Information Privacy Act 2014

1.1 The object of this TPP is to ensure that public sector agencies manage personal information in an open and transparent way.

Compliance with the TPPs etc

1.2 A public sector agency must take reasonable steps to implement practices, procedures and systems relating to the agency’s functions or activities that—

will ensure that the agency complies with the TPPs and any TPP code that binds the agency; and

will enable the agency to deal with inquiries or complaints from individuals about the agency’s compliance with the TPPs or a code.

TPP privacy policy

1.3 A public sector agency must have a clearly expressed and up‑to‑date policy (the TPP privacy policy) about the management of personal information by the agency.

1.4 Without limiting TPP 1.3, the TPP privacy policy of the public sector agency must contain the following information:

the kinds of personal information that the agency collects and holds;

how the agency collects and holds personal information;

the purposes for which the agency collects, holds, uses and discloses personal information;

how an individual may access personal information about the individual that is held by the agency and seek the correction of the information;

how an individual may complain about a breach of the TPPs, or any TPP code that binds the agency, and how the agency will deal with the complaint;

whether the agency is likely to disclose personal information to overseas recipients;

if the agency is likely to disclose personal information to overseas recipients—the countries in which the recipients are likely to be located if it is practicable to state those countries in the policy.

Availability of TPP privacy policy etc

1.5 A public sector agency must take reasonable steps to make its TPP privacy policy available—

free of charge; and

in an appropriate form.

Example

on the agency’s website

1.6 If a person requests a copy of the TPP privacy policy of a public sector agency in a particular form, the agency must take reasonable steps to give the person a copy in that form.

Note Person includes a reference to a corporation as well as an individual (see Legislation Act, s 160).

Personal information other than sensitive information

3.1 A public sector agency must not collect personal information (other than sensitive information) unless the information is reasonably necessary for, or directly related to, 1 or more of the agency’s functions or activities.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 3, s 3.2).

Sensitive information

3.3 A public sector agency must not collect sensitive information about an individual unless—

the individual consents to the collection of the information and the information is reasonably necessary for, or directly related to, 1 or more of the agency’s functions or activities; or

TPP 3.4 applies in relation to the information.

Note The equivalent provision in the Commonwealth APPs also applies to certain private sector entities (see Commonwealth APP 3, s 3.3 (a) (ii)).

3.4 This subsection applies in relation to sensitive information about an individual if—

the collection of the information is required or authorised by or under an Australian law or a court or tribunal order; or

a permitted general situation exists in relation to the collection of the information by the public sector agency; or

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 3, s 3.4 (c)).

the public sector agency is an enforcement body and the agency reasonably believes that the collection of the information is reasonably necessary for, or directly related to, 1 or more of the agency’s functions or activities.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to—

 the Commonwealth Immigration Department (see Commonwealth APP 3, s 3.4 (d) (i)); and

 non-profit organisations (see Commonwealth APP 3, s 3.4 (e)).

Means of collection

3.5 A public sector agency must collect personal information only by lawful and fair means.

3.6 A public sector agency must collect personal information about an individual only from the individual unless—

either—

the individual consents to the collection of the information from someone other than the individual; or

the agency is required or authorised by or under an Australian law, or a court or tribunal order, to collect the information from someone other than the individual; or

it is unreasonable or impracticable to do so.

Note The equivalent provision in the Commonwealth APPs applies, in part, to certain private sector entities.

Solicited personal information

3.7 TPP 3 applies to the collection of personal information that is solicited by a public sector agency.

4.1 If—

a public sector agency receives personal information; and

the agency did not solicit the information;

the agency must, within a reasonable period after receiving the information, decide whether or not the agency could have collected the information under TPP 3 if the agency had solicited the information.

4.2 The public sector agency may use or disclose the personal information for the purposes of making the decision under TPP 4.1.

4.3 If—

the public sector agency decides that the agency could not have collected the personal information; and

the information is not contained in a territory record;

the agency must, as soon as practicable but only if it is lawful and reasonable to do so, destroy the information or ensure that the information is de-identified.

4.4 If TPP 4.3 does not apply in relation to the personal information, TPPs 5 to 13 apply in relation to the information as if the agency had collected the information under TPP 3.

5.1 At or before the time or, if that is not practicable, as soon as practicable after, a public sector agency collects personal information about an individual, the agency must take reasonable steps—

to notify the individual of the matters mentioned in TPP 5.2 that are reasonable in the circumstances; or

to otherwise ensure that the individual is aware of those matters.

5.2 The matters for TPP 5.1 are as follows:

the identity and contact details of the public sector agency;

if—

the public sector agency collects the personal information from someone other than the individual; or

the individual may not be aware that the public sector agency has collected the personal information;

the fact that the agency collects, or has collected, the information and the circumstances of that collection;

if the collection of the personal information is required or authorised by or under an Australian law, or a court or tribunal order—the fact that the collection is required or authorised (including the name of the Australian law, or details of the court or tribunal order, that requires or authorises the collection);

the purposes for which the public sector agency collects the personal information;

the main consequences (if any) for the individual if all or some of the personal information is not collected by the public sector agency;

any other public sector agency or entity, or the kinds of any other public sector agencies or entities, to which the public sector agency usually discloses personal information of the kind collected by the agency;

that the TPP privacy policy of the public sector agency contains information about how the individual may access the personal information about the individual that is held by the agency and seek the correction of the information;

that the TPP privacy policy of the public sector agency contains information about how the individual may complain about a breach of the TPPs, or any TPP code that binds the agency, and how the agency will deal with the complaint;

whether the public sector agency is likely to disclose the personal information to overseas recipients;

if the public sector agency is likely to disclose the personal information to overseas recipients—the countries in which the recipients are likely to be located if it is practicable to state those countries in the notification or to otherwise make the individual aware of them.

Part 1.3 Dealing with personal information

Use or disclosure

6.1 If a public sector agency holds personal information about an individual that was collected for a particular purpose (the primary purpose), the agency must not use or disclose the information for another purpose (the secondary purpose) unless—

the individual has consented to the use or disclosure of the information; or

TPP 6.2 or TPP 6.3 applies in relation to the use or disclosure of the information.

Note TPP 8 sets out requirements for the disclosure of personal information to a person who is not in Australia or an external territory.

6.2 This subsection applies in relation to the use or disclosure of personal information about an individual if—

the individual would reasonably expect the public sector agency to use or disclose the information for the secondary purpose and the secondary purpose is—

if the information is sensitive information—directly related to the primary purpose; or

if the information is not sensitive information—related to the primary purpose; or

the use or disclosure of the information is required or authorised by or under an Australian law or a court or tribunal order; or

a permitted general situation exists in relation to the use or disclosure of the information by the public sector agency; or

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 6, s 6.2 (d)).

the public sector agency reasonably believes that the use or disclosure of the information is reasonably necessary for 1 or more enforcement-related activities conducted by, or on behalf of, an enforcement body.

6.3 This subsection applies in relation to the disclosure of personal information about an individual by a public sector agency if—

the agency is not an enforcement body; and

the information is biometric information or biometric templates; and

the recipient of the information is an enforcement body; and

the disclosure is conducted in accordance with the guidelines made by the information privacy commissioner for this subsection.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 6, s 6.4).

Written note of use or disclosure

6.5 If a public sector agency uses or discloses personal information in accordance with TPP 6.2 (e), the agency must make a written note of the use or disclosure.

Related bodies corporate

6.6 If—

a public sector agency is a corporation; and

the agency collects personal information from a related body corporate;

this TPP applies as if the agency’s primary purpose for the collection of the information were the primary purpose for which the related body corporate collected the information.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 6, s 6.7).

Note 1 The Commonwealth Act includes a privacy principle prohibiting direct marketing by certain private sector entities (see Commonwealth APP 7).

Note 2 However, Commonwealth APP 7 applies to an act or practice of a public sector agency if the agency engages in commercial activities (see s 23).

8.1 Before a public sector agency discloses personal information about an individual to a person (an overseas recipient)—

who is not in Australia or an external territory; and

who is not the agency or the individual;

the agency must take reasonable steps to ensure that the overseas recipient does not breach the TPPs (other than TPP 1) in relation to the information.

Note In certain circumstances, an act done, or a practice engaged in, by an overseas recipient is taken, under s 22, to have been done, or engaged in, by the public sector agency and to be a breach of the TPPs.

8.2 TPP 8.1 does not apply to the disclosure of personal information about an individual by a public sector agency to the overseas recipient if—

the agency reasonably believes that—

the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the TPPs protect the information; and

there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme; or

both of the following apply:

the agency expressly informs the individual that if the individual consents to the disclosure of the information, TPP 8.1 will not apply to the disclosure;

after being informed, the individual consents to the disclosure; or

the disclosure of the information is required or authorised by or under an Australian law, or a court or tribunal order; or

a permitted general situation (other than the situation mentioned in section 19 (1) (d) or (e)) exists in relation to the disclosure of the information by the agency; or

the disclosure of the information is required or authorised by or under an international agreement relating to information sharing to which Australia or the Territory is a party; or

both of the following apply:

the agency reasonably believes that the disclosure of the information is reasonably necessary for 1 or more enforcement-related activities conducted by, or on behalf of, an enforcement body;

the recipient is a body that exercises functions that are similar to those exercised by an enforcement body.

Note 1 The Commonwealth Act includes a privacy principle regulating the adoption, use or disclosure of government-related identifiers by certain private sector entities (see Commonwealth APP 9).

Note 2 However, Commonwealth APP 9 applies to an act or practice of a public sector agency if the agency engages in commercial activities (see s 23).

Part 1.4 Integrity of personal information

10.1 A public sector agency must take reasonable steps to ensure that the personal information that the agency collects is accurate, up‑to‑date and complete.

10.2 A public sector agency must take reasonable steps to ensure that the personal information that the agency uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up‑to‑date, complete and relevant.

11.1 If a public sector agency holds personal information, the agency must take reasonable steps to protect the information—

from misuse, interference or loss; and

from unauthorised access, modification or disclosure.

11.2 If—

a public sector agency holds personal information about an individual; and

the agency no longer needs the information for a purpose for which the information may be used or disclosed by the agency under the TPPs; and

the information is not contained in a territory record; and

the agency is not required by or under an Australian law, or a court or tribunal order, to retain the information;

the agency must take reasonable steps to destroy the information or to ensure that the information is de-identified.

Part 1.5 Access to, and correction of, personal information

Access

12.1 If a public sector agency holds personal information about an individual, the agency must, on request by the individual, give the individual access to the information.

Exception to access—agency

12.2 If the public sector agency is required or authorised to refuse to give the individual access to the personal information by or under—

the Freedom of Information Act 2016; or

another law in force in the ACT that provides for access by people to documents;

then, despite TPP 12.1, the agency is not required to give access to the extent that the agency is required or authorised to refuse to give access.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 12, s 12.3).

Dealing with requests for access

12.4 The public sector agency must—

respond to the request for access to the personal information within 30 days after the day the request is made; and

give access to the information in the way requested by the individual, if it is reasonable and practicable to do so.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 12, s 12.4 (a) (ii)).

Other means of access

12.5 If the public sector agency refuses—

to give access to the personal information because of TPP 12.2; or

to give access in the way requested by the individual;

the agency must take reasonable steps to give access in a way that meets the needs of the agency and the individual.

12.6 Without limiting TPP 12.5, access may be given through the use of a mutually agreed intermediary.

Access charges

12.7 The public sector agency must not charge the individual for the making of the request or for giving access to the personal information.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 12, s 12.8).

Refusal to give access

12.9 If the public sector agency refuses to give access to the personal information because of TPP 12.2, or to give access in the way requested by the individual, the agency must give the individual a written notice that sets out—

the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and

the mechanisms available to complain about the refusal; and

any other matter prescribed by regulation.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 12, s 12.10).

Correction

13.1 If—

a public sector agency holds personal information about an individual; and

either—

the agency is satisfied that, having regard to a purpose for which the information is held, the information is inaccurate, out‑of‑date, incomplete, irrelevant or misleading; or

the individual requests the agency to correct the information;

the agency must take reasonable steps to correct the information to ensure that, having regard to the purpose for which it is held, the information is accurate, up‑to‑date, complete, relevant and not misleading.

Notification of correction to third parties

13.2 If—

the public sector agency corrects personal information about an individual that the agency previously disclosed to another public sector agency; and

the individual requests the agency to notify the other public sector agency of the correction;

the agency must take reasonable steps to give the notification unless it is impracticable or unlawful to do so.

Refusal to correct information

13.3 If the public sector agency refuses to correct the personal information as requested by the individual, the agency must give the individual a written notice that sets out—

the reasons for the refusal except to the extent that it would be unreasonable to do so; and

the mechanisms available to complain about the refusal; and

any other matter prescribed by regulation.

Request to associate a statement

13.4 If—

the public sector agency refuses to correct the personal information as requested by the individual; and

the individual requests the agency to associate with the information a statement that the information is inaccurate, out‑of‑date, incomplete, irrelevant or misleading;

the agency must take reasonable steps to associate the statement in a way that will make the statement apparent to users of the information.

Dealing with requests

13.5 If a request is made under TPP 13.1 or TPP 13.4, the public sector agency—

must respond to the request within 30 days after the day the request is made; and

must not charge the individual for the making of the request, for correcting the personal information or for associating the statement with the personal information.

Note The equivalent provision in the Commonwealth APPs includes a provision applying to certain private sector entities (see Commonwealth APP 13, s 13.5 (a) (ii)).

Dictionary

(see s 3)

Note 1 The Legislation Act contains definitions and other provisions relevant to this Act.

Note 2 For example, the Legislation Act, dict, pt 1, defines the following terms:

 ACT

 administrative unit

 Coroner’s Court

 corporation

 Corporations Act

 document

 DPP

 exercise (a function)

 external territory

 function

 human rights commission

 individual

 integrity commission

 judge

 magistrate

 Magistrates Court

 Minister (see s 162)

 Office of the Legislative Assembly

 officer of the Assembly

 State

 statutory office-holder

 Supreme Court

 territory authority

 territory instrumentality

 tribunal

 working day.

act—see section 10.

ACT court—

means the Supreme Court, Magistrates Court, Coroner’s Court or a tribunal; and

includes a judge, magistrate, tribunal member and any other person exercising a function of the court or tribunal in relation to the hearing or determination of a matter before it.

Australian law, for schedule 1 (Territory privacy principles)—see section 14.

breach, a TPP—see section 12.

collects, personal information, for schedule 1 (Territory privacy principles)—see section 15.

Commonwealth Act means the Privacy Act 1988 (Cwlth).

Commonwealth APPs means the Australian privacy principles set out in the Commonwealth Act, schedule 1.

complainant, in relation to a privacy complaint—see section 33.

conciliation, of a privacy complaint, for division 6.3A (Conciliation of privacy complaints)—see section 44A.

conciliation agreement, for division 6.3A (Conciliation of privacy complaints)—see section 44F (1).

consent means express or implied consent.

contracted service provider—

means a person engaged under a government contract to provide services to the Territory or a public sector agency; and

includes a subcontractor in relation to the contract.

court or tribunal order, for schedule 1 (Territory privacy principles)—see section 14.

de-identified, personal information, for schedule 1 (Territory privacy principles)—see section 18.

doing, an act—see section 10 (2).

enforcement body, for schedule 1 (Territory privacy principles)—see section 14.

enforcement-related activity, for schedule 1 (Territory privacy principles)—see section 14.

generally available publication means a magazine, book, article, newspaper or other publication that is, or will be, generally available to members of the public—

whether or not it is published in print, electronically or in any other form; and

whether or not it is available on the payment of a fee.

government contract means a contract, to which the Territory or a public sector agency is a party, under which services are to be provided to—

the Territory or agency; or

another entity in relation to the exercise of the agency’s functions.

holds, personal information, for schedule 1 (Territory privacy principles)—see section 16.

information privacy commissioner means—

the Information Privacy Commissioner appointed under section 26; or

if an appointment is not made under section 26, the person exercising 1 or more functions under an arrangement mentioned in section 28.

interference, with an individual’s privacy—see section 11.

misconduct, of a person includes fraud, negligence, default, breach of trust, breach of duty, breach of discipline by or any other misconduct of the person in the exercise of the person’s functions as a public official.

overseas recipient, in relation to personal information—see TPP 8.1.

parties, to the conciliation of a privacy complaint, for division 6.3A (Conciliation of privacy complaints)—see section 44A.

permitted general situation, in relation to the collection, use or disclosure of personal information, for schedule 1 (Territory privacy principles)—see section 19.

personal information—see section 8.

practice—see section 10.

privacy complaint—see section 33.

public sector agency—see section 9.

record—

includes—

a document; or

an electronic or other device; and

does not include—

a generally available publication; or

anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or

a record open to public access under the Territory Records Act 2002, part 3; or

a letter or other item in the course of being sent by post.

Note Document—see the Legislation Act, dictionary, pt 1.

related body corporate, for schedule 1 (Territory privacy principles)—see the Corporations Act, section 9.

respondent, in relation to a privacy complaint—see section 33.

sensitive information, for schedule 1 (Territory privacy principles)—see section 14.

solicits, personal information, for schedule 1 (Territory privacy principles)—see section 17.

subcontractor, in relation to a government contract—see section 21 (4) (Privacy protection requirements for government contracts).

territory record, for schedule 1 (Territory privacy principles)—see the Territory Records Act 2002, section 9 (3).

TPP code—see section 49.

TPP privacy policy, for schedule 1 (Territory privacy principles)—see TPP 1.3.

TPPs—see section 13 (Territory privacy principles).