1Purposes

The purposes of this Act are—

(a)

to provide for responsible collection and handling of personal information in the Victorian public sector; and

(b)

to provide remedies for interferences with the information privacy of an individual; and

(c)

to establish a protective data security regime for the Victorian public sector; and

(d)

to establish a regime for monitoring and assuring public sector data security; and

S. 1(e) substituted by No. 20/2017 s. 78.

(e)

to provide for the appointment of the Privacy and Data Protection Deputy Commissioner; and

(f) to repeal the Information Privacy Act 2000 and the Commissioner for Law Enforcement Data Security Act 2005 and make consequential amendments to other Acts.

2Commencement

(1)

Subject to this section, this Act comes into operation on a day or days to be proclaimed.

(2)

Division 1 of Part 9 comes into operation on the later of—

(a)

the day after the day on which this Act receives the Royal Assent; and

(b)

the day on which section 278 of the Victoria Police Act 2013 comes into operation.

(3)

Division 2 of Part 9 comes into operation on the later of—

(a)

the day after the day on which this Act receives the Royal Assent; and

(b)

the day on which section 157 of the Legal Profession Uniform Law Application Act 2014 comes into operation.

(4)

If a provision of this Act (other than a provision referred to in subsection (2) or (3)) does not come into operation before 9 December 2014, it comes into operation on that day.

3Definitions

In this Act—

applicable code of practice, in relation to an organisation, means an approved code of practice by which the organisation is bound;

approved code of practice means a code of practice approved under Division 3 of Part 3 as amended and in operation for the time being;

approved information usage arrangement means an information usage arrangement approved under Division 6 of Part 3;

S. 3 def. of authorised legal representative inserted by No. 11/2021 s. 164.

authorised legal representative of a person means an Australian legal practitioner who has been instructed by a person to receive documents on the person's behalf;

body means body (whether incorporated or not);

S. 3 def. of Chief Commis-sioner of Police amended by No. 60/2014 s. 129(a).

Chief Commissioner of Police means the Chief Commissioner of Police appointed under section 17 of the Victoria Police Act 2013;

Chief Statistician means the person employed as the Chief Statistician under section 4 of the Crime Statistics Act 2014;

child means a person under the age of 18 years;

S. 3 def. of Commis-sioner repealed by No. 20/2017 s. 79(b).

* * * * *

Commonwealth-regulated organisation means an agency within the meaning of the Privacy Act 1988 of the Commonwealth and to which that Act applies;

consent means express consent or implied consent;

contracted service provider means a person or body who provides services under a State contract;

correct, in relation to personal information, means alter that information by way of amendment, deletion or addition;

S. 3 def. of Council amended by No. 9/2020 s. 390(Sch. 1 item 80).

Council has the same meaning as in the Local Government Act 2020;

crime statistics data means—

(a)

any law enforcement data obtained by the Chief Statistician from the Chief Commissioner of Police under section 7 of the Crime Statistics Act 2014; or

(b)

any information derived from data referred to in paragraph (a) by the Chief Statistician or an employee or consultant referred to in section 6 of the Crime Statistics Act 2014 in the performance of functions under that Act, other than information published by the Chief Statistician under section 5(1)(a) of that Act;

crime statistics data system means a database kept by the Chief Statistician (whether in computerised or other form and however described) containing crime statistics data;

current certificate means a certificate issued under section 55(1) that has not expired or been set aside;

data security standards means—

(a)

protective data security standards; or

(b)

law enforcement data security standards;

de-identified, in relation to personal information, means personal information that no longer relates to an identifiable individual or an individual who can be reasonably identified;

enactment means an Act or a Commonwealth Act or an instrument of a legislative character made under an Act or a Commonwealth Act;

Federal Privacy Commissioner means the Privacy Commissioner appointed under the Australian Information Commissioner Act 2010 of the Commonwealth;

generally available publication means a publication (whether in paper or electronic form) that is generally available to members of the public and includes information held on a public register;

handling, in relation to personal information, means collection, holding, management, use, disclosure or transfer of personal information;

IBAC means the Independent Broad-based Anti-corruption Commission established under section 12 of the Independent Broad-based Anti-corruption Commission Act 2011;

illness means a physical, mental or emotional illness, and includes a suspected illness;

S. 3 def. of Information Commis-sioner inserted by No. 20/2017 s. 79(a).

Information Commissioner means the Information Commissioner appointed under section 6C of the Freedom of Information Act 1982;

information handling provision means a provision of an Act that permits handling of personal information—

(a)

as authorised or required by law or by or under an Act; or

(b)

in circumstances or for purposes required by law or by or under an Act;

Information Privacy Principle means any of the Information Privacy Principles set out in Schedule 1;

information usage arrangement has the meaning given by section 45;

S. 3 def. of Integrity Oversight Victoria inserted by No. 31/2024 s. 113(Sch. 1 item 26.1(a)).

Integrity Oversight Victoria has the same meaning as in the Integrity Oversight Victoria Act 2011;

IPP means Information Privacy Principle;

S. 3 def. of law enforcement agency amended by Nos 60/2014 s. 129(b), 29/2016 s. 111, 57/2017 s. 50, 27/2018 s. 362, 31/2024 ss 51, 113(Sch. 1 item 26.1(b)).

law enforcement agency means—

(a)

Victoria Police; or

(b)

the police force or police service of another State or a Territory; or

(c)

the Australian Federal Police; or

(d)

the Australian Crime Commission established under section 7 of the Australian Crime Commission Act 2002 of the Commonwealth; or

(e)

the Commissioner appointed under section 8A of the Corrections Act 1986; or

(ea)

the Director, Fines Victoria employed under section 4 of the Fines Reform Act 2014;

(f)

the Business Licensing Authority established under Part 2 of the Business Licensing Authority Act 1998; or

(g)

a commission established by a law of Victoria or the Commonwealth or of any other State or a Territory with the function of investigating matters relating to criminal activity generally or of a specified class or classes; or

(h)

the Chief Examiner and Examiners appointed under Part 3 of the Major Crime (Investigative Powers) Act 2004; or

(i)

the IBAC; or

(j)

the sheriff within the meaning of the Sheriff Act 2009; or

(k)

Integrity Oversight Victoria; or

(l)

the Adult Parole Board established by section 61 of the Corrections Act 1986; or

(la)

the Post Sentence Authority continued in existence by section 290 of the Serious Offenders Act 2018; or

(m)

the Youth Parole Board within the meaning of the Children, Youth and Families Act 2005; or

(ma)

the Victorian Legal Services Board within the meaning of the Legal Profession Uniform Law Application Act 2014; or

(mb)

the Victorian Legal Services Commissioner within the meaning of the Legal Profession Uniform Law Application Act 2014; or

(n)

an agency responsible for the performance of functions or activities directed to—

(i)

the prevention, detection, investigation, prosecution or punishment of criminal offences or breaches of a law imposing a penalty or sanction for a breach; or

(ii)

the management of property seized or restrained under laws relating to the confiscation of the proceeds of crime or the enforcement of such laws, or of orders made under such laws; or

(o)

an agency responsible for the execution or implementation of an order or decision made by a court or tribunal; or

(p)

an agency that provides correctional services, including a contractor within the meaning of the Corrections Act 1986, or a subcontractor of that contractor, but only in relation to a function or duty or the exercise of a power conferred on it by or under that Act; or

(q)

an agency responsible for the protection of the public revenue under a law administered by it;

S. 3 def. of law enforcement data amended by No. 60/2014 s. 129(c).

law enforcement data means any information obtained, received or held by Victoria Police—

(a)

for the purpose of one or more of its, or any other law enforcement agency's law enforcement functions or activities; or

(b)

for the enforcement of laws relating to the confiscation of the proceeds of crime; or

(c)

in connection with the conduct of proceedings commenced, or about to be commenced, in any court or tribunal; or

(d)

for the purposes of its community policing functions;

S. 3 def. of law enforcement data security standards amended by No. 20/2017 s. 106(1)(a).

law enforcement data security standards means the standards issued, amended or reissued by the Information Commissioner under section 92;

S. 3 def. of law enforcement data system amended by No. 60/2014 s. 129(d).

law enforcement data system means a database kept by Victoria Police (whether in computerised or other form and however described) containing law enforcement data;

S. 3 def. of legal practitioner inserted by No. 20/2017 s. 79(a).

legal practitioner means an Australian legal practitioner;

S. 3 def. of member of staff inserted by No. 20/2017 s. 79(a).

member of staff, of the Office of the Victorian Information Commissioner, means a person employed or engaged under section 6Q of the Freedom of Information Act 1982;

S. 3 def. of notice to produce or attend inserted by No. 20/2017 s. 79(a).

notice to produce or attend means a notice issued under section 68 or 79, and includes a notice as varied under section 83B;

S. 3 def. of Office of the Victorian Information Commis-sioner inserted by No. 20/2017 s. 79(a).

Office of the Victorian Information Commissioner means the Office of the Victorian Information Commissioner established under the Freedom of Information Act 1982;

organisation means a person or body to which Part 3 applies under section 13;

parent, in relation to a child, includes—

(a)

the father and mother of the child; and

(b)

the spouse of the father or mother of the child; and

(c)

the domestic partner of the father or mother of the child; and

(d)

a person who has custody of the child; and

(e)

a person whose name is entered as the parent of the child in the register of births in the Register maintained by the Registrar of Births, Deaths and Marriages under Part 7 of the Births, Deaths and Marriages Registration Act 1996; and

(f)

a person who acknowledges that they are the parent of the child by an instrument of the kind described in section 8(2) or (2A) of the Status of Children Act 1974; and

(g)

a person in respect of whom a court has made a declaration or a finding or order that the person is the parent of the child;

personal information means information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the Health Records Act 2001 applies;

personal privacy means privacy of personal information;

S. 3 def. of Privacy and Data Protection Deputy Commis-sioner inserted by No. 20/2017 s. 79(a).

Privacy and Data Protection Deputy Commissioner means the Privacy and Data Protection Deputy Commissioner appointed under section 8H;

protective data security plan means a plan prepared under section 89;

S. 3 def. of protective data security standards amended by No. 20/2017 s. 106(1)(b).

protective data security standards means the standards issued by the Information Commissioner under section 86 or amended or reissued under section 87;

public interest determination means a determination made under section 31;

public register means a document held by a public sector agency or a Council and open to inspection by members of the public (whether or not on payment of a fee) under an Act or regulation (other than the Freedom of Information Act 1982 or the Public Records Act 1973) containing information that—

(a)

a person or body was required or permitted to give to that public sector agency or Council under an Act or regulation; and

(b)

would be personal information if the document were not a generally available publication;

public sector agency means a public service body or a public entity within the meaning of the Public Administration Act 2004;

public sector body Head has the meaning given in the Public Administration Act 2004;

public sector data means any information (including personal information) obtained, received or held by an agency or body to which Part 4 applies, whether or not the agency or body obtained, received or holds that information in connection with the functions of that agency or body;

public sector data system includes—

(a)

information technology for storage of public sector data, including hardware and software; and

(b)

non-electronic means for storage of public sector data; and

(c)

procedures for dealing with public sector data, including by use of information technology and non-electronic means;

public service body Head has the meaning given in the Public Administration Act 2004;

State contract means a contract between an organisation, or a person, agency or body to which Part 4 or 5 of this Act applies, and another person or body (whether or not this Act or a Part of this Act applies to the person or body) under which services are provided to one party (the outsourcing party) by the other party (the contracted service provider) in connection with the performance of the functions of the outsourcing party, including services that the outsourcing party provides to other persons or bodies;

temporary public interest determination means a temporary public interest determination made under section 39;

third party, in relation to personal information, means a person or body other than the organisation holding the information and the individual to whom the information relates;

S. 3 def. of Victorian Inspectorate repealed by No. 31/2024 s. 113(Sch. 1 item 26.1(c)).

* * * * *

Victorian protective data security framework means the Victorian protective data security framework developed under section 85.

4Interpretation

(1)

For the purposes of this Act, an organisation holds personal information if the information is contained in a document that is in the possession or under the control of the organisation, whether alone or jointly with other persons or bodies, irrespective of where the document is situated, whether in or outside Victoria.

(2)

If a provision of this Act refers to an IPP by a number, the reference is a reference to the IPP designated by that number.

(3)

A reference in this Act to a contracted service provider is a reference to a person or body in the capacity of contracted service provider and includes a reference to a subcontractor of the contracted service provider (or of another such subcontractor) for the purposes (whether direct or indirect) of the State contract.

(4)

Without limiting section 37(a) of the Interpretation of Legislation Act 1984, a reference in this Act to an organisation using a neuter pronoun includes a reference to an organisation that is an individual, unless the contrary intention appears.

5Objects

The objects of this Act are—

(a)

to balance the public interest in the free flow of information with the public interest in protecting the privacy of personal information in the public sector; and

(b)

to balance the public interest in promoting open access to public sector information with the public interest in protecting its security; and

(c)

to promote awareness of responsible personal information handling practices in the public sector; and

(d)

to promote the responsible and transparent handling of personal information in the public sector; and

(e)

to promote responsible data security practices in the public sector.

6Relationship of this Act to other laws

(1)

If a provision made by or under this Act (other than Division 5, 6 or 7 of Part 3) relating to an Information Privacy Principle or applicable code of practice is inconsistent with a provision made by or under any other Act, that other provision prevails and the provision made by or under this Act is (to the extent of the inconsistency) of no force or effect.

(2)

Without limiting subsection (1), nothing in this Act affects the operation of the Freedom of Information Act 1982 or any right, privilege, obligation or liability conferred or imposed under that Act or any exemption arising under that Act.

7Rights and liabilities

(1)

Nothing in this Act—

(a)

gives rise to any civil cause of action; or

(b)

without limiting paragraph (a), operates to create in any person any legal right enforceable in a court or tribunal—

otherwise than in accordance with the procedures set out in this Act.

(2)

A contravention of this Act does not create any criminal liability except to the extent expressly provided by this Act.

8Act binds the Crown

(1)

This Act binds the Crown in right of Victoria and, so far as the legislative power of the Parliament permits, the Crown in all its other capacities.

(2)

Nothing in this Act makes the Crown in any of its capacities liable to be prosecuted for an offence.

Pt 1A (Headings and ss 8A–8P) inserted by No. 20/2017 s. 80.

8AFunctions of Information Commissioner

(1)

The Information Commissioner has the following functions—

(a)

functions relating to information privacy set out in section 8C;

(b)

functions relating to protective data security and law enforcement data security set out in section 8D;

(c)

functions conferred on the Information Commissioner by or under this Act;

(d)

functions conferred on the Information Commissioner by or under any other Act.

(2)

The Information Commissioner must have regard to the objects of this Act in the performance of the Commissioner's functions and the exercise of the Commissioner's powers under this Act.

(3)

Except where expressly provided in this Act, the Information Commissioner is not subject to the direction or control of the Minister in respect of the performance of the Information Commissioner's duties and functions and the exercise of the Information Commissioner's powers.

S. 8B inserted by No. 20/2017 s. 80.

8BFunctions of Privacy and Data Protection Deputy Commissioner

(1)

The Privacy and Data Protection Deputy Commissioner has the following functions—

(a)

functions relating to information privacy set out in section 8C(2);

(b)

functions relating to protective data security and law enforcement data security set out in section 8D(2);

(c)

any function conferred by the Information Commissioner on the Deputy Commissioner by authorisation under section 8F;

(d)

any other function conferred on the Information Commissioner by or under this Act, except—

(i)

a function of the Information Commissioner referred to in section 8A(1)(d); or

(ii)

a function of the Information Commissioner referred to in section 8C(1) or 8D(1); or

(iii) a function of the Information Commissioner referred to in section 8F; or

(iv)

a function of the Information Commissioner referred to in section 8O; or

(v)

issuing directions under section 8P; or

(vi)

making reports under section 116.

(2)

The Privacy and Data Protection Deputy Commissioner must have regard to the objects of this Act in the performance of the Deputy Commissioner's functions and the exercise of the Deputy Commissioner's powers under this Act.

(3) Except where expressly provided in this Act, the Privacy and Data Protection Deputy Commissioner is not subject to the direction or control of the Minister in respect of the performance of the Deputy Commissioner's duties and functions and the exercise of the Deputy Commissioner's powers.

S. 8C inserted by No. 20/2017 s. 80.

8CInformation privacy functions

(1)

The Information Commissioner has the following functions in relation to information privacy—

(a)

in accordance with Division 3 of Part 3, to undertake activities relating to the development and approval of codes of practice;

(b)

to develop and publish model terms capable of being adopted by an organisation in a contract or arrangement with a recipient of personal information being transferred by the organisation outside Victoria;

(c)

to make public interest determinations and temporary public interest determinations in accordance with Division 5 of Part 3;

(d)

to approve information usage arrangements in accordance with Division 6 of Part 3;

(e)

to examine and assess any proposed legislation that would require or authorise acts or practices of an organisation that may, in the absence of the legislation, be interferences with the privacy of an individual or that may otherwise have an adverse effect on the privacy of an individual, and to report to the Minister the results of the examination and assessment;

(f)

to make public statements in relation to any matter affecting personal privacy or the privacy of any class of individual;

(g)

to issue guidelines and other materials in relation to the Information Privacy Principles and information usage arrangements;

(h)

to undertake reviews of any matters relating to information privacy, as requested by the Minister;

(i)

to make reports or recommendations in relation to information privacy as provided for by section 111.

(2)

The Information Commissioner and the Privacy and Data Protection Deputy Commissioner each have the following functions in relation to information privacy—

(a)

to promote understanding and acceptance of the Information Privacy Principles and of the objects of those Principles;

(b)

to examine the practice of an organisation with respect to personal information maintained by that organisation for the purpose of ascertaining whether or not the information is maintained according to the Information Privacy Principles or any applicable code of practice;

(c)

to issue certificates under Division 7 of Part 3;

(d)

subject to this Act—

(i)

to receive complaints about an act or practice of an organisation; and

(ii)

if appropriate to do so, to endeavour, by conciliation, to effect a settlement of the matters that gave rise to the complaint;

(e)

to issue compliance notices under Division 9 of Part 3 and to carry out an investigation for that purpose;

(f)

to conduct or commission audits of records of personal information maintained by an organisation for the purpose of ascertaining whether the records are maintained according to the Information Privacy Principles or any applicable code of practice;

(g)

to consult and cooperate with persons and bodies concerned with information privacy;

(h)

to undertake research in relation to matters relating to information privacy.

S. 8D inserted by No. 20/2017 s. 80.

Privacy and Data Protection Act 2014

About this Act

Bill & explanatory material

This Act’s bill