All legislation

VICAct

In force

Official source Save

This is the latest official compilation.Check the official source →

Ask a question about this ActPro

About this Act

TypeAct

Provisions190

Official source

Bill & explanatory material

Parliamentary material from legislation.vic.gov.au and the Parliament of Victoria. Links open the official source in a new tab.

Bill homepage (legislation.vic.gov.au)

This Act’s bill

Introduction print — Explanatory memorandum PDF Word

Provisions

Part 1 — Preliminary

s 1Purposes s 2Commencement s 3Definitions s 4Interpretation s 5Objects s 6Relationship of this Act to other laws s 7Rights and liabilities s 8Act binds the Crown

Part 1A — Functions, powers of Information Commissioner and appointment of Privacy and Data Protection Deputy Commissioner

Division 1 — Performance of functions

s 8AFunctions of Information Commissioner s 8BFunctions of Privacy and Data Protection Deputy Commissioner s 8CInformation privacy functions s 8DProtective data security and law enforcement data security functions s 8EPerformance of concurrent functions s 8FInformation Commissioner may confer functions on Privacy and Data Protection Deputy Commissioner s 8GGeneral powers of Information Commissioner and Privacy and Data Protection Deputy Commissioner

Division 2 — Privacy and Data Protection Deputy Commissioner

s 8HAppointment of Privacy and Data Protection Deputy Commissioner s 8ITerms and conditions of appointment of Privacy and Data Protection Deputy Commissioner s 8JRemuneration s 8KVacancy and resignation of Privacy and Data Protection Deputy Commissioner s 8LSuspension and removal from office s 8MActing Privacy and Data Protection Deputy Commissioner s 8NValidity of acts and decisions

Division 3 — General

s 8ODelegation s 8PDirections

Part 2 — Application of this Act

s 9Definition s 10Courts, tribunals etc.s 10ARoyal Commissions etc.s 11Parliamentary Committees s 12Publicly-available information

Part 3 — Information privacy

Division 1 — Application of this Part

s 13Public sector organisations to which this Part applies s 14Exemption—Freedom of Information Act 1982 s 15Exemption—law enforcement s 15AExemption—information sharing under the Family Violence Protection Act 2008 s 15BExemption—information sharing under the Child Wellbeing and Safety Act 2005 s 15CExemption—information sharing for quality and safety purposes under the Health Services Act 1988 s 15DInformation sharing under Division 6 of Part 4A of Terrorism (Community Protection) Act 2003 s 17Effect of outsourcing

Division 2 — Information Privacy Principles

s 18Information Privacy Principles s 19Application of Information Privacy Principles s 20Organisations to comply with Information Privacy Principles

Division 3 — Codes of practice

s 21Codes of practice s 22Process for approval of code of practice or code amendment s 23Organisations bound by code of practice s 24Effect of approved code s 25Codes of practice register s 26Revocation of approval s 27Effect of revocation of approval or amendment or expiry of approved code

Division 4 — Capacity to consent or make a request or exercise right of access

s 28Capacity to consent or make a request or exercise right of access

Division 5 — Public interest determinations and temporary public interest determinations

Subdivision 1 — Public interest determinations

s 29Public interest determination s 30Application taken to be application for temporary public interest determination on request s 31Information Commissioner may make public interest determination s 32Effect of public interest determination s 33Duration of public interest determination s 34Amendment of public interest determination s 35Revocation of public interest determination s 36Reporting and review

Subdivision 2 — Temporary public interest determinations

s 37Temporary public interest determination s 38Application for temporary public interest determination s 39Information Commissioner may make temporary public interest determination s 40Duration of temporary public interest determination s 41Revocation of temporary public interest determination

Subdivision 3 — Disallowance of determinations

s 42Disallowance of determinations

Division 6 — Information usage arrangements

Division 7 — Certification

s 55Information Commissioner may certify consistency of act or practice s 56Review of decision to issue certificate

Division 8 — Information privacy complaints

Subdivision 1 — Making a complaint

s 57Complaints s 58Complaint referred to Information Commissioner s 59Complaints by minors s 60Complaints by people with a disability

Subdivision 2 — Procedure after a complaint is made

s 61Information Commissioner must notify respondent s 62Circumstances in which Information Commissioner may decline to entertain complaint s 63Information Commissioner may refer complaint s 64Information Commissioner may dismiss stale complaint s 65Minister may refer a complaint direct to VCAT s 65APreliminary inquiries and consultation s 65BInformal resolution s 66What happens if conciliation is inappropriate?

Subdivision 3 — Conciliation of complaints

s 67Conciliation process s 68Information Commissioner may issue notice to produce or attend s 69Conciliation agreements s 70Evidence of conciliation is inadmissible s 71What happens if conciliation fails?

Subdivision 4 — Interim orders

s 72VCAT may make interim orders before hearing

Subdivision 5 — Jurisdiction of VCAT

s 73When may VCAT hear a complaint?s 74Who are the parties to a proceeding?s 75Time limits for complaints referred by the Minister s 76Inspection of exempt documents by VCAT s 77What may VCAT decide?

Division 9 — Enforcement of Information Privacy Principles and approved information usage arrangements

s 78Compliance notice s 79Power to compel production of documents or attendance of witness s 82Offence not to comply with compliance notice s 83Application for review

Division 10 — Notices to produce or attend

s 83ANotice to produce or attend s 83BVariation or revocation of a notice to produce or attend s 83CService of notice to produce documents or to attend s 83EPower to take evidence on oath or affirmation s 83FLegal advice and representation s 83GProtection of legal practitioners and persons—notice to produce or attend s 83GAAudio or video recording of examination s 83HFailure to comply with notice to produce or attend s 83IReasonable excuse—self-incrimination s 83JReasonable excuse—cabinet documents and legal professional privilege s 83KStatutory secrecy not a reasonable excuse s 83LAct applies equally to attendance in person or by audio or audio visual link

Part 4 — Protective data security

Division 1 — Application of Part

s 84Application of Part

Division 2 — Protective data security framework

s 85Information Commissioner to develop Victorian protective data security framework

Division 3 — Protective data security standards

s 86Information Commissioner may issue protective data security standards s 87Amendment, revocation or reissue of standards s 88Compliance with protective data security standards

Division 4 — Protective data security plans

s 89Protective data security plans s 90Exemption—Freedom of Information Act 1982

Part 5 — Law enforcement data security

s 91Application of Part s 92Information Commissioner may issue law enforcement data security standards s 93Inconsistency with protective data security standards s 94Compliance with law enforcement data security standards

Part 6 — General powers of Information Commissioner

Division 1 — General powers of Information Commissioner

s 106Information Commissioner may require access to data and data systems from public sector body Heads s 107Information Commissioner may require access to data and data systems from Chief Commissioner of Police s 108Information Commissioner may request access to crime statistics data s 109Information Commissioner may copy or take extracts from data s 110Public sector body Heads to provide assistance s 111Reports to the Minister and other reports s 112Disclosure during course of compliance audit—data security s 113Disclosure to the IBAC

Division 2 — Reporting

s 116Report on performance and exercise of powers

Part 7 — General

s 117Protection from liability s 118Employees and agents s 119Fees for access s 120Secrecy s 121Information Commissioner to give notice before certain disclosures s 122Offence to obstruct, mislead or provide false information s 123Offences by organisations or bodies s 124Prosecutions s 125Regulations

Part 8 — Repeal of Acts and transitional and savings provisions

s 126Repeal of Information Privacy Act 2000 s 127Repeal of Commissioner for Law Enforcement Data Security Act 2005 s 128Transitional and savings provisions s 129Transitional provisions—Freedom of Information Amendment (Office of the Victorian Information Commissioner) Act 2017

Schedule 1 — –The Information Privacy Principles

Schedule 1, s 1Principle 1—Collection Schedule 1, s 2Principle 2—Use and Disclosure Schedule 1, s 3Principle 3—Data Quality Schedule 1, s 4Principle 4—Data Security Schedule 1, s 5Principle 5—Openness Schedule 1, s 6Principle 6—Access and Correction Schedule 1, s 6.4If an organisation charges for providing access to personal information, the organisation—Schedule 1, s 6.7An organisation must provide reasons for denial of access or a refusal to correct personal information.Schedule 1, s 7Principle 7—Unique Identifiers Schedule 1, s 7.3An organisation must not use or disclose a unique identifier assigned to an individual by another organisation unless—Schedule 1, s 8Principle 8—Anonymity Schedule 1, s 9Principle 9—Transborder Data Flows Schedule 1, s 10.1An organisation must not collect sensitive information about an individual unless—Schedule 1, s 10.2Despite IPP 10.1, an organisation may collect sensitive information about an individual if—

Schedule 2 — –Transitional and savings provisions

Schedule 2, s 1Definitions Schedule 2, s 2General transitional provisions Schedule 2, s 3Superseded reference Schedule 2, s 4Re-enacted provisions—Information Privacy Act 2000

Schedule 1

Schedule 1, s 5Office of Privacy Commissioner abolished Schedule 1, s 6Office of Commissioner for Law Enforcement Data Security abolished Schedule 1, s 7References to former Commissioner Schedule 1, s 8Staff of Privacy Commissioner and Commissioner for Law Enforcement Data Security Schedule 1, s 9Offences Schedule 1, s 10Annual reports under Information Privacy Act 2000 for reporting periods which end before commencement day Schedule 1, s 11Annual reports under Information Privacy Act 2000 for reporting periods that end on or after commencement day Schedule 1, s 12Approved codes of practice Schedule 1, s 13Complaints and compliance notices Schedule 1, s 16Annual reports under Commissioner for Law Enforcement Data Security Act 2005 that have not been laid before Parliament

Schedule 3 — Transitional provisions—Freedom of Information Amendment (Office of the Victorian Information Commissioner) Act 2017

Schedule 3, s 1Definition Schedule 3, s 2Office of Commissioner for Privacy and Data Protection abolished Schedule 3, s 3References to Commissioner for Privacy and Data Protection Schedule 3, s 4Staff Schedule 3, s 5Codes of practice Schedule 3, s 6Public interest determinations Schedule 3, s 7Information usage arrangements Schedule 3, s 8Complaints Schedule 3, s 9Compliance notices Schedule 3, s 10Protective data security standards Schedule 3, s 11Law enforcement data security standards Schedule 3, s 12Reports for reporting periods which end before commencement day Schedule 3, s 13Annual reports for reporting periods which end on or after the commencement day Schedule 3, s 14Report to Minister