Information Privacy Principles
Information Privacy Principle 1
1. Personal information shall not be collected by a collector for inclusion
in a record or in a generally available publication unless:
a) the information is collected for a purpose that is a lawful purpose directly
related to a function or activity of the collector; and
b) the collection of information is necessary for or directly related to that
purpose
2. Personal information shall not be collected by a collector by unlawful or unfair means.
Information Privacy Principle 2
Where:
a) a collector collects personal information for inclusion in a record or in
a generally available publication; and
b) the information is solicited by the collector from the individual concerned;
the collector shall take such steps (if any) as are, in the circumstances, reasonable
to ensure that, before the information is collected or, if that is not practicable,
as soon as practicable after the information is collected, the individual concerned
is generally aware of:
- the purpose for which the information is being collected;
- if the collection of the information is authorised or required by or under law, the fact that the collection of the information is so authorised or required; and
- any person to whom, or any agency to which, it is the collector’s usual practice to disclose personal information of the kind so collected, and (if known by the collector) any person to whom, or anybody or agency to which, it is the usual practice of that first-mentioned person, body, or agency to pass on that information.
Information Privacy Principle 3
Where:
a) a collector collects personal information for inclusion in a record or in
a generally available publication; and
b) the information is solicited by the collector; the collector shall take such
steps (if any) as are, in the circumstances, reasonable to ensure that, having
regard to the purpose for which the information is collected:
- the information collected is relevant to that purpose and is up to date and complete; and
- the collection of the information does not intrude to an unreasonable extent upon the personal affairs of the individual concerned.
Information Privacy Principle 4
A record-keeper who has possession or control of a record that contains personal
information shall ensure:
a) that the record is protected, by such security safeguards as it is reasonable
in the circumstances to take, against loss, against authorised access, use,
modification or disclosure, and against other misuse; and
b) that if it is necessary for the record to be given to a person in connection
with the provision of a service to the record-keeper, everything reasonably
within the power of the record-keeper is done to prevent unauthorised use or
disclosure of information contained in the record.
Information Privacy Principle 5
1. A record-keeper who has possession or control of records that contain personal
information shall, subject to clause 2 of this principle, takes such steps as
are, in the circumstances, reasonable to enable any person to ascertain:
a) whether the record-keeper has possession or control of any records that contain
personal information; and
b) if the record-keeper has possession or control of a record that contains
such information:
- the nature of that information;
- the main purposes for which the information is used; and
- the steps that the person should take if the person wishes to obtain access to the record.
2. A record-keeper is not required under clause 1 of this Principle to give
a person information if the record-keeper is required or authorised to refuse
to give that information to the person under the applicable provisions of any
law of the State that provides for access by persons to documents.
3. A record-keeper shall maintain a record in the form of a privacy plan setting
out:
- The nature of the records of personal information kept by or on behalf of the record-keeper;
- The purpose for which each type of record is kept;
- The classes or types of individuals about whom records are kept;
- The period for which each type of record is kept;
- The persons who are entitled to have access to personal information contained in the records and the conditions under which they are entitled to have that access; and
- The steps that should be taken by persons wishing to obtain access to that information.
4. A record-keeper shall make the record maintained under clause 3 of this Principle available for inspection by members of the public.
Information Privacy Principle 6
Where a record-keeper has possession or control of a record that contains personal
information, the individual concerned shall be entitled to have access to that
record, except to the extent that the record-keeper is required or authorised
to refuse to provide the individual with access to that record under the applicable
provisions of any law of the State that provides for access by persons to documents.
Information Privacy Principle 7
1. A record-keeper who has possession or control of a record that contains personal
information shall take such steps (if any) by way of making appropriate correction,
deletions, and additions as are, in the circumstances, reasonable to ensure
that the record:
- Is accurate; and
- Is, having regard to the purpose for which the information was collected or is to be used and to any purpose that is directly related to that purpose, relevant, up to date, complete, and not misleading.
2. The obligation imposed on a record-keeper by clause 1 is subject to any
applicable limitation in a law of the State that provides a right to require
the correction or amendments of documents.
3. Where:
a) the record-keeper of a record containing personal information is not willing
to amend that record, by making a correction, deletion, or addition, in accordance
with a request by the individual concerned, and
b) no decision or recommendation to the effect that the record should be amended
wholly or partly in accordance with that request has been made under the applicable
provision of a law of the State; the record-keeper shall, if so requested by
the individual concerned, take such steps (if any) as are reasonable in the
circumstances to attach to the record any statement provided by that individual
of the correction, deletion, or addition sought.
Information Privacy Principle 8
A record-keeper who has possession or control of a record that contains personal
information shall not use that information without taking such steps (if any)
as are, in the circumstances, reasonable to ensure that, having regard to the
purpose for which the information is proposed to be used, the information is
accurate, up to date, and complete.
Information Privacy Principle 9
A record-keeper who has possession or control of a record that contains personal
information shall not use the information except for a purpose to which the
information is relevant.
Information Privacy Principle 10
1. A record-keeper who has possession or control of a record that contains personal
information that was obtained for a particular purpose shall not use the information
for any other purpose unless:
a) the individual concerned has consented to use of the information for that
purpose;
b) the record-keeper believes on reasonable grounds that use of the information
for that other purpose is necessary to prevent or lessen a serious or imminent
threat to the life of the individual concerned or another person;
c) use of the information for that other purpose is required or authorised under
law;
d) use of the information for that other purpose is reasonably necessary for
enforcement of the criminal law or of a law imposing a pecuniary penalty, or
for the protection of the public revenue; or
e) the purpose for which the information is used is directly related to the
purpose for which the information was obtained.
2. Where personal information is used for enforcement of the criminal law or
of a law imposing a pecuniary penalty, or for the protection of the public revenue,
the record-keeper shall include in the record containing that information a
note of that use.
Information Privacy Principle 11
1. A record-keeper who has possession or control of a record that contains personal
information shall not disclose the information to a person, body, or agency
(other than the individual concerned) unless:
a) the individual concerned is reasonably likely to have been aware, or made
aware under Principle 2, that information of that kind is usually passed to
that person, body, or agency;
b) the individual concerned has consented to the disclosure;
c) the record-keeper believes on reasonable grounds that the disclosure is necessary
to prevent or lessen a serious and imminent threat to the life or health of
the individual concerned or of another person;
d) the disclosure is required or authorised by or under law; or
e) the disclosure is reasonably necessary for the enforcement of the criminal
law or of a law imposing a pecuniary penalty, or for the protection of the public
revenue.
Last updated: 20 April 2005
