to the individual; or
(g) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of the collection of
payments that are overdue in respect of credit provided to the individual by
the credit provider; or
(h) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of the collection of
payments that are overdue in respect of commercial credit provided to a person
by the credit provider, and:
(i) the individual to whom the report relates has
specifically agreed, in writing, to the report being given to the credit
provider for that purpose; or
(ii) that individual had specifically agreed, in writing, to a
credit report relating to the individual being given to the credit provider
for the purpose of the credit provider assessing the application that the
first-mentioned person made to the credit provider for the provision of the
commercial credit concerned; or
(iii) the credit provider provided the commercial
credit concerned before the commencement of this section; or
(j) the information is contained in a credit report given to another credit
reporting agency; or
(k) the information is contained in a record in which the only personal
information relating to individuals is publicly available information; or
(m) the disclosure is required or authorised by or under law; or
(n) the credit reporting agency is satisfied that a credit provider or law
enforcement authority believes on reasonable grounds that the individual has
committed a serious credit infringement and the information is given to that
credit provider or law enforcement authority or to any other credit provider
or law enforcement authority.
(1A) For the purposes of paragraph (1) (b), the individual's agreement to
the report being given to the credit provider must be in writing unless:
(a) the report is requested for the purpose of assessing an application for
commercial credit that was at first instance made orally; and
(b) the application has not yet been made in writing.
(2) A credit reporting agency must not disclose personal information
contained in an individual's credit information file, or in any other record
containing information derived from the file, that is in the possession or
control of the credit reporting agency if the file or other record contains
personal information that the credit reporting agency would be:
(a) prohibited from including in an individual's credit information file
under section 18E; or
(b) required to delete from such a file under section 18F.
(3) Subsection (2) does not prohibit the credit reporting agency from
disclosing personal information that it would be prohibited from including in
an individual's credit information file under section 18E if:
(a) the credit reporting agency included the information in a credit
information file or other record before the commencement of this section; and
(b) the information is information of a kind that the Commissioner has
determined, in writing, to be information that the credit reporting agency may
disclose without contravening that subsection.
(4) A credit reporting agency that knowingly or recklessly contravenes
subsection (1) or (2) is guilty of an offence punishable, on conviction, by a
fine not exceeding $150,000.
(5) Where a credit reporting agency discloses personal information contained
in an individual's credit information file, it must include in the file a note
of that disclosure.
(6) A credit reporting agency must not include in a credit report given to a
credit provider under paragraph (1) (a) any information relating to an
individual's commercial activities (other than information that the credit
reporting agency is permitted under section 18E to include in the individual's
credit information file).
(7) A determination under paragraph (3) (b) is to be made by notice
published in the Gazette.
(8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.
PRIVACY ACT 1988 - SECT 18L
Limits on use by credit providers of personal information contained
in credit reports etc.
SECT
18L. (1) A credit provider that is or has been in possession or control of a
credit report must not use the report or any personal information derived from
the report for any purpose other than assessing an application for credit made
to the credit provider by the individual concerned unless:
(a) the report was obtained under paragraph 18K (1) (b) and the credit
provider uses the report or information for the purpose of assessing an
application for commercial credit made by the individual to the credit
provider; or
(b) the report was obtained under paragraph 18K (1) (c) and the credit
provider uses the report or information for the purpose of assessing whether
to accept the individual as a guarantor in respect of:
(i) a loan provided by the credit provider to a person
other than the individual; or
(ii) a loan for which an application has been made by
a person other than the individual to the credit provider; or
(ba) the report was obtained under paragraph 18K (1) (a), (b) or (c) and the
credit provider uses the report or information for the internal management
purposes of the credit provider, being purposes directly related to the
provision or management of loans by the credit provider; or
(c) the report was obtained under paragraph 18K (1) (f) and the credit
provider uses the information for the purpose of assisting the individual to
avoid defaulting on his or her credit obligations; or
(d) the credit provider uses the report or information for the purpose of
the collection of payments that are overdue in respect of credit provided to
the individual by the credit provider; or
(e) use of the report or information for that other purpose is required or
authorised by or under law; or
(f) the credit provider believes on reasonable grounds that the individual
has committed a serious credit infringement, and the report or information is
used in connection with that infringement.
(2) A credit provider that knowingly or recklessly contravenes subsection
(1) is guilty of an offence punishable, on conviction, by a fine not exceeding
$150,000.
(3) A credit provider that is or has been in possession or control of a
credit report must not:
(a) use the report unless all personal information concerning individuals
that is not information of a kind referred to in subsection 18E (1) has been
deleted from the report; or
(b) use any personal information derived from the report if the information
is not information of a kind referred to in subsection 18E (1).
(4) Where a credit provider has received a credit report for the purpose of
assessing an application for credit made to the credit provider by an
individual, the credit provider must not, in assessing the application, use
information that:
(a) concerns the individual's commercial activities or commercial credit
worthiness; and
(b) was obtained from a person or body carrying on a business or undertaking
involving the provision of information about the commercial credit worthiness
of persons;
unless the individual has specifically agreed to the information being
obtained by the credit provider for that purpose.
(4A) For the purposes of subsection (4), the individual's agreement to the
information being obtained by the credit provider must be in writing unless:
(a) the information is obtained for the purpose of assessing an application
for credit that was at first instance made orally; and
(b) the application has not yet been made in writing.
(5) References in subsection (3) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).
(6) The Commissioner may determine, in writing, the manner in which
information of a kind referred to in subsection (4) may, under that
subsection, be used (including the manner in which an individual's agreement
may be obtained for the purposes of that subsection).
(7) A determination is to be made by notice published in the Gazette.
(8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.
PRIVACY ACT 1988 - SECT 18M
Information to be given if an individual's application for credit is
refused
SECT
18M. (1) If:
(a) a credit provider refuses an application by an individual for credit
(including an application made jointly by that individual and one or more
other persons); and
(b) the refusal is based wholly or partly on information derived from a
credit report relating to that individual that a credit reporting agency has
given to the credit provider for the purpose of assessing the application;
the credit provider must give the individual a written notice:
(c) stating:
(i) that the application has been refused; and
(ii) that the refusal was based wholly or partly, as the case
requires, on information derived from a credit report relating to that
individual that a credit reporting agency has given to the credit provider;
and
(iii) the name and address of the credit reporting agency; and
(d) notifying that individual of his or her right under this Act to obtain
access to his or her credit information file maintained by the credit
reporting agency.
(2) If:
(a) a credit provider refuses an application by an individual for credit,
being an application made jointly by that individual and one or more other
persons; and
(b) the refusal is based wholly or partly on information derived from a
credit report relating to one of those other persons that a credit reporting
agency has given to the credit provider for the purpose of assessing the
application;
the credit provider must give to that individual a written notice stating:
(c) that the application has been refused; and
(d) that the refusal was based wholly or partly, as the case requires, on
information derived from a credit report relating to that person that a credit
reporting agency has given to the credit provider.
PRIVACY ACT 1988 - SECT 18N
Limits on disclosure by credit providers of personal information
contained in reports relating to credit worthiness etc.
SECT
18N. (1) A credit provider that is or has been in possession or control of a
report must not disclose the report or any personal information derived from
the report to another person for any purpose unless:
(a) the report or information is disclosed to a credit reporting agency for
the purpose of being used:
(i) to create a credit information file in relation to the
individual concerned; or
(ii) to include information in a credit information
file, maintained by the credit reporting agency, in relation to the individual
concerned; or
(b) the individual concerned has specifically agreed to the disclosure of
the report or information to another credit provider for the particular
purpose; or
(ba) the report or information is disclosed:
(i) to the guarantor of a loan provided by the credit provider to
the individual concerned; and
(ii) for any purpose related to the enforcement or proposed
enforcement of the guarantee; or
(bb) the report or information is disclosed to a mortgage insurer:
(i) for the purpose of assessing whether to provide insurance to,
or the risk of providing insurance to, a credit provider in respect of
mortgage credit given by the credit provider to the individual concerned or
applied for by the individual concerned to the credit provider; or
(ii) for the purpose of assessing the risk of the individual
defaulting on mortgage credit in respect of which the mortgage insurer has
provided insurance to the credit provider; or
(iii) for any purpose arising under a contract for mortgage
insurance that has been entered into between the credit provider and the
mortgage insurer; or
(bc) the report or information is disclosed:
(i) to a person or body generally recognised and accepted in the
community as being a person appointed, or a body established, for the purpose
of settling disputes between credit providers, acting in their capacity as
credit providers, and their customers; and
(ii) for the purpose of settling a dispute between the credit
provider and the individual concerned; or
(bd) the report or information is disclosed:
(i) to an authority of a State or Territory whose functions
include giving assistance (directly or indirectly) that facilitates the giving
of mortgage credit to individuals; and
(ii) for the purpose of enabling the authority to determine the
extent of assistance (if any) it will give in relation to the giving of
mortgage credit to the individual concerned; or
(be) the report or information:
(i) is disclosed to a person or body carrying on a business of
supplying goods or services; and
(ii) is disclosed for the purpose of enabling that person or body
to decide whether to accept, as payment for goods or services supplied to the
individual concerned, payment by means of credit card or electronic transfer
of funds; and
(iii) does not contain or include any personal information
derived from a credit report, other than:
(A) information of a kind referred to in paragraph 18E (1) (a);
and
(B) information as to whether the individual has a line of
credit with the credit provider, or funds deposited with the credit provider,
sufficient to meet the payment concerned; or
(bf) the report or information:
(i) is disclosed to a person or body that is considering taking
an assignment of, or discharging on the individual's behalf, a debt owed by
the individual to the credit provider; and
(ii) does not contain or include any personal information derived
from a credit report, other than:
(A) information of a kind referred to in paragraph 18E (1) (a);
and
(B) information as to the amount of the debt, or the amount
required to be paid in order to discharge the debt; or
(bg) the report or information is disclosed:
(i) in connection with an application for mortgage credit by the
individual concerned, being credit that the credit provider proposes will be
funded by means of an arrangement involving mortgage securitisation; and
(ii) to a person or body that carries on a business that is
involved in the funding of mortgage credit by means of such arrangements; and
(iii) for the purpose of enabling the person or body to perform a
task that is necessary in the funding of the mortgage credit concerned by
means of that arrangement;
and the individual concerned has specifically agreed to the disclosure of the
report or information to any such person or body for that purpose; or
(c) the report (not being a credit report) or information:
(i) is disclosed to a person or body carrying on a business or
undertaking that involves the collection of debts on behalf of others; and
(ii) is disclosed for the purpose of the collection of
payments that are overdue in respect of credit provided to the individual
concerned by the credit provider; and
(iii) does not contain or include any personal
information derived from a credit report, other than:
(A) information of a kind referred to in paragraph 18E
(1) (a); and
(B) information of a kind referred to in subparagraph
18E (1) (b) (vi), not being information that relates to an overdue payment in
respect of which a note to the effect that the individual is no longer overdue
in making the payment has been included, under subsection 18F (4), in the
credit information file from which the credit report was prepared; or
(d) where the credit provider is a corporation-the report or information is
disclosed to a corporation that is related to the credit provider; or
(e) the report or information is disclosed to a corporation (including the
professional legal advisers or professional financial advisers of that
corporation) that proposes to use the report or information:
(i) in the process of considering whether to:
(A) accept an assignment of a debt owed to the credit
provider; or
(B) accept a debt owed to the credit provider as
security for a loan to the credit provider; or
(C) purchase an interest in the credit provider (including, in
a case where the credit provider is a corporation, a corporation that is
related to the credit provider); or
(ii) in connection with exercising rights arising from any
acceptance or purchase of a kind referred to in subparagraph (i); or
(f) the report or information is disclosed to a person who manages loans
made by the credit provider, for use in managing those loans; or
(g) disclosure of the report or information to that other person for the
particular purpose is required or authorised by or under law; or
(ga) the report or information is given to:
(i) the individual; or
(ii) a person (other than a credit provider, mortgage
insurer or trade insurer) authorised, in writing, by the individual to seek
access to the report or information; or
(h) the credit provider believes on reasonable grounds that the individual
concerned has committed a serious credit infringement and the report or
information is given to another credit provider or a law enforcement
authority.
(1A) For the purposes of paragraph (1) (b), the individual's agreement to
the disclosure of the report or information to another credit provider:
(a) must be in writing unless:
(i) the disclosure is sought for the purpose of assessing an
application for credit or commercial credit that was initially made orally;
and
(ii) the application has not yet been made in writing; and
(b) must be given to:
(i) the credit provider with possession or control of the report
or information; or
(ii) the other credit provider.
(1B) For the purposes of paragraph (1) (bg), the individual's agreement to
the disclosure of the report or information must be in writing unless:
(a) the disclosure is sought for the purpose of enabling a person or body to
perform a task that is necessary in order to fund, by means of an arrangement
involving mortgage securitisation, mortgage credit for which an application
has initially been made orally; and
(b) the application has not yet been made in writing.
(1C) Paragraph (1) (ga) does not affect the operation of paragraph (1) (g)
in relation to an individual obtaining access to credit report under section
18H.
(2) A credit provider that knowingly or recklessly contravenes subsection
(1) is guilty of an offence punishable, on conviction, by a fine not exceeding
$150,000.
(3) A credit provider that is or has been in possession or control of a
credit report, or a report containing personal information derived from a
credit report, must not:
(a) disclose the report to another person unless all personal information
concerning individuals that is not information of a kind referred to in
subsection 18E (1) has been deleted from the report; or
(b) disclose to another person any personal information derived from the
report if the information is not information of a kind referred to in
subsection 18E (1).
(4) References in subsection (3) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).
(5) The Commissioner may determine, in writing, the manner in which a report
or personal information derived from a report may, under subsection (1), be
disclosed (including the manner in which an individual's agreement may be
obtained for the purposes of paragraph (1) (b)).
(6) Where the Commissioner so determines, a report or information that is
disclosed in a manner contrary to the determination is to be taken, except for
the purposes of subsection (2), to have been disclosed contrary to subsection
(1).
(7) A determination is to be made by notice published in the Gazette.
(8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901.
(9) In this section, unless the contrary intention appears:
"report" means:
(a) a credit report; or
(b) subject to subsection (10), any other record or information, whether in
a written, oral or other form, that has any bearing on an individual's credit
worthiness, credit standing, credit history or credit capacity;
but does not include a credit report or any other record or information in
which the only personal information relating to individuals is publicly
available information.
(10) For the purposes of the application of this section to a credit
provider that is not a corporation, a record or information (other than a
credit report) is not taken to be a report for the purposes of this section
unless it is being or has been prepared by or for a corporation.
PRIVACY ACT 1988 - SECT 18P
Limits on use or disclosure by mortgage insurers or trade insurers of
personal information contained in credit reports
SECT
18P. (1) A mortgage insurer that is or has been in possession or control of
a credit report must not use the report or any personal information derived
from the report for any purpose other than:
(a) assessing whether to provide insurance to, or the risk of providing
insurance to, a credit provider in respect of mortgage credit given by the
credit provider to the individual concerned or applied for by the individual
concerned to the credit provider; or
(b) assessing the risk of the individual concerned defaulting on mortgage
credit in respect of which the mortgage insurer has provided insurance to a
credit provider; or
(c) any purpose arising under the contract for mortgage insurance that has
been entered into between a credit provider and the mortgage insurer;
unless use of the report or information for that other purpose is required or
authorised by or under law.
(2) A trade insurer that is or has been in possession or control of a credit
report must not use the report or any personal information derived from the
report for any purpose other than assessing:
(a) whether to provide insurance to, or the risk of providing insurance to,
a credit provider in respect of commercial credit given by the credit provider
to another person; or
(b) the risk of a person defaulting on commercial credit in respect of which
the trade insurer has provided insurance to a credit provider;
unless use of the report or information for that other purpose is required or
authorised by or under law.
(3) A mortgage insurer or trade insurer that is or has been in possession or
control of a credit report must not:
(a) use the report unless all personal information concerning individuals
that is not information of a kind referred to in subsection 18E (1) has been
deleted from the report; or
(b) use any personal information derived from the report if the information
is not information of a kind referred to in subsection 18E (1).
(4) References in subsection (3) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).
(5) A mortgage insurer or trade insurer that is or has been in possession or
control of a credit report must not disclose the report or any personal
information derived from the report to another person for any purpose unless
disclosure of the report or information to that other person for that purpose
is required or authorised by or under law.
(6) A mortgage insurer or trade insurer that knowingly or recklessly
contravenes subsection (1), (2) or (5) is guilty of an offence punishable, on
conviction, by a fine not exceeding $150,000.
(7) A reference in this section to a credit report is taken to include a
reference to a report or information disclosed to a mortgage insurer under
paragraph 18N (1) (bb).
PRIVACY ACT 1988 - SECT 18Q
Limits on use by certain persons of personal information obtained
from credit providers
SECT
18Q. (1) A corporation that has obtained a report or information under
paragraph 18N (1) (d) must not:
(a) use the report or information, or any personal information derived from
the report or information, otherwise than for a purpose for which, or in
circumstances under which, a credit provider would be permitted under section
18L to use the report or information; or
(b) disclose the report or information, or any personal information derived
from the report or information, to another person otherwise than for a purpose
for which, or in circumstances under which, a credit provider would be
permitted under section 18N to disclose the report or information to another
person.
(1A) A person or body that has obtained a report or information under
paragraph 18N (1) (bg) must not use the report or information, or any personal
information derived from the report or information, for any purpose other than
the purpose referred to in subparagraph 18N (1) (bg) (iii), unless use of the
report or information, or the information so derived, for that other purpose
is required or authorised by or under law.
(2) A corporation that has obtained a report or information under paragraph
18N (1) (e) must not use the report or information, or any personal
information derived from the report or information, for any purpose other
than:
(a) for use in the process of considering whether to:
(i) accept an assignment of a debt owed to the credit
provider from whom the report or information was obtained; or
(ii) accept a debt owed to the credit provider as
security for a loan to the credit provider; or
(iii) purchase an interest in the credit provider
(including, where the credit provider is a corporation, a corporation that is
related to the credit provider); or
(b) for use in connection with exercising rights arising from any acceptance
or purchase of a kind referred to in paragraph (a).
(3) A professional legal adviser or professional financial adviser of a
corporation who has obtained a report or information under paragraph 18N (1)
(e) must not use the report or information, or any personal information
derived from the report or information, for any purpose other than use by the
person, in his or her capacity as such a professional legal or financial
adviser, in connection with advising the corporation:
(a) whether to accept an assignment of a debt owed to the credit provider
from whom the report or information was obtained; or
(b) whether to accept a debt owed to the credit provider as a security for a
loan to the credit provider; or
(c) whether to purchase an interest in the credit provider (including, in a
case where the credit provider is a corporation, a corporation that is related
to the credit provider);
(d) in connection with exercising rights arising from any acceptance or
purchase of a kind referred to in paragraph (a), (b) or (c);
unless use of the report or information, or the information so derived, is
required or authorised by or under law.
(4) A person who has obtained a report or information under paragraph 18N
(1) (f) must not use the report or information, or any personal information
derived from the report or information, for any purpose other than use by the
person in managing loans made by the credit provider from whom the person
obtained the report or information, unless use of the report or information,
or the information so derived, for that other purpose is required or
authorised by or under law.
(5) A person who has obtained a report or information under paragraph 18N
(1) (bg), (e) or (f) must not disclose the report or information, or any
personal information derived from the report or information, to another person
unless disclosure of the report or information, or the information so derived,
is required or authorised by or under law.
(6) A person who has obtained a report or information under paragraph 18N
(1) (bg), (d), (e) or (f) must not:
(a) use the report or information unless all personal information concerning
individuals that is not information of a kind referred to in subsection 18E
(1) has been deleted from the report or information; or
(b) use any personal information derived from the report or information if
the personal information so derived is not information of a kind referred to
in subsection 18E (1).
(7) References in subsection (6) to information that is not information of a
kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).
(8) In spite of anything in this section to the contrary, this section does
not impose any obligations on a person in relation to a report or information
obtained under paragraph 18N (1) (bg), (e) or (f), or in relation to any
personal information derived from such a report or information, unless:
(a) the person is a corporation; or
(b) the credit provider from whom the person obtained the report or
information is a corporation.
(9) A person who knowingly or recklessly contravenes subsection (1), (1A),
(2), (3), (4) or (5) is guilty of an offence punishable, on conviction, by a
fine not exceeding $30,000.
PRIVACY ACT 1988 - SECT 18R
False or misleading credit reports
SECT
18R. (1) A credit reporting agency or credit provider must not give to any
other person or body (whether or not the other person or body is a credit
reporting agency or credit provider) a credit report that contains false or
misleading information.
(2) A credit reporting agency or credit provider that knowingly or
recklessly contravenes subsection (1) is guilty of an offence punishable, on
conviction, by a fine not exceeding $75,000.
PRIVACY ACT 1988 - SECT 18S
Unauthorised access to credit information files or credit
reports
SECT
18S. (1) A person must not obtain access to an individual's credit
information file in the possession or control of a credit reporting agency
unless the access is authorised by this Act.
(2) A person must not obtain access to a credit report in the possession or
control of a credit provider or credit reporting agency unless:
(a) the person is given the report in accordance with this Act; or
(b) the access is otherwise authorised by this Act.
(3) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $30,000.
PRIVACY ACT 1988 - SECT 18T
Obtaining access to credit information files or credit reports by false
pretences
SECT
18T. (1) A person must not, by a false pretence, obtain access to an
individual's credit information file in the possession or control of a credit
reporting agency.
Penalty: $30,000.
(2) A person must not, by a false pretence, obtain access to a credit report
in the possession or control of a credit provider or credit reporting agency.
Penalty: $30,000.
PRIVACY ACT 1988 - SECT 18U
Application of section 4B of Crimes Act
SECT
18U. Subsection 4B (3) of the Crimes Act 1914 does not apply in relation to
an offence against subsection 18K (4), 18L (2), 18N (2) or 18R (2) or section
18P.
PRIVACY ACT 1988 - SECT 18V
Application of this Part
SECT
18V. (1) Subject to this section, this Part applies in relation to any
credit information file, any credit report or any report of a kind referred to
in section 18N, in existence on or after the commencement of this section,
whether or not it was in existence before that commencement.
(2) Paragraph 18E (8) (c) does not apply in relation to information acquired
by a credit provider before 25 February 1992.
(3) Section 18F applies in relation to personal information that was,
immediately before 25 February 1992, contained in an individual's credit
information file as if the references to the days mentioned in the paragraphs
of subsection 18F (2) were all references to 25 February 1992.
PRIVACY ACT 1988 - PART IV
PART IV-PRIVACY COMMISSIONER
BAIL ACT 1992 No. 8 of 1992 - DIVISION 1
Division 1-Privacy Commissioner
PRIVACY ACT 1988 - SECT 19
Privacy Commissioner
SECT
19. There shall be a Privacy Commissioner, who shall be appointed by the
Governor-General.
PRIVACY ACT 1988 - SECT 20
Terms and conditions of appointment
SECT
20. (1) Subject to this section, the Commissioner holds office for such
period, not exceeding 7 years, as is specified in the instrument of the
person's appointment, but is eligible for re-appointment.
(2) A person who has reached 65 years shall not be appointed as the
Commissioner, and a person shall not be appointed as the Commissioner for a
period extending beyond the day on which the person will reach 65 years.
(3) The Commissioner holds office on such terms and conditions (if any) in
respect of matters not provided for by this Act as are determined by the
Governor-General.
PRIVACY ACT 1988 - SECT 21
Remuneration of Commissioner
SECT
21. (1) The Commissioner shall be paid such remuneration as is determined by
the Remuneration Tribunal, but, if no determination of that remuneration by
the Tribunal is in operation, the Commissioner shall be paid such remuneration
as is prescribed.
(2) The Commissioner shall be paid such allowances as are prescribed.
(3) This section has effect subject to the Remuneration Tribunals Act 1973.
PRIVACY ACT 1988 - SECT 22
Leave of absence
SECT
22. (1) Subject to section 87E of the Public Service Act 1922, the
Commissioner has such recreation leave entitlements as are determined by the
Remuneration Tribunal.
(2) The Minister may grant the Commissioner leave of absence, other than
recreation leave, on such terms and conditions as to remuneration or otherwise
as the Minister determines.
PRIVACY ACT 1988 - SECT 23
Outside employment
SECT
23. Except with the approval of the Minister, the Commissioner shall not
engage in paid employment outside the duties of the office of Commissioner.
PRIVACY ACT 1988 - SECT 24
Resignation
SECT
24. The Commissioner may resign from the office of Commissioner by
delivering to the Governor-General a signed notice of resignation.
PRIVACY ACT 1988 - SECT 25
Termination of appointment
SECT
25. (1) The Governor-General may terminate the appointment of the
Commissioner by reason of misbehaviour or physical or mental incapacity.
(2) The Governor-General shall terminate the appointment of the Commissioner
if the Commissioner:
(a) becomes bankrupt, applies to take the benefit of any law for the relief
of bankrupt or insolvent debtors, compounds with creditors or makes an
assignment of remuneration for their benefit;
(b) is absent from duty, except on leave of absence, for 14 consecutive days
or for 28 days in any period of 12 months; or
(c) contravenes section 23.
PRIVACY ACT 1988 - SECT 26
Acting Commissioner
SECT
26. The Minister may appoint a person to act as Commissioner:
(a) during a vacancy in the office of Commissioner, whether or not an
appointment has previously been made to the office; or
(b) during any period, or during all periods, when the Commissioner is
absent from duty or from Australia, or is, for any other reason, unable to
perform the functions of the office of Commissioner;
but a person appointed to act during a vacancy shall not continue so to act
for more than 12 months.
PRIVACY ACT 1988 - DIVISION 2
Division 2-Functions of Commissioner
PRIVACY ACT 1988 - SECT 27
Functions of Commissioner in relation to interferences with privacy
SECT
27. (1) Subject to this Part, the Commissioner has the following functions:
(a) to investigate an act or practice of an agency that may breach an
Information Privacy Principle and, where the Commissioner considers it
appropriate to do so, to endeavour, by conciliation, to effect a settlement of
the matters that gave rise to the investigation;
(b) to examine (with or without a request from a Minister) a proposed
enactment that would require or authorise acts or practices of an agency that
might, in the absence of the enactment, be interferences with the privacy of
individuals or which may otherwise have any adverse effects on the privacy of
individuals and to ensure that any adverse effects of such proposed enactment
on the privacy of individuals are minimised;
(c) to undertake research into, and to monitor developments in, data
processing and computer technology (including data-matching and data-linkage)
to ensure that any adverse effects of such developments on the privacy of
individuals are minimised, and to report to the Minister the results of such
research and monitoring;
(d) to promote an understanding and acceptance of the Information Privacy
Principles and of the objects of those Principles;
(e) to prepare, and to publish in such manner as the Commissioner considers
appropriate, guidelines for the avoidance of acts or practices of an agency
that may or might be interferences with the privacy of individuals or which
may otherwise have any adverse effects on the privacy of individuals;
(f) to provide advice (with or without a request) to a Minister or an agency
on any matter relevant to the operation of this Act;
(g) to maintain, and to publish annually, a record (to be known as the
Personal Information Digest) of the matters set out in records maintained by
record-keepers in accordance with clause 3 of Information Privacy Principle
5;
(h) to conduct audits of records of personal information maintained by
agencies for the purpose of ascertaining whether the records are maintained
according to the Information Privacy Principles;
(j) whenever the Commissioner thinks it necessary, to inform the Minister of
action that needs to be taken by an agency in order to achieve compliance by
the agency with the Information Privacy Principles;
(k) to examine (with or without a request from a Minister) a proposal for
data matching or data linkage that may involve an interference with the
privacy of individuals or which may otherwise have any adverse effects on the
privacy of individuals and to ensure that any adverse effects of such proposal
on the privacy of individuals are minimised;
(m) for the purpose of promoting the protection of individual privacy, to
undertake educational programs on the Commissioner's own behalf or in
co-operation with other persons or authorities acting on behalf of the
Commissioner;
(n) to encourage corporations to develop programs for the handling of
records of personal information that are consistent with the Guidelines on the
Protection of Privacy and Transborder Flows of Personal Data issued by the
Organisation for Economic Co-operation and Development;
(o) to do anything incidental or conducive to the performance of any of the
preceding functions;
(p) to issue guidelines under the Data-matching Program (Assistance and Tax)
Act 1990;
(q) to monitor and report on the adequacy of equipment and user safeguards;
(r) may, and if requested to do so, shall make reports and recommendations
to the Minister in relation to any matter that concerns the need for or the
desirability of legislative or administrative action in the interests of the
privacy of individuals.
(2) The Commissioner has power to do all things that are necessary or
convenient to be done for or in connection with the performance of his or her
functions under subsection (1).
PRIVACY ACT 1988 - SECT 28
Functions of Commissioner in relation to tax file numbers
SECT
28. (1) In addition to the functions under sections 27 and 28A, the
Commissioner has the following functions in relation to tax file numbers:
(a) to issue guidelines under section 17;
(b) to investigate acts or practices of file number recipients that may
breach guidelines issued under section 17;
(c) to investigate acts or practices that may involve unauthorised requests
or requirements for the disclosure of tax file numbers;
(d) to examine the records of the Commissioner of Taxation to ensure that:
(i) he or she is not using tax file number information
for purposes beyond his or her powers; and
(ii) he or she is taking adequate measures to prevent
the unlawful disclosure of the tax file number information that he or she
holds;
(e) to conduct audits of records of tax file number information maintained
by file number recipients for the purpose of ascertaining whether the records
are maintained according to any relevant guidelines issued under section 17;
(f) to evaluate compliance with guidelines issued under section 17;
(g) to provide advice (with or without a request) to file number recipients
on their obligations under the Taxation Administration Act 1953 with regard to
the confidentiality of tax file number information and on any matter relevant
to the operation of this Act;
(h) to monitor the security and accuracy of tax file number information kept
by file number recipients;
(j) to do anything incidental or conducive to the performance of any of the
preceding functions.
(2) The Commissioner has power to do all things that are necessary or
convenient to be done for or in connection with the performance of his or her
functions under subsection (1).
PRIVACY ACT 1988 - SECT 28A
Functions of Commissioner in relation to credit reporting
SECT
28A. (1) In addition to the functions under sections 27 and 28, the
Commissioner has the following functions in relation to credit reporting:
(a) to develop the Code of Conduct in consultation with government,
commercial, consumer and other relevant bodies and organisations;
(b) to investigate an act or practice of a credit reporting agency or credit
provider that may constitute a credit reporting infringement and, where the
Commissioner considers it appropriate to do so, to endeavour, by conciliation,
to effect a settlement of the matters that gave rise to the investigation;
(c) to promote an understanding and acceptance of:
(i) the Code of Conduct and the provisions of Part
IIIA; and
(ii) the objects of those provisions;
(d) to make such determinations as the Commissioner is empowered to make
under section 11B or Part IIIA; and
(e) to prepare, and to publish in such manner as the Commissioner considers
appropriate, guidelines for the avoidance of acts or practices of a credit
reporting agency or credit provider that may or might be interferences with
the privacy of individuals;
(f) to provide advice (with or without a request) to a Minister, a credit
reporting agency or a credit provider on any matter relevant to the operation
of this Act;
(g) to conduct audits of credit information files maintained by credit
reporting agencies, and credit reports in the possession, or under the
control, of credit providers or credit reporting agencies, for the purpose of
ascertaining whether the files or reports are maintained in accordance with
the Code of Conduct and the provisions of Part IIIA;
(h) to monitor the security and accuracy of personal information contained
in credit information files maintained by credit reporting agencies and in
credit reports in the possession, or under the control, of credit providers or
credit reporting agencies;
(j) to examine the records of credit reporting agencies and credit providers
to ensure that:
(i) credit reporting agencies and credit providers are
not using personal information contained in credit information files and
credit reports for unauthorised purposes; and
(ii) credit reporting agencies and credit providers
are taking adequate measures to prevent the unlawful disclosure of personal
information contained in credit information files and credit reports;
(k) for the purpose of promoting the protection of individual privacy, to
undertake educational programs on the Commissioner's own behalf or in
co-operation with other persons or authorities on the Commissioner's behalf;
(m) to do anything incidental or conducive to the performance of any of the
preceding functions.
(2) The Commissioner has power to do all things that are necessary or
convenient to be done for or in connection with the performance of his or her
functions under subsection (1).
PRIVACY ACT 1988 - SECT 29
Commissioner to have regard to certain matters
SECT
29. In the performance of his or her functions, and the exercise of his or
her powers, under this Act, the Commissioner shall:
(a) have due regard for the protection of important human rights and social
interests that compete with privacy, including the general desirability of a
free flow of information and the recognition of the right of government and
business to achieve their objectives in an efficient way;
(b) take account of:
(i) international obligations accepted by Australia,
including those concerning the international technology of communications;
and
(ii) developing general international guidelines
relevant to the better protection of individual privacy;
(c) ensure that his or her recommendations and guidelines are, within the
limitations of the powers of the Commonwealth, capable of acceptance,
adaptation and extension throughout Australia; and
(d) ensure that his or her directions and guidelines are consistent with:
(i) the Information Privacy Principles; and
(ii) (where applicable) the Code of Conduct and the
provisions of Part IIIA.
PRIVACY ACT 1988 - DIVISION 3
Division 3-Reports by Commissioner
PRIVACY ACT 1988 - SECT 30
Reports following investigation of act or practice
SECT
30. (1) Where the Commissioner has investigated an act or practice without a
complaint having been made under section 36, the Commissioner may report to
the Minister about the act or practice, and shall do so:
(a) if so directed by the Minister; or
(b) if the Commissioner:
(i) thinks that the act or practice is an interference
with the privacy of an individual; and
(ii) has not considered it appropriate to endeavour to
effect a settlement of the matters that gave rise to the investigation or has
endeavoured without success to effect such a settlement.
(2) Where the Commissioner reports under subsection (1) about an act done in
accordance with a practice, the Commissioner shall also report to the Minister
about the practice.
(3) Where, after an investigation under paragraph 27 (1) (a), 28 (1) (b) or
(c) or 28A (1) (b) of an act or practice of an agency, file number recipient,
credit reporting agency or credit provider, the Commissioner is required by
virtue of paragraph (1) (b) of this section to report to the Minister about
the act or practice, the Commissioner:
(a) shall set out in the report his or her findings and the reasons for
those findings;
(b) may include in the report any recommendations by the Commissioner for
preventing a repetition of the act or a continuation of the practice;
(c) may include in the report any recommendation by the Commissioner for
either or both of the following:
(i) the payment of compensation in respect of a
person who has suffered loss or damage as a result of the act or practice;
(ii) the taking of other action to remedy or reduce
loss or damage suffered by a person as a result of the act or practice;
(d) shall serve a copy of the report on the agency, file number recipient,
credit reporting agency or credit provider concerned and the Minister (if any)
responsible for the agency, recipient, credit reporting agency or credit
provider; and
(e) may serve a copy of the report on any person affected by the act or
practice.
(4) Where, at the end of 60 days after a copy of a report about an act or
practice of an agency, file number recipient, credit reporting agency or
credit provider was served under subsection (3), the Commissioner:
(a) still thinks that the act or practice is an interference with the
privacy of an individual; and
(b) is not satisfied that reasonable steps have been taken to prevent a
repetition of the act or a continuation of the practice;
the Commissioner shall give to the Minister a further report that:
(c) incorporates the first-mentioned report and any document that the
Commissioner has received, in response to the first-mentioned report, from
the agency, file number recipient, credit reporting agency or credit
provider;
(d) states whether, to the knowledge of the Commissioner, any action has
been taken as a result of the findings, and recommendations (if any), set out
in the first-mentioned report and, if so, the nature of that action; and
(e) states why the Commissioner is not satisfied that reasonable steps have
been taken to prevent a repetition of the act or a continuation of the
practice;
and shall serve a copy of the report on the Minister (if any) responsible for
the agency, recipient, credit reporting agency or credit provider.
(5) The Minister shall cause a copy of a report given to the Minister under
subsection (4) to be laid before each House of the Parliament within 15
sitting days of that House after the report is received by the Minister.
PRIVACY ACT 1988 - SECT 31
Report following examination of proposed enactment
SECT
31. (1) Where the Commissioner has examined a proposed enactment under
paragraph 27 (1) (b), subsections (2) and (3) of this section have effect.
(2) If the Commissioner thinks that the proposed enactment would require or
authorise acts or practices of an agency that would be interferences with the
privacy of individuals, the Commissioner shall:
(a) report to the Minister about the proposed enactment; and
(b) include in the report any recommendations he or she wishes to make for
amendment of the proposed enactment to ensure that it would not require or
authorise such acts or practices.
(3) Otherwise, the Commissioner may report to the Minister about the
proposed enactment, and shall do so if so directed by the Minister.
(4) Where the Privacy Commissioner is of the belief that it is in the public
interest that the proposed enactment should be the subject of a further
report, the Commissioner may give to the Minister a further report setting out
the Commissioner's reasons for so doing.
(5) The Minister shall cause a copy of a report given under subsection (4)
to be laid before each House of the Parliament as soon as practicable, and no
later than 15 sitting days of that House, after the report is received by the
Minister.
PRIVACY ACT 1988 - SECT 32
Report following monitoring of certain activities
SECT
32. (1) Where the Commissioner, in the performance of the function referred
to in paragraph 27 (1) (c), (h), (h), (j), (k), (m) or (r), 28 (1) (e), (f) or
(h) or 28A (1) (g), (h), (j) or (k), has monitored an activity or conducted an
audit, the Commissioner may report to the Minister about that activity or
audit, and shall do so if so directed by the Minister.
(2) Where the Privacy Commissioner is of the belief that it is in the public
interest that the activity should be the subject of a further report, the
Commissioner may give to the Minister a further report setting out the
Commissioner's reasons for so doing.
(3) The Minister shall cause a copy of a report given under subsection (2)
to be laid before each House of the Parliament as soon as practicable, and no
later than 15 sitting days of that House, after the report is received by the
Minister.
PRIVACY ACT 1988 - SECT 33
Exclusion of certain matters from reports
SECT
33. (1) In setting out findings, opinions and reasons in a report to be
given under section 30, 31 or 32, the Commissioner may exclude a matter if the
Commissioner considers it desirable to do so having regard to the obligations
of the Commissioner under subsections (2) and (3).
(2) In deciding under subsection (1) whether or not to exclude matter from a
report, the Commissioner shall have regard to the need to prevent:
(a) prejudice to the security, defence or international relations of
Australia;
(b) prejudice to relations between the Commonwealth Government and the
Government of a State or between the Government of a State and the Government
of another State;
(c) the disclosure of deliberations or decisions of the Cabinet, or of a
Committee of the Cabinet, of the Commonwealth or of a State;
(d) the disclosure of deliberations or advice of the Federal Executive
Council or the Executive Council of a State;
(e) the disclosure, or the ascertaining by a person, of the existence or
identity of a confidential source of information in relation to the
enforcement of the criminal law;
(f) the endangering of the life or safety of any person;
(g) prejudice to the proper enforcement of the law or the protection of
public safety;
(h) the disclosure of information the disclosure of which is prohibited,
absolutely or subject to qualifications, by or under another enactment;
(j) the unreasonable disclosure of the personal affairs of any person; and
(k) the unreasonable disclosure of confidential commercial information.
(3) The Commissioner shall try to achieve an appropriate balance between
meeting the need referred to in subsection (2) and the desirability of
ensuring that interested persons are sufficiently informed of the results of
the Commissioner's investigation, examination or monitoring.
(4) Where the Commissioner excludes a matter from a report, he or she shall
give to the Minister a report setting out the excluded matter and his or her
reasons for excluding the matter.
PRIVACY ACT 1988 - DIVISION 4
Division 4-Miscellaneous
PRIVACY ACT 1988 - SECT 34
Provisions relating to documents exempt under the Freedom of
Information Act 1982
SECT
34. (1) The Commissioner shall not, in connection with the performance of
the functions referred to in section 27, give to a person information as to
the existence or non-existence of a document where information as to the
existence or non-existence of that document would, if included in a document
of an agency, cause the last-mentioned document to be an exempt document by
virtue of section 33 or 33A, or subsection 37 (1), of the Freedom of
Information Act 1982
(2) The Commissioner shall not, in connection with the performance of the
functions referred to in section 27, give to a person information:
(a) about the contents of a document of an agency, or the contents of an
official document of a Minister, being a document that is an exempt document;
or
(b) about exempt matter contained in a document of an agency or in an
official document of a Minister.
(3) An expression used in this section and in the Freedom of Information Act
1982 has the same meaning in this section as in that Act.
PRIVACY ACT 1988 - SECT 35
Direction where refusal or failure to amend exempt document
SECT
35. (1) Where:
(a) an application made under subsection 55 (1) of the Freedom of
Information Act 1982 for review of a decision under that Act refusing access
to a document has been finally determined or otherwise disposed of;
(b) the period within which an appeal may be made to the Federal Court has
expired or, if such an appeal has been instituted, the appeal has been
determined;
(c) the effect of the review and any appeal is that access is not to be
given to the document;
(d) the applicant has requested the agency concerned to amend the document;
(e) the applicant has complained to the Commissioner under this Act about
the refusal or failure of the agency to amend the document;
(f) the Commissioner has, as a result of the complaint, recommended under
subsection 30 (3) of this Act that the agency amend the document, or amend a
part of the document, to which the applicant has been refused access; and
(g) as at the end of 60 days after a copy of the report containing the
recommendation was served on the agency, the Commissioner:
(i) still thinks that the agency should amend the document in a
particular manner; and
(ii) is not satisfied that the agency has amended the
document in that manner;
the Commissioner may direct the agency to add to the document an appropriate
notation setting out particulars of the amendments of the document that the
Commissioner thinks should be made.
(2) An agency shall comply with a direction given in accordance with
subsection (1).
(3) In subsection (1), "amend", in relation to a document, means amend by
making a correction, deletion or addition.
(4) An expression used in this section and in the Freedom of Information Act
1982 has the same meaning in this section as in that Act.
PRIVACY ACT 1988 - PART V
PART V-INVESTIGATIONS
PRIVACY ACT 1988 - DIVISION 1
Division 1-Investigation of complaints and investigations
on the Commissioner's initiative
PRIVACY ACT 1988 - SECT 36
Complaints
SECT
36. (1) An individual may complain to the Privacy Commissioner about an act
or practice that may be an interference with the privacy of the individual.
(2) In the case of an act or practice that may be an interference with the
privacy of 2 or more individuals, any one of those individuals may make a
complaint under subsection (1) on behalf of all of the individuals.
(3) A complaint shall be in writing.
(4) It is the duty of:
(a) members of the staff of the Human Rights and Equal Opportunity
Commission; and
(b) members of the staff of the Ombudsman who have had powers of the
Commissioner delegated to them under section 99;
to provide appropriate assistance to a person who wishes to make a complaint
and requires assistance to formulate the complaint.
(5) The complaint shall specify the respondent to the complaint.
(6) In the case of a complaint about an act or practice of an agency:
(a) if the agency is an individual or a body corporate, the agency shall be
the respondent; and
(b) if the agency is an unincorporated body, the principal executive of the
agency shall be the respondent.
(7) In the case of a complaint about an act or practice of a person other
than an agency, that person shall be the respondent.
PRIVACY ACT 1988 - SECT 37
Principal executive of agency
SECT
37. For the purposes of this Part, the principal executive of an agency of a
kind specified in column 1 of an item in the following table is the person
specified in column 2 of the item:
Item Column 1 Column 2
Agency Principal executive
1 Department The Secretary of the
Department
2 An unincorporated body, The chief executive officer
or a tribunal, referred to of the body or tribunal
in paragraph (c) of the
definition of "agency" in
subsection 6 (1)
3 A body referred to in The chief executive officer
paragraph (d) of the of the body
definition of "agency"
in subsection 6 (1)
4 A federal court or a court The registrar or principal
of the Australian Capital registrar of the court or the
Territory equivalent office
5 The Australian Federal Police The Commissioner of Police
PRIVACY ACT 1988 - SECT 38
Matters to be considered in determination of representative complaints
SECT
38. (1) The Commissioner shall not deal with a complaint made under
subsection 36 (2) unless he or she is satisfied that the complaint was made in
good faith on behalf of persons other than the complainant.
(2) In order to be satisfied that a complaint was made in good faith on
behalf of persons other than the complainant, the Commissioner must be
satisfied:
(a) that:
(i) the complainant is a member of a class of persons,
the members of which class have been affected, or are reasonably likely to
have been affected, by the act or practice complained of;
(ii) the complainant has in fact been affected by that
act or practice;
(iii) the class is so numerous that joinder of all its members is
impracticable;
(iv) there are questions of law or fact common to the claims of
all members of the class;
(v) the claims of the complainant are typical of the
claims of the class;
(vi) multiple complaints would be likely to produce varying
determinations that could have incompatible or inconsistent results for the
individual members of the class; and
(vii) the respondent has acted on grounds apparently applying to
the class as a whole, thereby making relief appropriate for the class as a
whole; or
(b) that, although that the requirements of paragraph (a) have not been
satisfied, the justice of the case demands that the matter be dealt with and a
remedy provided by means of a representative complaint.
PRIVACY ACT 1988 - SECT 39
Individual complaints not precluded by representative complaints
SECT
39. Nothing in this Part prevents a person from making a complaint under
subsection 36 (1) about an act or practice about which a representative
complaint has been made.
PRIVACY ACT 1988 - SECT 40
Investigations
SECT
40. (1) The Commissioner shall investigate an act or practice if:
(a) the act or practice may be an interference with the privacy of an
individual; and
(b) a complaint about the act or practice has been made under section 36.
(2) The Commissioner may investigate an act or practice if:
(a) the act or practice may be an interference with the privacy of an
individual; and
(b) the Commissioner thinks it is desirable that the act or practice be
investigated.
PRIVACY ACT 1988 - SECT 41
Circumstances in which Commissioner may decide not to investigate or
may defer investigation
SECT
41. (1) The Commissioner may decide not to investigate, or not to
investigate further, an act or practice about which a complaint has been made
under section 36 if the Commissioner is satisfied that:
(a) the act or practice is not an interference with the privacy of an
individual;
(b) although a complaint has been made to the Commissioner about the act or
practice, the complainant has not complained to the respondent;
(c) the complaint was made more than 12 months after the complainant became
aware of the act or practice;
(d) the complaint is frivolous, vexatious, misconceived or lacking in
substance;
(e) the act or practice is the subject of an application under another
Commonwealth enactment and the subject-matter of the complaint has been, or is
being, dealt with adequately under that enactment; or
(f) the act or practice could be made the subject of an application under
another Commonwealth enactment for a more appropriate remedy.
(2) The Commissioner may decide not to investigate, or not to investigate
further, an act or practice about which a complaint has been made under
section 36 if the Commissioner is satisfied that the complainant has
complained to the respondent about the act or practice and either:
(a) the respondent has dealt, or is dealing, adequately with the complaint;
or
(b) the respondent has not yet had an adequate opportunity to deal with the
complaint.
(3) The Commissioner may defer the investigation or further investigation of
an act or practice about which a complaint has been made under section 36
if:
(a) an application has been made by the respondent for a determination under
section 72 in relation to the act or practice; and
(b) the Commissioner is satisfied that the interests of persons affected by
the act or practice would not be unreasonably prejudiced if the investigation
or further investigation were deferred until the application had been disposed
of.
(4) Where an act or practice may be an interference with the privacy of an
individual solely because it may breach Information Privacy Principle 7, the
Commissioner shall not investigate the act or practice except to the extent
that it is an interference with the privacy of a person who is, or persons
each of whom is:
(a) an Australian citizen; or
(b) a person whose continued presence in Australia is not subject to a
limitation as to time imposed by law.
PRIVACY ACT 1988 - SECT 42
Preliminary inquiries
SECT
42. Where a complaint has been made to the Commissioner, the Commissioner
may, for the purpose of determining:
(a) whether the Commissioner has power to investigate the matter to which
the complaint relates; or
(b) whether the Commissioner may, in his or her discretion, decide not to
investigate the matter;
make inquiries of the respondent.
PRIVACY ACT 1988 - SECT 43
Conduct of investigations
SECT
43. (1) Before commencing an investigation of a matter to which a complaint
relates, the Commissioner shall inform the respondent that the matter is to be
investigated.
(2) An investigation under this Division shall be conducted in private but
otherwise in such manner as the Commissioner thinks fit.
(3) The Commissioner may, for the purposes of an investigation, obtain
information from such persons, and make such inquiries, as he or she thinks
fit.
(4) Subject to subsection (5), it is not necessary for a complainant or
respondent to be afforded an opportunity to appear before the Commissioner in
connection with an investigation under this Division.
(5) The Commissioner shall not make a finding under section 52 that is
adverse to a complainant or respondent unless the Commissioner has afforded
the complainant or respondent an opportunity to appear before the Commissioner
and to make submissions, orally, in writing or both, in relation to the matter
to which the investigation relates.
(6) Where the Commissioner affords an agency or person an opportunity to
appear before the Commissioner under subsection (5), the agency or person may,
with the approval of the Commissioner, be represented by another person.
(7) Where, in connection with an investigation of a matter under this
Division, the Commissioner proposes to afford the complainant or respondent an
opportunity to appear before the Commissioner and to make submissions under
subsection (5), or proposes to make a requirement of a person under section
44, the Commissioner shall, if he or she has not previously informed the
responsible Minister (if any) that the matter is being investigated, inform
that Minister accordingly.
(8) The Commissioner may, either before or after the completion of an
investigation under this Division, discuss any matter that is relevant to the
investigation with a Minister concerned with the matter.
(9) Where the Commissioner forms the opinion, either before or after
completing an investigation under this Division, that there is evidence that
an officer of an agency has been guilty of a breach of duty or of misconduct
and that the evidence is, in all the circumstances, of sufficient force to
justify the Commissioner doing so, the Commissioner shall bring the evidence
to the notice of:
(a) an appropriate officer of an agency; or
(b) if the Commissioner thinks that there is no officer of an agency to
whose notice the evidence may appropriately be drawn-an appropriate Minister.
PRIVACY ACT 1988 - SECT 44
Power to obtain information and documents
SECT
44. (1) If the Commissioner has reason to believe that a person has
information or a document relevant to an investigation under this Division,
the Commissioner may give to the person a written notice requiring the
person:
(a) to give the information to the Commissioner in writing signed by the
person or, in the case of a body corporate, by an officer of the body
corporate; or
(b) to produce the document to the Commissioner.
(2) A notice given by the Commissioner under subsection (1) shall state:
(a) the place at which the information or document is to be given or
produced to the Commissioner; and
(b) the time at which, or the period within which, the information or
document is to be given or produced.
(3) If the Commissioner has reason to believe that a person has information
relevant to an investigation under this Division, the Commissioner may give to
the person a written notice requiring the person to attend before the
Commissioner at a time and place specified in the notice to answer questions
relevant to the investigation.
(4) This section is subject to sections 69 and 70 but it has effect
regardless of any other enactment.
(5) A person is not liable to a penalty under the provisions of any other
enactment because he or she gives information, produces a document or answers
a question when required to do so under this Division.
PRIVACY ACT 1988 - SECT 45
Power to examine witnesses
SECT
45. (1) The Commissioner may administer an oath or affirmation to a person
required under section 44 to attend before the Commissioner and may examine
such a person on oath or affirmation.
(2) The oath or affirmation to be taken or made by a person for the purposes
of this section is an oath or affirmation that the answers the person will
give will be true.
PRIVACY ACT 1988 - SECT 46
Directions to persons to attend compulsory conference
SECT
46. (1) For the purposes of performing the Commissioner's functions in
relation to a complaint, the Commissioner may, by written notice, direct:
(a) the complainant;
(b) the respondent; and
(c) any other person who, in the opinion of the Commissioner, is likely to
be able to provide information relevant to the matter to which the complaint
relates or whose presence at the conference is, in the opinion of the
Commissioner, likely to assist in connection with the performance of the
Commissioner's functions in relation to the complaint;
to attend, at a time and place specified in the notice, a conference presided
over by the Commissioner.
(2) A person who has been directed to attend a conference and, without
reasonable excuse:
(a) fails to attend as required by the direction; or
(b) fails to attend from day to day unless excused, or released from further
attendance, by the Commissioner;
is guilty of an offence punishable on conviction:
(c) in the case of an individual-by a fine not exceeding $1,000 or
imprisonment for a period not exceeding 6 months, or both; or
(d) in the case of a body corporate-by a fine not exceeding $5,000.
(3) A person who has been directed under subsection (1) to attend a
conference is entitled to be paid by the Commonwealth a reasonable sum for the
person's attendance at the conference.
(4) The Commissioner may, in a notice given to a person under subsection
(1), require the person to produce such documents at the conference as are
specified in the notice.
PRIVACY ACT 1988 - SECT 47
Conduct of compulsory conference
SECT
47. (1) The Commissioner may require a person attending a conference under
this Division to produce a document.
(2) A conference under this Division shall be held in private and shall be
conducted in such manner as the Commissioner thinks fit.
(3) A body of persons, whether corporate or unincorporate, that is directed
under section 46 to attend a conference shall be deemed to attend if a member,
officer or employee of that body attends on behalf of that body.
(4) Except with the consent of the Commissioner:
(a) an individual is not entitled to be represented at the conference by
another person; and
(b) a body of persons, whether corporate or unincorporate, is not entitled
to be represented at the conference by a person other than a member, officer
or employee of that body.
PRIVACY ACT 1988 - SECT 48
Complainant and certain other persons to be informed of various
matters
SECT
48. Where the Commissioner decides not to investigate, or not to investigate
further, a matter to which a complaint relates, the Commissioner shall, as
soon as practicable and in such manner as the Commissioner thinks fit, inform
the complainant and the respondent of the decision and of the reasons for the
decision.
PRIVACY ACT 1988 - SECT 49
Investigation under section 40 to cease if certain offences may have
been committed
SECT
49. (1) Where, in the course of an investigation under section 40, the
Commissioner forms the opinion that a tax file number offence or a credit
reporting offence may have been committed, the Commissioner shall:
(a) inform the Commissioner of Police or the Director of Public Prosecutions
of that opinion;
(b) in the case of an investigation under subsection 40 (1), give a copy of
the complaint to the Commissioner of Police or the Director of Public
Prosecutions, as the case may be; and
(c) subject to subsection (3), discontinue the investigation except to the
extent that it concerns matters unconnected with the offence that the
Commissioner believes may have been committed.
(2) If, after having been informed of the Commissioner's opinion under
paragraph (1) (a), the Commissioner of Police or the Director of Public
Prosecutions, as the case may be, decides that the matter will not be, or will
no longer be, the subject of proceedings for an offence, he or she shall give
a written notice to that effect to the Commissioner.
(3) Upon receiving such a notice the Commissioner may continue the
investigation discontinued under paragraph (1) (c).
(4) In subsection (1):
"credit reporting offence" means:
(a) an offence against subsection 18C (4), 18D (4), 18K (4), 18L (2), 18N
(2), 18R (2) or 18S (3) or section 18T; or
(b) an offence against section 6, 7 or 7A, or paragraph 86 (1) (a), of the
Crimes Act 1914, being an offence that relates to an offence referred to in
paragraph (a) of this definition;
"tax file number offence" means:
(a) an offence against section 8WA or 8WB of the Taxation Administration Act
1953; or
(b) an offence against section 6, 7 or 7A, or paragraph 86 (1) (a), of the
Crimes Act 1914, being an offence that relates to an offence referred to in
paragraph (a) of this definition.
PRIVACY ACT 1988 - SECT 50
Reference of matters to other authorities
SECT
50. (1) In this section:
"Human Rights and Equal Opportunity Commission" includes a person performing
functions of that Commission;
"Merit Protection Act" means the Merit Protection (Australian Government
Employees) Act 1984;
"Merit Protection Agency" means the Merit Protection and Review Agency
established by the Merit Protection Act;
"Ombudsman" means the Commonwealth Ombudsman.
(2) Where, before the Commissioner commences, or after the Commissioner has
commenced, to investigate a matter to which a complaint relates, the
Commissioner forms the opinion that:
(a) a complaint relating to that matter has been, or could have been, made
by the complainant:
(i) to the Human Rights and Equal Opportunity
Commission under Division 3 of Part II of the Human Rights and Equal
Opportunity Commission Act 1986; or
(ii) to the Ombudsman under the Ombudsman Act
1976; or
(b) an application with respect to that matter has been, or could have been,
made by the complainant to the Merit Protection Agency under section 47 of the
Merit Protection Act;
and that that matter could be more conveniently or effectively dealt with by
the Human Rights and Equal Opportunity Commission, the Ombudsman, or the Merit
Protection Agency, as the case may be, the Commissioner may decide not to
investigate the matter, or not to investigate the matter further, as the case
may be, and, if the Commissioner so decides, he or she shall:
(c) transfer the complaint to the Human Rights and Equal Opportunity
Commission, the Ombudsman or the Merit Protection Agency;
(d) give notice in writing to the complainant stating that the complaint has
been so transferred; and
(e) give to the Human Rights and Equal Opportunity Commission, the Ombudsman
or the Merit Protection Agency any information or documents that relate to the
complaint and are in the possession, or under the control, of the
Commissioner.
(3) A complaint transferred under subsection (2) shall be taken to be:
(a) a complaint made:
(i) to the Human Rights and Equal Opportunity
Commission under Division 3 of Part II of the Human Rights and Equal
Opportunity Commission Act 1986; or
(ii) to the Ombudsman under the Ombudsman Act
1976; or
(b) an application made to the Merit Protection Agency under section 47 of
the Merit Protection Act;
as the case requires.
PRIVACY ACT 1988 - SECT 51
Effect of investigation by Auditor-General
SECT
51. Where the Commissioner becomes aware that a matter being investigated by
the Commissioner is, or is related to, a matter that is under investigation by
the Auditor-General, the Commissioner shall not, unless the Commissioner and
Auditor-General agree to the contrary, continue to investigate the matter
until the investigation by the Auditor-General has been completed.
PRIVACY ACT 1988 - DIVISION 2
Division 2-Determinations following investigation of complaints
PRIVACY ACT 1988 - SECT 52
Determination of the Commissioner
SECT
52. (1) After investigating a complaint, the Commissioner may:
(a) make a determination dismissing the complaint; or
(b) find the complaint substantiated and make a determination that includes
one or more of the following:
(i) a declaration:
(A) where the principal executive of an agency is the
respondent-that the agency has engaged in conduct constituting an interference
with the privacy of an individual and should not repeat or continue such
conduct; or
(B) in any other case-that the respondent has engaged
in conduct constituting an interference with the privacy of an individual and
should not repeat or continue such conduct;
(ii) a declaration that the respondent should perform
any reasonable act or course of conduct to redress any loss or damage suffered
by the complainant;
(iii) except where the complaint was dealt with as a
representative complaint-a declaration that the complainant is entitled to a
specified amount by way of compensation for any loss or damage suffered by
reason of the act or practice the subject of the complaint;
(iv) a declaration that it would be inappropriate for
any further action to be taken in the matter.
(2) The Commissioner shall, in a determination, state any findings of fact
upon which the determination is based.
(3) In a determination under paragraph (1) (a) or (b) (other than a
determination made on a representative complaint), the Commissioner may
include a declaration that the complainant is entitled to a specified amount
to reimburse the complainant for expenses reasonably incurred by the
complainant in connection with the making of the complaint and the
investigation of the complaint.
(3A) In a determination under subparagraph (1) (b) (i) or (ii) that concerns
a breach of Information Privacy Principle 7 or section 18J, the Commissioner
may include an order that:
(a) an agency or respondent make an appropriate correction, deletion or
addition to a record, or to a credit information file or credit report, as the
case may be; or
(b) an agency or respondent attach to a record, or include in a credit
information file or credit report, as the case may be, a statement provided by
the complainant of a correction, deletion or addition sought by the
complainant.
(4) In this section:
"complainant", in relation to a representative complaint, includes all of
the persons on whose behalf the complaint is made.
PRIVACY ACT 1988 - SECT 53
Service of determination
SECT
53. (1) The Commissioner shall cause a copy of a determination to be served
on the complainant and on the respondent.
(2) A determination does not become effective for the purposes of Division 3
or 4 until a copy of the determination has been served on the complainant and
on the respondent.
PRIVACY ACT 1988 - DIVISION 3
Division 3-Review and enforcement of determinations
relating to alleged breaches of Information Privacy Principles
PRIVACY ACT 1988 - SECT 54
Application of Division
SECT
54. This Division applies to a determination under section 52 that:
(a) dismisses an IPP complaint; or
(b) includes a declaration that the respondent has engaged in conduct that
constitutes an interference with the privacy of the complainant because it
breaches an Information Privacy Principle.
PRIVACY ACT 1988 - SECT 55
Obligations of respondent agency
SECT
55. Where a determination to which this Division applies is made on a
complaint to which an agency is the respondent:
(a) the agency shall not repeat or continue the conduct the subject of a
declaration included in the determination under subparagraph 52 (1) (b) (i);
and
(b) the agency shall, in accordance with the determination, perform the act
or course of conduct the subject of a declaration included in the
determination under subparagraph 52 (1) (b) (ii).
PRIVACY ACT 1988 - SECT 56
Obligations of principal executive of agency
SECT
56. Where a determination to which this Division applies is made on a
complaint to which the principal executive of an agency is the respondent, the
respondent shall take all such steps as are reasonably within his or her power
to ensure that:
(a) the terms of the determination are brought to the notice of all members,
officers and employees of the agency whose duties are such that they may
engage in conduct of the kind to which the determination relates;
(b) conduct the subject of a declaration included in the determination under
subparagraph 52 (1) (b) (i) is not repeated or continued by any member,
officer or employee of the agency; and
(c) any act or course of conduct the subject of a declaration included in
the determination under subparagraph 52 (1) (b) (ii) is performed in
accordance with the determination.
PRIVACY ACT 1988 - SECT 57
Compensation and expenses
SECT
57. (1) Where a determination to which this Division applies includes a
declaration of the kind referred to in subparagraph 52 (1) (b) (iii) or
subsection 52 (3), the complainant is entitled to be paid the amount specified
in the declaration.
(2) Where the respondent to the determination is an agency that has the
capacity to sue and be sued, an amount referred to in subsection (1) is
recoverable as a debt due by the agency to the complainant.
(3) In any other case, the amount is recoverable as a debt due by the
Commonwealth to the complainant.
PRIVACY ACT 1988 - SECT 58
Review of determinations
SECT
58. (1) Application may be made to the Administrative Appeals Tribunal for
review of:
(a) a declaration of the kind referred to in subparagraph 52 (1) (b) (iii)
or subsection 52 (3) that is included in a determination to which this
Division applies; or
(b) a decision of the Commissioner refusing to include such a declaration in
a determination to which this Division applies.
(2) An agency or the principal executive of an agency may not apply under
subsection (1) except with the leave of the Minister.
(3) Subject to subsection 21 (1A) of the Administrative Appeals Tribunal
Act 1975, for the purpose of the exercise of its powers in relation to an
application under subsection (1) of this section, the Tribunal shall be
constituted by a presidential member who is a Judge and 2 other members who
are not Judges.
(4) An expression used in subsection (3) that is also used in the
Administrative Appeals Tribunal Act 1975 has the same meaning as in that Act.
PRIVACY ACT 1988 - SECT 59
Enforcement of determination against agency
SECT
59. (1) Where an agency fails to comply with section 55, the person on whose
complaint the determination was made or the Commissioner may apply to the
Federal Court for an order directing the agency to comply with that section.
(2) Where the principal executive of an agency fails to comply with section
56, the person on whose complaint the determination was made or the
Commissioner may apply to the Federal Court for an order directing the
principal executive to comply with that section.
(3) On an application under this section, the Federal Court may make such
other orders as it thinks fit with a view to securing compliance by the
respondent with section 55 or 56, as the case may be.
(4) An application may not be made under this section until:
(a) the time within which an application may be made under section 58 in
respect of the relevant determination has expired; or
(b) if such an application is made, the decision of the Administrative
Appeals Tribunal on the application has come into operation.
PRIVACY ACT 1988 - DIVISION 4
Division 4-Enforcement of determinations relating to tax
file numbers or credit reporting
PRIVACY ACT 1988 - SECT 60
Application of Division
SECT
60. This Division applies to a determination under section 52 that includes
a declaration that an agency or the respondent has engaged in conduct that
constitutes an interference with the privacy of the complainant because:
(a) it breaches a guideline issued under section 17; or
(b) it involves an unauthorised requirement or request for disclosure of a
tax file number; or
(c) it constitutes a credit reporting infringement.
PRIVACY ACT 1988 - SECT 61
Compensation and expenses
SECT
61. Where a determination to which this Division applies includes a
declaration of a kind referred to in subparagraph 52 (1) (b) (iii) or
subsection 52 (3), the declaration has effect as a declaration that the
complainant is entitled to receive the specified amount:
(a) if the respondent is an agency that does not have the capacity to sue or
be sued or is the principal executive of an agency-from the Commonwealth; and
(b) in any other case-from the respondent.
PRIVACY ACT 1988 - SECT 62
Proceedings in Federal Court
SECT
62. (1) The Commissioner or complainant may institute a proceeding in the
Federal Court for an order to enforce a determination to which this Division
applies.
(2) If the Federal Court is satisfied that the respondent or, where the
principal executive of an agency is the respondent, the agency has engaged in
conduct or committed an act constituting an interference with the privacy of
an individual, the court may make such orders (including a declaration of
right) as the court thinks fit.
(3) Orders made by the Federal Court under subsection (2) may give effect to
a determination of the Commissioner.
PRIVACY ACT 1988 - SECT 63
Legal assistance
SECT
63. (1) Where:
(a) the Commissioner has dismissed a file number complaint; and
(b) the respondent is not an agency or the principal executive of an
agency;
the respondent may apply to the Attorney-General for assistance under this
section.
(2) If the Attorney-General is satisfied that in all the circumstances it is
reasonable to grant an application made under this section, he or she may
authorise the provision by the Commonwealth to the applicant of such financial
assistance in connection with the investigation of the complaint as the
Attorney-General determines.
(3) An authorisation under subsection (2) may be made subject to such
conditions (if any) as the Attorney-General determines.
(4) In considering an application made under this section, the
Attorney-General shall have regard to any hardship to the applicant that
refusal of the application would involve.
PRIVACY ACT 1988 - DIVISION 5
Division 5-Miscellaneous
PRIVACY ACT 1988 - SECT 64
Commissioner not to be sued
SECT
64. Neither the Commissioner nor a person acting under his or her direction
or authority is liable to an action, suit or proceeding in relation to an act
done or omitted to be done in good faith in the exercise or purported exercise
of any power or authority conferred by this Act.
PRIVACY ACT 1988 - SECT 65
Failure to attend etc. before Commissioner
SECT
65. (1) A person shall not, without reasonable excuse:
(a) refuse or fail to attend before the Commissioner; or
(b) refuse or fail to be sworn or make an affirmation;
when so required under this Act.
Penalty: $2,000 or imprisonment for 12 months, or both.
(2) person shall not, without reasonable excuse, wilfully obstruct, hinder
or resist the Commissioner in the performance of his or her functions under
this Act.
Penalty: $2,000 or imprisonment for 12 months, or both.
(3) A person shall not furnish information or make a statement to the
Commissioner knowing that it is false or misleading in a material particular.
Penalty: $2,000 or imprisonment for 12 months, or both.
PRIVACY ACT 1988 - SECT 66
Failure to give information etc.
SECT
66. (1) A person shall not refuse or fail, without reasonable excuse:
(a) to give information; or
(b) to answer a question or produce a document or record;
when so required under this Act.
Penalty:
(a) in the case of an individual-$2,000 or imprisonment for 12 months, or
both; or
(b) in the case of a body corporate-$10,000.
(2) For the purposes of subsections (3) to (11) (inclusive):
"document" includes a record;
"information" includes an answer to a question.
(3) Subject to subsections (4), (7) and (10), it is a reasonable excuse for
the purposes of subsection (1) for an individual:
(a) to refuse or fail to give information when so required under this Act;
or
(b) to refuse or fail to produce a document when so required under this
Act;
that giving the information, or producing the document, as the case may be,
might tend to incriminate the individual or make the individual liable to
forfeiture or a penalty.
(4) Subsection (3) does not apply in relation to a failure or refusal by an
individual to give information, or to produce a document, on the ground that
giving the information or producing the document might tend to prove his or
her guilt of an offence against, or make him or her liable to forfeiture or a
penalty under, a law of the Commonwealth or of a Territory, if the Director of
Public Prosecutions has given the individual a written undertaking under
subsection (5).
(5) An undertaking by the Director of Public Prosecutions shall:
(a) be an undertaking that:
(i) information given, or a document produced, by the individual;
or
(ii) any information or document obtained as a direct or indirect
consequence of the giving of the information, or the production of the
document;
will not be used in evidence in any proceedings for an offence against a law
of the Commonwealth or of a Territory, or in any disciplinary proceedings,
against the individual, other than proceedings in respect of the falsity of
evidence given by the individual;
(b) state that, in the opinion of the Director of Public Prosecutions, there
are special reasons why, in the public interest, the information or document
should be available to the Commissioner; and
(c) state the general nature of those reasons.
(6) The Commissioner may recommend to the Director of Public Prosecutions
that an individual who has been, or is to be, required under this Act to give
information or produce a document be given an undertaking under subsection
(5).
(7) Subsection (3) does not apply in relation to a failure or refusal by an
individual to give information, or to produce a document, on the ground that
giving the information or producing the document might tend to prove his or
her guilt of an offence against, or make him or her liable to forfeiture or a
penalty under, a law of a State, if the Attorney-General of the State, or a
person authorised by that Attorney-General (being the person holding the
office of Director of Public Prosecutions, or a similar office, of the State)
has given the individual a written undertaking under subsection (8).
(8) An undertaking by the Attorney-General of the State, or authorised
person, shall:
(a) be an undertaking that:
(i) information given, or a document produced, by the individual;
or
(ii) any information or document obtained as a direct
or indirect consequence of the giving of the information, or the production of
the document;
will not be used in evidence in any proceedings for an offence against a law
of the State, or in any disciplinary proceedings, against the individual,
other than proceedings in respect of the falsity of evidence given by the
individual;
(b) state that, in the opinion of the person giving the undertaking, there
are special reasons why, in the public interest, the information or document
should be available to the Commissioner; and
(c) state the general nature of those reasons.
(9) The Commissioner may recommend to the Attorney-General of a State that
an individual who has been, or is to be, required under this Act to give
information or produce a document be given an undertaking under subsection
(8).
(10) For the purposes of subsection (1):
(a) it is not a reasonable excuse for a body corporate to refuse or fail to
produce a document that production of the document might tend to incriminate
the body corporate or make it liable to forfeiture or a penalty; and
(b) it is not a reasonable excuse for an individual to refuse or fail to
produce a document that is, or forms part of, a record of an existing or past
business (not being, if the individual is or has been an employee, a document
that sets out details of earnings received by the individual in respect of his
or her employment and does not set out any other information) that production
of the document might tend to incriminate the individual or make the
individual liable to forfeiture or a penalty.
(11) Subsections (4), (7) and (10) do not apply where proceedings, in
respect of which giving information or producing a document might tend to
incriminate an individual or make an individual liable to forfeiture or a
penalty, have been commenced against the individual and have not been finally
dealt with by a court or otherwise disposed of.
PRIVACY ACT 1988 - SECT 67
Protection from civil actions
SECT
67. Civil proceedings do not lie against a person in respect of loss, damage
or injury of any kind suffered by another person because of any of the
following acts done in good faith:
(a) the making of a complaint under this Act;
(b) the making of a statement to, or the giving of a document or information
to, the Commissioner, whether or not pursuant to a requirement under section
44.
PRIVACY ACT 1988 - SECT 68
Power to enter premises
SECT
68. (1) Subject to subsection (3), for the purposes of the performance by
the Commissioner of his or her functions under this Act, a person authorised
by the Commissioner for the purposes of this section may, at any reasonable
time of the day, enter premises occupied by an agency, a file number
recipient, a credit reporting agency or a credit provider and inspect any
documents that are kept at those premises and that are relevant to the
performance of those functions, other than documents in respect of which the
Attorney- General has furnished a certificate under subsection 70 (1) or (2).
(2) The occupier or person in charge of the premises shall provide the
authorised person with all reasonable facilities and assistance for the
effective exercise of the authorised person's powers under subsection (1).
(3) A person shall not enter under subsection (1) premises other than
premises that are occupied by an agency unless:
(a) the occupier of the premises has consented to the person entering the
premises; or
(b) the person is authorised, pursuant to a warrant issued under subsection
(4), to enter the premises.
(4) If, on an application made by a person authorised by the Commissioner
under subsection (1), a Magistrate is satisfied, by information on oath, that
it is reasonably necessary, for the purposes of the performance by the
Commissioner of his or her functions under this Act, that the person be
empowered to enter the premises, the Magistrate may issue a warrant
authorising the person, with such assistance as the person thinks necessary,
to enter the premises, if necessary by force, for the purpose of exercising
those powers.
(5) A warrant issued under subsection (4) shall state:
(a) whether entry is authorised to be made at any time of the day or during
specified hours of the day; and
(b) a day, not being later than one month after the day on which the warrant
was issued, at the end of which the warrant ceases to have effect.
(6) Nothing in subsection (1) restricts the operation of any other provision
of this Part.
PRIVACY ACT 1988 - SECT 69
Restrictions on Commissioner obtaining personal information and
documents
SECT
69. (1) Information relating to an individual shall not be furnished, in
connection with a complaint, in such a manner as to reveal the individual's
identity, unless the individual has made the complaint or has consented to the
information being so furnished.
(2) A document that contains information relating to an individual and that
reveals the individual's identity shall not be produced, in connection with a
complaint, unless:
(a) the person has made the complaint or has consented to the document being
so produced; or
(b) the document is a copy of another document and has had deleted from it
such information as reveals the identity of the person.
(3) A person shall not furnish, in connection with a complaint, prescribed
information that relates to an individual other than the complainant and does
not also relate to the complainant.
(4) A person shall not furnish, in connection with a complaint, prescribed
information that relates both to the complainant and to another individual,
unless the information is so furnished in such a manner as not to reveal the
identity of the other person.
(5) A person shall not produce, in connection with a complaint, a prescribed
document containing information that relates to an individual other than the
complainant and does not also relate to the complainant, unless the document
is a copy of another prescribed document and has had that information deleted
from it.
(6) A person shall not produce, in connection with a complaint, a prescribed
document containing information that relates both to the complainant and to
another individual, unless the document is a copy of another prescribed
document and has had deleted from it such information as reveals the identity
of the other individual.
(7) This section has effect notwithstanding any other provision of this
Part.
(8) A reference in this section to furnishing information, or to producing a
document, in connection with a complaint is a reference to furnishing the
information, or to producing the document, as the case may be, to the
Commissioner in connection with the performance or exercise by the
Commissioner, in relation to that complaint, of the Commissioner's functions
or powers.
(9) In this section:
"complaint" means a complaint under section 36;
"document" includes any other record;
"prescribed document" means a document that was furnished or obtained under
or for the purposes of a relevant law or a copy of such a document;
"prescribed information" means information that the person furnishing the
information acquired by reason of holding or having held an office, or being
or having been employed, under or for the purposes of a relevant law;
"relevant law" means a taxation law or a law of the Commonwealth relating to
census and statistics;
"taxation law" means:
(a) an Act of which the Commissioner of Taxation has the general
administration (other than an Act prescribed for the purposes of paragraph (b)
of the definition of "taxation law" in section 2 of the Taxation
Administration Act 1953); or
(b) regulations under an Act referred to in paragraph (a) of this
definition.
PRIVACY ACT 1988 - SECT 70
Certain documents and information not required to be disclosed
SECT
70. (1) Where the Attorney-General furnishes to the Commissioner a
certificate certifying that the giving to the Commissioner of information
concerning a specified matter (including the giving of information in answer
to a question), or the production to the Commissioner of a specified document
or other record, would be contrary to the public interest because it would:
(a) prejudice the security, defence or international relations of
Australia;
(b) involve the disclosure of communications between a Minister of the
Commonwealth and a Minister of a State, being a disclosure that would
prejudice relations between the Commonwealth Government and the Government of
a State;
(c) involve the disclosure of deliberations or decisions of the Cabinet or
of a Committee of the Cabinet;
(d) involve the disclosure of deliberations or advice of the Executive
Council;
(e) prejudice the conduct of an investigation or inquiry into crime or
criminal activity that is currently being pursued, or prejudice the fair trial
of any person;
(f) disclose, or enable a person to ascertain, the existence or identity of
a confidential source of information in relation to the enforcement of the
criminal law;
(g) prejudice the effectiveness of the operational methods or investigative
practices or techniques of agencies responsible for the enforcement of the
criminal law; or
(h) endanger the life or physical safety of any person;
the Commissioner is not entitled to require a person to give any information
concerning the matter or to produce the document or other record.
(2) Without limiting the operation of subsection (1), where the
Attorney-General furnishes to the Commissioner a certificate certifying that
the giving to the Commissioner of information as to the existence or
non-existence of information concerning a specified matter (including the
giving of information in answer to a question) or as to the existence or
non-existence of any document or other record required to be produced to the
Commissioner would be contrary to the public interest:
(a) by reason that it would prejudice the security, defence or international
relations of Australia; or
(b) by reason that it would prejudice the proper performance of the
functions of the National Crime Authority;
the Commissioner is not entitled, pursuant to this Act, to require a person to
give any information as to the existence or non-existence of information
concerning that matter or as to the existence of that document or other
record.
PRIVACY ACT 1988 - PART VI
PART VI-PUBLIC INTEREST DETERMINATIONS ABOUT CERTAIN ACTS
AND PRACTICES
PRIVACY ACT 1988 - SECT 71
Interpretation
SECT
71. For the purposes of this Part, a person is interested in an application
made under section 73 if, and only if, the Commissioner is of the opinion that
the person has a real and substantial interest in the application.
PRIVACY ACT 1988 - SECT 72
Power to make, and effect of, determinations
SECT
72. Subject to this Part, where the Commissioner is satisfied that:
(a) an act or practice of an agency breaches, or may breach, an Information
Privacy Principle; and
(b) the public interest in the agency doing the act, or engaging in the
practice, outweighs to a substantial degree the public interest in adhering to
that Information Privacy Principle;
the Commissioner may make a written determination to that effect and, if the
Commissioner does so, the fact that the act or practice breaches that
Information Privacy Principle shall:
(c) if the agency does the act while the determination is in force; or
(d) in so far as the agency engages in the practice while the determination
is in force;
as the case may be, be disregarded for the purpose of section 16.
PRIVACY ACT 1988 - SECT 73
Application by agency
SECT
73. (1) An agency may apply in accordance with the regulations for a
determination under section 72 about an act or practice.
(2) The National Health and Medical Research Council may make an application
under subsection (1) on behalf of other agencies concerned with medical
research or the provision of health care.
(3) Where an application is made by virtue of subsection (2), a reference in
the succeeding provisions of this Part to the agency is a reference to the
National Health and Medical Research Council.
(4) Where the Commissioner makes a determination under section 72 on an
application made by virtue of subsection (2), that section has effect, in
relation to each of the agencies on whose behalf the application was made as
if the determination had been made on an application by that agency.
PRIVACY ACT 1988 - SECT 74
Publication of application
SECT
74. (1) Subject to subsection (2), the Commissioner shall publish, in such
manner as he or she thinks fit, notice of the receipt by the Commissioner of
an application.
(2) The Commissioner shall not, except with the consent of the agency,
permit the disclosure to another body or person of information contained in a
document provided by an agency as part of, or in support of, an application if
the agency has informed the Commissioner in writing that the agency claims
that the document is an exempt document within the meaning of Part IV of the
Freedom of Information Act 1982
PRIVACY ACT 1988 - SECT 75
Draft determination
SECT
75. (1) The Commissioner shall prepare a draft of his or her proposed
determination in relation to the application.
(2) The Commissioner shall send to the agency, and to each person (if any)
other than the agency who is interested in the application, a written
invitation to notify the Commissioner, within the period specified in the
invitation, whether or not the agency or other person wishes the Commissioner
to hold a conference about the draft determination.
(3) An invitation under subsection (2) shall specify a period that begins on
the day on which the invitation is sent and is not shorter than the prescribed
period.
PRIVACY ACT 1988 - SECT 76
Conference
SECT
76. (1) If an agency or person notifies the Commissioner, within the period
specified in an invitation sent to the agency or person, that the agency or
person wishes a conference to be held about the draft determination, the
Commissioner shall hold such a conference.
(2) The Commissioner shall fix a day, time and place for the holding of the
conference.
(3) The day fixed shall not be more than 30 days after the latest day on
which a period specified in any of the invitations sent in relation to the
draft determination expires.
(4) The Commissioner shall give notice of the day, time and place of the
conference to the agency and to each person to whom an invitation was sent.
PRIVACY ACT 1988 - SECT 77
Conduct of conference
SECT
77. (1) At the conference, the agency is entitled to be represented by a
person who is, or persons each of whom is, an officer or employee of the
agency.
(2) At the conference, a person to whom an invitation was sent, or any other
person who is interested in the application and whose presence at the
conference is considered by the Commissioner to be appropriate, is entitled to
attend and participate personally or, in the case of a body corporate, to be
represented by a person who is, or persons each of whom is, a director,
officer or employee of the body corporate.
(3) The Commissioner may exclude from the conference a person who:
(a) is entitled neither to participate in the conference nor to represent a
person who is entitled to be represented at the conference;
(b) uses insulting language at the conference;
(c) creates, or takes part in creating or continuing, a disturbance at the
conference; or
(d) repeatedly disturbs the conference.
PRIVACY ACT 1988 - SECT 78
Determination of application
SECT
78. The Commissioner shall, after complying with this Part in relation to
the application, make:
(a) such determination under section 72 as he or she considers appropriate;
or
(b) a written determination dismissing the application.
PRIVACY ACT 1988 - SECT 79
Making of determination
SECT
79. (1) The Commissioner shall, in making a determination, take account of
all matters raised at the conference.
(2) The Commissioner shall, in making a determination, take account of all
submissions about the application that have been made, whether at a conference
or not, by the agency or any person.
(3) The Commissioner shall include in a determination a statement of the
reasons for the determination.
PRIVACY ACT 1988 - SECT 80
Determination disallowable
SECT
80. (1) A determination referred to in paragraph 78 (a) is a disallowable
instrument for the purposes of section 46A of the Acts Interpretation Act
1901.
(2) Section 48 of the Acts Interpretation Act 1901 applies to a
determination referred to in paragraph 78 (a) as if paragraph (1) (b) of
section 48 were omitted and the following paragraph substituted:
"(b) subject to this section, shall take effect on the first day on which
the determination is no longer liable to be disallowed, or to be deemed to be
disallowed, under this section; and".
PRIVACY ACT 1988 - PART VII
PART VII-PRIVACY ADVISORY COMMITTEE
PRIVACY ACT 1988 - SECT 81
Interpretation
SECT
81. In this Part, unless the contrary intention appears:
"Advisory Committee" means the Privacy Advisory Committee established by
subsection 82 (1);
"member" means a member of the Advisory Committee.
PRIVACY ACT 1988 - SECT 82
Establishment and membership
SECT
82. (1) A Privacy Advisory Committee is established.
(2) The Advisory Committee shall consist of:
(a) the Commissioner; and
(b) not more than 6 other members.
(3) A member other than the Commissioner:
(a) shall be appointed by the Governor-General; and
(b) shall be appointed as a part-time member.
(4) An appointed member holds office, subject to this Act, for such period,
not exceeding 5 years, as is specified in the instrument of the member's
appointment, but is eligible for re-appointment.
(5) The Commissioner shall be convenor of the Committee.
(6) The Governor-General shall so exercise the power of appointment
conferred by subsection (3) that a majority of the appointed members are
persons who are neither officers nor employees, nor members of the staff of an
authority or instrumentality, of the Commonwealth.
(7) Of the appointed members:
(a) at least one shall be a person who has had at least 5 years' experience
at a high level in industry, commerce, public administration or the service of
a government or an authority of a government;
(b) at least one shall be a person who has had at least 5 years' experience
in the trade union movement;
(c) at least one shall be a person who has had extensive experience in
electronic data-processing;
(d) at least one shall be appointed to represent general community
interests, including interests relating to social welfare; and
(e) at least one shall be a person who has had extensive experience in the
promotion of civil liberties.
(8) A person who has reached 65 years shall not be appointed as a member.
(9) A person shall not be appointed as a member for a period that extends
beyond the time at which the person will reach 65 years.
(10) An appointed member holds office on such terms and conditions (if any)
in respect of matters not provided for by this Act as are determined, in
writing, by the Governor-General.
(11) The performance of a function of the Advisory Committee is not affected
because of a vacancy or vacancies in the membership of the Advisory Committee.
PRIVACY ACT 1988 - SECT 83
Functions
SECT
83. The functions of the Advisory Committee are:
(a) on its own initiative, or when requested by the Commission, to advise
the Commissioner on matters relevant to his or her functions;
(b) to recommend material to the Commissioner for inclusion in guidelines to
be issued by the Commissioner pursuant to his or her functions; and
(c) subject to any direction given by the Commissioner, to engage in and
promote community education, and community consultation, in relation to the
protection of individual privacy.
PRIVACY ACT 1988 - SECT 84
Leave of absence
SECT
84. The convenor may, on such terms and conditions as the convenor thinks
fit, grant to another member leave to be absent from a meeting of the Advisory
Committee.
PRIVACY ACT 1988 - SECT 85
Removal and resignation of members
SECT
85. (1) The Governor-General may terminate the appointment of an appointed
member for misbehaviour or physical or mental incapacity.
(2) The Governor-General shall terminate the appointment of an appointed
member if the member:
(a) becomes bankrupt, applies to take the benefit of any law for the relief
of bankrupt or insolvent debtors, compounds with the member's creditors or
makes an assignment of the member's remuneration for their benefit;
(b) fails, without reasonable excuse, to comply with the member's
obligations under section 86; or
(c) is absent, without the leave of the convenor, from 3 consecutive
meetings of the Advisory Committee.
(3) An appointed member may resign from office by delivering a signed notice
of resignation to the Governor-General.
PRIVACY ACT 1988 - SECT 86
Disclosure of interests of members
SECT
86. (1) A member who has a direct or indirect pecuniary interest in a matter
being considered or about to be considered by the Advisory Committee, being an
interest that could conflict with the proper performance of that member's
functions in relation to the consideration of the matter, shall, as soon as
practicable after the relevant facts have come to the knowledge of that
member, disclose the nature of that interest at a meeting of the Advisory
Committee.
(2) A disclosure under subsection (1) at a meeting of the Advisory Committee
shall be recorded in the minutes of the meeting.
PRIVACY ACT 1988 - SECT 87
Meetings of Advisory Committee
SECT
87. (1) The convenor may convene such meetings of the Advisory Committee as
the convenor considers necessary for the performance of the Committee's
functions.
(2) Meetings of the Advisory Committee shall be held at such places and at
such times as the convenor determines.
(3) The convenor shall preside at all meetings of the Advisory Committee at
which the convenor is present.
(4) If, at a meeting of the Advisory Committee, the convenor is not present,
the members who are present shall elect one of their number to preside at the
meeting.
(5) At a meeting of the Advisory Committee:
(a) 3 members constitute a quorum;
(b) all questions shall be decided by a majority of votes of the members
present and voting; and
(c) the person presiding has a deliberative vote and, in the event of an
equality of votes, also has a casting vote.
(6) The Advisory Committee shall keep a record of its proceedings.
PRIVACY ACT 1988 - SECT 88
Travel allowance
SECT
88. An appointed member is entitled to be paid travelling allowance in
accordance with the regulations.
PRIVACY ACT 1988 - PART VIII
PART VIII-OBLIGATIONS OF CONFIDENCE
PRIVACY ACT 1988 - SECT 89
Obligations of confidence to which Part applies
SECT
89. Unless the contrary intention appears, a reference in this Part to an
obligation of confidence is a reference to an obligation of confidence:
(a) to which an agency or a Commonwealth officer is subject, however the
obligation arose; or
(b) that arises under or by virtue of the law in force in the Australian
Capital Territory.
PRIVACY ACT 1988 - SECT 90
Application of Part
SECT
90. (1) This Part applies where a person (in this Part called a "confidant")
is subject to an obligation of confidence to another person (in this Part
called a "confider") in respect of personal information, whether the
information relates to the confider or to a third person, being an obligation
in respect of a breach of which relief may be obtained (whether in the
exercise of a discretion or not) in legal proceedings.
(2) This Part does not apply where a criminal penalty only may be imposed in
respect of the breach.
PRIVACY ACT 1988 - SECT 91
Effect of Part on other laws
SECT
91. This Part does not, except to the extent that it does so expressly or by
necessary implication, limit or restrict the operation of any other law or of
any principle or rule of the common law or of equity, being a law, principle
or rule:
(a) under or by virtue of which an obligation of confidence exists; or
(b) that has the effect of restricting or prohibiting, or imposing a
liability (including a criminal liability) on a person in respect of, a
disclosure or use of information.
PRIVACY ACT 1988 - SECT 92
Extension of certain obligations of confidence
SECT
92. Where a person has acquired personal information about another person
and the first-mentioned person knows or ought reasonably to know that the
person from whom he or she acquired the information was subject to an
obligation of confidence with respect to the information, the first-mentioned
person, whether he or she is in the Australian Capital Territory or not, is
subject to a like obligation.
PRIVACY ACT 1988 - SECT 93
Relief for breach etc. of certain obligations of confidence
SECT
93. (1) A confider may recover damages from a confidant in respect of a
breach of an obligation of confidence with respect to personal information.
(2) Subsection (1) does not limit or restrict any other right that the
confider has to relief in respect of the breach.
(3) Where an obligation of confidence exists with respect to personal
information about a person other than the confider, whether the obligation
arose under a contract or otherwise, the person to whom the information
relates has the same rights against the confidant in respect of a breach or
threatened breach of the obligation as the confider has.
PRIVACY ACT 1988 - SECT 94
Jurisdiction of courts
SECT
94. (1) The jurisdiction of the courts of the Australian Capital Territory
extends to matters arising under this Part.
(2) Subsection (1) does not deprive a court of a State or of another
Territory of any jurisdiction that it has.
PRIVACY ACT 1988 - PART IX
PART IX-MISCELLANEOUS
PRIVACY ACT 1988 - SECT 95
Medical research guidelines
SECT
95. (1) The National Health and Medical Research Council may, with the
approval of the Commissioner, issue guidelines for the protection of privacy
in the conduct of medical research.
(2) The Commissioner shall not approve the issue of guidelines unless he or
she is satisfied that the public interest in the promotion of research of the
kind to which the guidelines relate outweighs to a substantial degree the
public interest in maintaining adherence to the Information Privacy
Principles.
(3) Guidelines shall be issued by being published in the Gazette.
(4) Where:
(a) but for this subsection, an act done by an agency would breach an
Information Privacy Principle; and
(b) the act is done in the course of medical research and in accordance with
guidelines under subsection (1);
the act shall be regarded as not breaching that Information Privacy Principle.
(5) Where the Commissioner refuses to approve the issue of guidelines under
subsection (1), an application may be made to the Administrative Appeals
Tribunal for review of the Commissioner's decision.
PRIVACY ACT 1988 - SECT 96
Non-disclosure of private information
SECT
96. (1) A person who is, or has at any time been, the Commissioner or a
member of the staff referred to in section 43 of the Human Rights and Equal
Opportunity Commission Act 1986 or is acting, or has at any time acted, on
behalf of the Commissioner shall not, either directly or indirectly, except in
the performance of a duty under or in connection with this Act or in the
course of acting on behalf of the Commissioner:
(a) make a record of, or divulge or communicate to any person, any
information relating to the affairs of another person acquired by the
first-mentioned person because of that person's office or employment under or
for the purposes of this Act or because of that person acting, or having
acted, on behalf of the Commissioner;
(b) make use of any such information; or
(c) produce to any person a document relating to the affairs of another
person furnished for the purposes of this Act.
Penalty: $5,000 or imprisonment for 1 year, or both.
(2) A person who is, or has at any time been, the Commissioner, or a member
of the staff referred to in section 43 of the Human Rights and Equal
Opportunity Commission Act 1986 or is acting, or has at any time acted, on
behalf of the Commissioner shall not be required:
(a) to divulge or communicate to a court any information relating to the
affairs of another person acquired by the first-mentioned person because of
that person's office or employment under or for the purposes of this Act or
because of that person acting, or having acted, on behalf of the Commissioner;
or
(b) to produce in a court a document relating to the affairs of another
person of which the first-mentioned person has custody, or to which that
person has access, because of that person's office or employment under or for
the purposes of this Act or because of that person acting, or having acted, on
behalf of the Commissioner;
except where it is necessary to do so for the purposes of this Act.
(3) Nothing in this section prohibits a person from:
(a) making a record of information that is, or is included in a class of
information that is, required or permitted by an Act to be recorded, if the
record is made for the purposes of or pursuant to that Act; or
(b) divulging or communicating information, or producing a document, that
is, or is included in a class of information that is or class of documents
that are, required or permitted by an Act to be divulged, communicated or
produced, as the case may be, if the information is divulged or communicated,
or the document is produced, for the purposes of or under that Act.
(4) Nothing in subsection (2) prevents a person being required, for the
purposes of or under an Act, to divulge or communicate information, or to
produce a document, that is, or is included in a class of information that is,
or class of documents that are, required or permitted by that Act to be
divulged, communicated or produced.
(5) In this section:
"court" includes any tribunal, authority or person having power to require
the production of documents or the answering of questions;
"produce" includes permit access to.
PRIVACY ACT 1988 - SECT 97
Annual report
SECT
97. (1) The Commissioner shall, as soon as practicable after 30 June in each
year, give to the Minister a report of the operation of this Act during that
year.
(2) Without limiting the generality of subsection (1), the report shall
include a statement of the performance of the Commissioner's functions under
paragraphs 27 (1) (n) and 28 (1) (a) and (f).
(3) The Minister shall cause a copy of the report to be laid before each
House of the Parliament within 15 sitting days of that House after the day on
which he or she receives the report.
PRIVACY ACT 1988 - SECT 98
Injunctions
SECT
98. (1) Where a person has engaged, is engaging or is proposing to engage in
any conduct that constituted or would constitute a contravention of this Act,
the Federal Court may, on the application of the Commissioner or any other
person, grant an injunction restraining the person from engaging in the
conduct and, if in the court's opinion it is desirable to do so, requiring the
person to do any act or thing.
(2) Where:
(a) a person has refused or failed, or is refusing or failing, or is
proposing to refuse or fail, to do an act or thing; and
(b) the refusal or failure was, is, or would be a contravention of this
Act;
the Federal Court may, on the application of the Commissioner or any other
person, grant an injunction requiring the first-mentioned person to do that
act or thing.
(3) Where an application is made to the court for an injunction under this
section, the court may, if in the court's opinion it is desirable to do so,
before considering the application, grant an interim injunction restraining a
person from engaging in conduct of the kind referred to in that subsection
pending the determination of the application.
(4) The court may discharge or vary an injunction granted under this
section.
(5) The power of the court to grant an injunction restraining a person from
engaging in conduct of a particular kind may be exercised:
(a) if the court is satisfied that the person has engaged in conduct of that
kind-whether or not it appears to the court that the person intends to engage
again, or to continue to engage, in conduct of that kind; or
(b) if it appears to the court that, in the event that an injunction is not
granted, it is likely that the person will engage in conduct of that
kind-whether or not the person has previously engaged in conduct of that kind
and whether or not there is an imminent danger of substantial damage to any
person if the first-mentioned person engages in conduct of that kind.
(6) The power of the court to grant an injunction requiring a person to do a
particular act or thing may be exercised:
(a) if the court is satisfied that the person has refused or failed to do
that act or thing-whether or not it appears to the court that the person
intends to refuse or fail again, or to continue to refuse or fail, to do that
act or thing; or
(b) if it appears to the court that, in the event that an injunction is not
granted, it is likely that the person will refuse or fail to do that act or
thing-whether or not the person has previously refused or failed to do that
act or thing and whether or not there is an imminent danger of substantial
damage to any person if the first-mentioned person refuses or fails to do that
act or thing.
(7) Where the Commissioner makes an application to the court for the grant
of an injunction under this section, the court shall not require the
Commissioner or any other person, as a condition of the granting of an interim
injunction, to give any undertakings as to damages.
(8) The powers conferred on the court under this section are in addition to,
and not in derogation of, any powers of the court, whether conferred by this
Act or otherwise.
PRIVACY ACT 1988 - SECT 99
Delegation
SECT
99. The Commissioner may delegate to either a member of the staff of the
Human Rights and Equal Opportunity Commission or a member of the staff of the
Ombudsman all or any of the powers conferred on the Commissioner by this Act,
other than a power conferred by section 52 or a power in connection with the
performance of the function of the Commissioner set out in paragraph 28 (1)
(a).
PRIVACY ACT 1988 - SECT 99A
Conduct of directors, servants and agents
SECT
99A. (1) Where, in proceedings for an offence against this Act, it is
necessary to establish the state of mind of a body corporate in relation to
particular conduct, it is sufficient to show:
(a) that the conduct was engaged in by a director, servant or agent of the
body corporate within the scope of his or her actual or apparent authority;
and
(b) that the director, servant or agent had the state of mind.
(2) Any conduct engaged in on behalf of a body corporate by a director,
servant or agent of the body corporate within the scope of his or her actual
or apparent authority is to be taken, for the purposes of a prosecution for an
offence against this Act, to have been engaged in also by the body corporate
unless the body corporate establishes that the body corporate took reasonable
precautions and exercised due diligence to avoid the conduct.
(3) Where, in proceedings for an offence against this Act, it is necessary
to establish the state of mind of a person other than a body corporate in
relation to particular conduct, it is sufficient to show:
(a) that the conduct was engaged in by a servant or agent of the person
within the scope of his or her actual or apparent authority; and
(b) that the servant or agent had the state of mind.
(4) Any conduct engaged in on behalf of a person other than a body corporate
by a servant or agent of a person within the scope of his or her actual or
apparent authority is to be taken, for the purposes of a prosecution for an
offence against this Act, to have been engaged in also by the first-mentioned
person unless the first-mentioned person establishes that the first-mentioned
person took reasonable precautions and exercised due diligence to avoid the
conduct.
(5) Where:
(a) a person other than a body corporate is convicted of an offence; and
(b) the person would not have been convicted of the offence if subsections
(3) and (4) had not been enacted;
the person is not liable to be punished by imprisonment for that offence.
(6) A reference in subsection (1) or (3) to the state of mind of a person
includes a reference to:
(a) the knowledge, intention, opinion, belief or purpose of the person; and
(b) the person's reasons for the intention, opinion, belief or purpose.
(7) A reference in this section to a director of a body corporate includes a
reference to a constituent member of a body corporate incorporated for a
public purpose by a law of the Commonwealth, of a State or of a Territory.
(8) A reference in this section to engaging in conduct includes a reference
to failing or refusing to engage in conduct.
(9) A reference in this section to an offence against this Act includes a
reference to an offence created by section 5, 6, 7 or 7A, or subsection 86
(1), of the Crimes Act 1914, being an offence that relates to this Act.
PRIVACY ACT 1988 - SECT 100
Regulations
SECT
100. The Governor-General may make regulations, not inconsistent with this
Act, prescribing matters:
(a) required or permitted by this Act to be prescribed; or
(b) necessary or convenient to be prescribed for carrying out or giving
effect to this Act.
PRIVACY ACT 1988 - PART X
PART X-AMENDMENTS OF OTHER ACTS
PRIVACY ACT 1988 - SECT 101
Amendments of other Acts
SECT
101. (1) The Acts specified in Schedule 1 are amended as set out in
Schedule 1.
(2) Section 27A of the Freedom of Information Act 1982 as amended by this
Act applies in relation to:
(a) a request that is received after the commencement of this Act; and
(b) a request that was received before that commencement if a decision to
grant access under the Freedom of Information Act 1982 to the document to
which the request related had not been made before that commencement by the
officer or Minister dealing with the request or a person reviewing, under
section 54 of that Act, a decision refusing to grant that access.
PRIVACY ACT 1988 - SCHEDULE 1
SCH
SCHEDULE 1 Section 101
AMENDMENTS OF OTHER ACTS
Freedom of Information Act 1982*2*
* * * * *
Human Rights and Equal Opportunity Commission Act 1986*3*
* * * * *
Merit Protection (Australian Government Employees) Act 1984*4*
* * * * *
Ombudsman Act 1976
After subsection 6 (4):
Insert the following subsections:
"(4A) Where, before the Ombudsman commences, or after the
Ombudsman has commenced, to investigate action taken by a
Department or by a prescribed authority, being action that is
the subject matter of a complaint, the Ombudsman becomes of the
opinion that:
(a) a complaint with respect to the action has been, or
could have been, made by the complainant to the Privacy
Commissioner under Part V of the Privacy Act 1988; and
(b) the action could be more conveniently or effectively dealt with
by the Privacy Commissioner;
the Ombudsman may decide not to investigate the action, or not to
investigate the action further, as the case may be, and, if the
Ombudsman so decides, the Ombudsman shall:
(c) transfer the complaint to the Privacy Commissioner;
(d) forthwith give notice in writing to the complainant stating
that the complaint has been so transferred; and
(e) give to the Privacy Commissioner any information or documents
that relate to the complaint and are in the possession, or under the
control, of the Ombudsman.
"(4B) A complaint transferred under subsection (4A) shall be deemed
to be a complaint made to the Privacy Commissioner under Part V of
the Privacy Act 1988.
"(4C) In subsections (4A) and (4B), 'Privacy Commissioner' means
the Privacy Commissioner within the meaning of the Privacy Act
1988.".
After subsection 35 (6):
Insert the following subsection:
"(6A) Subsection (2) does not prevent the Ombudsman, or
an
officer acting on behalf of the Ombudsman, from giving information or
documents under paragraph 6 (4A) (e).".
*2* Section 101-The amendments made by section 101 have been incorporated in
the reprint of the Freedom of Information Act 1982, which is published
separately.
*3* Section 101-The amendments made by section 101 have been incorporated in
the reprint of the Human Rights and Equal Opportunity Commission Act 1986,
which is published separately.
*4* Section 101-The amendments made by section 101 have been incorporated in
the reprint of the Merit Protection (Australian Government Employees) Act
1984, which is published separately.
PRIVACY ACT 1988 - SCHEDULE 2
SCH
SCHEDULE 2 Section 17
INTERIM GUIDELINES CONCERNING THE COLLECTION, STORAGE, USE
AND SECURITY OF TAX FILE NUMBER INFORMATION
INTRODUCTION
A breach of these guidelines amounts to an interference with
the privacy of an individual giving rise to a right to complain
to the Privacy Commissioner and a right to seek compensation.
1. GENERAL
1.1 The tax file number is not to be used as a national
identification system by whatever means.
1.2 Tax file number recipients shall not collect, record, use or
disclose tax file number information in an unauthorised manner and,
in particular, shall not act in an unauthorised manner to use tax
file number information as a means of matching personal information
about a person.
1.3 The Commissioner of Taxation shall publicise in a generally
available publication information relating to:
(a) the persons or bodies who are authorised by law to require or
request another person to quote that person's tax file number;
(b) the specific purposes for which such a requirement or request
may be made;
(c) the prohibitions on the use and disclosure of tax file number
information; and
(d) the penalties that apply to unauthorised acts and
practices in relation to tax file number information;
together with information as to where detailed particulars relating
to these matters can be obtained.
2. COLLECTION OF TAX FILE NUMBER INFORMATION
2.1 Tax file number recipients shall take all reasonable
steps in the
circumstances to ensure that staff whose duties include
collecting tax file
number information are informed of:
(a) the circumstances in which tax file number information
may be collected;
(b) the need to protect the privacy of the person to whom
that information relates; and
(c) the penalties that apply to unauthorised acts and
practices in relation to tax file number information.
2.2 Tax file number recipients collecting tax file number
information shall take all reasonable steps in the circumstances
to ensure that the manner of collection takes account of the
rights of persons to control the accumulation and dissemination
of information relating to themselves.
3. STORAGE AND SECURITY OF TAX FILE NUMBER INFORMATION
3.1 Tax file number recipients shall take all reasonable steps in the
circumstances to:
(a) introduce information handling procedures to protect
the privacy of individuals in relation to their tax file number
information;
(b) make staff aware of the rights of individuals to
privacy in relation to their tax file number information; and
(c) make staff aware of the penalties relating to unauthorised acts
and practices in relation to such information.
3.2 Tax file number recipients holding tax file number information
shall take all reasonable steps in the circumstances to ensure that
security safeguards and procedures are in place to prevent
unauthorised access to, modification or disclosure of, and loss of,
such information, whether that information is stored in physical or
electronic form.
3.3 Tax file number recipients shall take all reasonable steps in the
circumstances to ensure that access to records which contain tax file
number information for authorised purposes is confined to persons who
have a need for access to such information for the purpose of
carrying out tax-related functions of the tax file number recipient.
4. USE AND DISCLOSURE OF TAX FILE NUMBER INFORMATION
4.1 Tax file number recipients shall take all reasonable steps in the
circumstances to ensure that staff with access to tax file number
information are informed of the prohibitions on the use and
disclosure of such information and of the penalties that apply to
breach of those prohibitions.
4.2 Tax file number recipients shall not use tax file number
information for other than authorised purposes.
4.3 Without limiting the application of 4.2 to any other
circumstances:
(a) an employer or investment body shall not use a tax file
number for the purposes of building up a database on individuals
for its own purposes;
(b) an employer or investment body shall not cross-match tax file
number information with other information held about a person to
carry out activities which do not relate to obligations under a
taxation law; and
(c) Government agencies, including the Commissioner of
Taxation, shall not directly or indirectly disclose tax file
number information or use tax file number information to
cross-match information about a person, except in authorised
circumstances, for example, disclosure to an agency or person in
specified cases expressly approved by the Parliament under
sections 16 and 16A of the Income Tax Assessment Act 1936
or otherwise.
5. PUBLICITY
5.1 Publication by the Commissioner of Taxation pursuant to
guideline 1.3 shall be made prior to any obligation to quote a tax
file number arising as a result of the Taxation Laws Amendment (Tax
File Numbers) Act 1988.
6. CESSATION OF EMPLOYMENT AND INVESTMENT
6.1 Tax file number recipients shall destroy tax file number
information held by them as employers or as investment bodies in
relation to their former employees/investors in accordance with
guidelines issued by the Privacy Commissioner.
7. MEANING OF TERMS IN INTERIM GUIDELINES
7.1 "Tax file number recipient" means file number recipient.
7.2 "Investment body" means a person who is an investment body for
the purposes of Part VA of the Income Tax Assessment Act 1936.
7.3 "Employer" means an employer to whom a person may quote a tax
file number in relation to their employment.