SUMMARY OF POSITIONS

Proposal 1-1
Office position:

i. The Office agrees with the proposal that it should, either on its own motion or where approached in appropriate cases, encourage and assist agencies and organisations, in conjunction with Indigenous and other cultural groups in Australia, to create publicly available protocols that adequately respond to the particular privacy needs of those groups.

Proposal 3-1
Office position:

• i. The Office submits that the general regulation making power under the Privacy Act should retain the requirement that any regulation not be inconsistent with the Act.
• ii. Where the ALRC identifies specific areas where it may be appropriate for regulations to derogate from the protections afforded in the Privacy Act, the power to make such regulation should be expressly provided for and include additional requirements such as consultation with the Privacy Commissioner and the application of a public interest test similar to that which applies to public interest determinations.

Proposal 3-2
Office position:

i. The Privacy Act should be amended to achieve greater logical consistency, simplicity and clarity. For example, the Information Privacy Principles (IPPs) and the National Privacy Principles (NPPs) should be consolidated into a set of Unified Privacy Principles (UPPs); the exemptions should be clarified and grouped together in a separate part of the Privacy Act; and the Act should be restructured and renumbered.

Proposal 3-3
Office position:

• i. The Office reiterates its position that the preferred title for the legislation is the ‘Australian Privacy Act'.
• ii. As an alternative to the ‘Australian Privacy Act', the Office submits that the statute retain its current nomenclature: ‘Privacy Act'.

Proposal 3-4
Office position:

i. The Privacy Act should be amended to include an objects clause. This clause should contain the following provisions:

• (1)The objects of this Act are:
• (a) to implement Australia's obligations at international law in relation to privacy;
• (b) to promote the protection of individual privacy;
• (c) recognise that the right to privacy is not absolute and to provide a framework within which agencies and organisations may conduct their legitimate functions and activities in a manner that respects individuals' right to privacy;
• (d) to establish a cause of action to protect the interests that
• (e) individuals have in the personal sphere free from interference from others;
• (f) to promote the responsible and transparent handling of personal information by agencies and organisations;
• (g) facilitate the growth and development of electronic commerce, nationally and internationally, while ensuring respect for the right to privacy; and
• (h) to provide the basis for nationally consistent regulation of privacy; and
• (i) to provide a means for addressing complaints about an alleged interference with an individual's information privacy.
• (2) To assist in achieving these objects, this Act establishes:
• (a) the position [of Privacy Commissioner]; and
• (b) the Australian Privacy Commission.

Proposal 3-5
Office position:

• i. The Privacy Act should define ‘personal information' as ‘information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified or reasonably identifiable individual.'
• ii. The Explanatory Memorandum of the amending legislation should make clear that an individual is ‘reasonably identifiable' when the individual can be identified from information in the possession of an agency or organisation or from that information and other information the agency or organisation has the capacity to access or is likely to access.
• iii. The Office reiterates its recommendations from the Private Sector Review that it will issue guidance on what is personal information, which takes into account the fact that in the current environment it is more difficult to assume that any information about people cannot be connected.

Proposal 3-6
Office position:

• i. The definition of ‘sensitive information' in the Privacy Act should be amended to include: (a) biometric information collected for the purpose of automated biometric authentication or identification; and (b) biometric template information.

Proposal 3-7
Office position:

• i. The definition of ‘sensitive information' in the Privacy Act should be amended to refer to ‘sexual orientation and practices' rather than ‘sexual preferences and practices.'

Proposal 3-8
Office position:

• i. The Office suggests that, for the purposes of the Privacy Act, the definition of ‘record' should be amended to include:
  • (a) a document
  • (b) information stored in electronic or other forms
  • (c) a photograph or pictorial representation.
• ii. The Office suggests that, for the purposes of the Privacy Act, the Archives Act 1983 and the Freedom of Information Act 1982, consistent definitions of ‘record' and ‘document' should be developed.

Proposal 3-9
Office position:

• i. The definition of ‘generally available publication' in the Privacy Act should be amended to clarify that a publication is ‘generally available' whether or not a fee is charged for access to the publication.

Chapter 3 - other terms to be defined
Office position:

• i. The Office suggests that the definition of ‘agency' be amended to ensure that collaborations between state and Commonwealth governments, and public-private partnerships are covered where appropriate.
• ii. The Office suggests that the definition of ‘agency' which currently includes a Minister, should add words that describe the specific acts and practices of the Minister that are covered.
• iii. The Office suggests that a definition of ‘related bodies corporate' be introduced referring to the definition under section 50 of the Corporations Act 2001.

Proposal 3-10
Office position:

• i. The Office supports the proposal that personal information of deceased individuals held by agencies should continue to be subject to the Freedom of Information Act 1982 (Cth) and the Archives Act 1983 (Cth).

Proposal 3-11
Office position:

• i. The Office does not support proposal 3-11 relating to the inclusion of a new Part to the Privacy Act dealing with the protection of all personal information of deceased persons. The Office is not aware of a clear rationale for privacy protection of deceased persons' information held in the private sector beyond the health context.
• ii. The Office suggests that a provision be inserted into section 16C of the Privacy Act establishing that NPPs 1, 2 and 4 apply to the handling of the health information of deceased individuals.
• iii. The Office suggest that NPP 2.4 be amended to provide organisations a discretion to disclose health information about deceased persons to ‘responsible persons' as defined in NPPs 2.5 and 2.6.

Proposal 3-12
Office position:

• i. The Office agrees with the policy intent that deceased individuals' genetic information may be disclosed to genetic relatives in order to prevent serious threats to a genetic relative's life or health. The Office's proposal to apply NPPs 1, 2 and 4 would achieve this through NPP 2.1(ea).
• ii. In the Office's view, the existing arrangements under NPP 2.1(ea), involving binding guidelines issued by the NHMRC and approved by the Privacy Commissioner, seem an appropriate means of regulating disclosures of genetic information to lessen or prevent serious threats to life or health.

Proposal 3-13
Office position:

• i. The Office agrees that a breach of proposed provisions relating to a deceased individual's personal information should generally be considered an ‘interference with privacy' under the Privacy Act.
• ii. In the Office's view, standing to complain about a breach of a deceased person's privacy should be limited to an appropriately defined category of persons, such as those outlined in proposal 3-13(a) or existing NPP 2.5.
• iii. The Office does not support, in relation to an alleged breach of an access provision, any person who has made a request for access to the personal information of a deceased individual being given standing to complain. The Office believes that this arrangement is too broad.
• iv. The Office does not believe that an ‘access' provision should be applied to deceased persons' records. Organisations should have a clearly defined discretion to ‘disclose' such records to ‘responsible persons' (as defined in NPPs 2.5 and 2.6).

Proposal 4-1
Office position:

• i. The Office supports the proposal that the Privacy Act be amended to provide that the Privacy Act is intended to apply to the exclusion of state and territory laws dealing specifically with the handling of personal information by organisations. In particular, the following laws of a state or territory should be excluded to the extent that they apply to organisations:
  • (a) Health Records and Information Privacy Act 2002 (NSW);
  • (b) Health Records Act 2001 (Vic);
  • (c) Health Records (Privacy and Access) Act 1997 (ACT); and
  • (d) any other laws prescribed in the regulations.

Proposal 4-2
Office position:

• i. The Office supports the proposal that states and territories with information privacy legislation that purports to apply to private sector organisations should amend that legislation so that it is no longer expressed to apply to private sector organisations.

Proposal 4-3
Office position:

• i. The Office agrees that organisations should remain bound to comply with certain state and territory laws that affect personal information handling, such as the mandatory reporting of child abuse and notifiable diseases.
• ii. The Office is unsure of the merits of prescribing non-excluded matters, particularly as such matters will generally fall within the various required by law exceptions to the privacy principles.

Proposal 4-4
Office position:

• i. The Office supports the proposal that states and territories should enact legislation that regulates the handling of personal information in that state or territory's public sector that:
• applies the proposed Unified Privacy Principles (UPPs); and
• includes at a minimum:
• (i) relevant definitions used in the Privacy Act (including ‘personal information', ‘sensitive information' and ‘health information');
• (ii) provisions allowing public interest determinations and temporary public interest determinations;
• (iii) provisions relating to state and territory incorporated bodies (including statutory corporations);
• (iv) provisions relating to state and territory government contracts; and
• (v) provisions relating to data breach notification.
• ii. The legislation also should provide for the resolution of complaints by state and territory privacy regulators and agencies with responsibility for privacy regulation in that state or territory's public sector.
• iii. The Office's preferred model of health privacy law reform is to incorporate a discrete number of specific provisions in the privacy principles themselves, rather than to create a separate regulatory instrument.

Proposal 4-5
Office position:

i. The Office supports the proposal that the Australian Government should initiate a review in five years to consider whether the proposed Commonwealth-state cooperative scheme has been effective in achieving national consistency. This review should consider whether it would be more effective for the Australian Parliament to exercise its legislative power in relation to information privacy in the state and territory public sectors.

Proposal 4-6
Office position:

• i. The Office supports the proposal for the Standing Committee of Attorneys-General (SCAG) to establish an intergovernmental agreement requiring that any amendment to the UPPs be approved by SCAG. This approval must made in consultation with the Australian Health Ministers' Advisory Council where amendments relate to health privacy regulation.

Proposal 4-7
Office position:

• i. The Office does not support the proposal to establish an expert committee to advise the Standing Committee of Attorneys-General (SCAG) on matters relating to national consistency in privacy regulation. SCAG should be informed by the advice of relevant existing bodies responsible for information privacy laws in each jurisdiction, as well as by the process of broadbased consultation with stakeholders.

 
Proposal 5-1
Office position:

• i. The Office agrees with the proposal for a statutory cause of action for the invasion of privacy of individuals.
• ii. The Office submits that the Privacy Act is the appropriate location for the statutory cause of action.
• iii. The Office agrees with the proposal for individuals to select their choice of forum - whether to lodge a complaint or initiate the statutory cause of action based on the same circumstances.
• iv. The Office considers that the proposal for a test of unfairness to stay proceedings in one forum may be costly, is likely to add to the complexity of the Privacy Act in general and to the statutory cause of action, particularly if it means that a respondent is required to apply to a court to invoke the stay of proceedings. Careful consideration will need to be given regarding the details for implementing such a test.
• v. In relation to the staying of a complaint to the Privacy Commissioner where there is a simultaneous proceeding on foot for a statutory cause of action, the ALRC may wish to consider whether to model the proposal along the lines of that existing in section 41(e) of the Privacy Act subject to appropriate modifications.
• vi. The Office agrees that the Privacy Act should contain a non-exhaustive list of the types of invasion of privacy that fall within the cause of action.

Proposal 5-2
Office position:

• i. The Office supports the proposed elements of the cause of action.
• ii. The Office supports the requirement that the test of ‘substantial offence' should be measured by an objective standard as proposed.
• iii. The Office submits that if the test of ‘substantial offence' is introduced then the ALRC should provide examples illustrating how the test may apply in practice.

Proposal 5-3
Office position:

• i. The Office agrees that only natural persons should be entitled to bring an action for invasion of privacy.
• ii. The Office agrees that the cause of action should be actionable without proof of damage.
• iii. The Office agrees that the cause of action should be fault based and restricted to intentional and reckless acts (but not negligent or accidental) of the defendant.
• iv. The ALRC should consider whether the Privacy Commissioner should have an express function in the Privacy Act to intervene in court proceedings relating to the statutory cause of action in the role of amicus curiae.

Proposal 5-4
Office position:

• i. The Office agrees with the proposal that it should provide guidance to the public concerning the proposed statutory cause of action for invasion of privacy.

Proposal 5-5
Office position:

• i. The Office agrees with the list of defences to the proposed statutory cause of action for invasion of privacy provided for in the Privacy Act.
• ii. The list of proposed defences should be listed exhaustively in the Privacy Act.

Question 5-1
Office position:

• i. The Office is not aware of a compelling case for any other defences to be applied to the proposed statutory cause of action.

Proposal 5-6
Office position:

• i. The Office agrees that to address an invasion of privacy under the statutory cause of action that the court should be empowered by the Privacy Act to choose the remedy that is most appropriate in all the circumstances, free from the jurisdictional constraints that may apply to that remedy in the general law.

Proposal 5-7
Office position:

• i. The Office agrees with the proposal that until such time as the states and territories enact uniform legislation, the state and territory public sectors should be subjected to the proposed statutory cause of action for invasion of privacy in the Privacy Act.

Chapter 6 - Overview - Impact of developing technology on privacy
Office position:

• i. The Office agrees with the ALRC's assessment of technologies that impact on privacy, particularly the need to manage new technology. These include:
  • Privacy enhancing technologies, including encryption and identity management
  • The internet
  • Radio frequency identification
  • Other wireless technologies
  • Data-matching and data-mining
  • Smart cards
  • Biometric technologies
  • DNA-based technologies
  • Voice over internet protocol
  • Location detection technologies and
  • Surveillance technologies
    
    

Proposal 7-1
Office position:

• i. The Privacy Act should remain technologically neutral.

Proposal 7-2
Office position:

• i. The Privacy Commissioner should have the power, following consultation, to register binding codes giving lawful effect to standards developed by standards and industry bodies.

Proposal 7-3
Office position:

• i. In exercising its research and monitoring functions, the Office should consider technologies that can be deployed in a privacy enhancing way by individuals, agencies and organisations.

Proposal 7-4
Office position:

• i. The Office should educate individuals, agencies and organisations about specific privacy enhancing technologies and the privacy enhancing ways in which technologies can be deployed.
• ii. The Office should be given express legislative acknowledgement of the importance of promoting an understanding of technology and privacy in its education function.

Proposal 7-5
Office position:

• i. The Office will provide guidance about when the use of certain technology to collect personal information is not done by 'fair means' and is done 'in a unreasonably intrusive way'.
• ii. The Office submits that the notice requirements for new technologies should be dealt with by technologically specific binding industry codes where a future compelling public interest is identified.
• iii. The Office will provide guidance on RFID technology that addresses all the basic principles of privacy law.
• iv. The access and correction principle proposed in UPP 9 is not sufficiently clear that personal information should be given in an intelligible form where practicable. The Office seeks to have an express reference to the need to provide access in an intelligible form included in the Act.
• v. The Office believes that capacity for human review of automated decisions should be built into the Privacy Act to ensure technological neutrality and fair and reasonable review mechanisms.

Proposal 7-6
Office position:

• i. The Office is committed to providing guidelines to the private sector on best practice data-matching activities.
• ii. The Privacy Act should provide for the development of binding industry codes to add specific regulation to data-matching activities that might raise heightened privacy risks.

Question 8-1
Office position:

• i. The Office suggests that separate and widespread public consultation should take place on the issue of online content, individual privacy and take down notices and complaint mechanisms.
• ii. The range of content that may constitute an invasion of an individual's privacy could include information that is sensitive, revealing information about an individual's health, racial or ethnic origin, sexual preferences or practices, political opinions or membership of a political organisation or trade union.
• iii. The Office does not believe that it is best placed to issue take down notices or deal with a complaint about such matters and that the Privacy Act is unlikely to be the best means to regulate individual privacy.
• iv. The Office does not have a view on which would be the appropriate body to issue take down notices or deal with a complaint.

Proposal 8-1
Office position:

• i. The Office supports the proposal that it should provide guidance that relates to generally available publications in an electronic form.
• ii. The Office believes consideration could be given to referring the matter of electronic court records to the Standing Committee of Attorney's General (SCAG) as recommended by the ALRC in its Report, Keeping Secrets: The Protection of Classified and Security Sensitive Information.[13]

Chapter 9 - Identity Theft
Office position:

• i. The Office believes that identity theft constitutes a serious interference with individuals' privacy and will continue to issue educational and guidance material on how individuals can reduce the risks of identity theft.
• ii. The Office believes that any proposed reform to the Privacy Act which may assist in preventing identity theft and minimising the harm caused by it should be in keeping with the spirit and policy intent of the Privacy Act.

Chapter 10 - Overview - Interaction, Inconsistency and Fragmentation
Office position:

• i. The Office considers national uniformity in privacy regulation to be an overarching goal.

Proposal 11-1
Office position:

• i. The Office supports the proposal that it should provide further guidance to agencies and organisations on privacy requirements affecting information sharing.

Proposal 11-2
Office position:

• i. The Office supports the proposal that agencies that are required or authorised by legislation or a public interest determination to share personal information should develop and publish documentation that addresses the sharing of personal information; and where appropriate, publish other documents (including memoranda of understanding and ministerial agreements) relating to the sharing of personal information.

Proposal 11-3
Office position:

• i. The Office does not support the proposal that the Australian Government should convene an inter-agency working group of senior officers to identify circumstances where it would appropriate to share or streamline the sharing of personal information among Australian Government agencies.

Question 11-1
Office position:

• i. The Office reiterates its recommendation for legislative amendments to ensure that state and territory contractors are bound by the Privacy Act or equivalent legislation.

Proposal 12-1
Office position:

• i. The Office suggests that the Australian Government and state and territory governments should pursue consistency of definitions and key terms in federal, state and territory legislation that regulate the handling of personal information.

Proposal 12-2
Office position:

• i. Section 41(1) of the Freedom of Information Act 1982 (Cth) should be amended to provide that a document is exempt if it contains personal information, the disclosure of that information would constitute a breach of the proposed ‘Use and Disclosure' principle and disclosure would not, on balance, be in the public interest.
• ii. The Office supports an amendment to the Privacy Act to extend certain privacy protections to the health information of deceased individuals, including in regard to collection, use and disclosure and data security. However, the Office is not convinced that a clear rationale exists for privacy protection of deceased persons' personal information beyond the health context.

Proposal 12-3
Office position:

• i. The Office agrees that ‘personal information' should be defined in the Freedom of Information Act 1982 (Cth) as ‘information or an opinion, whether true or not and whether recorded in a material form or not, about an identified or reasonably identifiable individual'.

Proposal 12-4
Office position:

• i. The Office agrees that the Freedom of Information Act 1982 (Cth) should be amended to require that the body that is primarily responsible for administration of that Act is to:
  • (a) develop and publish guidelines on the interpretation and application of s41; and
  (b) consult with the Office of the Privacy Commissioner before issuing guidelines on the interpretation and application of s 41.

Proposal 12-5
Office position:

• i. The Freedom of Information Act 1982 (Cth) should be amended to provide that disclosure of personal information in accordance with that Act is a disclosure that is required or authorised for the purposes of the proposed ‘Use and Disclosure' principle under the Privacy Act.

Proposal 12-6
Office position:

• i. The Privacy Act should be amended to provide a new Part dealing with access to, and correction of, personal information held by an agency.

Proposal 12-7
Office position:

• i. The Freedom of Information Act 1982 (Cth) should be amended to provide that an individual's right to access or correct his or her own personal information is dealt with under the Privacy Act.
• ii. To enhance consistency between Privacy Act andFreedom of Information Act 1982 (Cth), consideration should be given to aligning the amendment rights in each.

Proposal 12-8
Office position:

• i. The proposed Part of the Privacy Act dealing with access to, and correction of, personal information held by an agency should provide that:
  • (a) if an agency holds personal information about an individual , the agency must, if requested by the individual, provide the individual with access to the information, subject to a number of exceptions under the Part;
  • (b) where an individual is given access to personal information, the individual must be advised that he or she may request the correction of that information;
  • (c) where an agency is not required to provide the individual with access to personal information because of an exception, the agency must take reasonable steps to reach an appropriate compromise, involving the use of a mutually agreed intermediary, provided that the compromise would allow for sufficient access to meet the needs of both parties; and
  • (d) nothing in the Part is intended to prevent or discourage agencies from publishing or giving access to personal information, otherwise than as required by the Part, where they can do so lawfully or are required to do so by law.

Proposal 12-9
Office position:

i. The proposed Part of the Privacy Act dealing with access to, and correction of, personal information held by agencies should provide that if an agency holds personal information about an individual the agency must:

(a) if requested by the individual take such steps to correct (by way of making appropriate corrections, deletions and additions) the information as are in the circumstances, reasonable to ensure that the information is, with reference to a purpose of collection permitted by the UPPs, accurate, complete, up-to-date, relevant and not misleading;

(b) where the agency has taken the steps outlined in (a) above, if requested to do so by the individual, and provided such notification would be practicable in the circumstances, notify any other entities to whom the personal information has already been disclosed before correction.

Proposal 12-10
Office position:

• i. The proposed part of the Privacy Act dealing with access to, and correction of personal information held by an agency should provide that where an agency decides not to correct the personal information of an individual, and the individual requests the agency to annotate the personal information with a statement by the individual claiming that the information is not accurate, complete, up-to-date, relevant, or is misleading, the agency must take reasonable steps to do so.

Proposal 12-11
Office position:

• i. The proposed Part of the Privacy Act dealing with access to, and correction, of personal information held by and agency should set out in broad terms a process for dealing with a request to access or correct personal information that addresses:
  • (a) the requirements for making an application for correction or annotation of personal information;
  • (b) time periods for processing a request to access or correct personal information;
  • (c) the transfer of a request to access or correct personal information to another agency in certain circumstances (for example, when a document is not in the possession of an agency but is, to the knowledge of that agency in the possession of another agency);
  • (d) how personal information is to be made available to the individual (including by giving a reasonable opportunity to inspect the records, by providing a copy of the record, by giving a summary of the contents of the record, by providing oral information about the contents of the record);
  • (e) how corrections are to be made (including by additions and deletions);
  • (f) the deletion of excepted matter or irrelevant material;
  • (g) the persons authorised to make a decision on behalf of an agency in relation to a request to access or correct personal information;
  • (h) when a request for access to personal information may be refused by an agency(for example, when it would substantially and unreasonably divert the resources of the agency from its other operations, or in the case of a Minister, would substantially and unreasonably interfere with the performance of the Minister's functions); and
  • (i) the provision of reasons for a decision to deny a request to access or correct personal information.

Proposal 12-12
Office position:

• i. The proposed Part of the Privacy Act dealing with access to, and correction of, personal information held by an agency should provide for:
  • (a) internal review by an agency of a decision made under the Part;
  • (b) review by the Administrative Appeals Tribunal of a decision made under the Part (including the power to make an order for compensation).
• ii. The proposed Part of the Privacy Act dealing with access to, and correction of, personal information held by an agency should provide for complaint to the Privacy Commissioner.

Proposal 12-13
Office position:

• i. The Office should issue guidelines on access to, and correction of records containing personal information held by an agency.

Proposal 12-14
Office position:

• i. The Office supports the repeal of Part VIII of the Privacy Act.

Question 12-1
Office position:

• i. Exceptions to the general provisions granting an individual the right to access his or her own personal information held by an agency should have a clear rationale.

Question 12-2
Office position:

• i. The Office's complaint files should be exempt under the Freedom of Information Act 1982 (Cth).
• ii. The Office's investigative and reporting functions should not be exempt under the Freedom of Information Act 1982 (Cth).

Question 13-1
Office position:

• i. The Office believes that a non-exhaustive definition could be useful in clarifying the meaning of ‘law' under the Privacy Act for the purposes of ‘required or [specifically] authorised by law' exceptions.
• ii. For clarity, any definition of ‘law' should remind agencies and organisations that they need to determine whether the law applies to them before seeking to rely on that law to perform an act or practice. This could be done by way of a note in the definition itself, or in the principles that have a ‘required or [specifically] authorised by law' exception.
• iii. The Office supports the inclusion of the term ‘specifically authorised' wherever the UPPs or equivalent principles include a ‘required or authorised by or under law' exception, as a way to promote regulatory certainty. This should include the principles dealing with collection of sensitive information (including health information); use and disclosure; and access.
• iv. The Office believes the term ‘by or under law' remains appropriate.

Question 13-2
Office position:

• i. In the Office's view, the benefits in creating a digest of relevant laws (that require or authorise acts or practices in relation to personal information that would otherwise be regulated by the Privacy Act) are unlikely to justify the resources that would be required to maintain such a digest.
• ii. The Office would not seek responsibility for such a digest if it were adopted.

Census and Statistics Act 1905 (Cth)
Office position:

• i. In conducting future population and housing censuses, the Australian Bureau of Statistics should consider whether greater emphasis should or could be placed on explaining administrative and other measures that protect privacy and which address the specific types of concerns raised by the community with the Office.

Corporations Act 1901 (Cth)
Office position:

• i. The Office suggests that greater consideration be given to the use of trusted third-party ‘clearing houses' to act as intermediaries to contact individuals on registers established under the Corporations Act.

Proposal 13-1
Office position:

• i. The Office supports the proposal that if the exemption that applies to registered political parties and political acts and practices is not removed, the Commonwealth Electoral Act 1918 (Cth) should be amended to provide that prescribed individuals, authorities and organisations to whom the Australian Electoral Commission must give information in relation to the electoral roll and certified lists of voters must take reasonable steps to:
  • (a) protect the information from misuse and loss and from unauthorised access, modification or disclosure; and
  • (b) destroy or render the information non-identifiable if it is no longer needed for a permitted purpose.

Proposal 13-2
Office position:

• i. The Office agrees with proposal 13-2 that the Australian Electoral Commission and state and territory electoral commissions in consultation with the Office of the Privacy Commissioner, should develop and publish protocols that address the collection, use and destruction of personal information shared for the purposes of the continuous update of the electoral roll.
• ii. However, the Office recommends that state and territory Privacy and Information Commissioners also be involved in the development of protocols regarding the handling of personal information pursuant to the continuous roll update.

Proposal 13-3
Office position:

• i. The review of the Anti-Money Laundering and Counter-terrorism Financing Act 2006 (Cth), the regulations and the Anti-Money Laundering and Counter-terrorism Financing Rules under s 251 of that Act should consider, in particular, whether:
  • (a) reporting entities and designated agencies are appropriately handling personal information under the legislation;
  • (b) the number and range of transactions for which identification is required should be more limited than currently provided for under the legislation;
  • (c) it remains appropriate that reporting entities are required to retain information for seven years; and
  • (d) it is appropriate that reporting entities are able to use the electoral roll for the purpose of identification verification.
• ii. The review referred to above should also include the handling of information by AUSTRAC, particularly as it relates to the provision of access to other bodies, including those overseas.

Proposal 13-4
Office position:

• i. The Office supports proposal 13-4 that the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) should be amended to provide that state and territory agencies that access personal information provided to the Australian Transaction Reports and Analysis Centre (AUSTRAC) under the Act be regulated under the Privacy Act in relation to the handling of that personal information, except where they are covered by obligations under a state of territory law that are, overall, at least the equivalent of all the relevant obligations in the Privacy Act.

Proposal 14-1
Office position:

• i. The Office supports the proposal that the Privacy Act should be amended to provide that when an Australian Government agency is participating in an intergovernmental body or other arrangement involving state and territory agencies (for example, a Ministerial Council) the Australian Government agency should ensure that a memorandum of understanding is in place so that the intergovernmental body and its members do not act, or engage in a practice, that would breach the Act.
• ii. The Office suggests that the definition of ‘agency' in the Privacy Act which currently includes a Minister should describe the specific acts and practices of the Minister that are covered.

Proposal 15-1
Office position:

• i. The Office agrees that the privacy principles in the Privacy Act should be drafted to pursue, as much as practicable, the following objectives:
  • (a) the obligations in the privacy principles generally should be expressed as high level principles;
  • (b) the privacy principles should be simple, clear and easy to understand and apply; and
  • (c) the privacy principles should impose reasonable obligations on agencies and organisations.

Proposal 15-2
Office position:

• i. The Office agrees that the Privacy Act should be amended to consolidate the current Information Privacy Principles and National Privacy Principles into a single set of privacy principles that would be generally applicable to agencies and organisations, subject to such exceptions as required.

Proposal 15-3
Office position:

• i. The Office agrees that the proposed UPPs should apply to information privacy except to the extent that:
  • (a) the Privacy Act or another piece of Commonwealth primary legislation imposes different or more specific requirements in a particular context; or
  • (b) subordinate legislation under the Privacy Act imposes different or more specific requirements in a particular context.

Proposal 15-4
Office position:

• i. The Office agrees that the National Privacy Principles should provide the general template in drafting and structuring the proposed UPPs.

Proposal 16-1
Office position:

• i. The Office suggests that it consult with agencies, organisations and other stakeholders to determine the need for and content of guidance material relating to consent in various contexts.

Proposal 17-1
Office position:

• i. The proposed Unified Privacy Principles should contain a principle called ‘Anonymity' that sets out the requirements on agencies and organisations in respect of anonymous and pseudonymous transactions with individuals.

Proposal 17 -2
Office position:

• i. The proposed Anonymity and Pseudonymity principle should require that where anonymity is not able to be offered, organisations and agencies still permit individuals to transact using a pseudonym, where this is practicable, lawful and not misleading.

Proposal 17-3
Office position:

• i. The proposed ‘Anonymity' principle should provide that, subject to the relevant qualifications in the principle, an agency or organisation is required to give individuals the clear option to transact anonymously. Where this is not possible, or where an individual would prefer to interact using a pseudonym rather than anonymously, an agency or organisation is required to give individuals the clear option to transact pseudonymously if this is lawful and practicable.

Proposal 17-4
Office position:

• i. The Office should provide guidance to agencies and organisations on:
  • (a) when it is and is not lawful and practicable to give individuals the option to transact anonymously or pseudonymously;
  • (b) when it would be misleading for an individual to transact pseudonymously with an agency or organisation;
  • (c) what is involved in providing a clear option to transact anonymously or pseudonymously; and
  • (d) the differences between transacting anonymously or pseudonymously.

Proposal 18-1
Office position:

• i. The proposed UPPs should contain a principle called Collection that requires agencies and organisations, where reasonable and practicable, to collect personal information about an individual only from the individual concerned.
• ii. The Office agrees that it could provide guidance to clarify when it would not be reasonable and practicable to collect personal about an individual from the individual concerned.

Proposal 18-2
Office position:

• i. The Collection principle in the proposed UPPs should provide that, where an agency or organisation receives unsolicited personal information, it must either:
  • (a) destroy the information without using or disclosing it; or
  • (b) comply with all relevant provisions in the UPPs that apply to the information in question, as if the agency or organisation had actively collected the information.
• ii. If proposal 18-1 and 18-2 are adopted, the Office suggests that it should produce guidance material to clarify the meaning of ‘unsolicited' in the context of this provision.

Proposal 18-3         
Office position:

• i. The Collection principle in the proposed UPPs should provide that an agency or organisation must not collect personal information unless it reasonably believes the information is necessary for one or more of its lawful functions or activities.
• ii. The ALRC should consider further the benefits of a ‘reasonable purpose' test in the proposed UPP regulating Collection.

Proposal 19-1
Office position:

• i. The proposed UPPs should set out the requirements on agencies and organisations in relation to the collection of personal information that is defined as ‘sensitive information' for the purposes of the Privacy Act.
• ii. These requirements should be located in the proposed Collection principle.

Proposal 19-2
Office position:

• i. The proposed sensitive information provisions should contain an exception permitting the collection of sensitive information by an agency or organisation where the collection is required or specifically authorised by law.

Proposal 19-3
Office position:

• i. The proposed UPP concerning collection of sensitive information should reflect the requirements of the current NPP 10.1(c): that collection of sensitive information is permitted where necessary to lessen or prevent a serious and imminent threat to the life or health of any individual where the individual concerned is incapable of giving consent to that collection.
• ii. If the requirement of ‘imminence' is removed, the proposed UPP should permit the collection of sensitive information where necessary to lessen or prevent a serious threat to the life or health of any individual, where:
  • (a) the individual concerned is incapable of giving consent to that collection; and
  • (b) it is not reasonably practicable to obtain consent from an authorised representative of the individual concerned.

Question 19-1
Office position:

• i. The Office suggests that homeless persons' service providers consider applying for a Public Interest Determination to address the collection of sensitive information from persons lacking the capacity to give consent.

Proposal 20-1
Office position:

• i. The proposed UPPs should contain a principle specifically relating to notification that outlines the obligations of both agencies and organisations. The principle should include the requirement to specifically notify an individual of particular matters regarding the collection and handling of their personal information.

Proposal  20-2
Office position:

• i. The Office agrees in principle that, either before or at the time of collection (or, if not practicable, as soon as practicable after collection) an agency or organisation must be required to take reasonable steps to ensure that an individual is aware of the matters outlined in proposal20-2 (a) to (g).
• ii. The Office recommends that UPP3.1 should be clarified by the inclusion of the qualification ‘if any' in relation to ‘reasonable steps'. As such UPP 3.1 would read: ‘...it must take reasonable steps, if any, to ensure that the individual is aware of the:...'.
• iii. The Office recommends that an additional notification requirement be included in proposal 20-2 which requires agencies and organisations to notify individuals of any law that requires specific information to be collected.
• iv. The Office does not support the inclusion of a ‘reasonable person test' as a threshold to determine whether notification is required to be given.
• v. The Office believes that the notification exception due to a serious threat to the life or health of any individual would be adequately addressed by the inclusion of an ‘if any' qualification relating to ‘reasonable steps'.
• vi. The Office does not support the proposed ‘required or specifically authorised by or under law' exception to notification for all agencies contained in UPP3.3(b)(ii). Such an exception for agencies could be adequately achieved through other legal mechanisms (such as secrecy provisions) and through the addition of a qualification to the term ‘reasonable steps'.

Proposal 20-3
Office position:

• i. The Office is committed to providing guidance to assist both agencies and organisations in ensuring that individuals are properly informed of the types of people, organisations, agencies or other entities to whom personal information is usually disclosed.

Proposal 20-4
Office position:

• i. The Office does not agree with the proposal to exclude agencies from providing notification where they are required or specifically authorised by or under law not to. The Office holds the view that by stipulating ‘reasonable steps, if any' (supported by guidance from the Office as proposed in 20-7) the Specific Notification principle adequately provides for circumstances where notification would be counter to the functions of an agency.

Proposal 20-5
Office position:

• i. The Office agrees in principle with the third party notification proposal contained in proposed UPP3.2. However, the Office recommends the inclusion of the ‘if any' qualification to require agencies and organisations to take ‘reasonable steps, if any' to ensure that individuals are notified regarding the collection of their personal information from third parties and to make clear that there may be circumstances where it is reasonable to take no steps.
• ii. The Office does not support the inclusion of a ‘reasonable person test' as a threshold to determine whether notification is required to be given when personal information is collected from a third party.
• iii. The Office believes that the notification exception due to a serious threat to the life or health of any individual would be adequately addressed by the inclusion of an ‘if any' qualification relating to ‘reasonable steps'.
• iv. The Office does not support the proposed ‘required or specifically authorised by or under law' exception to notification of collection from third parties for all agencies. Circumstances where notice is proscribed would be accommodated by a ‘reasonable steps if any' test.

Proposal 20-6
Office position:

• i. The Office is committed to providing guidance on the circumstances in which it is necessary for agencies and organisations to notify an individual when it has received personal information about that individual from a third party source.

Proposal 20-7
Office position:

• i. The Office supports proposal 20-7 to provide guidance on the meaning of the term ‘reasonable steps' to agencies and organisations within the context of specific notification obligations.
• ii. The Office submits that the proposed UPPs 3.1 and 3.2 be amended to include the qualification ‘if any' in relation to the term ‘reasonable steps'. This qualification would provide legislative clarification that, in some circumstances, ‘reasonable steps' may equate to no steps.

Proposal 21-1
Office position:

• i. The proposed UPPs should contain a principle called ‘Openness' that sets out the requirements on an agency or organisation to operate openly and transparently by providing general notification in a privacy policy of how it manages personal information and how personal information is collected, held, used and disclosed by it.

Proposal 21-2
Office position:

• i. The privacy policy in the proposed ‘Openness' principle should set out an agency's or organisation's policies on the management of personal information, including how the personal information is collected, held, used and disclosed. This document should also include:
  • (a) what sort of personal information the agency or organisation holds;
  • (b) the purposes for which personal information is held;
  • (c) the steps individuals may take to gain access to personal information about them held by the agency or organisation.
• ii. Where it is deemed necessary, the Office will issue guidance on the content of an agency's or organisation's policies on the management of personal information.

Proposal 21-3
Office position:

• i. The Office agrees with the proposal that it should issue guidance on how agencies and organisations can comply with their obligations in the proposed ‘Openness' principle to produce and make available a privacy policy.

Proposal 21-4
Office position:

• i. An agency or organisation should take reasonable steps to make its privacy policy, as referred to in the proposed ‘Openness' principle, available without charge to an individual in form that is useful and easily accessible.

Proposal 21-5
Office position:

• i. The Office agrees that it should continue to encourage and assist agencies and organisations to make available short form privacy notices summarising their personal information handling practices. Short form privacy notices should be seen as supplementing the more detailed information that is required to be made available to individuals under the Privacy Act.

Proposal  22-1
Office position:

• i. The proposed UPPs should contain a principle called ‘Use and Disclosure' that sets out the requirements on agencies and organisations in respect of the use or disclosure of personal information for a purpose other than the primary purpose of collecting the information.'

Proposal  22-2
Office position:

• i. The proposed ‘Use and Disclosure' principle should contain an exception permitting an agency or organisation to use or disclose an individual's personal information for a purpose (the secondary purpose) other than the primary purpose of collection if the:
  • (a) secondary purpose is related to the primary purpose and, if the personal information is sensitive information, directly related to the primary purpose of collection; and
  • (b) individual would reasonably expect the agency or organisation to use or disclose the information for the secondary purpose.

Proposal  22-3
Office position:

• i. The proposed ‘Use and Disclosure' principle should include an exception allowing use or disclosure for secondary purposes where necessary to lessen or prevent serious and imminent threats to an individual's life or health or public health.
• ii. If the requirement that a threat to an individual's life or health, or to public health be both serious and imminent is not retained, the Office proposes that the relevant exception also contain a provision requiring that the individual's consent be obtained where reasonable and practicable. The Office also proposes, in this case, that a meaning of ‘serious' be provided in the Privacy Act, explaining that its determinations include an assessment of relative likelihood.
• iii. The reference to ‘safety' should be removed from UPP 5.1(c).

Question 22-1
Office position:

• i. The proposed ‘Use and Disclosure' principle should contain an exception allowing an agency or organisation to use or disclose personal information for a purpose other than the primary purpose of collection where this is ‘required or specifically authorised by or under law.'

Chapter 22 - Missing persons
Office position:

• i. The proposed UPPs should not be amended to make specific provision for using and disclosing personal information in the context of missing persons issues.

Chapter 22 - Disclosure of ‘incidents' by insured professionals to insurers
Office position:

• i. The proposed UPPs should not be amended to make specific provision for disclosing personal information about ‘incidents' by insured professionals.

Chapter 22 - Due diligence
Office position:

• i. The Office regards the issue of due diligence as being adequately dealt with under the proposed UPPs.

Chapter 22 - Logging disclosures
Office position:

• i. The proposed ‘Use and Disclosure' principle should contain a requirement that agencies or organisations make a note of disclosures for the purposes of investigating or reporting unlawful activities.

Chapter 22 - Reporting and investigating unlawful activity
Office position:

• i. The Office suggests that consideration be given to more precisely defining legitimate uses and disclosures for the purposes of investigating alleged unlawful activity.

Chapter 22 - Notes
Office position:

i. The Office suggests that UPP 5 should feature explanatory notes similar to those currently found in NPP 2.

Proposal 23-1
Office position:

• i. The Office supports the proposal to create a separate UPP that regulates direct marketing and which would apply regardless of whether personal information is initially collected for the primary purpose of direct marketing or for another purpose.

Question 23-1
Office position:

• i. The Office submits that UPP6, Direct Marketing, should not apply to agencies. The regulation of the use of personal information by agencies for such purpose should continue to be regulated by the principle or principles applying to use and disclosure.

Proposal 23-2
Office position:

• i. The Office submits that the proposed Direct Marketing principle should set out the generally applicable requirements for organisations engaged in the practice of direct marketing.
• ii. It is matter for Parliament whether future legislation be enacted to regulate sector specific direct marketing, and this prospect need not be expressly anticipated in the proposed Direct Marketing principle. Inconsistencies between the proposed UPP and any future sector specific regulation would seem to be capable of being resolved through principles of statutory interpretation.
• iii. The Office holds the view that if there were any future sector specific regulation of direct marketing that derogated from the proposed UPP, such regulation should be pursued through primary, rather than delegated, legislation.

Proposal 23-3
Office position:

• i. The proposed Direct Marketing principle should require organisations to present individuals with a simple means to opt out of receiving direct marketing communications.

Proposal 23-4
Office position:

• i. The proposed Direct Marketing UPP should provide that an organisation involved in direct marketing must comply, within a specified time frame, with an individual's request not to receive direct marketing communications.

Proposal 23-5
Office position:

• i. The Direct Marketing principle should provide that an organisation involved in direct marketing must, when requested by an individual to whom it has sent direct marketing communications, take reasonable steps to advise the individual from where it acquired the individual's personal information.

Proposal 23-6
Office position:

• i. Consistent with the Office's functions under section 27 of the Privacy Act, the Office should issue guidance to organisations involved in direct marketing to highlight their obligations.

Proposal 24-1
Office position:

• i. The Office supports the proposal that the UPPs should contain a principle called Data Quality that applies to both agencies and organisations.

Proposal 24-2
Office position:

• i. The proposed Data Quality principle should require an agency or organisation to take reasonable steps to make sure that the personal information it collects, uses or discloses is, with reference to a purpose of collection permitted by the proposed UPPs, accurate, complete, up-to-date and relevant.

Proposal 25-1
Office position:

• i. The Office supports the proposal that the UPPs should contain a principle called ‘Data Security' that applies to both agencies and organisations.

Chapter 25 - General Security Provision
Office position:

• i. The proposed ‘Data Security' principle should require an agency or organisation to take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.

Proposal 25-2
Office position:

• i. The proposed ‘Data Security' principle should require an agency or organisation to take reasonable steps to ensure that personal information it discloses to a person pursuant to a contract, or otherwise in connection with the provision of a service to the agency or organisation, is protected from being used or disclosed by that person otherwise than in accordance with the Unified Privacy Principles.

Proposal 25-3
Office position:

• i. If there is a Data Security principle, the Office supports the proposal that it provide guidance on the inclusion of contractual provisions binding a contracted service provider of an agency or organisation to handle personal information consistently with the UPPs.
• ii. If there is a Data Security principle, the Office supports the proposal that it provide guidance on the importance of training staff adequately as to the steps they should take to protect personal information.

Proposal 25-4
Office position:

• i. The proposed ‘Data Security' principle should require an agency or organisation to take reasonable steps to destroy or render non-identifiable information if it is no longer needed for any purpose permitted by the UPPs, except to the extent that the agency or organisation is required or specifically authorised by or under law to retain the personal information.

Proposal 25-5
Office position:

• i. If there is a Data Security principle, the Office supports the proposal that it provide guidance about when it is appropriate for an agency or organisation to destroy or render non-identifiable personal information that is no longer needed for a purpose permitted under the UPPs.

Proposal 25-6
Office position:

• i. If there is a Data Security principle, the Office supports the proposal that it provide guidance about what is required of an agency or organisation to destroy or render non-identifiable personal information, particularly when that information is held or stored in an electronic form.

Proposal 26-1
Office position:

• i. The proposed Unified Privacy Principles should contain a principle called Access and Correction that:
  • (a) sets out the requirements that apply to organisations in respect of personal information that is held by organisations; and
  • (b) contains a note stating that the provisions dealing with access and correction of personal information held by agencies are located in a separate Part of the Privacy Act.

Proposal 26-2
Office position:

• i. The proposed Access and Correction principle should provide that, where an organisation is not required to provide an individual with access to his or her personal information because of an exception to the general provisions granting a right of access, the organisation must take reasonable steps to reach an appropriate compromise, involving the use of a mutually agreed intermediary, that would allow for sufficient access to meet the needs of both parties.
• ii. If the proposal concerning intermediaries is adopted, the Office agrees that it should provide guidance about the meaning of ‘reasonable steps' in this context, making clear, for instance, that an organisation need not take any steps where this would undermine a lawful reason denying a request for access in the first place.

Proposal 26-3
Office position:

• i. The proposed Access and Correction principle should provide that an organisation must respond within a reasonable time to a request from an individual for access to personal information held by the organisation. The Office of the Privacy Commissioner should provide guidance about the meaning of ‘reasonable time' in this context.
• ii. The proposed Access and Correction principle should be amended to provide that an organisation should provide access to personal information in the form requested by the individual, where this is practicable and reasonable.

Proposal 26-4
Office position:

• i. The proposed Access and Correction principle should provide that where, in accordance with this principle, an organisation has corrected personal information it holds about an individual, and the individual requests that the organisation notify any other entities to whom the personal information has already been disclosed prior to correction, the organisation must take reasonable steps to do so, provided such notification would be practicable in the circumstances.

Proposal 26-5
Office position:

• i. The proposed Access and Correction principle should provide that where an organisation holds personal information about an individual that the individual wishes to have corrected, the individual could raise reasonable grounds for the organisation to believe that information held about them is in need of correction.

Proposal 26-6
Office position:

• i. The proposed Access and Correction principle should provide that, where an organisation holds personal information about an individual, it is not required to provide access to that information to the individual to the extent that:
  • (a) providing access would be reasonable likely to pose a serious and imminent threat to the life or health of any individual;
  • (b) in the case of health information - providing access would be reasonable likely to pose a serious threat to the life or health of any individual.

Additional matter:  Required or ‘specifically' authorised by or under law
Office position:

• i. The Office submits that the relevant exception to the access principle should provide for the denial of access where ‘required or specifically authorised by or under law'.

Proposal 27-1
Office position:

• i. The Office agrees that the proposed UPPs should contain a principle on ‘Identifiers' that applies to agencies and organisations. As a consequence, s 100(2) and (3) of the Privacy Act should be amended to apply also to agencies.

Proposal 27-2
Office position:

• i. The Office agrees that the proposed ‘Identifiers' principle should define ‘identifier' inclusively to mean a number, symbol or any other particular that uniquely identifies an individual for the purpose of an agency's or organisation's operations.

Proposal 27-3
Office position:

• i. While the Office has invited further consideration of whether such a mechanism is warranted, if it is then the Office agrees that the proposed ‘Identifiers' principle should contain a note stating that a determination referred to in the ‘Identifiers' principle is a legislative instrument for the purposes of section 5 of the Legislative Instruments Act 2003 (Cth).

Proposal 27-4
Office position:

• i. The Office agrees that the proposed ‘Identifiers' principle should regulate the use, as well as the adoption and disclosure, by Australian Government agencies and organisations of identifiers that are assigned by state and territory governments.
• ii. The Privacy Act should not regulate how state and territory agencies handle identifiers issued by state and territory governments.

Question 27-1
Office position:

• i. The Office believes that there is merit in the ALRC considering a principle regulating the assignment of identifiers by Australian Government agencies.

Proposal 27-5
Office position:

• i. The Office agrees that before the introduction of unique multi-purpose identifiers, Australian Government agencies should be required to conduct privacy impact assessments.

Proposal 27-6
Office position:

• i. The Office agrees that it should, in consultation with the Australian Taxation Office and other relevant stakeholders, review the Tax File Number Guidelines issued under s 17 of the Privacy Act.

Provision of a consent mechanism for the handling of identifiers
Office position:

• i. The Office supports the ALRC's position that the inclusion of a consent mechanism would undermine the purpose and intent of a principle designed to limit the widespread use and adoption of unique government identifiers.

Proposal 28-1
Office position:

• i. The Office agrees that the Privacy Act should be amended to clarify that it applies to the acts and practices of Australian agencies that operate outside Australia.

Proposal 28-2
Office position:

• i. The Office agrees that the proposed Unified Privacy principles should contain a principle called ‘Transborder Data Flows' that applies to agencies and organisations.

Proposal 28-3
Office position:

• i. The proposed ‘Transborder Data Flows' principle should provide that an agency in Australia or an external territory may transfer personal information about an individual to a recipient (other than the agency, organisation or the individual) who is outside Australia by or on behalf of an enforcement body if it is required or authorised by or under Australian law;
• ii. The ‘Transborder Data Flow' principle should clarify that an overseas law or other matter (such as conduct deemed ‘seriously improper' in another country) may not be relied upon to authorise the disclosure of personal information.
• iii. Overseas law enforcement requests for personal information from organisations should be mediated by Australian law enforcement agencies.
• iv. The disclosure and transfer overseas of information for extradition or mutual assistance purposes should be based on clear legislative authorisations. This may require appropriate amendments to the relevant legislation so as to satisfy a ‘required or specifically authorised by law' exception of the ‘Use and Disclosure' principle.
• v. Where privacy protections substantially similar to the UPPs are not in place, agencies should establish administrative arrangements or memoranda of understanding or protocols regarding appropriate handling practices when transferring personal information for law enforcement, extradition and mutual assistance purposes.

Question 28-1
Office position:

• i. For the purposes of the proposed ‘Transborder Data Flows' principle, the Privacy Act should provide that, a ‘transfer':
  • (a) includes where personal information is stored in Australia in such a way that allows it to be accessed or viewed outside Australia; and
  • (b) excludes the temporary transfer of personal information due to incidental overseas routing between entities based in Australia.
• ii. The definition of ‘transfer' should not exclude information that is transferred overseas accidentally because the sending entity has not taken reasonable steps to protect the personal information.

Proposal 28-4
Office position:

• i. The Office agrees that subject to the relevant exceptions the ‘Transborder Data Flows' principle should provide that an agency or organisation in Australia or an external territory may transfer personal information about an individual to a recipient (other than the agency, organisation or the individual) who is outside Australia only if at least one of the following conditions is met:
• (a) the agency or organisation reasonably believes that the recipient of the information is subject to a law, binding scheme or contract which effectively upholds privacy protections that are substantially similar to the proposed UPPs; or
• (b) the individual consents to the transfer; or
• (c) the agency or organisation continues to be liable for any breaches of the proposed UPPs; and
  • (i) the individual would reasonably expect the transfer, and the transfer is necessary for the performance of a contract between the individual and the agency or organisation;
  • (ii) the individual would reasonably expect the transfer, and the transfer is necessary for the implementation of pre-contractual measures taken in response to the individual's request;
  • (iii) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the individual between the agency or organisation and a third party;
  • (iv) all of the following apply: the transfer is for the benefit of the individual; it is impracticable to obtain the consent of the individual to that transfer; and if it were practicable to obtain such consent, the individual would be likely to give it; or
  • (v) before the transfer has taken place, the agency or organisation has taken reasonable steps to ensure that the information will not be dealt with by the recipient of the information inconsistently with the proposed UPPs.
• ii. The ‘Transborder Data Flows' principle should allow an agency to transfer personal information about an individual to an overseas recipient when the transfer is required or specifically authorised by or under (an Australian) law.
• iii. When an overseas transfer of personal information is required or specifically authorised by or under law and where privacy protections substantially similar to the UPPs are not in place, agencies should establish administrative arrangements or memoranda of understanding or protocols regarding appropriatepersonal information handling practices.

Proposal 28-5
Office position:

• i. The Office agrees that the proposed ‘Use and Disclosure' principle should contain a note stating that agencies and organisations are subject to the requirements of the proposed ‘Transborder Data Flows' principle when transferring personal information about an individual to a recipient who is outside Australia.

Proposal 28-6
Office position:

• i. The Office agrees that the proposed ‘Transborder Data Flows' principle should contain a note stating that agencies and organisations are subject to the requirements of the proposed ‘Use and Disclosure' principle when transferring personal information about an individual to a recipient who is outside Australia.

Proposal 28-7
Office position:

• i. The Office agrees that the Privacy Act should be amended to clarify that, if an organisation transfers personal information to a related body corporate outside Australia, this transfer will be subject to the proposed ‘Transborder Data Flows' principle.

Proposal 28-8
Office position:

• i. The Office agrees that the Australian Government should develop and publish a list of laws and binding schemes that effectively uphold principles for fair handling of personal information that are substantially similar to the proposed UPPs.

Proposal 28-9
Office position:

• i. The Office should work with agencies and organisations to develop and publish guidance on the proposed ‘Transborder Data Flows' principle, including guidance on:
  • (a) when personal information may become available to a foreign government;
  • (b) outsourcing government services to organisations outside Australia;
  • (c) the issues that should be addressed as part of a contractual agreement with the overseas recipient of personal information; (d) when a transfer of personal information is ‘for the benefit' or ‘in the interests of' the individual concerned; and
  • (d) what constitute ‘reasonable steps' to ensure the information it has transferred will not be held, used or disclosed by the recipient of the information inconsistently with the proposed UPPs.

Proposal 28-10
Office position:

• i. The Office agrees that the privacy policy of an agency or organisation, referred to in the proposed ‘Openness' principle, should set out whether personal information is likely to be transferred outside Australia.

Question 28-2
Office position:

• i. The Office has not yet considered a model of how trustmarks might interact with the Privacy Act but would be interested to examine any such proposals if and when they are put forward.

Chapter 29 - Additional Privacy Principles
Office position:

i. The Office believes that the proposed UPPs should not include separate ‘accountability', ‘prevention of harm', or ‘no disadvantage' principles.

Proposal 30-1
Office position:

• i. The Privacy Act should be amended to group together in a separate part of the Act exemptions for certain categories of entities or types of acts and practices.

Proposal 30-2
Office position:

• i. The Privacy Act should be amended to set out in a schedule to the Act exemptions for specific, named entities. The schedule should distinguish between entities that are completely exempt and those that are partially exempt from the Privacy Act. For those entities that are partially exempt, the schedule should specify those acts and practices that are exempt.

Proposal 31-1
Office position:

• i. The privacy rules and guidelines, which relate to the handling of intelligence information concerning Australian persons by the Australian Security Intelligence Organisation, Australian Security Intelligence Service, Defence Imagery and Geospatial Organisation, Defence Intelligence Organisation, Defence Signals Directorate and Office of National Assessments, should include consistent rules and guidelines relating to:
  • (a) incidents involving the incorrect use and disclosure of personal information (including a requirement to contact the Inspector-General of Intelligence and Security and advise of the incident and measures taken to protect the privacy of the Australian person);
  • (b) the accuracy of personal information; and
  • (c) the storage and security of personal information.

Proposal 31-2
Office position:

• i. The Office supports the proposal that Section 15 of the Intelligence Services Act 2001 (Cth) be amended to provide that:
  • (a) the responsible minister in relation to the Defence Intelligence Organisation is required to make written rules regulating the communication and retention by the Defence Intelligence Organisation of intelligence information concerning Australian persons; and
  • (b) before making rules to protect the privacy of Australian persons, the ministers responsible for the Australian Security Intelligence Service, the Defence Imagery and Geospatial Organisation, the Defence Signals Directorate and the Defence Intelligence Organisation should consult with the Privacy Commissioner.

Proposal 31-3
Office position:

• i. The Office supports the proposal that the Office of National Assessments Act 1977 (Cth) should be amended to provide that:
  • (a) the responsible minister in relation to the Office of National Assessments (ONA) is required to make written rules regulating the communication and retention by the ONA of intelligence information concerning Australian persons; and
  • (b) before making rules to protect the privacy of Australian persons, the minister responsible for the ONA should consult with the Privacy Commissioner.

Proposal 31-4
Office position:

• i. The Office agrees that Section 8A of the Australian Security and Intelligence Organisation Act 1979 (Cth) should be amended to provide that, before making rules to protect the privacy of Australian persons, the responsible minister should consult with the Privacy Commissioner.

Proposal 31-5
Office position:

• i. The Office agrees that the privacy rules and guidelines referred to in proposal 31-1 should be made available electronically to the public; for example, on the websites of those agencies.
• ii. Reasonable steps should be taken to ensure that the privacy rules and guidelines should also be made available in other accessible forms as requested by members of the public.

Proposal 31-6
Office position:

• i. The Office reiterates the position expressed in its submission to ALRC IP 31 that entities with similar functions be treated consistently under the Privacy Act's exemption provisions.

Proposal 31-7
Office position:

• i. The Office agrees that the Inspector-General of Intelligence and Security, in consultation with the Privacy Commissioner, should develop and publish information-handling guidelines to ensure that the personal information handled by the IGIS is protected adequately.

Proposal 32-1
Office position:

• i. Federal courts that do not have a policy on granting access for research purposes to court records containing personal information should develop and publish such policies.

Chapter 32 - Access to personal information held by a court or tribunal
Office position:

• i. Regarding non-party access, the Office supports recommendation 7.1 from ALRC 98: Keeping Secrets, the Protection of Classified and Security Sensitive Information that the Standing Committee of Attorneys-General (SCAG) review court and tribunal rules for non-party access to court records.
• ii. Regarding access by parties to a federal tribunal matter, the Office suggests that the proposed review by SCAG also consider court rules on this issue.
• iii. The Office suggests that the proposed review by SCAG could also consider issues surrounding the electronic publication of court records.

Question 32-1
Office position:

• i. The Office reiterates the position expressed in its submission to ALRC IP 31 that entities with similar functions be treated consistently under the Privacy Act's exemption provisions.

Proposal 33-1
Office position:

• i. The Office believes that there should be a clear public interest enunciated for any exemption for the Australian Fair Pay Commission to be retained.

Proposal 33-2
Office position:

• i. The Office believes that there should be a clear public interest enunciated for any exemption to be retained.

Proposal 33-3
Office position:

• i. The Office believes that there should be a clear public interest enunciated for any exemption to be maintained.

Proposal 34-1
Office position:

• i. The Attorney-General's Department, in consultation with the Office, should develop and publish information-handling guidelines for royal commissions to assist in ensuring that the personal information they handle is protected adequately.

Proposal 34-2
Office position:

• i. The Office reiterates the position expressed in its submission to ALRC IP 31 that entities with similar functions be treated consistently under the Privacy Act's exemption provisions. Exemptions should only be established where there is a clear and compelling public interest.

Proposal 34-3
Office position:

• i. The Privacy Act should be amended to apply to the Integrity Commissioner in respect of the administrative operations of his or her office.

Proposal 34-4
Office position:

• i. The Integrity Commissioner, in consultation with the Office, should develop and publish information handling guidelines to ensure that the personal information handled by the Integrity Commissioner and the Australian Commission for Law Enforcement Integrity is protected adequately.

Question 34-1  
Office position:

• i. The Office does not agree that the Privacy Act should be amended to create an exemption applying to agencies that perform law enforcement functions in respect of a range of circumstances.
• ii. In the Office's view, exceptions in a law enforcement context offer more flexibility and consistency to exemptions.

Question 34-2
Office position:

• i. The Office believes that there should be a clear public interest enunciated for any exemption to be maintained.
• ii. Any exemption for the Department of Senate, the Department of the House of Representatives and the Department of Parliamentary Services should be explicitly referred to in the Privacy Act and included in a schedule of exemptions.
• iii. If the above bodies are exempt from the Privacy Act, they should implement standards for the handling of personal information.

Proposal 34-5
Office position:

• i. Subject to Proposal 4-4 (states and territories to enact legislation applying the proposed UPPs and Privacy (Health Information) Regulations), the Privacy Act should be amended to:
  • (a) apply to all state and territory incorporated bodies, including statutory corporations, except where they are covered by obligations under a state or territory law that are, overall, at least the equivalent of the relevant obligations in the Privacy Act; and
  • (b) empower the Governor-General to make regulations exempting state and territory incorporated bodies from coverage of the Privacy Act on public interest grounds.

Proposal 34-6
Office position:

• i. The Privacy Act should be amended to provide that, in considering whether to exempt state and territory incorporated bodies from coverage of the Privacy Act, the Minister must:
  • (a) be satisfied that the state or territory has requested that the body be exempt from the Act; and
  • (b) consider:
    • (i) whether coverage of the body under the Privacy Act adversely affects the state or territory government;
    • (ii) the desirability of regulating under the Privacy Act the handling of personal information by that body; and
    • (iii) whether the state or territory law regulates the handling of personal information by that body to a standard that is at least equivalent to the standard that would otherwise apply to the body under the Privacy Act; and
  • (c) consult with the Privacy Commissioner about the matters mentioned in paragraphs (ii) and (iii) above.

Proposal 35-1
Office position:

• i. The Office's position is that to achieve uniformity and consistency of application of privacy legislation, exemptions in the Privacy Act should be minimised. Exemptions should only apply where they are underpinned by a clear and compelling public interest.
• ii. The Office reiterates its position that the definition of small business be expressed in terms of the Australian Bureau of Statistics (ABS) definition, currently 20 employees or fewer, rather than the annual turnover.
• iii. The Office reiterates its position that the coverage of the Privacy Act should be extended to ensure small businesses in sectors that deal with significant amounts of personal information are prescribed under the Act.

Proposal 35-2
Office position:

• i. Consistent with the Office's functions under sections 27(d) and (e) of the Privacy Act, the Office should provide guidance material and assistance to small businesses to assist them in understanding and fulfilling their obligations under the Act. This will require appropriate resources to enable the Office to carry out these functions.

Proposal 36-1
Office position:

• i. The Office believes that, on balance, given the desirability of national consistency of privacy regulation and to reflect community expectations, the employee records exemption provided in section 7B(3) of the Privacy should be removed.
• ii. The Office submits that the small business exemption should be retained, meaning that their employee records would also be exempt.

Proposal 36-2
Office position:

• i. The Office does not support the ALRC proposal that a specific exception should be created regarding access to evaluative material, being material that is an evaluation or opinion compiled solely for the purpose of determining the suitability, eligibility, or qualifications of the individual concerned for employment.
• ii. The Office submits that the current exceptions under NPP6 (and those proposed for UPP9) would provide for denial of access to evaluative material compiled solely for the purpose of determining the suitability, eligibility or qualifications of the individual concerned for employment, a contract or other benefits.
• iii. Access to evaluative material should be regulated by reference to the general provisions and exceptions of NPP6 (and those proposed for UPP9) and any relevant guidance issued by the Office.

Proposal 37-1
Office position:

• i. The Office supports minimal exemptions to the Privacy Act to achieve uniformity and consistency for privacy regulation in Australia. The Office submits that privacy protection may be enhanced by requiring political parties to comply with key privacy principles including the openness, and access and correction principles.
• ii. If the political parties exemption is retained, the Office suggests that political parties should be required to comply with a few key privacy principles, which is consistent with the model suggested by the ALRC in proposals 13-1 and 13-2.
• iii. The Office suggests that the opt-in provision in s 6EA should be extended to entities that are exempt from the operation of the NPPs of the Privacy Act.

Proposal 37-2
Office position:

• i. The Privacy Act should be amended to provide that it does not apply to the extent, if any, that it would infringe any constitutional doctrine of implied freedom of political communication.
  

Proposal 37-3
Office position:

• i. Consistent with the Office's functions under section 27 of the Privacy Act, the Office should provide guidance material and assistance if the exemptions for registered political parties, political acts and practices were removed from the Privacy Act.

Proposal 38-1
Office position:

• i. The Office generally agrees that the Privacy Act should be amended to define ‘journalism'. The Office believes there is merit in the ALRC proposal to include news, current affairs, and documentaries in the definition of ‘journalism'.
• ii. The Office would encourage the ALRC to consider whether the definition of ‘journalism' could also usefully include an element that refers to the purpose or character of journalism.

Proposal 38-2
Office position:

• i. In consultation with the Australian Communications and Media Authority and peak media representative bodies, the Office of the Privacy Commissioner should establish criteria for assessing the adequacy of media privacy standards for the purposes of the journalism exemption.

Proposal 38-3
Office position:

• i. Consistent with the Privacy Commissioner's function under section 27(1)(e) of the Privacy Act, the Office should provide guidance material containing the criteria for assessing the adequacy of media privacy standards established under proposal 38-2.

Proposal 38-4
Office position:

• i. Section 7B(4)(b)(i) of the Privacy Act should be amended to provide that the standards must ‘deal adequately with privacy in the context of the activities of a media organisation (whether or not the standards also deal with other matters)', subject to further guidance being included on how the Office will assess adequacy of standards.

Proposal 38-5
Office position:

• i. The Office of the Privacy Commissioner agrees that it should issue guidance to clarify that the term ‘publicly committed' in s 7B(4) of the Privacy Act requires both:
  • (a) express commitment by a media organisation to observe privacy standards that have been published in writing by the media organisation or a person or body representing a class of media organisations; and
  • (b) conduct by the media organisation evidencing commitment to observe those standards.

Chapter 39 - Other private sector provisions
Office position:

• i. The Office reiterates the need for improved notice provisions for companies with a shared ownership or controlling interest, when non-sensitive information is shared.
• ii. The Office agrees with the ALRC's recommendation that the Office should issue guidance about direct marketing that clarifies organisations' obligations under the Privacy Act in dealing with particularly vulnerable people, such as individuals aged 14 and under.
• iii. As a matter of good practice, the Office believes that where a change in partnership arises, the new partnership should inform customers.
• iv. In relation to transborder data flows between related bodies corporate, the Office submits that:
  • (a) the Privacy Act could be amended to clarify that if an organisation transfers personal information to a related body corporate in an overseas jurisdiction, that transfer will be subject to NPP 9 transborder requirements (or equivalent UPP); and
  • (b) there is a need to include a note under section 13D reminding an organisation of their obligations in relation to transborder data flows of personal information under NPP 9 (or equivalent UPP).

Question 40-1
Office position:

• i. The Australian Government should request that the Standing Committee of Attorney's-General consider the regulation of private investigators and the impact of federal, state and territory privacy and related laws on the industry.

Question 40-2
Office position:

• i. The Office submits that the need for a specific notification principle to except Alternate Dispute Resolution (ADR) bodies from notice requirements for third parties is not necessary if the proposed amendments to UPP3, discussed in chapter 20, are made.
• ii. If required, the Office will produce specific guidance for ADR bodies clarifying their requirements under proposed UPP 3 regarding the ‘reasonable steps' they should take when collecting information from another individual, including unsolicited personal information, for the purpose of investigating and resolving disputes.
• iii. The Office submits that ADR bodies could be authorised similarly to courts and tribunals as currently provided for in NPP 2.1(h)(v). In terms of UPP 5, the Office proposes that ‘alternate dispute resolution body