Privacy

The Privacy Act

The Privacy Act protects personal Information about individuals handled by organisations subject to the Privacy Act. The 10 national Privacy Principles in the Privacy Act set the minimum standards for handling personal information.

Personal information – is information or an opinion that identifies or allows their identity to be readily worked out from the information. It included information such as a person’s name, address, financial information, marital Status or billing details. Some personal information is sensitive information.

National Privacy Principles (NPPs)

The NPP’s are principles or rules about collecting, using and disclosing personal information. Organisations and businesses must comply with these rules

NPP 1 Collection

Only collect personal information that is necessary for your functions or activities.

Use fair and lawful ways to collect personal information.

Collect personal information directly from an individual if it is reasonable and practicable to do so.

At the time you collect personal information or as soon as practicable afterwards, take reasonable steps to make an individual aware of;

-Why you are collecting information about them.

-Who else you might give it to.

-Other specified matters

Take reasonable steps to ensure the individual is aware of this information, even if you have collected it from someone else.

NPP 2 Use and Disclosure

Only use and disclose personal information for the primary purpose of collection unless one of the exceptions in NPP 2.1 applies (for example, for a related secondary purpose within the individual’s reasonable expectations, you have consent or there are specified law enforcement or public health and public safety circumstances).

Note:

If the information is sensitive the uses or disclosures allowed are more limited. A secondary purpose within reasonable expectations must be directly related to the purpose of collecting the information and the direct marketing provisions of NPP 2.1 (c) do not apply.

NPP 3 Quality

Take reasonable steps to ensure the personal information you collect, use or disclose is accurate, complete and up-to-date. This may require you to correct the information.

NPP 4 Security

Take reasonable steps to protect the personal information you hold from misuse and loss and from unauthorised access, modification or disclosure.

Take reasonable steps to destroy or permanently de-identify personal information if you no longer need it for any purpose for which you may use or disclose the information.

NPP 5 Openness

Have a short document that sets out clearly expressed policies on the way you manage personal information, and make it available to anyone who asks for it.

If an individual asks, take reasonable steps to let them know, generally, what sort of personal information you hold, what purposes you hold it for and how you collect, use and disclose the information.

NPP 6 Access

If an individual asks, you must give access to the personal information you hold about them unless particular circumstances apply that allow you to limit the extent to which you give access – these include emergency situations, specified business imperatives and law enforcement or other public interests.

NPP 7 Identifiers

Only adopt, use or disclose a commonwealth Government Identifier if particular circumstances apply that would allow you to do so.

NPP 8 Anonymity

If it is lawful and practicable to do so, give people the option of interacting anonymously with you.

NPP 9 Transfer overseas

Only transfer personal information overseas if you have checked that you meet the requirements of NPP9

NPP10 Sensitive Information

Get consent to collect sensitive information unless specified exemptions apply.