Information sheet 3 - 2001: Openness

View printable version of this page

National Privacy Principle 5 (NPP 5) requires organisations to be open about their handling of personal information in two ways. This information sheet expands on the Privacy Commissioner's Guidelines to the National Privacy Principles.

Ways an organisation could give NPP 5.1 information

There are a number of ways an organisation could set out its personal information management policies in a clearly expressed document. For example:

• a retailer might decide that the simplest way would be to display the organisation's privacy policy on a sign in the store;
• the information could be provided in a printout or a pamphlet that is handed out on request; or
• a privacy policy could be put on a web site, either on a home page or on a prominent and accessible link from the home page.

When an organisation is aware of any particular requirements affecting an individual requesting information about its privacy policy, it could consider presenting the information in a way that takes into account those requirements. Some factors that may affect the way an organisation presents information could include any disability the individual may have, the individual's level of understanding, or the individual's language or literacy skills.

Providing information under NPP 5.2

NPP 5.2 requires an organisation, when requested, to take reasonable steps to let an individual know, generally, what sort of personal information it holds, for what purposes and how it collects, holds, uses and discloses that information. NPP 5.2 does not limit the type or detail of information that an organisation can provide. It may tailor the information according to what the individual wants to know.

The type of information that an individual may ask for could include:

• the kind of personal information the organisation collects;
• what, if any, of that information is sensitive information under the Privacy Act 1988 (Cth) (the Privacy Act);
• how the organisation generally collects personal information;
• the purposes for which the organisation collects or holds personal information;
• more details about the way the organisation uses personal information;
• the kinds of personal information the organisation shares with related corporations;
• more information about who the organisation discloses personal information to and the reasons for doing so;
• more details on the organisation's functions or activities that involve personal information and are contracted out;
• who the person can contact in the organisation if they have a privacy concern;
• the organisation's contact details, for example, the name, street and postal addresses, the main telephone and fax numbers and appropriate e-mail addresses;
• how the organisation stores or secures information (an organisation is not required to give specific details of security measures that would jeopardise the security of the personal information an organisation holds);
• how individuals are able to get access to information the organisation holds about them;
• the kinds of personal information the organisation may transfer overseas; and
• how an individual can make a complaint to the organisation about a possible breach of privacy, including, where appropriate, a contact number for the organisation's complaints or privacy section.

Reasonable steps when providing the information required under NPP 5.2

• any particular requirements the individual making the request has, that the organization is aware of, which may affect the way an organisation considers presenting the information, such as disability, level of understanding, language or literacy skills;
• the size of the organisation and the variety and complexity of the information it holds. For example, in a small local organisation it may be appropriate for the person to be given the information verbally. In a large organisation written material may be a better option;
• how much information the individual wants. For example, the request may only be about the type of personal information an organisation holds;
• providing information, whether simple or complex, in a user-friendly, accessible way and avoiding jargon or in-house terms.