Information Privacy Principles under the Privacy Act 1988
View printable version of this page
The eleven Information Privacy Principles as extracted
from Section 14 of the Privacy Act 1988 (Cth): PDF
Word
Principle 1 - Manner and purpose of collection of
personal information
1. Personal information shall not be collected by a collector for
inclusion in a record or in a generally available publication unless:
(a) the information is collected for a purpose that is a lawful
purpose directly related to a function or activity of the collector; and
(b) the collection of the information is necessary for or directly
related to that purpose.
2. Personal information shall not be collected by a collector by
unlawful or unfair means.
Principle 2 - Solicitation of personal information
from individual concerned
Where:
(a) a collector collects personal information for inclusion in a
record or in a generally available publication; and
(b) the information is solicited by the collector from the
individual concerned;
the collector shall take such steps (if any) as are, in the
circumstances, reasonable to ensure that, before the information is collected
or, if that is not practicable, as soon as practicable after the information is
collected, the individual concerned is generally aware of:
(c) the purpose for which the information is being collected;
(d) if the collection of the information is authorised or required
by or under law - the fact that the collection of the information is so
authorised or required; and
(e) any person to whom, or any body or agency to which, it is the
collector's usual practice to disclose personal information of the kind so
collected, and (if known by the collector) any person to whom, or any body or
agency to which, it is the usual practice of that first mentioned person, body
or agency to pass on that information.
Principle 3 - Solicitation of personal information
generally
Where:
(a) a collector collects personal information for inclusion in a
record or in a generally available publication; and
(b) the information is solicited by the
collector:
the collector shall take such steps (if any) as are, in the
circumstances, reasonable to ensure that, having regard to the purpose for which
the information is collected:
(c) the information collected is relevant to that purpose and is
up to date and complete; and
(d) the collection of the information does not intrude to an
unreasonable extent upon the personal affairs of the individual
concerned.
Principle 4 - Storage and security of personal
information
A record-keeper who has possession or control of a record that
contains personal information shall ensure:
(a) that the record is protected, by such security safeguards as
it is reasonable in the circumstances to take, against loss, against
unauthorised access, use, modification or disclosure, and against other misuse;
and
(b) that if it is necessary for the record to be given to a person
in connection with the provision of a service to the record-keeper, everything
reasonably within the power of the record-keeper is done to prevent unauthorised
use or disclosure of information contained in the record.
Principle 5 - Information relating to records kept
by record-keeper
1. A record-keeper who has possession or control of records that
contain personal information shall, subject to clause 2 of this Principle, take
such steps as are, in the circumstances, reasonable to enable any person to
ascertain:
(a) whether the record-keeper has possession or control of any
records that contain personal information; and
(b) if the record-keeper has possession or control of a record
that contains such information:
(i) the nature of that information;
(ii) the main purposes for which that information is used; and
(iii) the steps that the person should take if the person wishes
to obtain access to the record.
2. A record-keeper is not required under clause 1 of this
Principle to give a person information if the record-keeper is required or
authorised to refuse to give that information to the person under the applicable
provisions of any law of the Commonwealth that provides for access by persons to
documents.
3. A record-keeper shall maintain a record setting out:
(a) the nature of the records of personal information kept by or
on behalf of the record-keeper;
(b) the purpose for which each type of record is kept;
(c) the classes of individuals about whom records are kept;
(d) the period for which each type of record is kept;
(e) the persons who are entitled to have access to personal
information contained in the records and the conditions under which they are
entitled to have that access; and
(f) the steps that should be taken by persons wishing to obtain
access to that information.
4. A record-keeper shall:
(a) make the record maintained under clause 3 of this Principle
available for inspection by members of the public; and
(b) give the Commissioner, in the month of June in each year, a
copy of the record so maintained.
Principle 6 - Access to records containing personal
information
Where a record-keeper has possession or control of a record that
contains personal information, the individual concerned shall be entitled to
have access to that record, except to the extent that the record-keeper is
required or authorised to refuse to provide the individual with access to that
record under the applicable provisions of any law of the Commonwealth that
provides for access by persons to documents.
Principle 7 - Alteration of records containing
personal information
1. A record-keeper who has possession or control of a record that
contains personal information shall take such steps (if any), by way of making
appropriate corrections, deletions and additions as are, in the circumstances,
reasonable to ensure that the record:
(a) is accurate; and
(b) is, having regard to the purpose for which the information was
collected or is to be used and to any purpose that is directly related to that
purpose, relevant, up to date, complete and not misleading.
2. The obligation imposed on a record-keeper by clause 1 is
subject to any applicable limitation in a law of the Commonwealth that provides
a right to require the correction or amendment of documents.
3. Where:
(a) the record-keeper of a record containing personal information
is not willing to amend that record, by making a correction, deletion or
addition, in accordance with a request by the individual concerned; and
(b) no decision or recommendation to the effect that the record
should be amended wholly or partly in accordance with that request has been made
under the applicable provisions of a law of the Commonwealth;
the record-keeper shall, if so requested by the individual
concerned, take such steps (if any) as are reasonable in the circumstances to
attach to the record any statement provided by that individual of the
correction, deletion or addition sought.
Principle 8 - Record-keeper to check accuracy etc
of personal information before use
A record-keeper who has possession or control of a record that
contains personal information shall not use that information without taking such
steps (if any) as are, in the circumstances, reasonable to ensure that, having
regard to the purpose for which the information is proposed to be used, the
information is accurate, up to date and complete.
Principle 9 - Personal information to be used only
for relevant purposes
A record-keeper who has possession or control of a record that
contains personal information shall not use the information except for a purpose
to which the information is relevant.
Principle 10 - Limits on use of personal
information
1. A record-keeper who has possession or control of a record that
contains personal information that was obtained for a particular purpose shall
not use the information for any other purpose unless:
(a) the individual concerned has consented to use of the
information for that other purpose;
(b) the record-keeper believes on reasonable grounds that use of
the information for that other purpose is necessary to prevent or lessen a
serious and imminent threat to the life or health of the individual concerned or
another person;
(c) use of the information for that other purpose is required or
authorised by or under law;
(d) use of the information for that other purpose is reasonably
necessary for enforcement of the criminal law or of a law imposing a pecuniary
penalty, or for the protection of the public revenue; or
(e) the purpose for which the information is used is directly
related to the purpose for which the information was obtained.
2. Where personal information is used for enforcement of the
criminal law or of a law imposing a pecuniary penalty, or for the protection of
the public revenue, the record-keeper shall include in the record containing
that information a note of that use.
Principle 11 - Limits on disclosure of personal
information
1. A record-keeper who has possession or control of a record that
contains personal information shall not disclose the information to a person,
body or agency (other than the individual concerned) unless:
(a) the individual concerned is reasonably likely to have been
aware, or made aware under Principle 2, that information of that kind is usually
passed to that person, body or agency;
(b) the individual concerned has consented to the disclosure;
(c) the record-keeper believes on reasonable grounds that the
disclosure is necessary to prevent or lessen a serious and imminent threat to
the life or health of the individual concerned or of another person;
(d) the disclosure is required or authorised by or under law;
or
(e) the disclosure is reasonably necessary for the enforcement of
the criminal law or of a law imposing a pecuniary penalty, or for the protection
of the public revenue.
2. Where personal information is disclosed for the purposes of
enforcement of the criminal law or of a law imposing a pecuniary penalty, or for
the purpose of the protection of the public revenue, the record-keeper shall
include in the record containing that information a note of the disclosure.
3. A person, body or agency to whom personal information is
disclosed under clause 1 of this Principle shall not use or disclose the
information for a purpose other than the purpose for which the information was
given to the person, body or agency.
For further information please contact:
Privacy Commissioner
GPO Box 5218
Sydney NSW 2001
Privacy Hotline: 1300 363 992
Telephone: (02) 9284 9800
Fax:
(02) 9284 9666
Email: privacy@privacy.gov.au
Back to Top
|
HOME > Information Privacy Principles under the Privacy Act 1988
