If Centrelink sends you a formal, written notice requesting certain information, and the notice states that you are required to provide the information by law (the law should be named in the notice), then you will need to comply. You will not breach the Privacy Act by providing the information.

Explanation: The Privacy Act 1988 limits when you can disclose personal information that you hold about an individual. Generally, you can only disclose personal information for the purpose for which it was originally collected, or for a closely related purpose that the person would reasonably expect.

There are, however, some exceptions to this general rule, including where a disclosure is required or authorised by or under law (NPP 2.1(g)). This means:

• Required by law � where a law explicitly states that (if asked) you must give certain information to a government department or authority, then you must comply with the request and you will not breach the Privacy Act by doing so;
• Authorised by law � where a law says that you may give out certain personal information, then you can make a decision about whether or not to disclose it. If you decide to disclose the information, you will not breach the Privacy Act.

Centrelink, acting under the Social Security (Administration) Act 1999, has the power to require information from others in the course of determining certain matters, including social security payments and the issue of concession cards. Sections 192 to 197 of the Social Security (Administration) Act set out Centrelink's powers to require this information. They also set out the legal obligations relating to a notice requiring information, and the penalty for not complying with such a notice.

Requirements to disclose information may arise from time to time with other Commonwealth or State/Territory agencies or authorities. Again, where a law is specified in a formal, written notice and it requires you to disclose information, you will need to do so.

It is very important that if you are unsure whether a requested disclosure is required by law, you should speak with the department or authority that is seeking the information from you. They must be able to explain to you which law requires you to meet their request.

For more information on how the NPPs apply in the private sector, see the Guidelines to the National Privacy Principles. The advice in the guidelines is generic, but offers some guidance about how to comply with the principles.

Here you can find the full text of the Privacy Act 1988.