[pic] Privacy Act 1988 Act No. 119 of 1988 as amended This compilation was prepared on 18 July 2008 taking into account amendments up to Act No. 73 of 2008 The text of any of those amendments not in force on that date is appended in the Notes section The operation of amendments that have been incorporated may be affected by application provisions that are set out in the Notes section Prepared by the Office of Legislative Drafting and Publishing, Attorney-General's Department, Canberra Contents Part I-Preliminary 1 1 Short title [see Note 1] 1 2 Commencement [see Note 1] 1 3 Saving of certain State and Territory laws 1 3A Application of the Criminal Code 2 4 Act to bind the Crown 2 5 Interpretation of Information Privacy Principles 2 5A Extension to external Territories 2 5B Extra-territorial operation of Act 3 Part II-Interpretation 5 6 Interpretation 5 6A Breach of a National Privacy Principle 20 6B Breach of an approved privacy code 21 6C Organisations 22 6D Small business and small business operators 25 6DA What is the annual turnover of a business? 27 6E Small business operator treated as organisation 28 6EA Small business operators choosing to be treated as organisations 29 6F State instrumentalities etc. treated as organisations 30 7 Acts and practices of agencies, organisations etc. 31 7A Acts of certain agencies treated as acts of organisation 34 7B Exempt acts and exempt practices of organisations 35 7C Political acts and practices are exempt 37 8 Acts and practices of, and disclosure of information to, staff of agency, organisation etc. 39 9 Collectors 40 10 Record-keepers 41 11 File number recipients 42 11A Credit reporting agencies 43 11B Credit providers 43 12 Application of Information Privacy Principles to agency in possession 46 12A Act not to apply in relation to State banking or insurance within that State 46 12B Severability: additional effect of Act in relation to organisations 46 Part III-Information privacy 48 Division 1-Interferences with privacy 48 13 Interferences with privacy 48 13A Interferences with privacy by organisations 49 13B Related bodies corporate 50 13C Change in partnership because of change in partners 51 13D Overseas act required by foreign law 52 13E Effect on section 13 of sections 13B, 13C and 13D 52 13F Act or practice not covered by section 13 or section 13A is not an interference with privacy 52 Division 2-Information Privacy Principles 53 14 Information Privacy Principles 53 15 Application of Information Privacy Principles 59 16 Agencies to comply with Information Privacy Principles 59 Division 3-Approved privacy codes and the National Privacy Principles 60 16A Organisations to comply with approved privacy codes or National Privacy Principles 60 16B Personal information in records 60 16C Application of National Privacy Principles 61 16D Delayed application of National Privacy Principles to small business 61 16E Personal, family or household affairs 62 16F Information under Commonwealth contract not to be used for direct marketing 63 Division 4-Tax file number information 64 17 Guidelines relating to tax file number information 64 18 File number recipients to comply with guidelines 64 Division 5-Credit information 65 18A Code of Conduct relating to credit information files and credit reports 65 18B Credit reporting agencies and credit providers to comply with Code of Conduct 65 Part IIIAA-Privacy codes 66 18BA Application for approval of privacy code 66 18BAA Privacy codes may cover exempt acts or practices 66 18BB Commissioner may approve privacy code 66 18BC When approval takes effect 69 18BD Varying an approved privacy code 69 18BE Revoking the approval of an approved privacy code 70 18BF Guidelines about privacy codes 70 18BG Register of approved privacy codes 71 18BH Review of operation of approved privacy code 71 18BI Review of adjudicator's decision under approved privacy code 72 Part IIIA-Credit reporting 73 18C Certain credit reporting only to be undertaken by corporations 73 18D Personal information not to be given to certain persons carrying on credit reporting 73 18E Permitted contents of credit information files 74 18F Deletion of information from credit information files 77 18G Accuracy and security of credit information files and credit reports 79 18H Access to credit information files and credit reports 80 18J Alteration of credit information files and credit reports 80 18K Limits on disclosure of personal information by credit reporting agencies 81 18L Limits on use by credit providers of personal information contained in credit reports etc. 85 18M Information to be given if an individual's application for credit is refused 88 18N Limits on disclosure by credit providers of personal information contained in reports relating to credit worthiness etc. 89 18NA Disclosure by credit providers to certain persons who gave indemnities 97 18P Limits on use or disclosure by mortgage insurers or trade insurers of personal information contained in credit reports 97 18Q Limits on use by certain persons of personal information obtained from credit providers 99 18R False or misleading credit reports 101 18S Unauthorised access to credit information files or credit reports 102 18T Obtaining access to credit information files or credit reports by false pretences 102 18U Application of section 4B of Crimes Act 102 18V Application of this Part 103 Part IV-Office of the Privacy Commissioner 104 Division 1-Office of the Privacy Commissioner 104 19 Establishment of the Office of the Privacy Commissioner 104 19A Privacy Commissioner 104 20 Terms and conditions of appointment 104 21 Remuneration of Commissioner 104 22 Leave of absence 105 23 Outside employment 105 24 Resignation 105 25 Termination of appointment 105 26 Acting Commissioner 106 26A Staff and consultants 106 Division 2-Functions of Commissioner 107 27 Functions of Commissioner in relation to interferences with privacy 107 28 Functions of Commissioner in relation to tax file numbers 110 28A Functions of Commissioner in relation to credit reporting 111 29 Commissioner to have regard to certain matters 112 Division 3-Reports by Commissioner 114 30 Reports following investigation of act or practice 114 31 Report following examination of proposed enactment 116 32 Report following monitoring of certain activities 116 33 Exclusion of certain matters from reports 117 Division 4-Miscellaneous 119 34 Provisions relating to documents exempt under the Freedom of Information Act 1982 119 35 Direction where refusal or failure to amend exempt document 119 Part V-Investigations 121 Division 1-Investigation of complaints and investigations on the Commissioner's initiative 121 36 Complaints 121 37 Principal executive of agency 122 38 Conditions for making a representative complaint 123 38A Commissioner may determine that a complaint is not to continue as a representative complaint 124 38B Additional rules applying to the determination of representative complaints 125 38C Amendment of representative complaints 125 39 Class member for representative complaint not entitled to lodge individual complaint 125 40 Investigations 125 40A Referring complaint about act under Commonwealth contract 126 41 Circumstances in which Commissioner may decide not to investigate or may defer investigation 127 42 Preliminary inquiries 128 43 Conduct of investigations 128 44 Power to obtain information and documents 130 45 Power to examine witnesses 131 46 Directions to persons to attend compulsory conference 131 47 Conduct of compulsory conference 132 48 Complainant and certain other persons to be informed of various matters 133 49 Investigation under section 40 to cease if certain offences may have been committed 133 50 Reference of matters to other authorities 134 50A Substitution of respondent to complaint 136 51 Effect of investigation by Auditor-General 137 Division 2-Determinations following investigation of complaints 138 52 Determination of the Commissioner 138 53 Determination must identify the class members who are to be affected by the determination 140 53A Notice to be given to outsourcing agency 140 53B Substituting respondent to determination 141 Division 3-Enforcement 142 54 Application of Division 142 55 Obligations of respondent organisation 142 55A Proceedings in the Federal Court or Federal Magistrates Court to enforce a determination 143 55B Evidentiary certificate 144 Division 4-Review and enforcement of determinations involving Commonwealth agencies 146 57 Application of Division 146 58 Obligations of respondent agency 146 59 Obligations of principal executive of agency 146 60 Compensation and expenses 147 61 Review of determinations regarding compensation and expenses 147 62 Enforcement of determination against an agency 147 Division 5-Miscellaneous 149 63 Legal assistance 149 64 Commissioner etc. not to be sued 150 65 Failure to attend etc. before Commissioner 150 66 Failure to give information etc. 151 67 Protection from civil actions 154 68 Power to enter premises 154 68A Identity cards 155 69 Restrictions on Commissioner obtaining personal information and documents 156 70 Certain documents and information not required to be disclosed 158 70A Application of Part to organisations that are not legal persons 159 70B Application of this Part to former organisations 159 Part VI-Public interest determinations and temporary public interest determinations 161 Division 1-Public interest determinations 161 71 Interpretation 161 72 Power to make, and effect of, determinations 161 73 Application by agency or organisation 162 74 Publication of application 163 75 Draft determination 163 76 Conference 164 77 Conduct of conference 164 78 Determination of application 165 79 Making of determination 165 80 Determinations disallowable 165 Division 2-Temporary public interest determinations 166 80A Temporary public interest determinations 166 80B Effect of temporary public interest determination 166 80C Determinations disallowable 167 80D Commissioner may continue to consider application 167 Division 3-Register of determinations 168 80E Register of determinations 168 Part VIA-Dealing with personal information in emergencies and disasters 169 Division 1-Object and interpretation 169 80F Object 169 80G Interpretation 169 80H Meaning of permitted purpose 170 Division 2-Declaration of emergency 171 80J Declaration of emergency-events of national significance 171 80K Declaration of emergency-events outside Australia 171 80L Form of declarations 172 80M When declarations take effect 172 80N When declarations cease to have effect 172 Division 3-Provisions dealing with the use and disclosure of personal information 173 80P Authorisation of collection, use and disclosure of personal information 173 Division 4-Other matters 176 80Q Disclosure of information-offence 176 80R Operation of Part 177 80S Severability-additional effect of Part 177 80T Compensation for acquisition of property-constitutional safety net 178 Part VII-Privacy Advisory Committee 180 81 Interpretation 180 82 Establishment and membership 180 83 Functions 181 84 Leave of absence 181 85 Removal and resignation of members 182 86 Disclosure of interests of members 182 87 Meetings of Advisory Committee 182 88 Travel allowance 183 Part VIII-Obligations of confidence 184 89 Obligations of confidence to which Part applies 184 90 Application of Part 184 91 Effect of Part on other laws 184 92 Extension of certain obligations of confidence 185 93 Relief for breach etc. of certain obligations of confidence 185 94 Jurisdiction of courts 185 Part IX-Miscellaneous 186 95 Medical research guidelines 186 95A Guidelines for National Privacy Principles about health information 186 95AA Guidelines for National Privacy Principles about genetic information 188 95B Requirements for Commonwealth contracts 188 95C Disclosure of certain provisions of Commonwealth contracts 189 96 Non-disclosure of private information 189 97 Annual report 191 98 Injunctions 191 99 Delegation 193 99A Conduct of directors, employees and agents 193 100 Regulations 195 Part X-Amendments of other Acts 197 101 Amendments of other Acts 197 Schedule 1-Amendments of other Acts 198 Schedule 2-Interim guidelines concerning the collection, storage, use and security of tax file number information 199 Introduction 199 1 General 199 2 Collection of tax file number information 200 3 Storage and security of tax file number information 200 4 Use and disclosure of tax file number information 201 5 Publicity 201 6 Cessation of employment and investment 201 7 Meaning of terms in interim guidelines 202 Schedule 3-National Privacy Principles 203 1 Collection 203 2 Use and disclosure 204 3 Data quality 208 4 Data security 208 5 Openness 208 6 Access and correction 208 7 Identifiers 210 8 Anonymity 211 9 Transborder data flows 211 10 Sensitive information 212 Notes 215 An Act to make provision to protect the privacy of individuals, and for related purposes WHEREAS Australia is a party to the International Covenant on Civil and Political Rights, the English text of which is set out in Schedule 2 to the Human Rights and Equal Opportunity Commission Act 1986: AND WHEREAS, by that Covenant, Australia has undertaken to adopt such legislative measures as may be necessary to give effect to the right of persons not to be subjected to arbitrary or unlawful interference with their privacy, family, home or correspondence: AND WHEREAS Australia is a member of the Organisation for Economic Co- operation and Development: AND WHEREAS the Council of that Organisation has recommended that member countries take into account in their domestic legislation the principles concerning the protection of privacy and individual liberties set forth in Guidelines annexed to the recommendation: AND WHEREAS Australia has informed that Organisation that it will participate in the recommendation concerning those Guidelines: BE IT THEREFORE ENACTED by the Queen, and the Senate and the House of Representatives of the Commonwealth of Australia, as follows: Part I-Preliminary 1 Short title [see Note 1] This Act may be cited as the Privacy Act 1988. 2 Commencement [see Note 1] This Act commences on a day to be fixed by Proclamation. 3 Saving of certain State and Territory laws It is the intention of the Parliament that this Act is not to affect the operation of a law of a State or of a Territory that makes provision with respect to the collection, holding, use, correction, disclosure or transfer of personal information (including such a law relating to credit reporting or the use of information held in connection with credit reporting) and is capable of operating concurrently with this Act. Note: Such a law can have effect for the purposes of the provisions of the National Privacy Principles that regulate the handling of personal information by organisations by reference to the effect of other laws. 3A Application of the Criminal Code Chapter 2 of the Criminal Code (except Part 2.5) applies to all offences against this Act. Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility. 4 Act to bind the Crown (1) This Act binds the Crown in right of the Commonwealth, of each of the States, of the Australian Capital Territory, of the Northern Territory and of Norfolk Island. (2) Nothing in this Act renders the Crown in right of the Commonwealth, of a State, of the Australian Capital Territory, of the Northern Territory or of Norfolk Island liable to be prosecuted for an offence. (3) Nothing in this Act shall be taken to have the effect of making the Crown in right of a State, of the Australian Capital Territory, of the Northern Territory or of Norfolk Island an agency for the purposes of this Act. 5 Interpretation of Information Privacy Principles For the purposes of the interpretation of the Information Privacy Principles, each Information Privacy Principle shall be treated as if it were a section of this Act. 5A Extension to external Territories This Act extends to all external Territories. 5B Extra-territorial operation of Act Application to overseas acts and practices of organisations (1) This Act (except Divisions 4 and 5 of Part III and Part IIIA) and approved privacy codes extend to an act done, or practice engaged in, outside Australia and the external Territories by an organisation if: (a) subject to subsection (1A), the act or practice relates to personal information about an Australian citizen or a person whose continued presence in Australia is not subject to a limitation as to time imposed by law; and (b) the requirements of subsection (2) or (3) are met. Note: The act or practice overseas will not breach a National Privacy Principle or approved privacy code or be an interference with the privacy of an individual if the act or practice is required by an applicable foreign law. See sections 6A, 6B and 13A. (1A) Paragraph (1)(a) does not apply in relation to National Privacy Principle 9. Note: Because of subsection (1A), the extra-territorial application of National Privacy Principle 9 is not limited by the citizenship etc. requirement of paragraph (1)(a). Organisational link with Australia (2) The organisation must be: (a) an Australian citizen; or (b) a person whose continued presence in Australia is not subject to a limitation as to time imposed by law; or (c) a partnership formed in Australia or an external Territory; or (d) a trust created in Australia or an external Territory; or (e) a body corporate incorporated in Australia or an external Territory; or (f) an unincorporated association that has its central management and control in Australia or an external Territory. Other link with Australia (3) All of the following conditions must be met: (a) the organisation is not described in subsection (2); (b) the organisation carries on business in Australia or an external Territory; (c) the personal information was collected or held by the organisation in Australia or an external Territory, either before or at the time of the act or practice. Power to deal with complaints about overseas acts and practices (4) Part V of this Act has extra-territorial operation so far as that Part relates to complaints and investigation concerning acts and practices to which this Act extends because of subsection (1). Note: This lets the Commissioner take action overseas to investigate complaints and lets the ancillary provisions of Part V operate in that context. Part II-Interpretation 6 Interpretation (1) In this Act, unless the contrary intention appears: ACC means the Australian Crime Commission. ACT enactment has the same meaning as enactment has in the Australian Capital Territory (Self-Government) Act 1988. agency means: (a) a Minister; or (b) a Department; or (c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a Commonwealth enactment, not being: (i) an incorporated company, society or association; or (ii) an organisation within the meaning of the Conciliation and Arbitration Act 1904 or a branch of such an organisation; or (d) a body established or appointed by the Governor-General, or by a Minister, otherwise than by or under a Commonwealth enactment; or (e) a person holding or performing the duties of an office established by or under, or an appointment made under, a Commonwealth enactment, other than a person who, by virtue of holding that office, is the Secretary of a Department; or (f) a person holding or performing the duties of an appointment, being an appointment made by the Governor-General, or by a Minister, otherwise than under a Commonwealth enactment; or (g) a federal court; or (h) the Australian Federal Police; or (i) an eligible case manager; or (j) the nominated AGHS company; or (k) an eligible hearing service provider. annual turnover of a business has the meaning given by section 6DA. approved privacy code means: (a) a privacy code approved by the Commissioner under section 18BB; or (b) a privacy code approved by the Commissioner under section 18BB with variations approved by the Commissioner under section 18BD. bank means: (a) the Reserve Bank of Australia; or (b) a body corporate that is an ADI (authorised deposit-taking institution) for the purposes of the Banking Act 1959; or (c) a person who carries on State banking within the meaning of paragraph 51(xiii) of the Constitution. Board of the ACC means the Board of the Australian Crime Commission established under section 7B of the Australian Crime Commission Act 2002. breach an approved privacy code has the meaning given by section 6B. breach an Information Privacy Principle has a meaning affected by subsection 6(2). breach a National Privacy Principle has the meaning given by section 6A. class member, in relation to a representative complaint, means any of the persons on whose behalf the complaint was lodged, but does not include a person who has withdrawn under section 38B. code complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant because it breached an approved privacy code. Code of Conduct means the Code of Conduct issued under section 18A. commercial credit means a loan sought or obtained by a person, other than a loan of a kind referred to in the definition of credit in this subsection. Commissioner means the Privacy Commissioner. Commissioner of Police means the Commissioner of Police appointed under the Australian Federal Police Act 1979. Commission of inquiry has the same meaning as it has in the Quarantine Act 1908. Commonwealth contract means a contract, to which the Commonwealth or an agency is or was a party, under which services are to be, or were to be, provided to an agency. Note: See also subsection (9) about provision of services to an agency. Commonwealth enactment means: (a) an Act other than: (i) the Northern Territory (Self-Government) Act 1978; or (ii) an Act providing for the administration or government of an external Territory; or (iii) the Australian Capital Territory (Self-Government) Act 1988; (b) an Ordinance of the Australian Capital Territory; (c) an instrument (including rules, regulations or by-laws) made under an Act to which paragraph (a) applies or under an Ordinance to which paragraph (b) applies; or (d) any other legislation that applies as a law of the Commonwealth (other than legislation in so far as it is applied by an Act referred to in subparagraph (a)(i) or (ii)) or as a law of the Australian Capital Territory, to the extent that it operates as such a law. Commonwealth officer means a person who holds office under, or is employed by, the Commonwealth, and includes: (a) a person appointed or engaged under the Public Service Act 1999; (b) a person (other than a person referred to in paragraph (a)) permanently or temporarily employed by, or in the service of, an agency; (c) a member of the Defence Force; and (d) a member, staff member or special member of the Australian Federal Police; but does not include a person permanently or temporarily employed in the Australian Capital Territory Government Service or in the Public Service of the Northern Territory or of Norfolk Island. consent means express consent or implied consent. contracted service provider, for a government contract, means: (a) an organisation that is or was a party to the government contract and that is or was responsible for the provision of services to an agency or a State or Territory authority under the government contract; or (b) a subcontractor for the government contract. corporation means a body corporate that: (a) is a foreign corporation; (b) is a trading corporation formed within the limits of Australia or is a financial corporation so formed; or (c) is incorporated in a Territory, other than the Northern Territory. credit means a loan sought or obtained by an individual from a credit provider in the course of the credit provider carrying on a business or undertaking as a credit provider, being a loan that is intended to be used wholly or primarily for domestic, family or household purposes. credit card means any article of a kind commonly known as a credit card, charge card or any similar article intended for use in obtaining cash, goods or services by means of loans, and includes any article of a kind commonly issued by persons carrying on business to customers or prospective customers of those persons for use in obtaining goods or services from those persons by means of loans. credit enhancement, in relation to a loan, means: (a) the process of insuring risk associated with purchasing or funding the loan by means of a securitisation arrangement; or (b) any other similar process related to purchasing or funding the loan by those means. credit information file, in relation to an individual, means any record that contains information relating to the individual and is kept by a credit reporting agency in the course of carrying on a credit reporting business (whether or not the record is a copy of the whole or part of, or was prepared using, a record kept by another credit reporting agency or any other person). credit provider has the meaning given by section 11B, and, for the purposes of sections 7 and 8 and Parts III, IV and V, is taken to include a mortgage insurer and a trade insurer. credit report means any record or information, whether in a written, oral or other form, that: (a) is being or has been prepared by a credit reporting agency; and (b) has any bearing on an individual's: (i) eligibility to be provided with credit; or (ii) history in relation to credit; or (iii) capacity to repay credit; and (c) is used, has been used or has the capacity to be used for the purpose of serving as a factor in establishing an individual's eligibility for credit. credit reporting agency has the meaning given by section 11A. credit reporting business means a business or undertaking (other than a business or undertaking of a kind in respect of which regulations made for the purposes of subsection (5C) are in force) that involves the preparation or maintenance of records containing personal information relating to individuals (other than records in which the only personal information relating to individuals is publicly available information), for the purpose of, or for purposes that include as the dominant purpose the purpose of, providing to other persons (whether for profit or reward or otherwise) information on an individual's: (a) eligibility to be provided with credit; or (b) history in relation to credit; or (c) capacity to repay credit; whether or not the information is provided or intended to be provided for the purposes of assessing applications for credit. credit reporting complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant because: (a) it breached the Code of Conduct; or (b) it breached a provision of Part IIIA. credit reporting infringement means: (a) a breach of the Code of Conduct; or (b) a breach of a provision of Part IIIA. current credit provider, in relation to an individual, means a credit provider who has given, to the individual, credit that has not yet been fully repaid or otherwise fully discharged. Defence Force includes the Australian Navy Cadets, the Australian Army Cadets and the Australian Air Force Cadets. Department means an Agency within the meaning of the Public Service Act 1999. eligible case manager means an entity (within the meaning of the Employment Services Act 1994): (a) that is, or has at any time been, a contracted case manager within the meaning of that Act; and (b) that is not covered by paragraph (a), (b), (c), (d), (e), (f), (g) or (h) of the definition of agency. eligible communications service means a postal, telegraphic, telephonic or other like service, within the meaning of paragraph 51(v) of the Constitution. eligible hearing service provider means an entity (within the meaning of the Hearing Services Administration Act 1997): (a) that is, or has at any time been, engaged under Part 3 of the Hearing Services Administration Act 1997 to provide hearing services; and (b) that is not covered by paragraph (a), (b), (c), (d), (e), (f), (g), (h) or (j) of the definition of agency. employee record, in relation to an employee, means a record of personal information relating to the employment of the employee. Examples of personal information relating to the employment of the employee are health information about the employee and personal information about all or any of the following: (a) the engagement, training, disciplining or resignation of the employee; (b) the termination of the employment of the employee; (c) the terms and conditions of employment of the employee; (d) the employee's personal and emergency contact details; (e) the employee's performance or conduct; (f) the employee's hours of employment; (g) the employee's salary or wages; (h) the employee's membership of a professional or trade association; (i) the employee's trade union membership; (j) the employee's recreation, long service, sick, personal, maternity, paternity or other leave; (k) the employee's taxation, banking or superannuation affairs. enforcement body means: (a) the Australian Federal Police; or (aa) the Integrity Commissioner; or (b) the ACC; or (c) the Australian Customs Service; or (d) the Australian Prudential Regulation Authority; or (e) the Australian Securities and Investments Commission; or (f) another agency, to the extent that it is responsible for administering, or performing a function under, a law that imposes a penalty or sanction or a prescribed law; or (g) another agency, to the extent that it is responsible for administering a law relating to the protection of the public revenue; or (h) a police force or service of a State or a Territory; or (i) the New South Wales Crime Commission; or (j) the Independent Commission Against Corruption of New South Wales; or (k) the Police Integrity Commission of New South Wales; or (l) the Crime and Misconduct Commission of Queensland; or (m) another prescribed authority or body that is established under a law of a State or Territory to conduct criminal investigations or inquiries; or (n) a State or Territory authority, to the extent that it is responsible for administering, or performing a function under, a law that imposes a penalty or sanction or a prescribed law; or (o) a State or Territory authority, to the extent that it is responsible for administering a law relating to the protection of the public revenue. Federal Court means the Federal Court of Australia. file number complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant: (a) because it breached a guideline issued under section 17; or (b) because it involved an unauthorised requirement or request for disclosure of a tax file number. financial corporation means a financial corporation within the meaning of paragraph 51(xx) of the Constitution. foreign corporation means a foreign corporation within the meaning of paragraph 51(xx) of the Constitution. Freedom of Information Act means the Freedom of Information Act 1982. generally available publication means a magazine, book, newspaper or other publication (however published) that is or will be generally available to members of the public. genetic relative of an individual (the first individual) means another individual who is related to the first individual by blood, including but not limited to a sibling, a parent or a descendant of the first individual. government contract means a Commonwealth contract or a State contract. guarantee includes an indemnity given against the default of a borrower in making a payment in respect of a loan. health information means: (a) information or an opinion about: (i) the health or a disability (at any time) of an individual; or (ii) an individual's expressed wishes about the future provision of health services to him or her; or (iii) a health service provided, or to be provided, to an individual; that is also personal information; or (b) other personal information collected to provide, or in providing, a health service; or (c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or (d) genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual. health service means: (a) an activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or the person performing it: (i) to assess, record, maintain or improve the individual's health; or (ii) to diagnose the individual's illness or disability; or (iii) to treat the individual's illness or disability or suspected illness or disability; or (b) the dispensing on prescription of a drug or medicinal preparation by a pharmacist. hearing services has the same meaning as in the Hearing Services Administration Act 1997. individual means a natural person. individual concerned, in relation to personal information or a record of personal information, means the individual to whom the information relates. Information Privacy Principle means any of the Information Privacy Principles set out in section 14. Integrity Commissioner has the same meaning as in the Law Enforcement Integrity Commissioner Act 2006. intelligence agency means: (a) the Australian Security Intelligence Organisation; (b) the Australian Secret Intelligence Service; or (c) the Office of National Assessments. IPP complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant because it breached an Information Privacy Principle. loan means a contract, arrangement or understanding under which a person is permitted to defer payment of a debt, or to incur a debt and defer its payment, and includes: (a) a hire-purchase agreement; and (b) such a contract, arrangement or understanding for the hire, lease or renting of goods or services, other than a contract, arrangement or understanding under which: (i) full payment is made before, or at the same time as, the goods or services are provided; and (ii) in the case of a hiring, leasing or renting of goods-an amount greater than or equal to the value of the goods is paid as a deposit for the return of the goods. media organisation means an organisation whose activities consist of or include the collection, preparation for dissemination or dissemination of the following material for the purpose of making it available to the public: (a) material having the character of news, current affairs, information or a documentary; (b) material consisting of commentary or opinion on, or analysis of, news, current affairs, information or a documentary. medical research includes epidemiological research. mortgage credit means credit provided in connection with the acquisition, maintenance or improvement of real property, being credit in respect of which the real property is security. mortgage insurer means a corporation that carries on a business or undertaking (whether for profit, reward or otherwise) that involves providing insurance to credit providers in respect of mortgage credit given by credit providers to other persons. National Privacy Principle means a clause of Schedule 3. A reference in this Act to a National Privacy Principle by number is a reference to the clause of Schedule 3 with that number. nominated AGHS company means a company that: (a) is the nominated company (within the meaning of Part 2 of the Hearing Services and AGHS Reform Act 1997); and (b) is either: (i) Commonwealth-owned (within the meaning of that Part); or (ii) a corporation. NPP complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant because it breached a National Privacy Principle. Ombudsman means the Commonwealth Ombudsman. organisation has the meaning given by section 6C. personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion. principal executive, of an agency, has a meaning affected by section 37. privacy code means a written code regulating acts and practices that affect privacy. record means: (a) a document; or (b) a database (however kept); or (c) a photograph or other pictorial representation of a person; but does not include: (d) a generally available publication; or (e) anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or (f) Commonwealth records as defined by subsection 3(1) of the Archives Act 1983 that are in the open access period for the purposes of that Act; or (fa) records (as defined in the Archives Act 1983) in the custody of the Archives (as defined in that Act) in relation to which the Archives has entered into arrangements with a person other than a Commonwealth institution (as defined in that Act) providing for the extent to which the Archives or other persons are to have access to the records; or (g) documents placed by or on behalf of a person (other than an agency) in the memorial collection within the meaning of the Australian War Memorial Act 1980; or (h) letters or other articles in the course of transmission by post. registered political party means a political party registered under Part XI of the Commonwealth Electoral Act 1918. representative complaint means a complaint where the persons on whose behalf the complaint was made include persons other than the complainant, but does not include a complaint that the Commissioner has determined should no longer be continued as a representative complaint. Secretary means an Agency Head within the meaning of the Public Service Act 1999. securitisation arrangement means an arrangement: (a) involving the funding, or proposed funding, of: (i) loans that have been, or are to be, provided by a credit provider; or (ii) the purchase of loans by a credit provider; by issuing instruments or entitlements to investors; and (b) under which payments to investors in respect of such instruments or entitlements are principally derived, directly or indirectly, from such loans. sensitive information means: (a) information or an opinion about an individual's: (i) racial or ethnic origin; or (ii) political opinions; or (iii) membership of a political association; or (iv) religious beliefs or affiliations; or (v) philosophical beliefs; or (vi) membership of a professional or trade association; or (vii) membership of a trade union; or (viii) sexual preferences or practices; or (ix) criminal record; that is also personal information; or (b) health information about an individual; or (c) genetic information about an individual that is not otherwise health information. serious credit infringement means an act done by a person: (a) that involves fraudulently obtaining credit, or attempting fraudulently to obtain credit; or (b) that involves fraudulently evading the person's obligations in relation to credit, or attempting fraudulently to evade those obligations; or (c) that a reasonable person would consider indicates an intention, on the part of the first-mentioned person, no longer to comply with the first-mentioned person's obligations in relation to credit. small business has the meaning given by section 6D. small business operator has the meaning given by section 6D. solicit, in relation to personal information, means request a person to provide that information, or a kind of information in which that information is included. staff of the Ombudsman means the persons appointed or employed for the purposes of section 31 of the Ombudsman Act 1976. State includes the Australian Capital Territory and the Northern Territory. State contract means a contract, to which a State or Territory or State or Territory authority is or was a party, under which services are to be, or were to be, provided to a State or Territory authority. Note: See also subsection (9) about provision of services to a State or Territory authority. State or Territory authority has the meaning given by section 6C. subcontractor, for a government contract, means an organisation: (a) that is or was a party to a contract (the subcontract): (i) with a contracted service provider for the government contract (within the meaning of paragraph (a) of the definition of contracted service provider); or (ii) with a subcontractor for the government contract (under a previous application of this definition); and (b) that is or was responsible under the subcontract for the provision of services to an agency or a State or Territory authority, or to a contracted service provider for the government contract, for the purposes (whether direct or indirect) of the government contract. tax file number means a tax file number as defined in Part VA of the Income Tax Assessment Act 1936. tax file number information means information (including information forming part of a database), whether compiled lawfully or unlawfully, and whether recorded in a material form or not, that records the tax file number of a person in a manner connecting it with the person's identity. temporary public interest determination means a determination made under section 80A. trade insurer means a corporation that carries on a business or undertaking (whether for profit, reward or otherwise) that involves providing insurance to credit providers in respect of commercial credit given by credit providers to other persons. trading corporation means a trading corporation within the meaning of paragraph 51(xx) of the Constitution. use, in relation to information, does not include mere disclosure of the information, but does include the inclusion of the information in a publication. (1A) In order to avoid doubt, it is declared that an ACT enactment is not a Commonwealth enactment for the purposes of this Act. (2) For the purposes of this Act, an act or practice breaches an Information Privacy Principle if, and only if, it is contrary to, or inconsistent with, that Information Privacy Principle. (3) For the purposes of this Act, an act or practice breaches a guideline issued under section 17 if, and only if, it is contrary to, or inconsistent with, the guideline. (3A) For the purposes of this Act, an act or practice breaches the Code of Conduct if, and only if, it is contrary to, or inconsistent with, the Code of Conduct. (4) The definition of individual in subsection (1) shall not be taken to imply that references to persons do not include persons other than natural persons. (5) For the purposes of this Act, a person shall not be taken to be an agency merely because the person is the holder of, or performs the duties of: (a) a prescribed office; (b) an office prescribed by regulations made for the purposes of subparagraph 4(3)(b)(i) of the Freedom of Information Act 1982; (c) an office established by or under a Commonwealth enactment for the purposes of an agency; (d) a judicial office or of an office of magistrate; or (e) an office of member of a tribunal that is established by or under a law of the Commonwealth and that is prescribed for the purposes of this paragraph. (5A) For the purposes of the definition of credit reporting business in subsection (1), information concerning commercial transactions engaged in by or on behalf of an individual is not to be taken to be information relating to an individual's: (a) eligibility to be provided with credit; or (b) history in relation to credit; or (c) capacity to repay credit. (5B) In considering whether a business or undertaking, carried on by a credit provider that is a corporation, is a credit reporting business within the meaning of this Act, the provision of information by the credit provider to corporations related to it is to be disregarded. (5C) The regulations may provide that businesses or undertakings of a specified kind are not credit reporting businesses within the meaning of this Act. (5D) A reference in this Act to the purchase of a loan includes a reference to the purchase of rights to receive payments under the loan. (6) For the purposes of this Act, the Department of Defence shall be taken to include the Defence Force. (7) Nothing in this Act prevents a complaint from: (a) being both a file number complaint and an IPP complaint; or (b) being both a file number complaint and a credit reporting complaint; or (c) being both a file number complaint and a code complaint; or (d) being both a file number complaint and an NPP complaint; or (e) being both a code complaint and a credit reporting complaint; or (f) being both an NPP complaint and a credit reporting complaint. (8) For the purposes of this Act, the question whether bodies corporate are related to each other is determined in the manner in which that question is determined under the Corporations Act 2001. (9) To avoid doubt, for the purposes of this Act, services provided to an agency or a State or Territory authority include services that consist of the provision of services to other persons in connection with the performance of the functions of the agency or State or Territory authority. 6A Breach of a National Privacy Principle Breach if contrary to, or inconsistent with, Principle (1) For the purposes of this Act, an act or practice breaches a National Privacy Principle if, and only if, it is contrary to, or inconsistent with, that National Privacy Principle. No breach-contracted service provider (2) An act or practice does not breach a National Privacy Principle if: (a) the act is done, or the practice is engaged in: (i) by an organisation that is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and (ii) for the purposes of meeting (directly or indirectly) an obligation under the contract; and (b) the act or practice is authorised by a provision of the contract that is inconsistent with the Principle. No breach-disclosure to the Archives (3) An act or practice does not breach a National Privacy Principle if the act or practice involves the disclosure by an organisation of personal information in a record (as defined in the Archives Act 1983) solely for the purposes of enabling the Archives (as defined in that Act) to decide whether to accept, or to arrange, custody of the record. No breach-act or practice outside Australia (4) An act or practice does not breach a National Privacy Principle if: (a) the act is done, or the practice is engaged in, outside Australia and the external Territories; and (b) the act or practice is required by an applicable law of a foreign country. Effect despite subsection (1) (5) Subsections (2), (3) and (4) have effect despite subsection (1). 6B Breach of an approved privacy code Breach if contrary to, or inconsistent with, code (1) For the purposes of this Act, an act or practice breaches an approved privacy code if, and only if, it is contrary to, or inconsistent with, the code. No breach-contracted service provider (2) An act or practice does not breach an approved privacy code if: (a) the act is done, or the practice is engaged in: (i) by an organisation that is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and (ii) for the purposes of meeting (directly or indirectly) an obligation under the contract; and (b) the act or practice is authorised by a provision of the contract that is inconsistent with the code. No breach-disclosure to the Archives (3) An act or practice does not breach an approved privacy code if the act or practice involves the disclosure by an organisation of personal information in a record (as defined in the Archives Act 1983) solely for the purposes of enabling the Archives (as defined in that Act) to decide whether to accept, or to arrange, custody of the record. No breach-act or practice outside Australia (4) An act or practice does not breach an approved privacy code if: (a) the act is done, or the practice is engaged in, outside Australia and the external Territories; and (b) the act or practice is required by an applicable law of a foreign country. Effect despite subsection (1) (5) Subsections (2), (3) and (4) have effect despite subsection (1). 6C Organisations What is an organisation? (1) In this Act: organisation means: (a) an individual; or (b) a body corporate; or (c) a partnership; or (d) any other unincorporated association; or (e) a trust; that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory. Note: Regulations may prescribe an instrumentality by reference to one or more classes of instrumentality. See subsection 46(2) of the Acts Interpretation Act 1901. Example: Regulations may prescribe an instrumentality of a State or Territory that is an incorporated company, society or association and therefore not a State or Territory authority. Legal person treated as different organisations in different capacities (2) A legal person can have a number of different capacities in which the person does things. In each of those capacities, the person is taken to be a different organisation. Example: In addition to his or her personal capacity, an individual may be the trustee of one or more trusts. In his or her personal capacity, he or she is one organisation. As trustee of each trust, he or she is a different organisation. What is a State or Territory authority? (3) In this Act: State or Territory authority means: (a) a State or Territory Minister; or (b) a Department of State of a State or Territory; or (c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a law of a State or Territory, other than: (i) an incorporated company, society or association; or (ii) an association of employers or employees that is registered or recognised under a law of a State or Territory dealing with the resolution of industrial disputes; or (d) a body established or appointed, otherwise than by or under a law of a State or Territory, by: (i) a Governor of a State; or (ii) the Australian Capital Territory Executive; or (iii) the Administrator of the Northern Territory; or (iv) the Administrator of Norfolk Island; or (v) a State or Territory Minister; or (vi) a person holding an executive office mentioned in section 12 of the Norfolk Island Act 1979; or (e) a person holding or performing the duties of an office established by or under, or an appointment made under, a law of a State or Territory, other than the office of head of a State or Territory Department (however described); or (f) a person holding or performing the duties of an appointment made, otherwise than under a law of a State or Territory, by: (i) a Governor of a State; or (ii) the Australian Capital Territory Executive; or (iii) the Administrator of the Northern Territory; or (iv) the Administrator of Norfolk Island; or (v) a State or Territory Minister; or (vi) a person holding an executive office mentioned in section 12 of the Norfolk Island Act 1979; or (g) a State or Territory court. Making regulations to stop instrumentalities being organisations (4) Before the Governor-General makes regulations prescribing an instrumentality of a State or Territory for the purposes of the definition of organisation in subsection (1), the Minister must: (a) be satisfied that the State or Territory has requested that the instrumentality be prescribed for those purposes; and (b) consider: (i) whether treating the instrumentality as an organisation for the purposes of this Act adversely affects the government of the State or Territory; and (ii) the desirability of regulating under this Act the collection, holding, use, correction, disclosure and transfer of personal information by the instrumentality; and (iii) whether the law of the State or Territory regulates the collection, holding, use, correction, disclosure and transfer of personal information by the instrumentality to a standard that is at least equivalent to the standard that would otherwise apply to the instrumentality under this Act; and (c) consult the Commissioner about the matters mentioned in subparagraphs (b)(ii) and (iii). State does not include Territory (5) In this section: State does not include the Australian Capital Territory or the Northern Territory (despite subsection 6(1)). 6D Small business and small business operators What is a small business? (1) A business is a small business at a time (the test time) in a financial year (the current year) if its annual turnover for the previous financial year is $3,000,000 or less. Test for new business (2) However, if there was no time in the previous financial year when the business was carried on, the business is a small business at the test time only if its annual turnover for the current year is $3,000,000 or less. What is a small business operator? (3) A small business operator is an individual, body corporate, partnership, unincorporated association or trust that: (a) carries on one or more small businesses; and (b) does not carry on a business that is not a small business. Entities that are not small business operators (4) However, an individual, body corporate, partnership, unincorporated association or trust is not a small business operator if he, she or it: (a) carries on a business that has had an annual turnover of more than $3,000,000 for a financial year that has ended after the later of the following: (i) the time he, she or it started to carry on the business; (ii) the commencement of this section; or (b) provides a health service to another individual and holds any health information except in an employee record; or (c) discloses personal information about another individual to anyone else for a benefit, service or advantage; or (d) provides a benefit, service or advantage to collect personal information about another individual from anyone else; or (e) is a contracted service provider for a Commonwealth contract (whether or not a party to the contract). Private affairs of small business operators who are individuals (5) Subsection (4) does not prevent an individual from being a small business operator merely because he or she does something described in paragraph (4)(b), (c) or (d): (a) otherwise than in the course of a business he or she carries on; and (b) only for the purposes of, or in connection with, his or her personal, family or household affairs. Non-business affairs of other small business operators (6) Subsection (4) does not prevent a body corporate, partnership, unincorporated association or trust from being a small business operator merely because it does something described in paragraph (4)(b), (c) or (d) otherwise than in the course of a business it carries on. Disclosure compelled or made with consent (7) Paragraph (4)(c) does not prevent an individual, body corporate, partnership, unincorporated association or trust from being a small business operator only because he, she or it discloses personal information about another individual: (a) with the consent of the other individual; or (b) as required or authorised by or under legislation. Collection with consent or under legislation (8) Paragraph (4)(d) does not prevent an individual, body corporate, partnership, unincorporated association or trust from being a small business operator only because he, she or it: (a) collects personal information about another individual from someone else: (i) with the consent of the other individual; or (ii) as required or authorised by or under legislation; and (b) provides a benefit, service or advantage to be allowed to collect the information. Related bodies corporate (9) Despite subsection (3), a body corporate is not a small business operator if it is related to a body corporate that carries on a business that is not a small business. 6DA What is the annual turnover of a business? What is the annual turnover of a business for a financial year? (1) The annual turnover of a business for a financial year is the total of the following that is earned in the year in the course of the business: (a) the proceeds of sales of goods and/or services; (b) commission income; (c) repair and service income; (d) rent, leasing and hiring income; (e) government bounties and subsidies; (f) interest, royalties and dividends; (g) other operating income. Note: The annual turnover for a financial year of a business carried on by an entity that does not carry on another business will often be similar to the total of the instalment income the entity notifies to the Commissioner of Taxation for the 4 quarters in the year (or for the year, if the entity pays tax in annual instalments). (2) However, if a business has been carried on for only part of a financial year, its annual turnover for the financial year is the amount worked out using the formula: [pic] 6E Small business operator treated as organisation Small business operator that is a reporting entity (1A) If a small business operator is a reporting entity (within the meaning of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006) because of anything done in the course of a small business carried on by the small business operator, this Act applies, with the prescribed modifications (if any), in relation to the activities carried on by the small business operator for the purpose of compliance with: (a) the Anti-Money Laundering and Counter-Terrorism Financing Act 2006; or (b) regulations or AML/CTF Rules under that Act; as if the small business operator were an organisation. Note: The regulations may prescribe different modifications of the Act for different small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901. Regulations treating a small business operator as an organisation (1) This Act applies, with the prescribed modifications (if any), in relation to a small business operator prescribed for the purposes of this subsection as if the small business operator were an organisation. Note 1: The regulations may prescribe different modifications of the Act for different small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901. Note 2: Regulations may prescribe a small business operator by reference to one or more classes of small business operator. See subsection 46(2) of the Acts Interpretation Act 1901. Regulations treating a small business operator as an organisation for particular acts or practices (2) This Act also applies, with the prescribed modifications (if any), in relation to the prescribed acts or practices of a small business operator prescribed for the purposes of this subsection as if the small business operator were an organisation. Note 1: The regulations may prescribe different modifications of the Act for different acts, practices or small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901. Note 2: Regulations may prescribe an act, practice or small business operator by reference to one or more classes of acts, practices or small business operators. See subsection 46(2) of the Acts Interpretation Act 1901. What are modifications? (3) In this section: modifications includes additions, omissions and substitutions. Making regulations (4) Before the Governor-General makes regulations prescribing a small business operator, act or practice for the purposes of subsection (1) or (2), the Minister must: (a) be satisfied that it is desirable in the public interest to regulate under this Act the small business operator, act or practice; and (b) consult the Commissioner about the desirability of regulating under this Act the matters described in paragraph (a). 6EA Small business operators choosing to be treated as organisations (1) This Act (except section 16D) applies in relation to a small business operator as if the operator were an organisation while a choice by the operator to be treated as an organisation is registered under this section. (2) A small business operator may make a choice in writing given to the Commissioner to be treated as an organisation. Note: A small business operator may revoke such a choice by writing given to the Commissioner. See subsection 33(3) of the Acts Interpretation Act 1901. (3) If the Commissioner is satisfied that a small business operator has made the choice to be treated as an organisation, the Commissioner must enter in a register of operators who have made such a choice: (a) the name or names under which the operator carries on business; and (b) the operator's ABN, if the operator has one under the A New Tax System (Australian Business Number) Act 1999. (4) If a small business operator revokes a choice to be treated as an organisation, the Commissioner must remove from the register the material relating to the operator. (5) The Commissioner may decide the form of the register and how it is to be kept. (6) The Commissioner must make the register available to the public in the way that the Commissioner determines. However, the Commissioner must not make available to the public in the register information other than that described in subsection (3). 6F State instrumentalities etc. treated as organisations Regulations treating a State instrumentality etc. as an organisation (1) This Act applies, with the prescribed modifications (if any), in relation to a prescribed State or Territory authority or a prescribed instrumentality of a State or Territory (except an instrumentality that is an organisation because of section 6C) as if the authority or instrumentality were an organisation. Note 1: The regulations may prescribe different modifications of the Act for different authorities or instrumentalities. See subsection 33(3A) of the Acts Interpretation Act 1901. Note 2: Regulations may prescribe an authority or instrumentality by reference to one or more classes of authority or instrumentality. See subsection 46(2) of the Acts Interpretation Act 1901. What are modifications? (2) In this section: modifications includes additions, omissions and substitutions. Making regulations to treat instrumentality etc. as organisation (3) Before the Governor-General makes regulations prescribing a State or Territory authority or instrumentality of a State or Territory for the purposes of subsection (1), the Minister must: (a) be satisfied that the relevant State or Territory has requested that the authority or instrumentality be prescribed for those purposes; and (b) consult the Commissioner about the desirability of regulating under this Act the collection, holding, use, correction, disclosure and transfer of personal information by the authority or instrumentality. 7 Acts and practices of agencies, organisations etc. (1) Except so far as the contrary intention appears, a reference in this Act (other than section 8) to an act or to a practice is a reference to: (a) an act done, or a practice engaged in, as the case may be, by an agency (other than an eligible case manager or an eligible hearing service provider), a file number recipient, a credit reporting agency or a credit provider other than: (i) an agency specified in any of the following provisions of the Freedom of Information Act 1982: (A) Schedule 1; (B) Division 1 of Part I of Schedule 2; (C) Division 1 of Part II of Schedule 2; (ii) a federal court; (iii) a Minister; (iiia) the Integrity Commissioner; or (iv) the ACC; or (v) a Royal Commission; or (vi) the Commission of inquiry; or (b) an act done, or a practice engaged in, as the case may be, by a federal court or by an agency specified in Schedule 1 to the Freedom of Information Act 1982, being an act done, or a practice engaged in, in respect of a matter of an administrative nature; or (c) an act done, or a practice engaged in, as the case may be, by an agency specified in Division 1 of Part II of Schedule 2 to the Freedom of Information Act 1982, other than an act done, or a practice engaged in, in relation to a record in relation to which the agency is exempt from the operation of that Act; or (ca) an act done, or a practice engaged in, as the case may be, by a part of the Department of Defence specified in Division 2 of Part I of Schedule 2 to the Freedom of Information Act 1982, other than an act done, or a practice engaged in, in relation to the activities of that part of the Department; or (cb) an act done, or a practice engaged in, as the case may be, by an eligible case manager in connection with: (i) the provision of case management services (within the meaning of the Employment Services Act 1994) to persons referred to the eligible case manager under Part 4.3 of that Act; or (ii) the performance of functions conferred on the eligible case manager under that Act; or (cc) an act done, or a practice engaged in, as the case may be, by an eligible hearing service provider in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or (d) an act done, or a practice engaged in, as the case may be, by a Minister in relation to the affairs of an agency (other than an eligible hearing service provider or an eligible case manager), not being an act done, or a practice engaged in, in relation to an existing record; or (e) an act done, or a practice engaged in, as the case may be, by a Minister in relation to a record that is in the Minister's possession in his or her capacity as a Minister and relates to the affairs of an agency (other than an eligible hearing service provider or an eligible case manager); or (ea) an act done, or a practice engaged in, as the case may be, by a Minister in relation to the affairs of an eligible case manager, being affairs in connection with: (i) the provision of case management services (within the meaning of the Employment Services Act 1994) to persons referred to the eligible case manager under Part 4.3 of that Act; or (ii) the performance of functions conferred on the eligible case manager under that Act; or (eb) an act done, or a practice engaged in, as the case may be, by a Minister in relation to a record that is in the Minister's possession in his or her capacity as a Minister and relates to the affairs of an eligible case manager, being affairs in connection with: (i) the provision of case management services (within the meaning of the Employment Services Act 1994) to persons referred to the eligible case manager under Part 4.3 of that Act; or (ii) the performance of functions conferred on the eligible case manager under that Act; or (ec) an act done, or a practice engaged in, as the case may be, by a Minister in relation to the affairs of an eligible hearing service provider, being affairs in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or (ed) an act done, or a practice engaged in, as the case may be, by a Minister in relation to a record that is in the Minister's possession in his or her capacity as a Minister and relates to the affairs of an eligible hearing service provider, being affairs in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or (ee) an act done, or a practice engaged in, by an organisation, other than an exempt act or exempt practice (see sections 7B and 7C); but does not include a reference to an act done, or a practice engaged in, in relation to a record that has originated with, or has been received from: (f) an intelligence agency; (g) the Defence Intelligence Organisation, the Defence Imagery and Geospatial Organisation or the Defence Signals Directorate of the Department of Defence; or (ga) the Integrity Commissioner or a staff member of ACLEI (within the meaning of the Law Enforcement Integrity Commissioner Act 2006); or (h) the ACC or the Board of the ACC. (1A) Despite subsections (1) and (2), a reference in this Act (other than section 8) to an act or to a practice does not include a reference to the act or practice so far as it involves the disclosure of personal information to: (a) the Australian Security Intelligence Organisation; or (b) the Australian Secret Intelligence Service; or (c) the Defence Signals Directorate of the Department of Defence. (2) Except so far as the contrary intention appears, a reference in this Act (other than section 8) to an act or to a practice includes, in the application of this Act otherwise than in respect of the Information Privacy Principles, the National Privacy Principles, an approved privacy code and the performance of the Commissioner's functions under section 27, a reference to an act done, or a practice engaged in, as the case may be, by an agency specified in Part I of Schedule 2 to the Freedom of Information Act 1982 or in Division 1 of Part II of that Schedule other than: (a) an intelligence agency; (b) the Defence Intelligence Organisation, the Defence Imagery and Geospatial Organisation or the Defence Signals Directorate of the Department of Defence; or (c) the ACC or the Board of the ACC. (3) Except so far as the contrary intention appears, a reference in this Act to doing an act includes a reference to: (a) doing an act in accordance with a practice; or (b) refusing or failing to do an act. (3A) For the purposes of this Act, an act is only to be taken to have been done, and a practice is only to be taken to have been engaged in, by a credit provider that is not a corporation if the act is done, or the practice is engaged in, in the course of, or for the purposes of, banking (other than State banking not extending beyond the limits of the State concerned) carried on by the credit provider. (4) For the purposes of paragraphs 27(1)(b), (c), (d), (e), (g), (k) and (m), of subsection 31(2) and of Part VI, this section has effect as if a reference in subsection (1) of this section to an act done, or to a practice engaged in, included a reference to an act that is proposed to be done, or to a practice that is proposed to be engaged in, as the case may be. 7A Acts of certain agencies treated as acts of organisation (1) This Act applies, with the prescribed modifications (if any), in relation to an act or practice described in subsection (2) or (3) as if: (a) the act or practice were an act done, or practice engaged in, by an organisation; and (b) the agency mentioned in that subsection were the organisation. (2) Subsection (1) applies to acts done, and practices engaged in, by a prescribed agency. Regulations for this purpose may prescribe an agency only if it is specified in Part I of Schedule 2 to the Freedom of Information Act 1982. (3) Subsection (1) also applies to acts and practices that: (a) are done or engaged in by an agency specified in Division 1 of Part II of Schedule 2 to the Freedom of Information Act 1982 in relation to documents in respect of its commercial activities or the commercial activities of another entity; and (b) relate to those commercial activities. (4) This section has effect despite subparagraph 7(1)(a)(i), paragraph 7(1)(c) and subsection 7(2). (5) In this section: modifications includes additions, omissions and substitutions. 7B Exempt acts and exempt practices of organisations Individuals in non-business capacity (1) An act done, or practice engaged in, by an organisation that is an individual is exempt for the purposes of paragraph 7(1)(ee) if the act is done, or the practice is engaged in, other than in the course of a business carried on by the individual. Note: See also section 16E which provides that the National Privacy Principles do not apply for the purposes of, or in connection with, an individual's personal, family or household affairs. Organisation acting under Commonwealth contract (2) An act done, or practice engaged in, by an organisation is exempt for the purposes of paragraph 7(1)(ee) if: (a) the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and (b) the organisation would be a small business operator if it were not a contracted service provider for a Commonwealth contract; and (c) the act is done, or the practice is engaged in, otherwise than for the purposes of meeting (directly or indirectly) an obligation under a Commonwealth contract for which the organisation is the contracted service provider. Note: This puts the organisation in the same position as a small business operator as far as its activities that are not for the purposes of a Commonwealth contract are concerned, so the organisation need not comply with the National Privacy Principles or a binding approved privacy code in relation to those activities. Employee records (3) An act done, or practice engaged in, by an organisation that is or was an employer of an individual, is exempt for the purposes of paragraph 7(1)(ee) if the act or practice is directly related to: (a) a current or former employment relationship between the employer and the individual; and (b) an employee record held by the organisation and relating to the individual. Journalism (4) An act done, or practice engaged in, by a media organisation is exempt for the purposes of paragraph 7(1)(ee) if the act is done, or the practice is engaged in: (a) by the organisation in the course of journalism; and (b) at a time when the organisation is publicly committed to observe standards that: (i) deal with privacy in the context of the activities of a media organisation (whether or not the standards also deal with other matters); and (ii) have been published in writing by the organisation or a person or body representing a class of media organisations. Organisation acting under State contract (5) An act done, or practice engaged in, by an organisation is exempt for the purposes of paragraph 7(1)(ee) if: (a) the organisation is a contracted service provider for a State contract (whether or not the organisation is a party to the contract); and (b) the act is done, or the practice is engaged in for the purposes of meeting (directly or indirectly) an obligation under the contract. 7C Political acts and practices are exempt Members of a Parliament etc. (1) An act done, or practice engaged in, by an organisation (the political representative) consisting of a member of a Parliament, or a councillor (however described) of a local government authority, is exempt for the purposes of paragraph 7(1)(ee) if the act is done, or the practice is engaged in, for any purpose in connection with: (a) an election under an electoral law; or (b) a referendum under a law of the Commonwealth or a law of a State or Territory; or (c) the participation by the political representative in another aspect of the political process. Contractors for political representatives etc. (2) An act done, or practice engaged in, by an organisation (the contractor) is exempt for the purposes of paragraph 7(1)(ee) if the act is done or the practice is engaged in: (a) for the purposes of meeting an obligation under a contract between the contractor and a registered political party or a political representative described in subsection (1); and (b) for any purpose in connection with one or more of the following: (i) an election under an electoral law; (ii) a referendum under a law of the Commonwealth or a law of a State or Territory; (iii) the participation in another aspect of the political process by the registered political party or political representative; (iv) facilitating acts or practices of the registered political party or political representative for a purpose mentioned in subparagraph (i), (ii) or (iii) of this paragraph. Subcontractors for organisations covered by subsection (1) etc. (3) An act done, or practice engaged in, by an organisation (the subcontractor) is exempt for the purposes of paragraph 7(1)(ee) if the act is done or the practice is engaged in: (a) for the purposes of meeting an obligation under a contract between the subcontractor and a contractor described in subsection (2); and (b) for a purpose described in paragraph (2)(b). Volunteers for registered political parties (4) An act done voluntarily, or practice engaged in voluntarily, by an organisation for or on behalf of a registered political party and with the authority of the party is exempt for the purposes of paragraph 7(1)(ee) if the act is done or the practice is engaged in for any purpose in connection with one or more of the following: (a) an election under an electoral law; (b) a referendum under a law of the Commonwealth or a law of a State or Territory; (c) the participation in another aspect of the political process by the registered political party; (d) facilitating acts or practices of the registered political party for a purpose mentioned in paragraph (a), (b) or (c). Effect of subsection (4) on other operation of Act (5) Subsection (4) does not otherwise affect the operation of the Act in relation to agents or principals. Meaning of electoral law and Parliament (6) In this section: electoral law means a law of the Commonwealth, or a law of a State or Territory, relating to elections to a Parliament or to a local government authority. Parliament means: (a) the Parliament of the Commonwealth; or (b) a State Parliament; or (c) the legislature of a Territory. Note: To avoid doubt, this section does not make exempt for the purposes of paragraph 7(1)(ee) an act or practice of the political representative, contractor, subcontractor or volunteer for a registered political party involving the use or disclosure (by way of sale or otherwise) of personal information in a way not covered by subsection (1), (2), (3) or (4) (as appropriate). The rest of this Act operates normally in relation to that act or practice. 8 Acts and practices of, and disclosure of information to, staff of agency, organisation etc. (1) For the purposes of this Act: (a) an act done or practice engaged in by, or information disclosed to, a person employed by, or in the service of, an agency, organisation, file number recipient, credit reporting agency or credit provider in the performance of the duties of the person's employment shall be treated as having been done or engaged in by, or disclosed to, the agency, organisation, recipient, credit reporting agency or credit provider; (b) an act done or practice engaged in by, or information disclosed to, a person on behalf of, or for the purposes of the activities of, an unincorporated body, being a board, council, committee, sub-committee or other body established by or under a Commonwealth enactment for the purpose of assisting, or performing functions in connection with, an agency or organisation, shall be treated as having been done or engaged in by, or disclosed to, the agency or organisation; and (c) an act done or practice engaged in by, or information disclosed to, a member, staff member or special member of the Australian Federal Police in the performance of his or her duties as such a member, staff member or special member shall be treated as having been done or engaged in by, or disclosed to, the Australian Federal Police. (2) Where: (a) an act done or a practice engaged in by a person, in relation to a record, is to be treated, under subsection (1), as having been done or engaged in by an agency; and (b) that agency is not the record-keeper in relation to that record; that act or practice shall be treated as the act or the practice of the record-keeper in relation to that record. (3) For the purposes of the application of this Act in relation to an organisation that is a partnership: (a) an act done or practice engaged in by a partner is taken to have been done or engaged in by the organisation; and (b) a communication (including a complaint, notice, request or disclosure of information) made to a partner is taken to have been made to the organisation. (4) For the purposes of the application of this Act in relation to an organisation that is an unincorporated association: (a) an act done or practice engaged in by a member of the committee of management of the association is taken to have been done or engaged in by the organisation; and (b) a communication (including a complaint, notice, request or disclosure of information) made to a member of the committee of management of the association is taken to have been made to the organisation. (5) For the purposes of the application of this Act in relation to an organisation that is a trust: (a) an act done or practice engaged in by a trustee is taken to have been done or engaged in by the organisation; and (b) a communication (including a complaint, notice or request or disclosure of information) made to a trustee is taken to have been made to the organisation. 9 Collectors (1) An agency that collects personal information shall be treated, for the purposes of this Act, as a collector in relation to that information. (2) Subject to subsection (3), where personal information is collected by a person: (a) in the course of the person's employment by, or in the service of, an agency other than the Australian Federal Police; or (b) as a member, staff member or special member of the Australian Federal Police in the performance of his or her duties as such a member, staff member or special member; then, for the purposes of this Act: (c) if paragraph (a) applies-the agency first referred to in that paragraph; and (d) if paragraph (b) applies-the Australian Federal Police; shall be treated as a collector in relation to that information. (3) Where personal information is collected by a person for the purposes of the activities of, an unincorporated body, being a board, council, committee, sub-committee or other body established by or under a Commonwealth enactment for the purpose of assisting, or performing functions connected with, an agency, that agency shall be treated, for the purposes of this Act, as a collector in relation to that information. 10 Record-keepers (1) Subject to subsections (4) and (5), an agency that is in possession or control of a record of personal information shall be regarded, for the purposes of this Act, as the record-keeper in relation to that record. (2) Subject to subsections (3), (4) and (5), where a record of personal information is in the possession or under the control of a person: (a) in the course of the person's employment in the service of or by an agency other than the Australian Federal Police; or (b) as a member, staff member or special member of the Australian Federal Police in the performance of his or her duties as such a member, staff member or special member; then, for the purposes of this Act, the record-keeper in relation to that record shall be taken to be: (c) if paragraph (a) applies-the agency first referred to in that paragraph; and (d) if paragraph (b) applies-the Australian Federal Police. (3) Where a record of personal information is in the possession or under the control of a person for the purposes of the activities of, an unincorporated body, being a board, council, committee, sub- committee or other body established by or under a Commonwealth enactment for the purpose of assisting, or performing functions connected with, an agency, that agency shall be regarded, for the purposes of this Act, as the record-keeper in relation to that record. (4) Where: (a) a record of personal information (not being a record relating to the administration of the Australian Archives) is in the custody of the Australian Archives; or (b) a record of personal information (not being a record relating to the administration of the Australian War Memorial) is in the custody of the Australian War Memorial; the agency by or on behalf of which the record was placed in that custody or, if that agency no longer exists, the agency to whose functions the contents of the record are most closely related, shall be regarded, for the purposes of this Act, as the record- keeper in relation to that record. (5) Where a record of personal information was placed by or on behalf of an agency in the memorial collection within the meaning of the Australian War Memorial Act 1980, that agency or, if that agency no longer exists, the agency to whose functions the contents of the record are most closely related, shall be regarded, for the purposes of this Act, as the record-keeper in relation to that record. 11 File number recipients (1) A person who is (whether lawfully or unlawfully) in possession or control of a record that contains tax file number information shall be regarded, for the purposes of this Act, as a file number recipient. (2) Subject to subsection (3), where a record that contains tax file number information is in the possession or under the control of a person: (a) in the course of the person's employment in the service of or by a person or body other than an agency; (b) in the course of the person's employment in the service of or by an agency other than the Australian Federal Police; or (c) as a member, staff member or special member of the Australian Federal Police in the performance of his or her duties as such a member, staff member or special member; then, for the purposes of this Act, the file number recipient in relation to that record shall be taken to be: (d) if paragraph (a) applies-the person's employer; (e) if paragraph (b) applies-the agency first referred to in that paragraph; and (f) if paragraph (c) applies-the Australian Federal Police. (3) Where a record that contains tax file number information is in the possession or under the control of a person for the purposes of the activities of, an unincorporated body, being a board, council, committee, sub-committee or other body established by or under a Commonwealth enactment for the purpose of assisting, or performing functions connected with, an agency, that agency shall be treated, for the purposes of this Act, as the file number recipient in relation to that record. 11A Credit reporting agencies For the purposes of this Act, a person is a credit reporting agency if the person is a corporation that carries on a credit reporting business. 11B Credit providers (1) For the purposes of this Act, but subject to subsection (2), a person is a credit provider if the person is: (a) a bank; or (b) a corporation (other than an agency): (iii) a substantial part of whose business or undertaking is the provision of loans (including the provision of loans by issuing credit cards); or (iv) that carries on a retail business in the course of which it issues credit cards to members of the public in connection with the sale of goods, or the supply of services, by the corporation; or (v) that: (A) carries on a business or undertaking involving the provision of loans (including the provision of loans by issuing credit cards); and (B) is included in a class of corporations determined by the Commissioner to be credit providers for the purposes of this Act; or (c) a person: (i) who is not a corporation; and (ii) in relation to whom paragraph (b) would apply if the person were a corporation; or (d) an agency that: (i) carries on a business or undertaking that involves the making of loans; and (ii) is determined by the Commissioner to be a credit provider for the purposes of this Act. (1A) If an agency is a credit provider because of paragraph (1)(d), Part IIIA has effect in relation to the carrying on by the agency of a business or undertaking involving the making of loans despite anything in Part III or in the Freedom of Information Act 1982. (2) For the purposes of this Act, a corporation that would, but for this section, be a credit provider is not to be regarded as a credit provider if it is included in a class of corporations declared by the regulations not to be credit providers. (3) A determination under sub-subparagraph (1)(b)(v)(B) or subparagraph (1)(d)(ii) is to be made by notice in writing published in the Gazette. (4) A notice so published is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901. (4A) Subsection (4B) applies to a person who carries on a business that is involved in one or both of the following: (a) a securitisation arrangement; (b) managing loans that are the subject of a securitisation arrangement. (4B) While a person to whom this subsection applies is performing a task that is reasonably necessary for purchasing, funding or managing, or processing an application for, a loan by means of a securitisation arrangement (being a loan that has been provided by, or in respect of which application has been made to, a credit provider): (a) the person: (i) is taken, for the purposes of this Act, to be another credit provider; and (ii) is subject to the same obligations under this Act as any other credit provider; and (b) for the purposes of this Act, the loan is taken to have been provided by, or the application for the loan is taken to have been made to, both the person and the first-mentioned credit provider. (4C) Nothing in this Act prevents a report (within the meaning of subsection 18N(9)) to which section 18N applies being disclosed if: (a) the disclosure is reasonably necessary for purchasing, funding or managing, or processing an application for, a loan by means of a securitisation arrangement (being a loan that has been provided by, or in respect of which an application has been made to, a credit provider); and (b) the disclosure takes place between a person to whom subsection (4B) applies in relation to that loan and: (i) the credit provider; or (ii) another person to whom that subsection applies in relation to that loan. (4D) A reference in subsection (4B) or (4C) to purchasing or funding a loan by means of a securitisation arrangement includes a reference to credit enhancement of the loan. (4E) A reference in subsection (4B) or (4C) to managing a loan does not include a reference to an act relating to the collection of overdue payments in respect of the loan if the act is undertaken by a person whose primary function in relation to the loan is the collection of overdue payments. (5) Subject to subsection (6), while a person is acting as an agent of a credit provider in performing, on behalf of the credit provider, a task that is necessary: (a) in processing an application for a loan; or (b) in managing: (i) a loan given by the credit provider; or (ii) an account maintained by any person with the credit provider; the first-mentioned person: (c) is taken, for the purposes of this Act, to be another credit provider; and (d) is subject to the same obligations under this Act as any other credit provider. (6) Nothing in this Act prevents such an agent of a credit provider disclosing to the credit provider, in the agent's capacity as such an agent, a report (within the meaning of subsection 18N(9)) to which section 18N applies. (7) The reference in subsection (5) to the management of a loan does not include a reference to any act relating to the collection of payments that are overdue in respect of the loan. 12 Application of Information Privacy Principles to agency in possession For the purposes of this Act, where an agency has possession but not control of a record of personal information, the Information Privacy Principles apply in relation to that agency to the extent only of the obligations or duties to which that agency is subject, otherwise than by virtue of the operation of this Act, because it is in possession of that particular record. 12A Act not to apply in relation to State banking or insurance within that State Where, but for this section, a provision of this Act: (a) would have a particular application; and (b) by virtue of having that application, would be a law with respect to, or with respect to matters including: (i) State banking not extending beyond the limits of the State concerned; or (ii) State insurance not extending beyond the limits of the State concerned; the provision is not to have that application. 12B Severability: additional effect of Act in relation to organisations (1) Without limiting its effect apart from each of the following subsections of this section, this Act also has effect in relation to organisations as provided by that subsection. (2) This Act also has the effect it would have if its operation in relation to organisations were expressly confined to an operation to give effect to the International Covenant on Civil and Political Rights, and in particular Article 17 of the Covenant. Note: The text of the International Covenant on Civil and Political Rights is set out in Australian Treaty Series 1980 No. 23. In 2000, this was available in the Australian Treaties Library of the Department of Foreign Affairs and Trade, accessible on the Internet through that Department's world-wide web site. (3) This Act also has the effect it would have if its operation in relation to organisations were expressly confined to acts or practices covered by subsection 5B(1) (which deals with acts and practices outside Australia and the external Territories by organisations). (4) This Act also has the effect it would have if its operation in relation to organisations were expressly confined to organisations that are corporations. (5) This Act also has the effect it would have if its operation in relation to organisations were expressly confined to acts or practices of organisations taking place in the course of, or in relation to, trade or commerce: (a) between Australia and places outside Australia; or (b) among the States; or (c) within a Territory, between a State and a Territory or between 2 Territories. (6) This Act also has the effect it would have if its operation in relation to organisations were expressly confined to acts or practices of organisations taking place using a postal, telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution. (7) This Act also has the effect it would have if its operation in relation to organisations were expressly confined to acts or practices of organisations taking place in a Territory. (8) This Act also has the effect it would have if its operation in relation to organisations were expressly confined to acts or practices of organisations taking place in a place acquired by the Commonwealth for public purposes. Part III-Information privacy Division 1-Interferences with privacy 13 Interferences with privacy For the purposes of this Act, an act or practice is an interference with the privacy of an individual if the act or practice: (a) in the case of an act or practice engaged in by an agency (whether or not the agency is also a file number recipient, credit reporting agency or credit provider)-breaches an Information Privacy Principle in relation to personal information that relates to the individual; (b) in the case of an act or practice engaged in by a file number recipient (whether or not the file number recipient is also an agency, organisation, credit reporting agency or credit provider)-breaches a guideline under section 17 in relation to tax file number information that relates to the individual; (ba) constitutes a breach of Part 2 of the Data-matching Program (Assistance and Tax) Act 1990 or the guidelines in force under that Act; (bb) constitutes a breach of the guidelines in force under section 135AA of the National Health Act 1953; (c) involves an unauthorised requirement or request for disclosure of the tax file number of the individual; or (d) in the case of an act or practice engaged in by a credit reporting agency or credit provider (whether or not the credit reporting agency or credit provider is also an agency, organisation or file number recipient)-constitutes a credit reporting infringement in relation to personal information that relates to the individual. 13A Interferences with privacy by organisations General rule (1) For the purposes of this Act, an act or practice of an organisation is an interference with the privacy of an individual if: (a) the act or practice breaches an approved privacy code that binds the organisation in relation to personal information that relates to the individual; or (b) both of the following apply: (i) the act or practice breaches a National Privacy Principle in relation to personal information that relates to the individual; (ii) the organisation is not bound by an approved privacy code in relation to the personal information; or (c) all of the following apply: (i) the act or practice relates to personal information that relates to the individual; (ii) the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); (iii) because of a provision of the contract that is inconsistent with an approved privacy code or a National Privacy Principle that applies to the organisation in relation to the personal information, the act or practice does not breach the code or Principle (see subsections 6A(2) and 6B(2)); (iv) the act is done, or the practice is engaged in, in a manner contrary to, or inconsistent with, that provision; or (d) the act or practice involves the organisation in a contravention of section 16F (which limits direct marketing using information collected under a Commonwealth contract) involving personal information that relates to the individual. Note: Sections 13B, 13C and 13D contain exceptions to this rule. Rule applies even if other rules also apply (2) It does not matter whether the organisation is also a credit reporting agency, a credit provider or a file number recipient. 13B Related bodies corporate Acts or practices that are not interferences with privacy (1) Despite paragraphs 13A(1)(a) and (b), each of the following acts or practices of an organisation that is a body corporate is not an interference with the privacy of an individual: (a) the collection of personal information (other than sensitive information) about the individual by the body corporate from a related body corporate; (b) the disclosure of personal information (other than sensitive information) about the individual by the body corporate to a related body corporate. Note: Subsection (1) lets related bodies corporate share personal information. However, in using or holding the information, they must comply with the National Privacy Principles or a binding approved privacy code. For example, there is an interference with privacy if: (a) a body corporate uses personal information it has collected from a related body corporate; and (b) the use breaches National Privacy Principle 2 (noting that the collecting body's primary purpose of collection will be taken to be the same as that of the related body) or a corresponding provision in a binding approved privacy code. (1A) However, paragraph (1)(a) does not apply to the collection by a body corporate of personal information (other than sensitive information) from: (a) a related body corporate that is not an organisation; or (b) a related body corporate whose disclosure of the information to the body corporate is an exempt act or exempt practice for the purposes of paragraph 7(1)(ee); or (c) a related body corporate whose disclosure of the information to the body corporate is not an interference with privacy because of section 13D. Note: The effect of subsection (1A) is that a body corporate's failure to comply with the National Privacy Principles, or a binding approved privacy code, in collecting personal information about an individual from a related body corporate covered by that subsection is an interference with the privacy of the individual. Relationship with paragraphs 13A(1)(c) and (d) (2) Subsection (1) does not prevent an act or practice of an organisation from being an interference with the privacy of an individual under paragraph 13A(1)(c) or (d). 13C Change in partnership because of change in partners Acts or practices that are not interferences with privacy (1) If: (a) an organisation (the new partnership) that is a partnership forms at the same time as, or immediately after, the dissolution of another partnership (the old partnership); and (b) at least one person who was a partner in the old partnership is a partner in the new partnership; and (c) the new partnership carries on a business that is the same as, or similar to, a business carried on by the old partnership; and (d) the new partnership holds, immediately after its formation, personal information about an individual that the old partnership held immediately before its dissolution; neither the disclosure (if any) by the old partnership, nor the collection (if any) by the new partnership, of the information that was necessary for the new partnership to hold the information immediately after its formation constitutes an interference with the privacy of the individual. Note: Subsection (1) lets personal information be passed on from an old to a new partnership. However, in using or holding the information, they must comply with the National Privacy Principles or a binding approved privacy code. For example, the new partnership's use of personal information collected from the old partnership may constitute an interference with privacy if it breaches National Privacy Principle 2 or a corresponding provision in a binding approved privacy code. Effect despite section 13A (2) Subsection (1) has effect despite section 13A. 13D Overseas act required by foreign law Acts or practices that are not interferences with privacy (1) An act or practice of an organisation done or engaged in outside Australia and an external Territory is not an interference with the privacy of an individual if the act or practice is required by an applicable law of a foreign country. Effect despite section 13A (2) Subsection (1) has effect despite section 13A. 13E Effect on section 13 of sections 13B, 13C and 13D Sections 13B, 13C and 13D do not prevent an act or practice of an organisation from being an interference with the privacy of an individual under section 13. 13F Act or practice not covered by section 13 or section 13A is not an interference with privacy An act or practice that is not covered by section 13 or section 13A is not an interference with the privacy of an individual. Division 2-Information Privacy Principles 14 Information Privacy Principles The Information Privacy Principles are as follows: Information Privacy Principles Principle 1 Manner and purpose of collection of personal information 1. Personal information shall not be collected by a collector for inclusion in a record or in a generally available publication unless: (a) the information is collected for a purpose that is a lawful purpose directly related to a function or activity of the collector; and (b) the collection of the information is necessary for or directly related to that purpose. 2. Personal information shall not be collected by a collector by unlawful or unfair means. Principle 2 Solicitation of personal information from individual concerned Where: (a) a collector collects personal information for inclusion in a record or in a generally available publication; and (b) the information is solicited by the collector from the individual concerned; the collector shall take such steps (if any) as are, in the circumstances, reasonable to ensure that, before the information is collected or, if that is not practicable, as soon as practicable after the information is collected, the individual concerned is generally aware of: (c) the purpose for which the information is being collected; (d) if the collection of the information is authorised or required by or under law-the fact that the collection of the information is so authorised or required; and (e) any person to whom, or any body or agency to which, it is the collector's usual practice to disclose personal information of the kind so collected, and (if known by the collector) any person to whom, or any body or agency to which, it is the usual practice of that first-mentioned person, body or agency to pass on that information. Principle 3 Solicitation of personal information generally Where: (a) a collector collects personal information for inclusion in a record or in a generally available publication; and (b) the information is solicited by the collector; the collector shall take such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is collected: (c) the information collected is relevant to that purpose and is up to date and complete; and (d) the collection of the information does not intrude to an unreasonable extent upon the personal affairs of the individual concerned. Principle 4 Storage and security of personal information A record-keeper who has possession or control of a record that contains personal information shall ensure: (a) that the record is protected, by such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorised access, use, modification or disclosure, and against other misuse; and (b) that if it is necessary for the record to be given to a person in connection with the provision of a service to the record- keeper, everything reasonably within the power of the record- keeper is done to prevent unauthorised use or disclosure of information contained in the record. Principle 5 Information relating to records kept by record-keeper 1. A record-keeper who has possession or control of records that contain personal information shall, subject to clause 2 of this Principle, take such steps as are, in the circumstances, reasonable to enable any person to ascertain: (a) whether the record-keeper has possession or control of any records that contain personal information; and (b) if the record-keeper has possession or control of a record that contains such information: (i) the nature of that information; (ii) the main purposes for which that information is used; and (iii) the steps that the person should take if the person wishes to obtain access to the record. 2. A record-keeper is not required under clause 1 of this Principle to give a person information if the record-keeper is required or authorised to refuse to give that information to the person under the applicable provisions of any law of the Commonwealth that provides for access by persons to documents. 3. A record-keeper shall maintain a record setting out: (a) the nature of the records of personal information kept by or on behalf of the record-keeper; (b) the purpose for which each type of record is kept; (c) the classes of individuals about whom records are kept; (d) the period for which each type of record is kept; (e) the persons who are entitled to have access to personal information contained in the records and the conditions under which they are entitled to have that access; and (f) the steps that should be taken by persons wishing to obtain access to that information. 4. A record-keeper shall: (a) make the record maintained under clause 3 of this Principle available for inspection by members of the public; and (b) give the Commissioner, in the month of June in each year, a copy of the record so maintained. Principle 6 Access to records containing personal