Commonwealth Consolidated Acts

PRIVACY ACT 1988 - SECT 13B

Acts or practices that are not interferences with privacy

             (1)  Despite paragraphs 13A(1)(a) and (b), each of the following acts or practices of an organisation that is a body corporate is not an interference with the privacy of an individual:

                     (a)  the collection of personal information (other than sensitive information) about the individual by the body corporate from a related body corporate;

                     (b)  the disclosure of personal information (other than sensitive information) about the individual by the body corporate to a related body corporate.

Note:          Subsection (1) lets related bodies corporate share personal information. However, in using or holding the information, they must comply with the National Privacy Principles or a binding approved privacy code. For example, there is an interference with privacy if:

(a)           a body corporate uses personal information it has collected from a related body corporate; and

(b)           the use breaches National Privacy Principle 2 (noting that the collecting body's primary purpose of collection will be taken to be the same as that of the related body) or a corresponding provision in a binding approved privacy code.

          (1A)  However, paragraph (1)(a) does not apply to the collection by a body corporate of personal information (other than sensitive information) from:

                     (a)  a related body corporate that is not an organisation; or

                     (b)  a related body corporate whose disclosure of the information to the body corporate is an exempt act or exempt practice for the purposes of paragraph 7(1)(ee); or

                     (c)  a related body corporate whose disclosure of the information to the body corporate is not an interference with privacy because of section 13D.

Note:          The effect of subsection (1A) is that a body corporate's failure to comply with the National Privacy Principles, or a binding approved privacy code, in collecting personal information about an individual from a related body corporate covered by that subsection is an interference with the privacy of the individual.

Relationship with paragraphs 13A(1)(c) and (d)

             (2)  Subsection (1) does not prevent an act or practice of an organisation from being an interference with the privacy of an individual under paragraph 13A(1)(c) or (d).