Site Changes

On 1 November 2010 the Office of the Privacy Commissioner was integrated into the Office of the Australian Information Commissioner and a new website established at www.oaic.gov.au.

Note 1: Major changes to the Privacy Act 1988 will come into effect in March 2014. Agencies, businesses and not for profits need to start preparing for these changes. For more information go to our privacy law reform page at www.oaic.gov.au
Note 2: From 12 March 2013 content is no longer being added to, or amended, on this site, consequently some information may be out of date. For new privacy content visit the www.oaic.gov.au website.

Types

Topic(s): Compliance

Information Sheet (Private Sector) 10 - 2001 Application to the Privacy Act to Information Already Held

document icon pdf (61.28 KB)

When the new private sector amendments to the Privacy Act 1988 (Cth) (the Privacy Act) come into force on 21 December 2001, not all the National Privacy Principles (NPPs) will apply to information that private sector organisations have already collected. Section 16C of the Privacy Act sets out which NPPs will apply regardless of when the information was collected, and which NPPs will only apply to information collected after the private sector amendments commence.

Starting date of private sector provisions

The private sector provisions will take effect for different organisations at different times. This table explains when the provisions are due to take effect.

Type of organisation	Start date
Organisations with an annual turnover of more than $3 million. Health service providers regardless of turnover. Organisations with an annual turnover of $3 million or less that opt in to coverage.	21 December 2001
Organisations with a turnover of $3 million or less that trade in personal information are Commonwealth government contractors. (See Information Sheet 12 - 2001 Coverage of and Exemptions from the Private Sector Provisions for more detail.)	21 December 2002
Other small businesses with a turnover of $3 million or less.	The Privacy Act does not apply.

When each NPP applies

Only some of the NPPs apply to personal information that an organisation has already collected at the time the private sector provisions come into effect. The table below sets out, for those organisations covered by the Privacy Act, whether the NPP applies to information already collected and when each NPP will apply.

NPP	Topic	What information the NPP applies to
NPP 1	Collection	Only applies to information collected after 21 December 2001 (or for small businesses (not health services) applies to information collected after 21 December 2002).
NPP 2	Use and disclosure	Only applies to information collected after 21 December 2001 (or for small businesses (not health services) applies to information collected after 21 December 2002).
NPP 3	Data quality and collection	As it applies to collection it only applies to information collected after 21 December 2001 (or for small businesses (not health services) applies to information collected after 21 December 2002).
NPP 3	Data quality on use and disclosure	As it applies to use and disclosure it applies regardless of when it was collected (for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 4	Data security	Applies regardless of when information was collected (for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 5	Privacy policies and openness	Applies regardless of when information was collected (for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 6	Access and correction	If information already held is not used or disclosed it only applies to information collected after 21 December 2001. But if information already held is used or disclosed after commencement then rights of access and correction apply unless: there is an unreasonable administrative burden; or it will cause the organisation unreasonable expense (or for small businesses (not health services), applies to information collected after 21 December 2002, with no exception).
NPP 7	Commonwealth Government identifiers	Applies regardless of when information collected (for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 8	Anonymity	Only applies to information collected after 21 December 2001 (for small businesses, only applies to transactions entered into with an organisation after 21 December 2002).
NPP 9	Transborder data flow	Applies regardless of when information collected(for small business, delay in application until 21 December 2002, then applies regardless of when collected).
NPP 10	Collection of sensitive information	Only applies to information collected after 21 December 2001 (or for small businesses (not health services), applies to information collected after 21 December 2002).

About Information Sheets

Information sheets are advisory only and are not legally binding. (The NPPs in Schedule 3 of the Privacy Act 1988 (Cth) (the Privacy Act) do legally bind organisations.)

Information sheets are based on the Office's understanding of how the Privacy Act works. They provide explanations of some of the terms used in the NPPs and good practice or compliance tips. They are intended to help organisations apply the NPPs in ordinary circumstances. Organisations may need to seek separate legal advice on the application of the Privacy Act to their particular situation.

Nothing in an information sheet limits the Privacy Commissioner's freedom to investigate complaints under the Privacy Act or to apply the NPPs in the way that seems most appropriate to the facts of the case being dealt with.

Organisations may also wish to consult the Commissioner's guidelines and other information sheets.

Office of the Privacy Commissioner ISBN 1-877079-31-6

Privacy Hotline 1300 363 992 (local call charge)