PRIVACY ACT 1988

PART I - PRELIMINARY  

SECTION 1   1   SHORT TITLE  
This Act may be cited as the Privacy Act 1988.

SECTION 2   2   COMMENCEMENT  
This Act commences on a day to be fixed by Proclamation.

SECTION 2A   2A   OBJECTS OF THIS ACT  


The objects of this Act are:


(a) to promote the protection of the privacy of individuals; and


(b) to recognise that the protection of the privacy of individuals is balanced with the interests of entities in carrying out their functions or activities; and


(c) to provide the basis for nationally consistent regulation of privacy and the handling of personal information; and


(d) to promote responsible and transparent handling of personal information by entities; and


(e) to facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected; and


(f) to facilitate the free flow of information across national borders while ensuring that the privacy of individuals is respected; and


(g) to provide a means for individuals to complain about an alleged interference with their privacy; and


(h) to implement Australia's international obligation in relation to privacy.

SECTION 3   3   SAVING OF CERTAIN STATE AND TERRITORY LAWS  


It is the intention of the Parliament that this Act is not to affect the operation of a law of a State or of a Territory that makes provision with respect to the collection, holding, use, correction or disclosure of personal information (including such a law relating to credit reporting or the use of information held in connection with credit reporting) and is capable of operating concurrently with this Act.
Note:

Such a law can have effect for the purposes of the provisions of the Australian Privacy Principles that regulate the handling of personal information by organisations by reference to the effect of other laws.

SECTION 3A   3A   APPLICATION OF THE CRIMINAL CODE  


Chapter 2 of the Criminal Code (except Part 2.5) applies to all offences against this Act.
Note:

Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility.

SECTION 4   ACT TO BIND THE CROWN  

4(1)  


This Act binds the Crown in right of the Commonwealth, of each of the States, of the Australian Capital territory and of the Northern Territory.

4(2)  


Nothing in this Act renders the Crown in right of the Commonwealth, of a State, of the Australian Capital Territory or of the Northern Territory liable to be prosecuted for an offence.

4(3)  


Nothing in this Act shall be taken to have the effect of making the Crown in right of a State, of the Australian Capital Territory or of the Northern Territory an agency for the purposes of this Act.

SECTION 5   5   INTERPRETATION OF INFORMATION PRIVACY PRINCIPLES  
(Repealed by No 197 of 2012)

SECTION 5A   5A   EXTENSION TO EXTERNAL TERRITORIES  
This Act extends to allexternal Territories.

SECTION 5B   EXTRA-TERRITORIAL OPERATION OF ACT  

Agencies

5B(1)  


This Act, a registered APP code and the registered CR code extend to an act done, or practice engaged in, outside Australia and the external Territories by an agency.
Note:

The act or practice overseas will not breach an Australian Privacy Principle or a registered APP code if the act or practice is required by an applicable foreign law (see sections 6A and 6B).

Organisations and small business operators

5B(1A)  


This Act, a registered APP code and the registered CR code extend to an act done, or practice engaged in, outside Australia and the external Territories by an organisation, or small business operator, that has an Australian link.
Note:

The act or practice overseas will not breach an Australian Privacy Principle or a registered APP code if the act or practice is required by an applicable foreign law (see sections 6A and 6B).

Australian link

5B(2)  


An organisation or small business operator has an Australian link if the organisation or operator is:


(a) an Australian citizen; or


(b) a person whose continued presence in Australia is not subject to a limitation as to time imposed by law; or


(c) a partnership formed in Australia or an external Territory; or


(d) a trust created in Australia or an external Territory; or


(e) a body corporate incorporated in Australia or an external Territory; or


(f) an unincorporated association that has its central management and control in Australia or an external Territory.

5B(3)  


An organisation or small business operator also has an Australian link if all of the following apply:


(a) the organisation or operator is not described in subsection (2);


(b) the organisation or operator carries on business in Australia or an external Territory;


(c) the personal information was collected or held by the organisation or operator in Australia or an external Territory, either before or at the time of the act or practice.

Power to deal with complaints about overseas acts and practices

5B(4)  


Part V of this Act has extra-territorial operation so far as that Part relates to complaints and investigation concerning acts and practices to which this Act extends because of subsection (1) or (1A).
Note:

This lets the Commissioner take action overseas to investigate complaints and lets the ancillary provisions of Part V operate in that context.

PART II - INTERPRETATION  

Division 1 - General definitions  

SECTION 6   INTERPRETATION  

6(1)  


In this Act, unless the contrary intention appears:

ACC
means the Australian Crime Commission.

access seeker
has the meaning given by subsection 6L(1).

ACT enactment
has the same meaning as enactment has in the Australian Capital Territory (Self-Government) Act 1988;

advice related functions
has the meaning given by subsection 28B(1).

affected information recipient
means:


(a) a mortgage insurer; or


(b) a trade insurer; or


(c) a body corporate referred to in paragraph 21G(3)(b); or


(d) a person referred to in paragraph 21G(3)(c); or


(e) an entity or adviser referred to in paragraph 21N(2)(a).

agency
means:


(a) a Minister; or


(b) a Department; or


(c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a Commonwealth enactment, not being:


(i) an incorporated company, society or association; or

(ii) an organisation that is registered under the Fair Work (Registered Organisations) Act 2009 or a branch of such an organisation; or


(d) a body established or appointed by the Governor-General, or by a Minister, otherwise than by or under a Commonwealth enactment; or


(e) a person holding or performing the duties of an office established by or under, or an appointment made under, a Commonwealth enactment, other than a person who, by virtue of holding that office, is the Secretary of a Department; or


(f) a person holding or performing the duties of an appointment, being an appointment made by the Governor-General, or by a Minister, otherwise than under a Commonwealth enactment; or


(g) a federal court; or


(h) the Australian Federal Police; or


(ha) a Norfolk Island agency; or


(i) (Repealed by No 197 of 2012)


(j) (Repealed by No 92 of 2017)


(k) an eligible hearing service provider; or


(l) the service operator under the Healthcare Identifiers Act 2010.

amount of credit
has the meaning given by subsection 6M(2).

annual turnover
of a business has the meaning given by section 6DA.

APP code
has the meaning given by section 26C.

APP code developer
means:


(a) an APP entity; or


(b) a group of APP entities; or


(c) a body or association representing one or more APP entities.

APP complaint
means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual because it breached an Australian Privacy Principle.

APP entity
means an agency or organisation.

APP privacy policy
has the meaning given by Australian Privacy Principle 1.3.

approved privacy code
(Repealed by No 197 of 2012)

at risk
from an eligible data breach has the meaning given by section 26WE.

Australian law
means:


(a) an Act of the Commonwealth or of a State or Territory; or


(b) regulations, or any other instrument, made under such an Act; or


(c) a Norfolk Island enactment; or


(d) a rule of common law or equity.

Australian link
has the meaning given by subsections 5B(2) and (3).

Australian Privacy Principle
has the meaning given by section 14.

authorised agent
of a reporting entity means a person authorised to act on behalf of the reporting entity as mentioned in section 37 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

bank
means:


(a) the Reserve Bank of Australia; or


(b) a body corporate that is an ADI (authorised deposit-taking institution) for the purposes of the Banking Act 1959; or


(c) a person who carries on State banking within the meaning of paragraph 51(xiii) of the Constitution;

Bankruptcy Act
means the Bankruptcy Act 1966.

ban period
has the meaning given by subsection 20K(3).

Board of the ACC
means the Board of the Australian Crime Commission established under section 7B of the Australian Crime Commission Act 2002.

breach
:


(a) in relation to an Australian Privacy Principle, has the meaning given by section 6A; and


(b) in relation to a registered APP code, has the meaning given by section 6B; and


(c) in relation to the registered CR code, has the meaning given by section 6BA.

breach an approved privacy code
(Repealed by No 197 of 2012)

breach an Information Privacy Principle
(Repealed by No 197 of 2012)

breach a National Privacy Principle
(Repealed by No 197 of 2012)

building society
(Repealed by Act No 44 of 1999)

Cabinet
(Repealed by No 59 of 2015, s 3 and Sch 1 item 150, effective 18 June 2015.)

civil penalty order
(Repealed by No 124 of 2017, s 3 and Sch 13 item 1, effective 6 November 2018.)

civil penalty provision
has the same meaning as in the Regulatory Powers Act.

class member
, in relation to a representative complaint, means any of the persons on whose behalf the complaint was lodged, but does not include a person who has withdrawn under section 38B;

[ Commissioner's Note: Section 16(3) of Law and Justice Legislation Amendment Act 1993 Act No 13 of 1994 provides that amendments made by Act No 13 of 1994 relating to representative complaints do not apply to complaints lodged before the commencement of the amendment.]

code complaint
means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual because it breached a registered APP code.

Code of Conduct
(Repealed by No 197 of 2012)

Codes Register
has the meaning given by subsection 26U(1).

collects
: an entity collects personal information only if the entity collects the personal information for inclusion in a record or generally available publication.

commercial credit
means credit (other than consumer credit) that is applied for by, or provided to, a person.

commercial credit related purpose
of a credit provider in relation to a person means the purpose of:


(a) assessing an application for commercial credit made by the person to the provider; or


(b) collecting payments that are overdue in relation to commercial credit provided by the provider to the person.

Commissioner
means the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010.

Commissioner of Police
means the Commissioner of Police appointed under the Australian Federal Police Act 1979;

Commission of inquiry
means:


(a) the Commission of inquiry within the meaning of the Quarantine Act 1908 (as in force immediately before its repeal); or


(b) a Commission of inquiry within the meaning of the Offshore Petroleum and Greenhouse Gas Storage Act 2006.

committee of management
of an unincorporated association means a body (however described) that governs, manages or conducts the affairs of the association.

Commonwealth contract
means a contract, to which the Commonwealth or an agency is or was a party, under which services are to be, or were to be, provided to an agency.

Note: See also subsection (9) about provision of services to an agency.

Commonwealth enactment
means:


(a) an Act other than:


(i) the Northern Territory (Self-Government) Act 1978; or

(ii) an Act providing for the administration or government of an external Territory; or

(iii) the Australian Capital Territory (Self-Government) Act 1988;


(b) an Ordinance of the Australian Capital Territory;


(c) an instrument (including rules, regulations or by-laws) made under an Act to which paragraph (a) applies or under an Ordinance to which paragraph (b) applies; or


(d) any other legislation that applies as a law of the Commonwealth (other than legislation in so far as it is applied by an Act referred to in subparagraph (a)(i) or (ii)) or as a law of the Australian Capital Territory, to the extent that it operates as such a law;

Commonwealth officer
means a person who holds office under, or is employed by, the Commonwealth, and includes:


(a) a person appointed or engaged under the Public Service Act 1999;


(b) a person (other than a person referred to in paragraph (a)) permanently or temporarily employed by, or in the service of, an agency;


(c) a member of the Defence Force; and


(d) a member, staff member or special member of the Australian Federal Police;

but does not include a person permanently or temporarily employed in the Australian Capital Territory Government Service or in the Public Service of the Northern Territory;

Commonwealth record
has the same meaning as in the Archives Act 1983.

consent
means express consent or implied consent;

consumer credit
means credit:


(a) for which an application has been made by an individual to a credit provider, or that has been provided to an individual by a credit provider, in the course of the provider carrying on a business or undertaking as a credit provider; and


(b) that is intended to be used wholly or primarily:


(i) for personal, family or household purposes; or

(ii) to acquire, maintain, renovate or improve residential property for investment purposes; or

(iii) to refinance consumer credit that has been provided wholly or primarily to acquire, maintain, renovate or improve residential property for investment purposes.

consumer credit liability information
: if a credit provider provides consumer credit to an individual, the following information about the consumer credit is consumer credit liability information about the individual:


(a) the name of the provider;


(b) whether the provider is a licensee;


(c) the type of consumer credit;


(d) the day on which the consumer credit is entered into;


(e) the terms or conditions of the consumer credit:


(i) that relate to the repayment of the amount of credit; and

(ii) that are prescribed by the regulations;


(f) the maximum amount of credit available under the consumer credit;


(g) the day on which the consumer credit is terminated or otherwise ceases to be in force.

consumer credit related purpose
of a credit provider in relation to an individual means the purpose of:


(a) assessing an application for consumer credit made by the individual to the provider; or


(b) collecting payments that are overdue in relation to consumer credit provided by the provider to the individual.

contracted service provider
, for a government contract, means:


(a) an organisation that is or was a party to the government contract and that is or was responsible for the provision of services to an agency or a State or Territory authority under the government contract; or


(b) a subcontractor for the government contract.

corporation
means a body corporate that:


(a) is a foreign corporation;


(b) is a trading corporation formed within the limits of Australia or is a financial corporation so formed; or


(c) is incorporated in a Territory, other than the Northern Territory;

court proceedings information
about an individual means information about a judgement of an Australian court:


(a) that is made, or given, against the individual in proceedings (other than criminal proceedings); and


(b) that relates to any credit that has been provided to, or applied for by, the individual.

court/tribunal order
means an order, direction or other instrument made by:


(a) a court; or


(b) a tribunal; or


(c) a judge (including a judge acting in a personal capacity) or a person acting as a judge; or


(d) a magistrate (including a magistrate acting in a personal capacity) or a person acting as a magistrate; or


(e) a member or an officer of a tribunal;

and includes an order, direction or other instrument that is of an interim or interlocutory nature.

CP derived information
about an individual means any personal information (other than sensitive information) about the individual:


(a) that is derived from credit reporting information about the individual that was disclosed to a credit provider by a credit reporting body under Division 2 of Part IIIA; and


(b) that has any bearing on the individual's credit worthiness; and


(c) that is used, has been used or could be used in establishing the individual's eligibility for consumer credit.

CRB derived information
about an individual means any personal information (other than sensitive information) about the individual:


(a) that is derived by a credit reporting body from credit information about the individual that is held by the body; and


(b) that has any bearing on the individual's credit worthiness; and


(c) that is used, has been used or could be used in establishing the individual's eligibility for consumer credit.

CR code
has the meaning given by section 26N.

CR code developer
means:


(a) an entity that is subject to Part IIIA; or


(b) a group of entities that are subject to Part IIIA; or


(c) a body or association representing one or more entities that are subject to Part IIIA.

credit
has the meaning given by subsections 6M(1) and (3).

credit card
means any article of a kind commonly known as a credit card, charge card or any similar article intended for use in obtaining cash, goods or services by means of credit, and includes any article of a kind commonly issued by persons carrying on business to customers or prospective customers of those persons for use in obtaining goods or services from those persons by means of credit;

credit eligibility information
about an individual means:


(a) credit reporting information about the individual that was disclosed to a credit provider by a credit reporting body under Division 2 of Part IIIA; or


(b) CP derived information about the individual.

credit enhancement
, in relation to credit, means:


(a) the process of insuring risk associated with purchasing or funding the credit by means of a securitisation arrangement; or


(b) any other similar process related to purchasing or funding the credit by those means;

credit guarantee purpose
of a credit provider in relation to an individual means the purpose of assessing whether to accept the individual as a guarantor in relation to:


(a) credit provided by the provider to a person other than the individual; or


(b) credit for which an application has been made to the provider by a person other than the individual.

credit information
has the meaning given by section 6N.

credit information file
(Repealed by No 197 of 2012)

credit provider
has the meaning given by sections 6G to 6K, and, for the purposes of sections 7 and 8 and Parts III, IIIB, IV and V, is taken to include a mortgage insurer and a trade insurer;

credit report
(Repealed by No 197 of 2012)

credit reporting agency
(Repealed by No 197 of 2012)

credit reporting body
means:


(a) an organisation; or


(b) an agency prescribed by the regulations;

that carries on a credit reporting business.

credit reporting business
has the meaning given by section 6P.

credit reporting complaint
means a complaint about an act or practice that, if established, would be an interference with the privacyof an individual because:


(a) it breached the registered CR code; or


(b) it breached a provision of Part IIIA;

credit reporting information
about an individual means credit information, or CRB derived information, about the individual.

credit reporting infringement
(Repealed by No 197 of 2012)

credit union
(Repealed by Act No 44 of 1999)

credit worthiness
of an individual means the individual's:


(a) eligibility to be provided with consumer credit; or


(b) history in relation to consumer credit; or


(c) capacity to repay an amount of credit that relates to consumer credit.

current credit provider
(Repealed by No 197 of 2012)

de facto partner
of an individual has the meaning given by the Acts Interpretation Act 1901.

default information
has the meaning given by section 6Q.

Defence Department
means the Department of State that deals with defence and that is administered by the Minister administering section 1 of the Defence Act 1903.

Defence Force
includes the Australian Defence Force Cadets.

de-identified
: personal information is de-identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable.

Department
means an Agency within the meaning of the Public Service Act 1999.

eligible case manager
(Repealed by No 197 of 2012)

eligible communications service
(Repealed by No 197 of 2012)

eligible data breach
has the meaning given by Division 2 of Part IIIC.

eligible hearing service provider
means an entity (within the meaning of the Hearing Services Administration Act 1997);


(a) that is, or has at any time been, engaged under Part 3 of the Hearing Services Administration Act 1997 to provide hearing services; and


(b) that is not covered by paragraph (a), (b), (c), (d), (e), (f), (g) or (h) of the definition of agency .

employee record
, in relation to an employee, means a record of personal information relating to the employment of the employee. Examples of personal information relating to the employment of the employee are health information about the employee and personal information about all or any of the following:


(a) the engagement, training, disciplining or resignation of the employee;


(b) the termination of the employment of the employee;


(c) the terms and conditions of employment of the employee;


(d) the employee's personal and emergency contact details;


(e) the employee's performance or conduct;


(f) the employee's hours of employment;


(g) the employee's salary or wages;


(h) the employee's membership of a professional or trade association;


(i) the employee's trade union membership;


(j) the employee's recreation, long service, sick, personal, maternity, paternity or other leave;


(k) the employee's taxation, banking or superannuation affairs.

enactment
includes a Norfolk Island enactment.

enforcement body
means:


(a) the Australian Federal Police; or


(aa) the Integrity Commissioner; or


(b) the ACC; or


(ba) (Repealed by No 45 of 2016)


(c) (Repealed by No 41 of 2015)


(ca) the Immigration Department; or


(d) the Australian Prudential Regulation Authority; or


(e) the Australian Securities and Investments Commission; or


(ea) the Office of the Director of Public Prosecutions, or a similar body established under a law of a State or Territory; or


(f) another agency, to the extent that it is responsible for administering, or performing a function under, a law that imposes a penalty or sanction or a prescribed law; or


(g) another agency, to the extent that it is responsible for administering a law relating to the protection of the public revenue; or


(h) a police force or service of a State or a Territory; or


(i) the New South Wales Crime Commission; or


(j) the Independent Commission Against Corruption of New South Wales; or


(k) the Law Enforcement Conduct Commission of New South Wales; or


(ka) the Independent Broad-based Anti-corruption Commission of Victoria; or


(l) the Crime and Corruption Commission of Queensland; or


(la) the Corruption and Crime Commission of Western Australia; or


(lb) the Independent Commissioner Against Corruption of South Australia; or


(m) another prescribed authority or body that is established under a law of a State or Territory to conduct criminal investigations or inquiries; or


(n) a State or Territory authority, to the extent that it is responsible for administering, or performing a function under, a law that imposes a penalty or sanction or a prescribed law; or


(o) a State or Territory authority, to the extent that it is responsible for administering a law relating to the protection of the public revenue.

enforcement related activity
means:


(a) the prevention, detection, investigation, prosecution or punishment of:


(i) criminal offences; or

(ii) breaches of a law imposing a penalty or sanction; or


(b) the conduct of surveillance activities, intelligence gathering activities or monitoring activities; or


(c) the conduct of protective or custodial activities; or


(d) the enforcement of laws relating to the confiscation of the proceeds of crime; or


(e) the protection of the public revenue; or


(f) the prevention, detection, investigation or remedying of misconduct of a serious nature, or other conduct prescribed by the regulations; or


(g) the preparation for, or conduct of, proceedings before any court or tribunal, or the implementation of court/tribunal orders.

entity
means:


(a) an agency; or


(b) an organisation; or


(c) a small business operator.

Federal Circuit Court
means the Federal Circuit Court of Australia.

Federal Court
means the Federal Court of Australia;

file number complaint
means a complaint about an act or practice that, if established, would be an interference with the privacy of an individual:


(a) because it breached a rule issued under section 17; or


(b) because it involved an unauthorised requirement or request for disclosure of a tax file number;

financial corporation
means a financial corporation within the meaning of paragraph 51(xx) of the Constitution;

foreign corporation
means a foreign corporation within the meaning of paragraph 51(xx) of the Constitution;

Freedom of Information Act
means the Freedom of Information Act 1982;

generally available publication
means a magazine, book, article, newspaper or other publication that is, or will be, generally available to members of the public:


(a) whether or not it is published in print, electronically or in any other form; and


(b) whether or not it is available on the payment of a fee.

genetic relative
of an individual (the first individual ) means another individual who is related to the first individual by blood, including but not limited to a sibling, a parent or a descendant of the first individual.

government contract
means a Commonwealth contract or a State contract.

government related identifier
of an individual means an identifier of the individual that has been assigned by:


(a) an agency; or


(b) a State or Territory authority; or


(c) an agent of an agency, or a State or Territory authority, acting in its capacity as agent; or


(d) a contracted service provider for a Commonwealth contract, or a State contract, acting in its capacity as contracted service provider for that contract.

guarantee
includes an indemnity given against the default of a person in making a payment in relation to credit that has been applied for by, or provided to, the person.

guidance related functions
has the meaning given by subsection 28(1).

healthcare identifier
has the meaning given by the Healthcare Identifiers Act 2010.

healthcare identifier offence
means:


(a) an offence against section 26 of the Healthcare Identifiers Act 2010; or


(b) an offence against section 6 of the Crimes Act 1914 that relates to an offence mentioned in paragraph (a) of this definition.

Note:

For ancillary offences, see section 11.6 of the Criminal Code.

health information
has the meaning given by section 6FA.

health service
has the meaning given by section 6FB.

hearing services
has the same meaning as in the Hearing Services Administration Act 1997.

holds
: an entity holds personal information if the entity has possession or control of a record that contains the personal information.

Note:

See section 10 for when an agency is taken to hold a record.

identification information
about an individual means:


(a) the individual's full name; or


(b) an alias or previous name of the individual; or


(c) the individual's date of birth; or


(d) the individual's sex; or


(e) the individual's current or last known address, and 2 previous addresses (if any); or


(f) the name of the individual's current or last known employer; or


(g) if the individual holds a driver's licence - the individual's driver's licence number.

identifier
of an individual means a number, letter or symbol, or a combination of any or all of those things, that is used to identify the individual or to verify the identity of the individual, but does not include:


(a) the individual's name; or


(b) the individual's ABN (within the meaning of the A New Tax System (Australian Business Number) Act 1999); or


(c) anything else prescribed by the regulations.

Immigration Department
means the Department administered by the Minister administering the Migration Act 1958.

individual
means a natural person;

individual concerned
(Repealed by No 197 of 2012)

Information Privacy Principle
(Repealed by No 197 of 2012)

information request
has the meaning given by section 6R.

Integrity Commissioner
has the same meaning as in the Law Enforcement Integrity Commissioner Act 2006.

intelligence agency
means:


(a) the Australian Security Intelligence Organisation;


(b) the Australian Secret Intelligence Service; or


(ba) the Australian Signals Directorate; or


(c) the Office of National Intelligence.

interested party
has the meaning given by subsections 20T(3) and 21V(3).

interference with the privacy of an individual
has the meaning given by sections 13 to 13F.

IPP complaint
(Repealed by No 197 of 2012)

licensee
has the meaning given by the National Consumer Credit Protection Act 2009.

loan
(Repealed by No 197 of 2012)

managing credit
does not include the act of collecting overdue payments in relation to credit.

media organisation
means an organisation whose activities consist of or include the collection, preparation for dissemination or dissemination of the following material for the purpose of making it available to the public:


(a) material having the character of news, current affairs, information or a documentary;


(b) material consisting of commentary or opinion on, or analysis of, news, current affairs, information or a documentary.

medical research
includes epidemiological research;

misconduct
includes fraud, negligence, default, breach of trust, breach of duty, breach of discipline or any other misconduct in the course of duty.

monitoring related functions
has the meaning given by subsections 28A(1) and (2).

mortgage credit
means consumer credit:


(a) that is provided in connection with the acquisition, maintenance, renovation or improvement of real property; and


(b) in relation to which the real property is security.

mortgage insurance purpose
of a mortgage insurer in relation to an individual is the purpose of assessing:


(a) whether to provide insurance to, or the risk of providing insurance to, a credit provider in relation to mortgage credit:


(i) provided by the provider to the individual; or

(ii) for which an application to the provider has been made by the individual; or


(b) the risk of the individual defaulting on mortgage credit in relation to which the insurer has provided insurance to a credit provider; or


(c) the risk of the individual being unable to meet a liability that might arise under a guarantee provided, or proposed to be provided, in relation to mortgage credit provided by a credit provider to another person.

mortgage insurer
means an organisation, or small business operator, that carries on a business or undertaking that involves providing insurance to credit providers in relation to mortgage credit provided by providers to other persons.

National Personal Insolvency Index
has the meaning given by the Bankruptcy Act.

National Privacy Principle
(Repealed by No 197 of 2012)

new arrangement information
has the meaning given by section 6S.

nominated AGHS company
(Repealed by No 92 of 2017, s 3 and Sch 3 item 7, effective 23 August 2017.)

non-profit organisation
means an organisation:


(a) that is a non-profit organisation; and


(b) that engages in activities for cultural, recreational, political, religious, philosophical, professional, trade or trade union purposes.

Norfolk Island agency
means:


(a) a Norfolk Island Minister; or


(b) a public sector agency (within the meaning of the Public Sector Management Act 2000 of Norfolk Island); or


(c) a body (whether incorporated or not), or a tribunal, established for a public purpose by or under a Norfolk Island enactment, other than a body established or registered under:


(i) the Companies Act 1985 of Norfolk Island; or

(ii) the Associations Incorporation Act 2005 of Norfolk Island; or


(d) (Repealed by No 59 of 2015)


(e) a person holding or performing the duties of:


(i) an office established by or under a Norfolk Island enactment; or

(ii) an appointment made under a Norfolk Island enactment; or


(f) (Repealed by No 59 of 2015)


(g) a court of Norfolk Island.

Norfolk Island enactment
means:


(a) an enactment (within the meaning of the Norfolk Island Act 1979); or


(b) an instrument (including rules, regulations or by-laws) made under such an enactment;

and includes a Norfolk Island enactment as amended by another Norfolk Island enactment.

Norfolk Island Justice Minister
(Repealed by No 59 of 2015, s 3 and Sch 1 item 153, effective 18 June 2015.)

Norfolk Island Minister
(Repealed by No 59 of 2015, s 3 and Sch 1 item 154, effective 18 June 2015.)

NPP complaint
(Repealed by No 197 of 2012)

offence against this Act
includes an offence against section 6 of the Crimes Act 1914, or section 11.1, 11.2, 11.2A, 11.4 or 11.5 of the Criminal Code, that relates to an offence against this Act.

Ombudsman
means the Commonwealth Ombudsman;

organisation
has the meaning given by section 6C.

overseas recipient
, in relation to personal information, has the meaning given by Australian Privacy Principle 8.1.

payment information
has the meaning given by section 6T.

penalty unit
has the meaning given by section 4AA of the Crimes Act 1914.

pending correction request
in relation to credit information or CRB derived information means:


(a) a request made under subsection 20T(1) in relation to the information if a notice has not been given under subsection 20U(2) or (3) in relation to the request; or


(b) a request made under subsection 21V(1) in relation to the information if:


(i) the credit reporting body referred to in subsection 20V(3) has been consulted about the request under subsection 21V(3); and

(ii) a notice has not been given under subsection 21W(2) or (3) in relation to the request.

pending dispute
in relation to credit information or CRB derived information means:


(a) a complaint made under section 23A that relates to the information if a decision about the complaint has not been made under subsection 23B(4); or


(b) a matter that relates to the information and that is still being dealt with by a recognised external dispute resolution scheme; or


(c) a complaint made to the Commissioner under Part V that relates to the information and that is still being dealt with.

permitted CP disclosure
has the meaning given by sections 21J to 21N.

permitted CP use
has the meaning given by section 21H.

permitted CRB disclosure
has the meaning given by section 20F.

permitted general situation
has the meaning given by section 16A.

permitted health situation
has the meaning given by section 16B.

personal information
means information or an opinion about an identified individual, or an individual who is reasonably identifiable:


(a) whether the information or opinion is true or not; and


(b) whether the information or opinion is recorded in a material form or not.

Note:

Section 187LA of the Telecommunications (Interception and Access) Act 1979 extends the meaning of personal information to cover information kept under Part 5-1A of that Act.

personal insolvency information
has the meaning given by section 6U.

pre-screening assessment
means an assessment made under paragraph 20G(2)(d).

principal executive
, of an agency, has a meaning affected by section 37.

privacy code
(Repealed by No 197 of 2012)

purchase
, in relation to credit, includes the purchase of rights to receive payments relating to the credit.

recognised external dispute resolution scheme
means an external dispute resolution scheme recognised under section 35A.

record
includes:


(a) a document; or


(b) an electronic or other device;


(c) (Repealed by No 197 of 2012)

but does not include:


(d) a generally available publication; or


(e) anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or


(f) Commonwealth records as defined by subsection 3(1) of the Archives Act 1983 that are in the open access period for the purposes of that Act; or


(fa) records (as defined in the Archives Act 1983) in the care (as defined in that Act) of the National Archives of Australia in relation to which the Archives has entered into arrangements with a person other than a Commonwealth institution (as defined in that Act) providing for the extent to which the Archives or other persons are to have access to the records; or


(g) documents placed by or on behalf of a person (other than an agency) in the memorial collection within the meaning of the Australian War Memorial Act 1980; or


(h) letters or other articles in the course of transmission by post;

Note:

For document , see section 2B of the Acts Interpretation Act 1901.

registered APP code
has the meaning given by section 26B.

registered CR code
has the meaning given by section 26M.

registered political party
means a political party registered under Part XI of the Commonwealth Electoral Act 1918.

regulated information
of an affected information recipient means:


(a) if the recipient is a mortgage insurer or trade insurer - personal information disclosed to the recipient under Division 2 or 3 of Part IIIA; or


(b) if the recipient is a body corporate referred to in paragraph 21G(3)(b) - credit eligibility information disclosed to the recipient under that paragraph; or


(c) if the recipient is a person referred to in paragraph 21G(3)(c) - credit eligibility information disclosed to the recipient under that paragraph; or


(d) if the recipient is an entity or adviser referred to in paragraph 21N(2)(a) - credit eligibility information disclosed to the recipient under subsection 21N(2).

Regulatory Powers Act
means the Regulatory Powers (Standard Provisions) Act 2014.

repayment history information
has the meaning given by subsection 6V(1).

reporting entity
has the same meaning as in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

representative complaint
means a complaint where the persons on whose behalf the complaint was made include persons other than the complainant, but does not include a complaint that the Commissioner has determined should no longer be continued as a representative complaint;

[ Commissioner's Note: Section 16(3) of Law and Justice Legislation Amendment Act 1993 Act No 13 of 1994 provides that amendments made by Act No 13 of 1994 relating to representative complaints do not apply to complaints lodged before the commencement of the amendment.]

residential property
has the meaning given by section 204 of the National Credit Code (within the meaning of the National Consumer Credit Protection Act 2009).

respondent
for a complaint made under section 23A means the credit reporting body or credit provider to which the complaint is made.

responsible person
has the meaning given by section 6AA.

retention period
has the meaning given by sections 20W and 20X.

Secretary
means an Agency Head within the meaning of the Public Service Act 1999.

securitisation arrangement
means an arrangement:


(a) involving the funding, or proposed funding, of:


(i) credit that has been, or is to be, provided by a credit provider; or

(ii) the purchase of credit by a credit provider;
by issuing instruments or entitlements to investors; and


(b) under which payments to investors in respect of such instruments or entitlements are principally derived, directly or indirectly, from such credit;

securitisation related purpose
of a credit provider in relation to an individual is the purpose of:


(a) assessing the risk in purchasing, by means of a securitisation arrangement, credit that has been provided to, or applied for by:


(i) the individual; or

(ii) a person for whom the individual is, or is proposing to be, a guarantor; or


(b) assessing the risk in undertaking credit enhancement in relation to credit:


(i) that is, or is proposed to be, purchased or funded by means of a securitisation arrangement; and

(ii) that has been provided to, or applied for by, the individual or a person for whom the individual is, or is proposing to be, a guarantor.

sensitive information
means:


(a) information or an opinion about an individual's:


(i) racial or ethnic origin; or

(ii) political opinions; or

(iii) membership of a political association; or

(iv) religious beliefs or affiliations; or

(v) philosophical beliefs; or

(vi) membership of a professional or trade association; or

(vii) membership of a trade union; or

(viii) sexual orientation or practices; or

(ix) criminal record;
that is also personal information; or


(b) health information about an individual; or


(c) genetic information about an individual that is not otherwise health information; or


(d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or


(e) biometric templates.

serious credit infringement
means:


(a) an act done by an individual that involves fraudulently obtaining consumer credit, or attempting fraudulently to obtain consumer credit; or


(b) an act done by an individual that involves fraudulently evading the individual's obligations in relation to consumer credit, or attempting fraudulently to evade those obligations; or


(c) an act done by an individual if:


(i) a reasonable person would consider that the act indicates an intention, on the part of the individual, to no longer comply with the individual's obligations in relation to consumer credit provided by a credit provider; and

(ii) the provider has, after taking such steps as are reasonable in the circumstances, been unable to contact the individual about the act; and

(iii) at least 6 months have passed since the provider last had contact with the individual.

small business
has the meaning given by section 6D.

small business operator
has the meaning given by section 6D.

solicit
(Repealed by No 197 of 2012)

solicits
: an entity solicits personal information if the entity requests another entity to provide the personal information, or to provide a kind of information in which that personal information is included.

staff of the Ombudsman
means the persons appointed or employed for the purposes of section 31 of the Ombudsman Act 1976;

State
includes the Australian Capital Territory and the Northern Territory;

State contract
means a contract, to which a State or Territory or State or Territory authority is or was a party, under which services are to be, or were to be, provided to a State or Territory authority.

Note: See also subsection (9) about provision of services to a State or Territory authority.

State or Territory authority
has the meaning given by section 6C.

subcontractor
, for a government contract, means an organisation:


(a) that is or was a party to a contract (the subcontract ):


(i) with a contracted service provider for the government contract (within the meaning of paragraph (a) of the definition of contracted service provider ); or

(ii) with a subcontractor for the government contract (under a previous application of this definition); and


(b) that is or was responsible under the subcontract for the provision of services to an agency or a State or Territory authority, or to a contracted service provider for the government contract, for the purposes (whether direct or indirect) of the government contract.

tax file number
means a tax file number as defined in Part VA of the Income Tax Assessment Act 1936;

tax file number information
means information, whether compiled lawfully or unlawfully, and whether recorded in a material form or not, that records the tax file number of a person in a manner connecting it with the person's identity;

temporary public interest determination
means a determination made under section 80A.

trade insurance purpose
of a trade insurer in relation to an individual is the purpose of assessing:


(a) whether to provide insurance to, or the risk of providing insurance to, a credit provider in relation to commercial credit provided by the provider to the individual or another person; or


(b) the risk of a person defaulting on commercial credit in relation to which the insurer has provided insurance to a credit provider.

trade insurer
means an organisation, or small business operator, that carries on a business or undertaking that involves providing insurance to credit providers in relation to commercial credit provided by providers to other persons.

trading corporation
means a trading corporation within the meaning of paragraph 51(xx) of the Constitution;

use
(Repealed by No 197 of 2012)

6(1A)  
In order to avoid doubt, it is declared that an ACT enactment is not a Commonwealth enactment for the purposes of this Act.

6(2)  
(Repealed by No 197 of 2012)

6(3)  


For the purposes of this Act, an act or practice breaches a rule issued under section 17 if, and only if, it is contrary to, or inconsistent with, the rule.

6(3A)  
(Repealed by No 197 of 2012)

6(4)  
The definition of individual in subsection (1) shall not be taken to imply that references to persons do not include persons other than natural persons.

6(5)  
For the purposes of this Act, a person shall not be taken to be an agency merely because the person is the holder of, or performs the duties of:


(a) a prescribed office; or


(b) an office prescribed by regulations made for the purposes of subparagraph 4(3)(b)(i) of the Freedom of Information Act 1982; or


(c) an office established by or under a Commonwealth enactment for the purposes of an agency; or


(ca) an office established by or under a Norfolk Island enactment for the purposes of a Norfolk Island agency; or


(d) a judicial office or of an office of magistrate; or


(e) an office of member of a tribunal that is established by or under a law of the Commonwealth and that is prescribed for the purposes of this paragraph; or


(f) an office of member of a tribunal that is established by or under a Norfolk Island enactment and that is prescribed for the purposes of this paragraph.

6(5A)-(5D)  
(Repealed by No 197 of 2012)

6(6)  


For the purposes of this Act, the Defence Department shall be taken to include the Defence Force.

6(7)  
Nothing in this Act prevents a complaint from:


(a) being both a file number complaint and an APP complaint; or


(b) being both a file number complaint and a credit reporting complaint; or


(c) being both a file number complaint and a code complaint; or


(d) (Repealed by No 197 of 2012)


(e) being both a code complaint and a credit reporting complaint; or


(f) being both an APP complaint and a credit reporting complaint; or


(g) being both an APP complaint and a code complaint.

6(8)  


For the purposes of this Act, the question whether bodies corporate are related to each other is determined in the manner in which that question is determined under the Corporations Act 2001.

6(9)  


To avoid doubt, for the purposes of this Act, services provided to an agency or a State or Territory authority include services that consist of the provision of services to other persons in connection with the performance of the functions of the agency or State or Territory authority.

6(10)  


For the purposes of this Act, a reference to family in the definition of consumer credit in subsection 6(1), and in sections 6D and 16, in relation to any individual is taken to include the following (without limitation):


(a) a de facto partner of the individual;


(b) someone who is the child of the person, or of whom the person is the child, because of the definition of child in subsection (11);


(c) anyone else who would be a member of the individual's family if someone mentioned in paragraph (a) or (b) is taken to be a member of the individual's family.

6(10A)  
For the purposes of this Act, the Supreme Court of Norfolk Island is taken not to be a federal court.

6(11)  


In this section:

child:
without limiting who is a child of a person for the purposes of subsection (10), someone is the child of a person if he or she is a child of the person within the meaning of the Family Law Act 1975.

SECTION 6AA   MEANING OF RESPONSIBLE PERSON  

6AA(1)  
A responsible person for an individual is:


(a) a parent of the individual; or


(b) a child or sibling of the individual if the child or sibling is at least 18 years old; or


(c) a spouse or de facto partner of the individual; or


(d) a relative of the individual if the relative is:


(i) at least 18 years old; and

(ii) a member of the individual's household; or


(e) a guardian of the individual; or


(f) a person exercising an enduring power of attorney granted by the individual that is exercisable in relation to decisions about the individual's health; or


(g) a person who has an intimate personal relationship with the individual; or


(h) a person nominated by the individual to be contacted in case of emergency.

6AA(2)  
In this section:

child
: without limiting who is a child of an individual for the purposes of subsection (1), each of the following is a child of an individual:


(a) an adopted child, stepchild, exnuptial child or foster child of the individual;


(b) someone who is a child of the individual within the meaning of the Family Law Act 1975.

parent
: without limiting who is a parent of an individual for the purposes of subsection (1), someone is a parent of an individual if the individual is his or her child because of the definition of child in this subsection.

relative
, of an individual (the first individual ) means a grandparent, grandchild, uncle, aunt, nephew or niece of the first individual and for this purpose, relationships to the first individual may also be traced to or through another individual who is:


(a) a de facto partner of the first individual; or


(b) the child of the first individual because of the definition of child in this subsection.

sibling
of an individual includes:


(a) a half-brother, half-sister, adoptive brother, adoptive sister, step-brother, step-sister, foster-brother and foster-sister of the individual; and


(b) another individual if a relationship referred to in paragraph (a) can be traced through a parent of either or both of the individuals.

stepchild
: without limiting who is a stepchild of an individual, someone is a stepchild of an individual if he or she would be the individual's stepchild except that the individual is not legally married to the individual's de facto partner.

SECTION 6A   BREACH OF AN AUSTRALIAN PRIVACY PRINCIPLE  

6A(1)  


For the purposes of this Act, an act or practice breaches an Australian Privacy Principle if, and only if, it is contrary to, or inconsistent with, that principle.

6A(2)   No breach - contracted service provider.  

An act or practice does not breach an Australian Privacy Principle if:


(a) the act is done, or the practice is engaged in:


(i) by an organisation that is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and

(ii) for the purposes of meeting (directly or indirectly) an obligation under the contract; and


(b) the act or practice is authorised by a provision of the contract that is inconsistent with the principle.

6A(3)   No breach - disclosure to the National Archives of Australia.  

An act or practice does not breach an Australian Privacy Principle if the act or practice involves the disclosure by an organisation of personal information in a record (as defined in the Archives Act 1983) solely for the purposes of enabling the National Archives of Australia to decide whether to accept, or to arrange, care (as defined in that Act) of the record.

6A(4)   No breach - act or practice outside Australia.  

An act or practice does not breach an Australian Privacy Principle if:


(a) the act is done, or the practice is engaged in, outside Australia and the external Territories; and


(b) the act or practice is required by an applicable law of a foreign country.

6A(5)   Effect despite subsection (1).  

Subsections (2), (3) and (4) have effect despite subsection (1).

SECTION 6B   BREACH OF A REGISTERED APP CODE  

6B(1)   Breach if contrary to, or inconsistent with, code.  

For the purposes of this Act, an act or practice breaches a registered APP code if, and only if, it is contrary to, or inconsistent with, the code.

6B(2)   No breach - contracted service provider.  

An act or practice does not breach a registered APP code if:


(a) the act is done, or the practice is engaged in:


(i) by an organisation that is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and

(ii) for the purposes of meeting (directly or indirectly) an obligation under the contract; and


(b) the act or practice is authorised by a provision of the contract that is inconsistent with the code.

6B(3)   No breach - disclosure to the National Archives of Australia.  

An act or practice does not breach a registered APP code if the act or practice involves the disclosure by an organisation of personal information in a record (as defined in the Archives Act 1983) solely for the purposes of enabling the National Archives of Australia to decide whether to accept, or to arrange, care (as defined in that Act) of the record.

6B(4)   No breach - act or practice outside Australia.  

An act or practice does not breach a registered APP code if:


(a) the act is done, or the practice is engaged in, outside Australia and the external Territories; and


(b) the act or practice is required by an applicable law of a foreign country.

6B(5)   Effect despite subsection (1).  

Subsections (2), (3) and (4) have effect despite subsection (1).


SECTION 6BA   6BA   BREACH OF THE REGISTERED CR CODE  


For the purposes of this Act, an act or practice breaches the registered CR code if, and only if, it is contrary to, or inconsistent with, the code.

SECTION 6C   ORGANISATIONS  

6C(1)   What is an organisation ?  

In this Act:

organisation
means:


(a) an individual; or


(b) a body corporate; or


(c) a partnership; or


(d) any other unincorporated association; or


(e) a trust;

that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory.

Note 1:

Under section 187LA of the Telecommunications (Interception and Access) Act 1979, service providers are, in relation to their activities relating to retained data, treated as organisations for the purposes of this Act.

Note 2:

Regulations may prescribe an instrumentality by reference to one or more classes of instrumentality. See subsection 13(3) of the Legislation Act 2003.

Example: Regulations may prescribe an instrumentality of a State or Territory that is an incorporated company, society or association and therefore not a State or Territory authority.

6C(2)   Legal person treated as different organisations in different capacities.  

A legal person can have a number of different capacities in which the person does things. In each of those capacities, the person is taken to be a different organisation .

Example: In addition to his or her personal capacity, an individual may be the trustee of one or more trusts. In his or her personal capacity, he or she is one organisation. As trustee of each trust, he or she is a different organisation.

6C(3)   What is a State or Territory authority ?  

In this Act:

State or Territory authority
means:


(a) a State or Territory Minister; or


(b) a Department of State of a State or Territory; or


(c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a law of a State or Territory, other than:


(i) an incorporated company, society or association; or

(ii) an association of employers or employees that is registered or recognised under a law of a State or Territory dealing with the resolution of industrial disputes; or


(d) a body established or appointed, otherwise than by or under a law of a State or Territory, by:


(i) a Governor of a State; or

(ii) the Australian Capital Territory Executive; or

(iii) the Administrator of the Northern Territory; or

(iv) (Repealed by No 59 of 2015)

(v) a State or Territory Minister; or

(vi) (Repealed by No 139 of 2010)


(e) a person holding or performing the duties of an office established by or under, or an appointment made under, a law of a State or Territory, other than the office of head of a State or Territory Department (however described); or


(f) a person holding or performing the duties of an appointment made, otherwise than under a law of a State or Territory, by:


(i) a Governor of a State; or

(ii) the Australian Capital Territory Executive; or

(iii) the Administrator of the Northern Territory; or

(iv) (Repealed by No 59 of 2015)

(v) a State or Territory Minister; or

(vi) (Repealed by No 139 of 2010)


(g) a State or Territory court.

6C(4)   Making regulations to stop instrumentalities being organisations.  

Before the Governor-General makes regulations prescribing an instrumentality of a State or Territory for the purposes of the definition of organisation in subsection (1), the Minister must:


(a) be satisfied that the State or Territory has requested that the instrumentality be prescribed for those purposes; and


(b) consider:


(i) whether treating the instrumentality as an organisation for the purposes of this Act adversely affects the government of the State or Territory; and

(ii) the desirability of regulating under this Act the collection, holding, use, correction and disclosure of personal information by the instrumentality; and

(iii) whether the law of the State or Territory regulates the collection, holding, use, correction and disclosure of personal information by the instrumentality to a standard that is at least equivalent to the standard that would otherwise apply to the instrumentality under this Act; and


(c) consult the Commissioner about the matters mentioned in subparagraphs (b)(ii) and (iii).

6C(5)   State does not include Territory.  

In this section:

State
does not include the Australian Capital Territory or the Northern Territory (despite subsection 6(1)).

SECTION 6D   SMALL BUSINESS AND SMALL BUSINESS OPERATORS  

6D(1)   What is a small business ?  

A business is a small business at a time (the test time ) in a financial year (the current year ) if its annual turnover for the previous financial year is $3,000,000 or less.

6D(2)   Test for new business.  

However, if there was no time in the previous financial year when the business was carried on, the business is a small business at the test time only if its annual turnover for the current year is $3,000,000 or less.

6D(3)   What is a small business operator ?  

A small business operator is an individual, body corporate, partnership, unincorporated association or trust that:


(a) carries on one or more small businesses; and


(b) does not carry on a business that is not a small business.

6D(4)   Entities that are not small business operators.  

However, an individual, body corporate, partnership, unincorporated association or trust is not a small business operator if he, she or it:


(a) carries on a business that has had an annual turnover of more than $3,000,000 for a financial year that has ended after the later of the following:


(i) the time he, she or it started to carry on the business;

(ii) the commencement of this section; or


(b) provides a health service to another individual and holds any health information except in an employee record; or


(c) discloses personal information about another individual to anyone else for a benefit, service or advantage; or


(d) provides a benefit, service or advantage to collect personal information about another individual from anyone else; or


(e) is a contracted service provider for a Commonwealth contract (whether or not a party to the contract); or


(f) is a credit reporting body.

6D(5)   Private affairs of small business operators who are individuals.  

Subsection (4) does not prevent an individual from being a small business operator merely because he or she does something described in paragraph (4)(b), (c) or (d):


(a) otherwise than in the course of a business he or she carries on; and


(b) only for the purposes of, or in connection with, his or her personal, family or household affairs.

6D(6)   Non-business affairs of other small business operators.  

Subsection (4) does not prevent a body corporate, partnership, unincorporated association or trust from being a small business operator merely because it does something described in paragraph (4)(b), (c) or (d) otherwise than in the course of a business it carries on.

6D(7)   Disclosure compelled or made with consent.  

Paragraph (4)(c) does not prevent an individual, body corporate, partnership, unincorporated association or trust from being a small business operator only because he, she or it discloses personal information about another individual:


(a) with the consent of the other individual; or


(b) as required or authorised by or under legislation.

6D(8)   Collection with consent or under legislation.  

Paragraph (4)(d) does not prevent an individual, body corporate, partnership, unincorporated association or trust from being a small business operator only because he, she or it:


(a) collects personal information about another individual from someone else:


(i) with the consent of the other individual; or

(ii) as required or authorised by or under legislation; and


(b) provides a benefit, service or advantage to be allowed to collect the information.

6D(9)   Related bodies corporate.  

Despite subsection (3), a body corporate is not a small business operator if it is related to a body corporate that carries on a business that is not a small business.

SECTION 6DA   WHAT IS THE ANNUAL TURNOVER OF A BUSINESS?  

6DA(1)   What is the annual turnover of a business for a financial year?  

The annual turnover of a business for a financial year is the total of the following that is earned in the year in the course of the business:


(a) the proceeds of sales of goods and/or services;


(b) commission income;


(c) repair and service income;


(d) rent, leasing and hiring income;


(e) government bounties and subsidies;


(f) interest, royalties and dividends;


(g) other operating income.

Note: The annual turnover for a financial year of a business carried on by an entity that does not carry on another business will often be similar to the total of the instalment income the entity notifies to the Commissioner of Taxation for the 4 quarters in the year (or for the year, if the entity pays tax in annual instalments).

6DA(2)   [Business carried out for only part of a financial year]  

However, if a business has been carried on for only part of a financial year, its annual turnover for the financial year is the amount worked out using the formula:


Amount that would be the
annual turnover of the
business under
subsection (1) if the part
were a whole financial year
× Number of days in the
  whole financial year  
Number of days in the part

SECTION 6E   SMALL BUSINESS OPERATOR TREATED AS ORGANISATION  

6E(1A)   Small business operator that is a reporting entity.  

If a small business operator is a reporting entity or an authorised agent of a reporting entity because of anything done in the course of a small business carried on by the small business operator, this Act applies, with the prescribed modifications (if any), in relation to the activities carried on by the small business operator for the purposes of, or in connection with, activities relating to:


(a) the Anti-Money Laundering and Counter-Terrorism Financing Act 2006; or


(b) regulations or AML/CTF Rules under that Act;

as if the small business operator were an organisation.

Note:

The regulations may prescribe different modifications of the Act for different small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901.

6E(1B)   Small business operator that is a protected action ballot agent under the Fair Work Act 2009 .  

If a small business operator is the protected action ballot agent for a protected action ballot conducted under Part 3-3 of the Fair Work Act 2009, this Act applies, with the prescribed modifications (if any), in relation to the activities carried on by the small business operator for the purpose of, or in connection with, the conduct of the protected action ballot, as if the small business operator were an organisation.

Note:

The regulations may prescribe different modifications of the Act for different small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901.

6E(1C)   Small business operator that is an association of employees that is registered or recognised under the Fair Work (Registered Organisations) Act 2009 .  

If a small business operator is an association of employees that is registered or recognised under the Fair Work (Registered Organisations) Act 2009, this Act applies, with the prescribed modifications (if any), in relation to the activities carried on by the small business operator, as if the small business operator were an organisation (within the meaning of this Act).

Note:

The regulations may prescribe different modifications of the Act for different small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901.

6E(1)   Regulations treating a small business operator as an organisation.  

This Act applies, with the prescribed modifications (if any), in relation to a small business operator prescribed for the purposes of this subsection as if the small business operator were an organisation.

Note 1: The regulations may prescribe different modifications of the Act for different small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901.

Note 2: Regulations may prescribe a small business operator by reference to one or more classes of small business operator. See subsection 13(3) of the Legislation Act 2003.

6E(2)   Regulations treating a small business operator as an organisation for particular acts or practices.  

This Act also applies, with the prescribed modifications (if any), in relation to the prescribed acts or practices of a small business operator prescribed for the purposes of this subsection as if the small business operator were an organisation.

Note 1: The regulations may prescribe different modifications of the Act for different acts, practices or small business operators. See subsection 33(3A) of the Acts Interpretation Act 1901.

Note 2: Regulations may prescribe an act, practice or small business operator by reference to one or more classes of acts, practices or small business operators. See subsection 13(3) of the Legislation Act 2003.

Definition

6E(3)  


In this section:

modifications
(Repealed by No 46 of 2011)

protected action ballot agent
means a person (other than the Australian Electoral Commission) that conducts a protected action ballot under Part 3-3 of the Fair Work Act 2009.

6E(4)   Making regulations.  

Before the Governor-General makes regulations prescribing a small business operator, act or practice for the purposes of subsection (1) or (2), the Minister must:


(a) be satisfied that it is desirable in the public interest to regulate under this Act the small business operator, act or practice; and


(b) consult the Commissioner about the desirability of regulating under this Act the matters described in paragraph (a).

SECTION 6EA   SMALL BUSINESS OPERATORS CHOOSING TO BE TREATED AS ORGANISATIONS  

6EA(1)   [Application]  

This Act applies in relation to a small business operator as if the operator were an organisation while a choice by the operator to be treated as an organisation is registered under this section.

6EA(2)   [Choice in writing]  

A small business operator may make a choice in writing given to the Commissioner to be treated as an organisation.

Note:

A small business operator may revoke such a choice by writing given to the Commissioner. See subsection 33(3) of the Acts Interpretation Act 1901.

6EA(3)   [Register of operators]  

If the Commissioner is satisfied that a small business operator has made the choice to be treated as an organisation, the Commissioner must enter in a register of operators who have made such a choice:


(a) the name or names under which the operator carries on business; and


(b) the operator's ABN, if the operator has one under the A New Tax System (Australian Business Number) Act 1999.

6EA(4)   [Revocation of choice to be treated as organisation]  

If a small business operator revokes a choice to be treated as an organisation, the Commissioner must remove from the register the material relating to the operator.

6EA(5)   [Form of register]  

The Commissioner may decide the form of the register and how it is to be kept.

6EA(6)   [Availability to public]  

The Commissioner must make the register available to the public in the way that the Commissioner determines. However, the Commissioner must not make available to the public in the register information other than that described in subsection (3).

SECTION 6F   STATE INSTRUMENTALITIES ETC. TREATED AS ORGANISATIONS  

6F(1)   Regulations treating a State instrumentality etc. as an organisation.  

This Act applies, with the prescribed modifications (if any), in relation to a prescribed State or Territory authority or a prescribed instrumentality of a State or Territory (except an instrumentality that is an organisation because of section 6C) as if the authority or instrumentality were an organisation.

Note 1: The regulations may prescribe different modifications of the Act for different authorities or instrumentalities. See subsection 33(3A) of the Acts Interpretation Act 1901.

Note 2: Regulations may prescribe an authority or instrumentality by reference to one or more classes of authority or instrumentality. See subsection 13(3) of the Legislation Act 2003.

6F(2)  
(Repealed by No 46of 2011)

6F(3)   Making regulations to treat instrumentality etc. as organisation.  

Before the Governor-General makes regulations prescribing a State or Territory authority or instrumentality of a State or Territory for the purposes of subsection (1), the Minister must:


(a) be satisfied that the relevant State or Territory has requested that the authority or instrumentality be prescribed for those purposes; and


(b) consult the Commissioner about the desirability of regulating under this Act the collection, holding, use, correction and disclosure of personal information by the authority or instrumentality.


SECTION 6FA   6FA   MEANING OF HEALTH INFORMATION  


The following information is health information :


(a) information or an opinion about:


(i) the health, including an illness, disability or injury, (at any time) of an individual; or

(ii) an individual's expressed wishes about the future provision of health services to the individual; or

(iii) a health service provided, or to be provided, to an individual;
that is also personal information;


(b) other personal information collected to provide, or in providing, a health service to an individual;


(c) other personal information collected in connection with the donation, or intended donation, by an individual of his or her body parts, organs or body substances;


(d) genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

SECTION 6FB   MEANING OF HEALTH SERVICE  

6FB(1)  
An activity performed in relation to an individual is a health service if the activity is intended or claimed (expressly or otherwise) by the individual or the person performing it:


(a) to assess, maintain or improve the individual's health; or


(b) where the individual's health cannot be maintained or improved - to manage the individual's health; or


(c) to diagnose the individual's illness, disability or injury; or


(d) to treat the individual's illness, disability or injury or suspected illness, disability or injury; or


(e) to record the individual's health for the purposes of assessing, maintaining, improving or managing the individual's health.

6FB(2)  
The dispensing on prescription of a drug or medicinal preparation by a pharmacist is a health service .

6FB(3)  
To avoid doubt:


(a) a reference in this section to an individual's health includes the individual's physical or psychological health; and


(b) an activity mentioned in subsection (1) or (2) that takes place in the course of providing aged care, palliative care or care for a person with a disability is a health service .

6FB(4)  
The regulations may prescribe an activity that, despite subsections (1) and (2) is not to be treated as a health service for the purposes of this Act.

Division 2 - Key definitions relating to credit reporting  

Subdivision A - Credit provider  

SECTION 6G   MEANING OF CREDIT PROVIDER  

General

6G(1)  
Each of the following is a credit provider :


(a) a bank;


(b) an organisation or small business operator if:


(i) the organisation or operator carries on a business or undertaking; and

(ii) a substantial part of the business or undertaking is the provision of credit;


(c) an organisation or small business operator:


(i) that carries on a retail business; and

(ii) that, in the course of the business, issues credit cards to individuals in connection with the sale of goods, or the supply of services, by the organisation or operator (as the case may be);


(d) an agency, organisation or small business operator:


(i) that carries on a business or undertaking that involves providing credit; and

(ii) that is prescribed by the regulations.
Other credit providers

6G(2)  
If:


(a) an organisation or small business operator (the supplier ) carries on a business or undertaking in the course of which the supplier provides credit in connection with the sale of goods, or the supply of services, by the supplier; and


(b) the repayment, in full or in part, of the amount of credit is deferred for at least 7 days; and


(c) the supplier is not a credit provider under subsection (1);
then the supplier is a credit provider but only in relation to the credit.

6G(3)  
If:


(a) an organisation or small business operator (the lessor ) carries on a business or undertaking in the course of which the lessor provides credit in connection with the hiring, leasing or renting of goods; and


(b) the credit is in force for at least 7 days; and


(c) no amount, or an amount less than the value of the goods, is paid as a deposit for the return of the goods; and


(d) the lessor is not a credit provider under subsection (1);

then the lessor is a credit provider but only in relation to the credit.

6G(4)  
An organisation or small business operator is a credit provider if subsection 6H(1), 6J(1) or 6K(1) provides that the organisation or operator is a credit provider. Exclusions

6G(5)  
Despite subsections (1) to (4) of this section, an organisation or small business operator acting in the capacity of:


(a) a real estate agent; or


(b) a general insurer (within the meaning of the Insurance Act 1973); or


(c) an employer of an individual;

is not a credit provider while acting in that capacity.

6G(6)  
Despite subsections (1) to (4) of this section, an organisation or small business operator is not a credit provider if it is included in a class of organisations or operators prescribed by the regulations.

SECTION 6H   AGENTS OF CREDIT PROVIDERS  

6H(1)  
If an organisation or small business operator (the agent ) is acting as an agent of a credit provider (the principal ) in performing, on behalf of the principal, a task that is reasonably necessary:


(a) in processing an application for credit made to the principal; or


(b) in managing credit provided by the principal;

then, while the agent is so acting, the agent is a credit provider .

6H(2)  
Subsection (1) does not apply if the principal is an organisation or small business operator that is a credit provider because of a previous application of that subsection.

6H(3)  
If subsection (1) applies in relation to credit that has been provided by the principal, the credit is taken, for the purposes of this Act, to have been provided by both the principal and the agent.

6H(4)  
If subsection (1) applies in relation to credit for which an application has been made to the principal, the application is taken, for the purposes of this Act, to have been made to both the principal and the agent.

SECTION 6J   SECURITISATION ARRANGEMENTS ETC.  

6J(1)  
If:


(a) an organisation or small business operator (the securitisation entity ) carries on a business that is involved in either or both of the following:


(i) a securitisation arrangement;

(ii) managing credit that is the subject of a securitisation arrangement; and


(b) the securitisation entity performs a task that is reasonably necessary for:


(i) purchasing, funding or managing, or processing an application for, credit by means of a securitisation arrangement; or

(ii) undertaking credit enhancement in relation to credit; and


(c) the credit has been provided by, or is credit for which an application has been made to, a credit provider (the original credit provider );

then, while the securitisation entity performs such a task, the securitisation entity is a credit provider .

6J(2)  
Subsection (1) does not apply if the original credit provider is an organisation or small business operator that is a credit provider because of a previous application of that subsection.

6J(3)  
If subsection (1) applies in relation to credit that has been provided by the original credit provider, the credit is taken, for the purposes of this Act, to have been provided by both the original credit provider and the securitisation entity.

6J(4)  
If subsection (1) applies in relation to credit for which an application has been made to the original credit provider, the application is taken, for the purposes of this Act, to have been made to both the original credit provider and the securitisation entity.

SECTION 6K   ACQUISITION OF THE RIGHTS OF A CREDIT PROVIDER  

6K(1)  
If:


(a) an organisation or small business operator (the acquirer ) acquires, whether by assignment, subrogation or any other means, the rights of a credit provider (the original credit provider ) in relation to the repayment of an amount of credit; and


(b) the acquirer is not a credit provider under subsection 6G(1);

then the acquirer is a credit provider but only in relation to the credit.

6K(2)  
If subsection (1) of this section applies in relation to credit that has been provided by the original credit provider, the credit is taken, for the purposes of this Act, to have been provided by the acquirer.

6K(3)  
If subsection (1) of this section applies in relation to credit for which an application has been made to the original credit provider, the application is taken, for the purposes of this Act, to have been made to the acquirer.

Subdivision B - Other definitions  

SECTION 6L   MEANING OF ACCESS SEEKER  

6L(1)  
An access seeker in relation to credit reporting information, or credit eligibility information, about an individual is:


(a) the individual; or


(b) a person:


(i) who is assisting the individual to deal with a credit reporting body or credit provider; and

(ii) who is authorised, in writing, by the individual to make a request in relation to the information under subsection 20R(1) or 21T(1).

6L(2)  
An individual must not authorise a person under subparagraph (1)(b)(ii) if the person is:


(a) a credit provider; or


(b) a mortgage insurer; or


(c) a trade insurer; or


(d) a person who is prevented from being a credit provider by subsection 6G(5) or (6).

6L(3)  
Subparagraph (1)(b)(ii) does not apply to a person who provides the National Relay Service or a person prescribed by the regulations.

SECTION 6M   MEANING OF CREDIT AND AMOUNT OF CREDIT  

6M(1)  
Credit is a contract, arrangement or understanding under which:


(a) payment of a debt owed by one person to another person is deferred; or


(b) one person incurs a debt to another person and defers the payment of the debt.

6M(2)  
The amount of credit is the amount of the debt that is actually deferred, or that may be deferred, but does not include any fees or charges payable in connection with the deferral of the debt.

6M(3)  
Without limiting subsection (1), credit includes:


(a) a hire-purchase agreement; and


(b) a contract, arrangement or understanding of a kind referred to in that subsection that is for the hire, lease or rental of goods, or for the supply of services, other than a contract, arrangement or understanding under which:


(i) full payment is made before, or at the same time as, the goods or services are provided; and

(ii) in the case of goods - an amount greater than, or equal to, the value of the goods is paid as a deposit for the return of the goods.

SECTION 6N   6N   MEANING OF CREDIT INFORMATION  


Credit information about an individual is personal information (other than sensitive information) that is:


(a) identification information about the individual; or


(b) consumer credit liability information about the individual; or


(c) repayment history information about the individual; or


(d) a statement that an information request has been made in relation to the individual by a credit provider, mortgage insurer or trade insurer; or


(e) the type of consumer credit or commercial credit, and the amount of credit, sought in an application:


(i) that has been made by the individual to a credit provider; and

(ii) in connection with which the provider has made an information request in relation to the individual; or


(f) default information about the individual; or


(g) payment information about the individual; or


(h) new arrangement information about the individual; or


(i) court proceedings information about the individual; or


(j) personal insolvency information about the individual; or


(k) publicly available information about the individual:


(i) that relates to the individual's activities in Australia or the external Territories and the individual's credit worthiness; and

(ii) that is not court proceedings information about the individual or information about the individual that is entered or recorded on the National Personal Insolvency Index; or


(l) the opinion of a credit provider that the individual has committed, in circumstances specified by the provider, a serious credit infringement in relation to consumer credit provided by the provider to the individual.

SECTION 6P   MEANING OF CREDIT REPORTING BUSINESS  

6P(1)  
A credit reporting business is a business or undertaking that involves collecting, holding, using or disclosing personal information about individuals for the purpose of, or for purposes including the purpose of, providing an entity with information about the credit worthiness of an individual.

6P(2)  
Subsection (1) applies whether or not the information about the credit worthiness of an individual is:


(a) provided for profit or reward; or


(b) provided, or intended to be provided, for the purposes of assessing an application for consumer credit.

6P(3)  
In determining whether a business or undertaking carried on by a credit provider is a credit reporting business, disregard the provision of information about the credit worthiness of an individual to a related body corporate by the provider.

6P(4)  
Despite subsection (1), a business or undertaking is not a credit reporting business if the business or undertaking is included in a class of businesses or undertakings prescribed by the regulations.

SECTION 6Q   MEANING OF DEFAULT INFORMATION  

Consumer credit defaults

6Q(1)  
Default information about an individual is information about a payment (including a payment that is wholly or partly a payment of interest) that the individual is overdue in making in relation to consumer credit that has been provided by a credit provider to the individual if:


(a) the individual is at least 60 days overdue in making the payment; and


(b) the provider has given a written notice to the individual informing the individual of the overdue payment and requesting that the individual pay the amount of the overdue payment; and


(c) the provider is not prevented by a statute of limitations from recovering the amount of the overdue payment; and


(d) the amount of the overdue payment is equal to or more than:


(i) $150; or

(ii) such higher amount as is prescribed by the regulations.
Guarantor defaults

6Q(2)  
Default information about an individual is information about a payment that the individual is overdue in making as a guarantor under a guarantee given against any default by a person (the borrower ) in repaying all or any of the debt deferred under consumer credit provided by a credit provider to the borrower if:


(a) the provider has given the individual written notice of the borrower's default that gave rise to the individual's obligation to make the overdue payment; and


(b) the notice requests that the individual pay the amount of the overdue payment; and


(c) at least 60 days have passed since the day on which the notice was given; and


(d) in addition to giving the notice, the provider has taken other steps to recover the amount of the overdue payment from the individual; and


(e) the provider is not prevented by a statute of limitations from recovering the amount of the overdue payment.

SECTION 6R   MEANING OF INFORMATION REQUEST  

Credit provider

6R(1)  
A credit provider has made an information request in relation to an individual if the provider has sought information about the individual from a credit reporting body:


(a) in connection with an application for consumer credit made by the individual to the provider; or


(b) in connection with an application for commercial credit made by a person to the provider; or


(c) for a credit guarantee purpose of the provider in relation to the individual; or


(d) for a securitisation related purpose of the provider in relation to the individual. Mortgage insurer

6R(2)  
A mortgage insurer has made an information request in relation to an individual if:


(a) the insurer has sought information about the individual from a credit reporting body; and


(b) the information was sought in connection with the provision of insurance to a credit provider in relation to mortgage credit provided by the provider to:


(i) the individual; or

(ii) a person for whom the individual is, or is proposing to be, a guarantor.
Trade insurer

6R(3)  
A trade insurer has made an information request in relation to an individual if:


(a) the insurer has sought information about the individual from a credit reporting body; and


(b) the information was sought in connection with the provision of insurance to a credit provider in relation to commercial credit provided by the provider to the individual or another person.

SECTION 6S   MEANING OF NEW ARRANGEMENT INFORMATION  

Consumer credit defaults

6S(1)  
If:


(a) a credit provider has disclosed default information about an individual to a credit reporting body; and


(b) the default information relates to a payment that the individual is overdue in making in relation to consumer credit (the original consumer credit ) that has been provided by the provider to the individual; and


(c) because of the individual being so overdue:


(i) the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied; or

(ii) the individual is provided with other consumer credit (the new consumer credit ) by a credit provider that relates, wholly or in part, to that amount of credit;

then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.

Serious credit infringements

6S(2)  
If:


(a) a credit provider is of the opinion that an individual has committed a serious credit infringement in relation to consumer credit (the original consumer credit ) provided by the provider to the individual; and


(b) the provider has disclosed the opinion to a credit reporting body; and


(c) because of the provider having that opinion:


(i) the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied; or

(ii) the individual is provided with other consumer credit (the new consumer credit ) by a credit provider that relates, wholly or in part, to that amount of credit;

then new arrangement information about the individual is a statement that those terms or conditions of the original consumer credit have been varied, or that the individual has been provided with the new consumer credit.

SECTION 6T   6T   MEANING OF PAYMENT INFORMATION  


If:


(a) a credit provider has disclosed default information about an individual to a credit reporting body; and


(b) on a day after the default information was disclosed, the amount of the overdue payment to which the information relates is paid;

then payment information about the individual is a statement that the amount of the overdue payment has been paid on that day.

SECTION 6U   MEANING OF PERSONAL INSOLVENCY INFORMATION  

6U(1)  
Personal insolvency information about an individual is information:


(a) that is entered or recorded in the National Personal Insolvency Index; and


(b) that relates to:


(i) a bankruptcy of the individual; or

(ii) a debt agreement proposal given by the individual; or

(iii) a debt agreement made by the individual; or

(iv) a personal insolvency agreement executed by the individual; or

(v) a direction given, or an order made, under section 50 of the Bankruptcy Act that relates to the property of the individual; or

(vi) an authority signed under section 188 of that Act that relates to the property of the individual.

6U(2)  
Despite subparagraph (1)(b)(i), personal insolvency information about an individual must not relate to:


(a) the presentation of a creditor's petition against the individual; or


(b) an administration under Part XI of the Bankruptcy Act of the individual's estate.

6U(3)  
An expression used in paragraph (1)(b) or (2)(a) that is also used in the Bankruptcy Act has the same meaning in that paragraph as it has in that Act.

SECTION 6V   MEANING OF REPAYMENT HISTORY INFORMATION  

6V(1)  
If a credit provider provides consumer credit to an individual, the following information about the consumer credit is repayment history information about the individual:


(a) whether or not the individual has met an obligation to make a monthly payment that is due and payable in relation to the consumer credit;


(b) the day on which the monthly payment is due and payable;


(c) if the individual makes the monthly payment after the day on which the payment is due and payable - the day on which the individual makes that payment.

6V(2)  
The regulations may make provision in relation to:


(a) whether or not an individual has met an obligation to make a monthly payment that is due and payable in relation to consumer credit; and


(b) whether or not a payment is a monthly payment.

Division 3 - Other matters  

SECTION 7   ACTS AND PRACTICES OF AGENCIES, ORGANISATIONS ETC.  

7(1)  
Except so far as the contrary intention appears, a reference in this Act (other than section 8) to an act or to a practice is a reference to:


(a) an act done, or a practice engaged in, as the case may be, by an agency (other than an eligible hearing service provider), a file number recipient, a credit reporting body or a credit provider other than:


(i) an agency specified in any of the following provisions of the Freedom of Information Act 1982:

(A) Schedule 1;

(B) Division 1 of Part I of Schedule 2;

(C) Division 1 of Part II of Schedule 2; or

(ii) a federal court; or

(iia) a court of Norfolk Island; or

(iii) a Minister; or

(iiiaa) (Repealed by No 59 of 2015)

(iiia) the Integrity Commissioner; or

(iv) the ACC; or

(v) a Royal Commission; or

(vi) a Commission of inquiry; or


(b) an act done, or a practice engaged in, as the case may be, by a federal court, or by an agency specified in Schedule 1 to the Freedom of Information Act 1982, being an act done, or a practice engaged in, in respect of a matter of an administrative nature; or


(ba) an act done, or a practice engaged in, as the case may be, by a court of Norfolk Island, being an act done, or a practice engaged in, in respect of a matter of an administrative nature; or


(c) an act done, or a practice engaged in, as the case may be, by an agency specified in Division 1 of Part II of Schedule 2 to the Freedom of Information Act 1982, other than an act done, or a practice engaged in, in relation to a record in relation to which the agency is exempt from the operation of that Act; or


(ca) an act done, or a practice engaged in, as the case may be, by a part of the Defence Department specified in Division 2 of Part I of Schedule 2 to the Freedom of Information Act 1982, other than an act done, or a practice engaged in, in relation to the activities of that part of the Department; or


(cb) (Repealed by No 197 of 2012)


(cc) an act done, or a practice engaged in, as the case may be, by an eligible hearing service provider in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or


(d) an act done, or a practice engaged in, as the case may be, by a Minister in relation to the affairs of an agency (other than a Norfolk Island agency or an eligible hearing service provider), not being an act done, or a practice engaged in, in relation to an existing record; or


(e) an act done, or a practice engaged in, as the case may be, by a Minister in relation to a record that is in the Minister's possession in his or her capacity as a Minister and relates to the affairs of an agency (other than a Norfolk Island agency or an eligible hearing service provider); or


(eaa)-(eab) (Repealed by No 59 of 2015)


(ea)-(eb) (Repealed by No 197 of 2012)


(ec) an act done, or a practice engaged in, as the case may be, by a Minister in relation to the affairs of an eligible hearing service provider, being affairs in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or


(ed) an act done, or a practice engaged in, as the case may be, by a Minister in relation to a record that is in the Minister's possession in his or her capacity as a Minister and relates to the affairs of an eligible hearing service provider, being affairs in connection with the provision of hearing services under an agreement made under Part 3 of the Hearing Services Administration Act 1997; or


(ee) an act done, or a practice engaged in, by an organisation, other than an exempt act or exempt practice (see sections 7B and 7C);

but does not include a reference to an act done, or a practice engaged in, in relation to a record that has originated with, or has been received from:


(f) an intelligence agency;


(g) the Defence Intelligence Organisation or the Australian Geospatial-Intelligence Organisation; or


(ga) the Integrity Commissioner or a staff member of ACLEI (within the meaning of the Law Enforcement Integrity Commissioner Act 2006); or


(h) the ACC or the Board of the ACC.

7(1A)  
Despite subsections (1) and (2), a reference in this Act (other than section 8) to an act or to a practice does not include a reference to the act or practice so far as it involves the disclosure of personal information to:


(a) the Australian Security Intelligence Organisation; or


(b) the Australian Secret Intelligence Service; or


(c) the Australian Signals Directorate.

7(1B)  


Despite subsections (1) and (2), a reference in this Act (other than section 8) to an act or to a practice does not include a reference to the act or practice by an agency with an intelligence role or function (within the meaning of the Office of National Intelligence Act 2018) so far as it involves the disclosure of personal information to the Office of National Intelligence.

7(2)  


Except so far as the contrary intention appears, a reference in this Act (other than section 8) to an act or to a practice includes, in the application of this Act otherwise than in respect of the Australian Privacy Principles, a registered APP code and the performance of the Commissioner's functions in relation to the principles and such a code, a reference to an act done, or a practice engaged in, as the case may be, by an agency specified in Part I of Schedule 2 to the Freedom of Information Act 1982 or in Division 1 of Part II of that Schedule other than:


(a) an intelligence agency;


(b) the Defence Intelligence Organisation or the Australian Geospatial-Intelligence Organisation; or


(c) the ACC or the Board of the ACC.

7(3)  
Except so far as the contrary intention appears, a reference in this Act to doing an act includes a reference to:


(a) doing an act in accordance with a practice; or


(b) refusing or failing to do an act.

7(3A)  
(Repealed by No 197 of 2012)

7(4)  


For the purposes of section 28, of paragraphs 28A(2)(a) to (e), of subsection 31(2) and of Part VI, this section has effect as if a reference in subsection (1) of this section to an act done, or to a practice engaged in, included a reference to an act that is proposed to be done, or to a practice that is proposed to be engaged in, as the case may be.

SECTION 7A   ACTS OF CERTAIN AGENCIES TREATED AS ACTS OF ORGANISATION  

7A(1)   [Application]  

This Act applies, with the prescribed modifications (if any), in relation to an act or practice described in subsection (2) or (3) as if:


(a) the act or practice were an act done, or practice engaged in, by an organisation; and


(b) the agency mentioned in that subsection were the organisation.

7A(2)   [Prescribed agencies]  

Subsection (1) applies to acts done, and practices engaged in, by a prescribed agency. Regulations for this purpose may prescribe an agency only if it is specified in Part I of Schedule 2 to the Freedom of Information Act 1982.

7A(3)   [Additional acts and practices]  

Subsection (1) also applies to acts and practices that:


(a) are done or engaged in by an agency specified in Division 1 of Part II of Schedule 2 to the Freedom of Information Act 1982 in relation to documents in respect of its commercial activities or the commercial activities of another entity; and


(b) relate to those commercial activities.

7A(4)   [Effect]  

This section has effect despite subparagraph 7(1)(a)(i), paragraph 7(1)(c) and subsection 7(2).

7A(5)  
(Repealed by No 46 of 2011)

SECTION 7B   EXEMPT ACTS AND EXEMPT PRACTICES OF ORGANISATIONS  

7B(1)   Individuals in non-business capacity.  

An act done, or practice engaged in, by an organisation that is an individual is exempt for the purposes of paragraph 7(1)(ee) if the act is done, or the practice is engaged in, other than in the course of a business carried on by the individual.

Note: See also section 16 which provides that the Australian Privacy Principles do not apply for the purposes of, or in connection with, an individual's personal, family or household affairs.

7B(2)   Organisation acting under Commonwealth contract.  

An act done, or practice engaged in, by an organisation is exempt for the purposes of paragraph 7(1)(ee) if:


(a) the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract); and


(b) the organisation would be a small business operator if it were not a contracted service provider for a Commonwealth contract; and


(c) the act is done, or the practice is engaged in, otherwise than for the purposes of meeting (directly or indirectly) an obligation under a Commonwealth contract for which the organisation is the contracted service provider.

Note:

This puts the organisation in the same position as a small business operator as far as its activities that are not for the purposes of a Commonwealth contract are concerned, so the organisation need not comply with the Australian Privacy Principles, or a registered APP code that binds the organisation, in relation to those activities.

7B(3)   Employee records.  

An act done, or practice engaged in, by an organisation that is or was an employer of an individual, is exempt for the purposes of paragraph 7(1)(ee) if the act or practice is directly related to:


(a) a current or former employment relationship between the employer and the individual; and


(b) an employee record held by the organisation and relating to the individual.

7B(4)   Journalism.  

An act done, or practice engaged in, by a media organisation is exempt for the purposes of paragraph 7(1)(ee) if the act is done, or the practice is engaged in:


(a) by the organisation in the course of journalism; and


(b) at a time when the organisation is publicly committed to observe standards that:


(i) deal with privacy in the context of the activities of a media organisation (whether or not the standards also deal with other matters); and

(ii) have been published in writing by the organisation or a person or body representing a class of media organisations.

7B(5)   Organisation acting under State contract.  

An act done, or practice engaged in, by an organisation is exempt for the purposes of paragraph 7(1)(ee) if:


(a) the organisation is a contracted service provider for a State contract (whether or not the organisation is a party to the contract); and


(b) the act is done, or the practice is engaged in for the purposes of meeting (directly or indirectly) an obligation under the contract.

SECTION 7C   POLITICAL ACTS AND PRACTICES ARE EXEMPT  

7C(1)   Members of a Parliament etc.  

An act done, or practice engaged in, by an organisation (the political representative ) consisting of a member of a Parliament, or a councillor (however described) of a local government authority, is exempt for the purposes of paragraph 7(1)(ee) if the act is done, or the practice is engaged in, for any purpose in connection with:


(a) an election under an electoral law; or


(b) a referendum under a law of the Commonwealth or a law of a State or Territory; or


(c) the participation by the political representative in another aspect of the political process.

7C(2)   Contractors for political representatives etc.  

An act done, or practice engaged in, by an organisation (the contractor ) is exempt for the purposes of paragraph 7(1)(ee) if the act is done or the practice is engaged in:


(a) for the purposes of meeting an obligation under a contract between the contractor and a registered political partyor a political representative described in subsection (1); and


(b) for any purpose in connection with one or more of the following:


(i) an election under an electoral law;

(ii) a referendum under a law of the Commonwealth or a law of a State or Territory;

(iii) the participation in another aspect of the political process by the registered political party or political representative;

(iv) facilitating acts or practices of the registered political party or political representative for a purpose mentioned in subparagraph (i), (ii) or (iii) of this paragraph.

7C(3)   Subcontractors for organisations covered by subsection (1) etc.  

An act done, or practice engaged in, by an organisation (the subcontractor ) is exempt for the purposes of paragraph 7(1)(ee) if the act is done or the practice is engaged in:


(a) for the purposes of meeting an obligation under a contract between the subcontractor and a contractor described in subsection (2); and


(b) for a purpose described in paragraph (2)(b).

7C(4)   Volunteers for registered political parties.  

An act done voluntarily, or practice engaged in voluntarily, by an organisation for or on behalf of a registered political party and with the authority of the party is exempt for the purposes of paragraph 7(1)(ee) if the act is done or the practice is engaged in for any purpose in connection with one or more of the following:


(a) an election under an electoral law;


(b) a referendum under a law of the Commonwealth or a law of a State or Territory;


(c) the participation in another aspect of the political process by the registered political party;


(d) facilitating acts or practices of the registered political party for a purpose mentioned in paragraph (a), (b) or (c).

7C(5)   Effect of subsection (4) on other operation of Act.  

Subsection (4) does not otherwise affect the operation of the Act in relation to agents or principals.

7C(6)   Meaning of electoral law and Parliament .  

In this section:

electoral law
means a law of the Commonwealth, or a law of a State or Territory, relating to elections to a Parliament or to a local government authority.

Parliament
means:


(a) the Parliament of the Commonwealth; or


(b) a State Parliament; or


(c) the legislature of a Territory.

Note: To avoid doubt, this section does not make exempt for the purposes of paragraph 7(1)(ee) an act or practice of the political representative, contractor, subcontractor or volunteer for a registered political party involving the use or disclosure (by way of sale or otherwise) of personal information in a way not covered by subsection (1), (2), (3) or (4) (as appropriate). The rest of this Act operates normally in relation to that act or practice.

SECTION 8   ACTS AND PRACTICES OF, AND DISCLOSURE OF INFORMATION TO, STAFF OF AGENCY, ORGANISATION ETC.  

8(1)   [Deemed acts by agency]  

For the purposes of this Act:


(a) an act done or practice engaged in by, or information disclosed to, a person employed by, or in the service of, an agency, organisation, file number recipient, credit reporting body or credit provider in the performance of the duties of the person's employment shall be treated as having been done or engaged in by, or disclosed to, the agency, organisation, recipient,credit reporting body or credit provider;


(b) an act done or practice engaged in by, or information disclosed to, a person on behalf of, or for the purposes of the activities of, an unincorporated body, being a board, council, committee, sub-committee or other body established by or under a Commonwealth enactment or a Norfolk Island enactment for the purpose of assisting, or performing functions in connection with, an agency, or organisation, shall be treated as having been done or engaged in by, or disclosed to, the agency or organisation; and


(c) an act done or practice engaged in by, or information disclosed to, a person who is the Commissioner of the Australian Federal Police, a Deputy Commissioner of the Australian Federal Police, an AFP employee or a special member of the Australian Federal Police (all within the meaning of the Australian Federal Police Act 1979) in the performance of his or her duties as such a person is treated as having been done or engaged in by, or disclosed to, the Australian Federal Police.

8(2)   [Deemed act by record-keeper]  

Where:


(a) an act done or a practice engaged in by a person, in relation to a record, is to be treated, under subsection (1), as having been done or engaged in by an agency; and


(b) that agency does not hold that record;

that act or practice shall be treated as the act or the practice of the agency that holds that record.

8(3)   [Deemed acts by organisation]  

For the purposes of the application of this Act in relation to an organisation that is a partnership:


(a) an act done or practice engaged in by a partner is taken to have been done or engaged in by the organisation; and


(b) a communication (including acomplaint, notice, request or disclosure of information) made to a partner is taken to have been made to the organisation.

8(4)   [Deemed acts of unincorporated association]  

For the purposes of the application of this Act in relation to an organisation that is an unincorporated association:


(a) an act done or practice engaged in by a member of the committee of management of the association is taken to have been done or engaged in by the organisation; and


(b) a communication (including a complaint, notice, request or disclosure of information) made to a member of the committee of management of the association is taken to have been made to the organisation.

8(5)   [Deemed acts of trust organisation]  

For the purposes of the application of this Act in relation to an organisation that is a trust:


(a) an act done or practice engaged in by a trustee is taken to have been done or engaged in by the organisation; and


(b) a communication (including a complaint, notice or request or disclosure of information) made to a trustee is taken to have been made to the organisation.

SECTION 9   9   COLLECTORS  
(Repealed by No 197 of 2012)

SECTION 10   AGENCIES THAT ARE TAKEN TO HOLD A RECORD  

10(1)-(3)  
(Repealed by No 197 of 2012)

10(4)  


Where:


(a) a record of personal information (not being a record relating to the administration of the National Archives of Australia) is in the care (within the meaning of the Archives Act 1983) of the National Archives of Australia; or


(b) a record of personal information (not being a record relating to the administration of the Australian War Memorial) is in the custody of the Australian War Memorial;

the agency by or on behalf of which the record was placed in that care or custody or, if that agency no longer exists, the agency to whose functions the contents of the record are most closely related, shall be regarded, for the purposes of this Act, to be the agency that holds that record.

10(5)  


Where a record of personal information was placed by or on behalf of an agency in the memorial collection within the meaning of the Australian War Memorial Act 1980, that agency or, if that agency no longer exists, the agency to whose functions the contents of the record are most closely related, shall be regarded, for the purposes of this Act, to be the agency that holds that record.

SECTION 11   FILE NUMBER RECIPIENTS  

11(1)   [Person possessing tax file number information]  

A person who is (whether lawfully or unlawfully) in possession or control of a record that contains tax file number information shall be regarded, for the purposes of this Act, as a file number recipient.

11(2)   [Employer or agency deemed file number recipient]  

Subject to subsection (3), where a record that contains tax file number information is in the possession or under the control of a person:


(a) in the course of the person's employment in the service of or by a person or body other than an agency;


(b) in the course of the person's employment in the service of or by an agency other than the Australian Federal Police; or


(c) as the Commissioner of the Australian Federal Police, a Deputy Commissioner of the Australian Federal Police, an AFP employee or a special member of the Australian Federal Police (all within the meaning of the Australian Federal Police Act 1979) in the performance of his or her duties as such a person;

then, for the purposes of this Act, the file number recipient in relation to that record shall be taken to be:


(d) if paragraph (a) applies - the person's employer;


(e) if paragraph (b) applies - the agency first referred to in that paragraph; and


(f) if paragraph (c) applies - the Australian Federal Police.

11(3)   [Commonwealth body assisting agency]  

Where a record that contains tax file number information is in the possession or under the control of a person for the purposes of the activities of, an unincorporated body, being a board, council, committee, sub-committee or other body established by or under a Commonwealth enactment or a Norfolk Island enactment for the purpose of assisting, or performing functions connected with, an agency, that agency shall be treated, for the purposes of this Act, as the file number recipient in relation to that record.

SECTION 11A   11A   CREDIT REPORTING AGENCIES  
(Repealed by No 197 of 2012)

SECTION 11B   11B   CREDIT PROVIDERS  
(Repealed by No 197 of 2012)

SECTION 12   12   APPLICATION OF INFORMATION PRIVACY PRINCIPLES TO AGENCY IN POSSESSION  
(Repealed by No 197 of 2012)

SECTION 12A   12A   ACT NOT TO APPLY IN RELATION TO STATE BANKING OR INSURANCE WITHIN THAT STATE  
Where, but for this section, a provision of this Act:


(a) would have a particular application; and


(b) by virtue of having that application, would be a law with respect to, or with respect to matters including:


(i) State banking not extending beyond the limits of the State concerned; or

(ii) State insurance not extending beyond the limits of the State concerned;

the provision is not to have that application.

SECTION 12B   SEVERABILITY - ADDITIONAL EFFECT OF THIS ACT  

12B(1)  


Without limiting its effect apart from this section, this Act has effect in relation to the following (the regulated entities ) as provided by this section:


(a) an agency;


(b) an organisation;


(c) a small business operator;


(d) a body politic.

Note:

Subsection 27(4) applies in relation to an investigation of an act or practice referred to in subsection 29(1) of the Healthcare Identifiers Act 2010.

12B(2)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to an operation to give effect to the following:


(a) the International Covenant on Civil and Political Rights done at New York on 16 December 1966 ([1980] ATS 23), and in particular Articles 17 and 24(1) of the Covenant;


(b) Article 16 of the Convention on the Rights of the Child done at New York on 20 November 1989 ([1991] ATS 4).

Note:

In 2012, the text of the Covenant and Convention in the Australian Treaty Series was accessible through the Australian Treaties Library on the AustLII website (www.austlii.edu.au).

12B(3)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to acts or practices covered by section 5B (which deals with acts and practices outside Australia and the external Territories).

12B(4)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to regulated entities that are corporations.

12B(5)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to acts or practices of regulated entities taking place in the course of, or in relation to, trade or commerce:


(a) between Australia and places outside Australia; or


(b) among the States; or


(c) within a Territory, between a State and a Territory or between 2 Territories.

12B(5A)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to acts or practices engaged in by regulated entities in the course of:


(a) banking (other than State banking not extending beyond the limits of the State concerned); or


(b) insurance (other than State insurance not extending beyond the limits of the State concerned).

12B(6)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to acts or practices of regulated entities taking place using a postal, telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution.

12B(7)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to acts or practices of regulated entities taking place in a Territory.

12B(8)  


This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to acts or practices of regulated entities taking place in a place acquired by the Commonwealth for public purposes.

PART III - INFORMATION PRIVACY  

Division 1 - Interferences with privacy  

SECTION 13   INTERFERENCES WITH PRIVACY  

APP entities

13(1)  
An act or practice of an APP entity is an interference with the privacy of an individual if:


(a) the act or practice breaches an Australian Privacy Principle in relation to personal information about the individual; or


(b) the act or practice breaches a registered APP code that binds the entity in relation to personal information about the individual. Credit reporting

13(2)  
An act or practice of an entity is an interference with the privacy of an individual if:


(a) the act or practice breaches a provision of Part IIIA in relation to personal information about the individual; or


(b) the act or practice breaches the registered CR code in relation to personal information about the individual and the code binds the entity. Contracted service providers

13(3)  
An act or practice of an organisation is an interference with the privacy of an individual if:


(a) the act or practice relates to personal information about the individual; and


(b) the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is aparty to the contract); and


(c) the act or practice does not breach:


(i) an Australian Privacy Principle; or

(ii) a registered APP code that binds the organisation;
in relation to the personal information because of a provision of the contract that is inconsistent with the principle or code; and


(d) the act is done, or the practice is engaged in, in a manner contrary to, or inconsistent with, that provision.

Note:

See subsections 6A(2) and 6B(2) for when an act or practice does not breach an Australian Privacy Principle or a registered APP code.

Tax file numbers

13(4)  
An act or practice is an interference with the privacy of an individual if:


(a) it is an act or practice of a file number recipient and the act or practice breaches a rule issued under section 17 in relation to tax file number information that relates to the individual; or


(b) the act or practice involves an unauthorised requirement or request for disclosure of the tax file number of the individual. Notification of eligible data breaches etc.

13(4A)  


If an entity (within the meaning of Part IIIC) contravenes subsection 26WH(2), 26WK(2), 26WL(3) or 26WR(10), the contravention is taken to be an act that is an interference with the privacy of an individual . Other interferences with privacy

13(5)  
An act or practice is an interference with the privacy of an individual if the act or practice:


(a) constitutes a breach of Part 2 of the Data-matching Program (Assistance and Tax) Act 1990 or the rules issued under section 12 of that Act; or


(b) constitutes a breach of the rules issued under section 135AA of the National Health Act 1953.

Note:

Other Acts may provide that an act or practice is an interference with the privacy of an individual. For example, see the Healthcare Identifiers Act 2010, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and the Personal Property Securities Act 2009.

SECTION 13A   13A   INTERFERENCES WITH PRIVACY BY ORGANISATIONS  
(Repealed by No 197 of 2012)

SECTION 13B   RELATED BODIES CORPORATE  

Acts or practices that are not interferences with privacy

13B(1)  


Despite subsection 13(1), each of the following acts or practices of an organisation that is a body corporate is not an interference with the privacy of an individual :


(a) the collection of personal information (other than sensitive information) about the individual by the body corporate from a related body corporate;


(b) the disclosure of personal information (other than sensitive information) about the individual by the body corporate to a related body corporate.

Note:

Subsection (1) lets related bodies corporate share personal information. However, in using or holding the information, they must comply with the Australian Privacy Principles and a registered APP code that binds them. For example, there is an interference with privacy if:

  • (a) a body corporate uses personal information it has collected from a related body corporate; and
  • (b) the use breaches Australian Privacy Principle 6 (noting that the collecting body's primary purpose of collection will be taken to be the same as that of the related body).
  • 13B(1A)  
    However, paragraph (1)(a) does not apply to the collection by a body corporate of personal information (other than sensitive information) from:


    (a) a related body corporate that is not an organisation; or


    (b) a related body corporate whose disclosure of the information to the body corporate is an exempt act or exempt practice for the purposes of paragraph 7(1)(ee); or


    (c) a related body corporate whose disclosure of the information to the body corporate is not an interference with privacy because of section 13D.

    Note:

    The effect of subsection (1A) is that a body corporate's failure to comply with the Australian Privacy Principles, or a registered APP code that binds the body, in collecting personal information about an individual from a related body corporate covered by that subsection is an interference with the privacy of the individual.

    Relationship with subsection 13(3)

    13B(2)  


    Subsection (1) does not prevent an act or practice of an organisation from being an interference with the privacy of an individual under subsection 13(3).

    SECTION 13C   CHANGE IN PARTNERSHIP BECAUSE OF CHANGE IN PARTNERS  

    Acts or practices that are not interferences with privacy

    13C(1)  


    If:


    (a) an organisation (the new partnership ) that is a partnership forms at the same time as, or immediately after, the dissolution of another partnership (the old partnership ); and


    (b) at least one person who was a partner in the old partnership is a partner in the new partnership; and


    (c) the new partnership carries on a business that is the same as, or similar to, a business carried on by the old partnership; and


    (d) the new partnership holds, immediately after its formation, personal information about an individual that the old partnership held immediately before its dissolution;

    neither the disclosure (if any) by the old partnership, nor the collection (if any) by the new partnership, of the information that was necessary for the new partnership to hold the information immediately after its formation constitutes an interference with the privacy of the individual .

    Note:

    Subsection (1) lets personal information be passed on from an old to a new partnership. However, in using or holding the information, they must comply with the Australian Privacy Principles and a registered APP code that binds them. For example, the new partnership's use of personal information collected from the old partnership may constitute an interference with privacy if it breaches Australian Privacy Principle 6.

    Effect of subsection (1)

    13C(2)  


    Subsection (1) has effect despite subsections 13(1) and (3).

    SECTION 13D   OVERSEAS ACT REQUIRED BY FOREIGN LAW  

    13D(1)   Acts or practices that are not interferences with privacy.  

    An act or practice of an organisation done or engaged in outside Australia and an external Territory is not an interference with the privacy of an individual if the act or practice is required by an applicable law of a foreign country.

    Effect of subsection (1)

    13D(2)  


    Subsection (1) has effect despite subsections 13(1) and (3).

    SECTION 13E   13E   EFFECT OF SECTIONS 13B, 13C AND 13D  


    Sections 13B, 13C and 13D do not prevent an act or practice of an organisation from being an interference with the privacy of an individual under subsection 13(2), (4) or (5).

    SECTION 13F   13F   ACT OR PRACTICE NOT COVERED BY SECTION 13 IS NOT AN INTERFERENCE WITH PRIVACY  


    An act or practice that is not covered by section 13 is not an interference with the privacy of an individual .

    SECTION 13G   13G   SERIOUS AND REPEATED INTERFERENCES WITH PRIVACY  


    An entity contravenes this subsection if:


    (a) the entity does an act, or engages in a practice, that is a serious interference with the privacy of an individual; or


    (b) the entity repeatedly does an act, or engages in a practice, that is an interference with the privacy of one or more individuals.

    Civil penalty: 2,000 penalty units.

    Division 2 - Australian Privacy Principles  

    SECTION 14   AUSTRALIAN PRIVACY PRINCIPLES  

    14(1)  
    The Australian Privacy Principles are set out in the clauses of Schedule 1.

    14(2)  
    A reference in any Act to an Australian Privacy Principle by a number is a reference to the Australian Privacy Principle with that number.

    SECTION 15   15   APP ENTITIES MUST COMPLY WITH AUSTRALIAN PRIVACY PRINCIPLES  


    An APP entity must not do an act, or engage in a practice, that breaches an Australian Privacy Principle.

    SECTION 15B   15B   SPECIAL PROVISION RELATING TO THE APPLICATION OF THE INFORMATION PRIVACY PRINCIPLES IN RELATION TO NORFOLK ISLAND  
    (Repealed by No 197 of 2012)

    SECTION 16   16   PERSONAL, FAMILY OR HOUSEHOLD AFFAIRS  


    Nothing in the Australian Privacy Principles applies to:


    (a) the collection, holding, use or disclosure of personal information by an individual; or


    (b) personal information held by an individual;

    only for the purposes of, or in connection with, his or her personal, family or household affairs.

    SECTION 16A   PERMITTED GENERAL SITUATIONS IN RELATION TO THE COLLECTION, USE OR DISCLOSURE OF PERSONAL INFORMATION  

    16(1)  
    A permitted general situation exists in relation to the collection, use or disclosure by an APP entity of personal information about an individual, or of a government related identifier of an individual, if:


    (a) the entity is an entity of a kind specified in an item in column 1 of the table; and


    (b) the item in column 2 of the table applies to the information or identifier; and


    (c) such conditions as are specified in the item in column 3 of the table are satisfied.


    Permitted general situations
    Item Column 1
    Kind of entity
    Column 2
    Item applies to
    Column 3
    Condition(s)
    1 APP entity (a) personal information; or
    (b) a government related identifier.
    (a) it is unreasonable or impracticable to obtain the individual's consent to the collection, use or disclosure; and
    (b) the entity reasonably believes that the collection, use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.
    2 APP entity (a) personal information; or
    (b) a government related identifier.
    (a) the entity has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the entity's functions or activities has been, is being or may be engaged in; and
    (b) the entity reasonably believes that the collection, use or disclosure is necessary in order for the entity to take appropriate action in relation to the matter.
    3 APP entity Personal information (a) the entity reasonably believes that the collection, use or disclosure is reasonably necessary to assist any APP entity, body or person to locate a person who has been reported as missing; and
    (b) the collection, use or disclosure complies with the rules made under subsection (2).
    4 APP entity Personal information The collection, use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim.
    5 APP entity Personal information The collection, use or disclosure is reasonably necessary for the purposes of a confidential alternative dispute resolution process.
    6 Agency Personal information The entity reasonably believes that the collection, use or disclosure is necessary for the entity's diplomatic or consular functions or activities.
    7 Defence Force Personal information The entity reasonably believes that the collection, use or disclosure is necessary for any of the following occurring outside Australia and the external Territories:
    (a) war or warlike operations;
    (b) peacekeeping or peace enforcement;
    (c) civil aid, humanitarian assistance, medical or civil emergency or disaster relief.

    16A(2)  
    The Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).

    SECTION 16B   PERMITTED HEALTH SITUATIONS IN RELATION TO THE COLLECTION, USE OR DISCLOSURE OF HEALTH INFORMATION  

    Collection - provision of a health service

    16B(1)  
    A permitted health situation exists in relation to the collection by an organisation of health information about an individual if:


    (a) the information is necessary to provide a health service to the individual; and


    (b) either:


    (i) the collection is required or authorised by or under an Australian law (other than this Act); or

    (ii) the information is collected in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.

    16B(1A)  


    A permitted health situation exists in relation to the collection by an organisation of health information about an individual (the third party ) if:


    (a) it is necessary for the organisation to collect the family, social or medical history of an individual (the patient ) to provide a health service to the patient; and


    (b) the health information about the third party is part of the family, social or medical history necessary for the organisation to provide the health service to the patient; and


    (c) the health information is collected by the organisation from the patient or, if the patient is physically or legally incapable of giving the information, a responsible person for the patient.

    Collection - research etc.

    16B(2)  
    A permitted health situation exists in relation to the collection by an organisation of health information about an individual if:


    (a) the collection is necessary for any of the following purposes:


    (i) research relevant to public health or public safety;

    (ii) the compilation or analysis of statistics relevant to public health or public safety;

    (iii) the management, funding or monitoring of a health service; and


    (b) that purpose cannot be served by the collection of information about the individual that is de-identified information; and


    (c) it is impracticable for the organisation to obtain the individual's consent to the collection; and


    (d) any of the following apply:


    (i) the collection is required by or under an Australian law (other than this Act);

    (ii) the information is collected in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation;

    (iii) the information is collected in accordance with guidelines approved under section 95A for the purposes of this subparagraph.
    Use or disclosure - research etc.

    16B(3)  
    A permitted health situation exists in relation to the use or disclosure by an organisation of health information about an individual if:


    (a) the use or disclosure is necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety; and


    (b) it is impracticable for the organisation to obtain the individual's consent to the use or disclosure; and


    (c) the use or disclosure is conducted in accordance with guidelines approved under section 95A for the purposes of this paragraph; and


    (d) in the case of disclosure - the organisation reasonably believes that the recipient of the information will not disclose the information, or personal information derived from that information. Use or disclosure - genetic information

    16B(4)  
    A permitted health situation exists in relation to the use or disclosure by an organisation of genetic information about an individual (the first individual ) if:


    (a) the organisation has obtained the information in the course of providing a health service to the first individual; and


    (b) the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of another individual who is a genetic relative of the first individual; and


    (c) the use or disclosure is conducted in accordance with guidelines approved under section 95AA; and


    (d) in the case of disclosure - the recipient of the information is a genetic relative of the first individual. Disclosure - responsible person for an individual

    16B(5)  
    A permitted health situation exists in relation to the disclosure by an organisation of health information about an individual if:


    (a) the organisation provides a health service to the individual; and


    (b) the recipient of the information is a responsible person for the individual; and


    (c) the individual:


    (i) is physically or legally incapable of giving consent to the disclosure; or

    (ii) physically cannot communicate consent to the disclosure; and


    (d) another individual (the carer ) providing the health service for the organisation is satisfied that either:


    (i) the disclosure is necessary to provide appropriate care or treatment of the individual; or

    (ii) the disclosure is made for compassionate reasons; and


    (e) the disclosure is not contrary to any wish:


    (i) expressed by the individual before the individual became unable to give or communicate consent; and

    (ii) of which the carer is aware, or of which the carer could reasonably be expected to be aware; and


    (f) the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (d).

    SECTION 16C   ACTS AND PRACTICES OF OVERSEAS RECIPIENTS OF PERSONAL INFORMATION  

    16C(1)  
    This section applies if:


    (a) an APP entity discloses personal information about an individual to an overseas recipient; and


    (b) Australian Privacy Principle 8.1 applies to the disclosure of the information; and


    (c) the Australian Privacy Principles do not apply, under this Act, to an act done, or a practice engaged in, by the overseas recipient in relation to the information; and


    (d) the overseas recipient does an act, or engages in a practice, in relation to the information that would be a breach of the Australian Privacy Principles (other than Australian Privacy Principle 1) if those Australian Privacy Principles so applied to that act or practice.

    16C(2)  
    The act done, or the practice engaged in, by the overseas recipient is taken, for the purposes of this Act:


    (a) to have been done, or engaged in, by the APP entity; and


    (b) to be a breach of those Australian Privacy Principles by the APP entity.

    Division 3 - Approved privacy codes and the National Privacy Principles  

    SECTION 16D   16D   DELAYED APPLICATION OF NATIONAL PRIVACY PRINCIPLES TO SMALL BUSINESS  
    (Repealed by No 197 of 2012)

    SECTION 16E   16E   PERSONAL, FAMILY OR HOUSEHOLD AFFAIRS  
    (Repealed by No 197 of 2012)

    SECTION 16F   16F   INFORMATION UNDER COMMONWEALTH CONTRACT NOT TO BE USED FOR DIRECT MARKETING  
    (Repealed by No 197 of 2012)

    Division 4 - Tax file number information  

    SECTION 17   17   RULES RELATING TO TAX FILE NUMBER INFORMATION  


    The Commissioner must, by legislative instrument, issue rules concerning the collection, storage, use and security of tax file number information.

    SECTION 18   18   FILE NUMBER RECIPIENTS TO COMPLY WITH RULES  


    A file number recipient shall not do an act,or engage in a practice, that breaches a rule issued under section 17.

    Division 5 - Credit information  

    SECTION 18A   18A   CODE OF CONDUCT RELATING TO CREDIT INFORMATION FILES AND CREDIT REPORTS  
    (Repealed by No 197 of 2012)

    SECTION 18B   18B   CREDIT REPORTING AGENCIES AND CREDIT PROVIDERS TO COMPLY WITH CODE OF CONDUCT  
    (Repealed by No 197 of 2012)

    PART IIIAA - PRIVACY CODES  

    SECTION 18BA   18BA   APPLICATION FOR APPROVAL OF PRIVACY CODE  
    (Repealed by No 197 of 2012)

    SECTION 18BAA   18BAA   PRIVACY CODES MAY COVER EXEMPT ACTS OR PRACTICES  
    (Repealed by No 197 of 2012)

    SECTION 18BB   18BB   COMMISSIONER MAY APPROVE PRIVACY CODE  
    (Repealed by No 197 of 2012)

    SECTION 18BC   18BC   WHEN APPROVAL TAKES EFFECT  
    (Repealed by No 197 of 2012)

    SECTION 18BD   18BD   VARYING AN APPROVED PRIVACY CODE  
    (Repealed by No 197 of 2012)

    SECTION 18BE   18BE   REVOKING THE APPROVAL OF AN APPROVED PRIVACY CODE  
    (Repealed by No 197 of 2012)

    SECTION 18BF   18BF   GUIDELINES ABOUT PRIVACY CODES  
    (Repealed by No 197 of 2012)

    SECTION 18BG   18BG   REGISTER OF APPROVED PRIVACY CODES  
    (Repealed by No 197 of 2012)

    SECTION 18BH   18BH   REVIEW OF OPERATION OF APPROVED PRIVACY CODE  
    (Repealed by No 197 of 2012)

    SECTION 18BI   18BI   REVIEW OF ADJUDICATOR'S DECISION UNDER APPROVED PRIVACY CODE  
    (Repealed by No 197 of 2012)

    PART IIIA - CREDIT REPORTING  

    Division 1 - Introduction  

    SECTION 19   19   GUIDE TO THIS PART  


    In general, this Part deals with the privacy of information relating to credit reporting.

    Divisions 2 and 3 contain rules that apply to credit reporting bodies and credit providers in relation to their handling of information relating to credit reporting.

    Division 4 contains rules that apply to affected information recipients in relation to their handling of their regulated information.

    Division 5 deals with complaints to credit reporting bodies or credit providers about acts or practices that may be a breach of certain provisions of this Part or the registered CR code.

    Division 6 deals with entities that obtain credit reporting information or credit eligibility information by false pretence, or when they are not authorised to do so under this Part.

    Division 7 provides for compensation orders, and other orders, to be made by the Federal Court or Federal Circuit Court.

    Division 2 - Credit reporting bodies  

    Subdivision A - Introduction and application of this Division etc.  

    SECTION 20   20   GUIDE TO THIS DIVISION  


    This Division sets out rules that apply to credit reporting bodies in relation to their handling of the following:

  • (a) credit reporting information;
  • (b) CP derived information;
  • (c) credit reporting information that is de-identified;
  • (d) a pre-screening assessment.
  • The rules apply in relation to that kind of information or assessment instead of the Australian Privacy Principles.

    SECTION 20A   APPLICATION OF THIS DIVISION AND THE AUSTRALIAN PRIVACY PRINCIPLES TO CREDIT REPORTING BODIES  

    20A(1)  
    This Division applies to a credit reporting body in relation to the following:


    (a) credit reporting information;


    (b) CP derived information;


    (c) credit reporting information that is de-identified;


    (d) a pre-screening assessment.

    20A(2)  
    The Australian Privacy Principles do notapply to a credit reporting body in relation to personal information that is:


    (a) credit reporting information; or


    (b) CP derived information; or


    (c) a pre-screening assessment.

    Note:

    The Australian Privacy Principles apply to the credit reporting body in relation to other kinds of personal information.

    Subdivision B - Consideration of information privacy  

    SECTION 20B   OPEN AND TRANSPARENT MANAGEMENT OF CREDIT REPORTING INFORMATION  

    20B(1)  
    The object of this section is to ensure that credit reporting bodies manage credit reporting information in an open and transparent way. Compliance with this Division etc.

    20B(2)  
    A credit reporting body must take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the credit reporting business of the body that:


    (a) will ensure that the body complies with this Division and the registered CR code; and


    (b) will enable the body to deal with inquiries or complaints from individuals about the body's compliance with this Division or the registered CR code. Policy about the management of credit reporting information

    20B(3)  
    A credit reporting body must have a clearly expressed and up-to-date policy about the management of credit reporting information by the body.

    20B(4)  
    Without limiting subsection (3), the policy of the credit reporting body must contain the following information:


    (a) the kinds of credit information that the body collects and how the body collects that information;


    (b) the kinds of credit reporting information that the body holds and how the body holds that information;


    (c) the kinds of personal information that the body usually derives from credit information that the body holds;


    (d) the purposes for which the body collects, holds, uses and discloses credit reporting information;


    (e) information about the effect of section 20G (which deals with direct marketing) and how the individual may make a request under subsection (5) of that section;


    (f) how an individual may access credit reporting information about the individual that is held by the body and seek the correction of such information;


    (g) information about the effect of section 20T (which deals with individuals requesting the correction of credit information etc.);


    (h) how an individual may complain about a failure of the body to comply with this Division or the registered CR code and how the body will deal with such a complaint. Availability of policy etc.

    20B(5)  
    A credit reporting body must take such steps as are reasonable in the circumstances to make the policy available:


    (a) free of charge; and


    (b) in such form as is appropriate.

    Note:

    A credit reporting body will usually make the policy available on the body's website.

    20B(6)  
    If a person or body requests a copy, in a particular form, of the policy of a credit reporting body, the credit reporting body must take such steps as are reasonable in the circumstances to give the person or body a copy in that form.

    Subdivision C - Collection of credit information  

    SECTION 20C   COLLECTION OF SOLICITED CREDIT INFORMATION  

    Prohibition on collection

    20C(1)  
    A credit reporting body must not collect credit information about an individual.

    Civil penalty: 2,000 penalty units.

    Exceptions

    20C(2)  
    Subsection (1) does not apply if the collection of the credit information is required or authorised by or under an Australian law or a court/tribunal order.

    20C(3)  
    Subsection (1) does not apply if:


    (a) the credit reporting body collects the credit information about the individual from a credit provider who is permitted under section 21D to disclose the information to the body; and


    (b) the body collects the information in the course of carrying on a credit reporting business; and


    (c) if the information is identification information about the individual - the body also collects from the provider, or already holds, credit information of another kind about the individual.

    20C(4)  
    Subsection (1) does not apply if:


    (a) the credit reporting body:


    (i) collects the credit information about the individual from an entity (other than a credit provider) in the course of carrying on a credit reporting business; and

    (ii) knows, or believes on reasonable grounds, that the individual is at least 18 years old; and


    (b) the information does not relate to an act, omission, matter or thing that occurred or existed before the individual turned 18; and


    (c) if the information relates to consumer credit or commercial credit - the credit is or has been provided, or applied for, in Australia; and


    (d) if the information is identification information about the individual - the body also collects from the entity, or already holds, credit information of another kind about the individual; and


    (e) if the information is repayment history information about the individual - the body collects the information from another credit reporting body that has an Australian link.

    20C(5)  
    Paragraph (4)(b) does not apply to identification information about the individual.

    20C(6)  
    Despite paragraph (4)(b), consumer credit liability information about the individual may relate to consumer credit that was entered into on a day before the individual turned 18, so long as the consumer credit was not terminated, or did not otherwise cease to be in force, on a day before the individual turned 18. Means of collection

    20C(7)  
    A credit reporting body must collect credit information only by lawful and fair means. Solicited credit information

    20C(8)  
    This section applies to the collection of credit information that is solicited by a credit reporting body.

    SECTION 20D   DEALING WITH UNSOLICITED CREDIT INFORMATION  

    20D(1)  
    If:


    (a) a credit reporting body receives credit information about an individual; and


    (b) the body did not solicit the information;
    the body must, within a reasonable period after receiving the information, determine whether or not the body could have collected the information under section 20C if the body had solicited the information.

    20D(2)  
    The credit reporting body may use or disclose the credit information for the purposes of making the determination under subsection (1).

    20D(3)  
    If the credit reporting body determines that it could have collected the credit information, sections 20E to 20ZA apply in relation to the information as if the body had collected the information under section 20C.

    20D(4)  
    If the credit reporting body determines that it could not have collected the credit information, the body must, as soon as practicable, destroy the information.

    Civil penalty: 1,000 penalty units.

    20D(5)  
    Subsection (4) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit information.

    Subdivision D - Dealing with credit reporting information etc.  

    SECTION 20E   USE OR DISCLOSURE OF CREDIT REPORTING INFORMATION  

    Prohibition on use or disclosure

    20E(1)  
    If a credit reporting body holds credit reporting information about an individual, the body must not use or disclose the information.

    Civil penalty: 2,000 penalty units.

    Permitted uses

    20E(2)  
    Subsection (1) does not apply to the use of credit reporting information about the individual if:


    (a) the credit reporting body uses the information in the course of carrying on the body's credit reporting business; or


    (b) the use is required or authorised by or under an Australian law or a court/tribunal order; or


    (c) the use is a use prescribed by the regulations. Permitted disclosures

    20E(3)  
    Subsection (1) does not apply to the disclosure of credit reporting information about the individual if:


    (a) the disclosure is a permitted CRB disclosure in relation to the individual; or


    (b) the disclosure is to another credit reporting body that has an Australian link; or


    (c) both of the following apply:


    (i) the disclosure is for the purposes of a recognised external dispute resolution scheme;

    (ii) a credit reporting body or credit provider is a member of the scheme; or


    (d) both of the following apply:


    (i) the disclosure is to an enforcement body;

    (ii) the credit reporting body is satisfied that the body, or another enforcement body, believes on reasonable grounds that the individual has committed a serious credit infringement; or


    (e) the disclosure is required or authorised by or under an Australian law or a court/tribunal order; or


    (f) the disclosure is a disclosure prescribed by the regulations.

    20E(4)  
    However, if the credit reporting information is, or was derived from, repayment history information about the individual, the credit reporting body must not disclose the information under paragraph (3)(a) or (f) unless the recipient of the information is:


    (a) a credit provider who is a licensee or is prescribed by the regulations; or


    (b) a mortgage insurer.

    Civil penalty: 2,000 penalty units.

    20E(5)  
    If a credit reporting body discloses credit reporting information under this section, the body must make a written note of that disclosure.

    Civil penalty: 500 penalty units.

    Note:

    Other Acts may provide that the note must not be made (see for example the Australian Crime Commission Act 2002 and the Law Enforcement Integrity Commissioner Act 2006).

    No use or disclosure for the purposes of direct marketing

    20E(6)  
    This section does not apply to the use or disclosure of credit reporting information for the purposes of direct marketing.

    Note:

    Section 20G deals with the use or disclosure of credit reporting information for the purposes of direct marketing.

    SECTION 20F   PERMITTED CRB DISCLOSURES IN RELATION TO INDIVIDUALS  

    20F(1)  
    A disclosure by a credit reporting body of credit reporting information about an individual is a permitted CRB disclosure in relation to the individual if:


    (a) the disclosure is to an entity that is specified in an item of the table and that has an Australian link; and


    (b) such conditions as are specified for the item are satisfied.


    Permitted CRB disclosures
    Item If the disclosure is to ... the condition or conditions are ...
    1 a credit provider the provider requests the information for a consumer credit related purpose of the provider in relation to the individual.
    2 a credit provider (a) the provider requests the information for a commercial credit related purpose of the provider in relation to a person; and
    (b) the individual expressly consents to the disclosure of the information to the provider for that purpose.
    3 a credit provider (a) the provider requests the information for a credit guarantee purpose of the provider in relation to the individual; and
    (b) the individual expressly consents, in writing, to the disclosure of the information to the provider for that purpose.
    4 a credit provider the credit reporting body is satisfied that the provider, or another credit provider, believes on reasonable grounds that the individual has committed a serious credit infringement.
    5 a credit provider (a) the credit reporting body holds consumer credit liability information that relates to consumer credit provided by the provider to the individual; and
    (b) the consumer credit has not been terminated, or has not otherwise ceased to be in force.
    6 a credit provider under subsection 6J(1) the provider requests the information for a securitisation related purpose of the provider in relation to the individual.
    7 a mortgage insurer the insurer requests the information for a mortgage insurance purpose of the insurer in relation to the individual.
    8 a trade insurer (a) the insurer requests the information for a trade insurance purpose of the insurer in relation to the individual; and
    (b) the individual expressly consents, in writing, to the disclosure of the information to the insurer for that purpose.

    20F(2)  
    The consent of the individual under paragraph (b) of item 2 of the table in subsection (1) must be given in writing unless:


    (a) the credit provider referred to in that item requests the information for the purpose of assessing an application for commercial credit made by a person to the provider; and


    (b) the application has not been made in writing.

    SECTION 20G   USE OR DISCLOSURE OF CREDIT REPORTING INFORMATION FOR THE PURPOSES OF DIRECT MARKETING  

    Prohibition on direct marketing

    20G(1)  
    If a credit reporting body holds credit reporting information about an individual, the body must not use or disclose the information for the purposes of direct marketing.

    Civil penalty: 2,000 penalty units.

    Permitted use for pre-screening

    20G(2)  
    Subsection (1) does not apply to the use by the credit reporting body of credit information about the individual for the purposes of direct marketing by, or on behalf of, a credit provider if:


    (a) the provider has an Australian link and is a licensee; and


    (b) the direct marketing is about consumer credit that the provider provides in Australia; and


    (c) the information is not consumer credit liability information, or repayment history information, about the individual; and


    (d) the body uses the information to assess whether or not the individual is eligible to receive the direct marketing communications of the credit provider; and


    (e) the individual has not made a request under subsection (5); and


    (f) the body complies with any requirements that are set out in the registered CR code.

    20G(3)  
    In assessing under paragraph (2)(d) whether or not the individual is eligible to receive the direct marketing communications of the credit provider, the credit reporting body must have regard to the eligibility requirements nominated by the provider.

    20G(4)  
    An assessment under paragraph (2)(d) is not credit reporting information about the individual. Request not to use information for pre-screening

    20G(5)  
    An individual may request a credit reporting body that holds credit information about the individual not to use the information under subsection (2).

    20G(6)  
    If the individual makes a request under subsection (5), the credit reporting body must not charge the individual for the making of the request or to give effect to the request. Written note of use

    20G(7)  
    If a credit reporting body uses credit information under subsection (2), the body must make a written note of that use.

    Civil penalty: 500 penalty units.

    SECTION 20H   USE OR DISCLOSURE OF PRE-SCREENING ASSESSMENTS  

    Use or disclosure by credit reporting bodies

    20H(1)  
    If a credit reporting body makes a pre-screening assessment in relation to direct marketing by, or on behalf of, a credit provider, the body must not use or disclose the assessment.

    Civil penalty: 2,000 penalty units.

    20H(2)  
    Subsection (1) does not apply if:


    (a) the credit reporting body discloses the pre-screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider; and


    (b) the recipient of the assessment is an entity (other than the provider) that has an Australian link.

    20H(3)  
    If the credit reporting body discloses the pre-screening assessment under subsection (2), the body must make a written note of that disclosure.

    Civil penalty: 500 penalty units.

    Use or disclosure by recipients

    20H(4)  
    If the credit reporting body discloses the pre-screening assessment under subsection (2), the recipient must not use or disclose the assessment.

    Civil penalty: 1,000 penalty units.

    20H(5)  
    Subsection (4) does not apply if the recipient uses the pre-screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider.

    20H(6)  
    If the recipient uses the pre-screening assessment under subsection (5), the recipient must make a written note of that use.

    Civil penalty: 500 penalty units.

    Interaction with the Australian Privacy Principles

    20H(7)  
    If the recipient is an APP entity, Australian Privacy Principles 6, 7 and 8 do not apply to the recipient in relation to a pre-screening assessment.

    SECTION 20J   DESTRUCTION OF PRE-SCREENING ASSESSMENT  

    20J(1)  
    If an entity has possession or control of a pre-screening assessment, the entity must destroy the assessment if:


    (a) the entity no longer needs the assessment for any purpose for which it may be used or disclosed under section 20H; and


    (b) the entity is not required by or under an Australian law, or a court/tribunal order, to retain the assessment.

    Civil penalty: 1,000 penalty units.

    20J(2)  
    If the entity is an APP entity but not a credit reporting body, Australian Privacy Principle 11.2 does not apply to the entity in relation to the pre-screening assessment.

    SECTION 20K   NO USE OR DISCLOSURE OF CREDIT REPORTING INFORMATION DURING A BAN PERIOD  

    20K(1)  
    If:


    (a)a credit reporting body holds credit reporting information about an individual; and


    (b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); and


    (c) the individual requests the body not to use or disclose the information under this Division;

    then, despite any other provision of this Division, the body must not use or disclose the information during the ban period for the information.

    Civil penalty: 2,000 penalty units.

    20K(2)  
    Subsection (1) does not apply if:


    (a) the individual expressly consents, in writing, to the use or disclosure of the credit reporting information under this Division; or


    (b) the use or disclosure of the credit reporting information is required by or under an Australian law or a court/tribunal order. Ban period

    20K(3)  
    The ban period for credit reporting information about an individual is the period that:


    (a) starts when the individual makes a request under paragraph (1)(c); and


    (b) ends:


    (i) 21 days after the day on which the request is made; or

    (ii) if the period is extended under subsection (4) - on the day after the extended period ends.

    20K(4)  
    if:


    (a) there is a ban period for credit reporting information about an individual that is held by a credit reporting body; and


    (b) before the ban period ends, the individual requests the body to extend that period; and


    (c) the body believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud);

    the body must:


    (d) extend the ban period by such period as the body considers is reasonable in the circumstances; and


    (e) give the individual written notification of the extension.

    Civil penalty: 1,000 penalty units.

    20K(5)  
    A ban period for credit reporting information may be extended more than once under subsection (4). No charge for request etc.

    20K(6)  
    If an individual makes a request under paragraph (1)(c) or (4)(b), a credit reporting body must not charge the individual for the making of the request or to give effect to the request.

    SECTION 20L   ADOPTION OF GOVERNMENT RELATED IDENTIFIERS  

    20L(1)  
    If:


    (a) a credit reporting body holds credit reporting information about an individual; and


    (b) the information is a government related identifier of the individual;

    the body must not adopt the government related identifier as its own identifier of the individual.

    Civil penalty: 2,000 penalty units.

    20L(2)  
    Subsection (1) does not apply if the adoption of the government related identifier is required or authorised by or under an Australian law or a court/tribunal order.

    SECTION 20M   USE OR DISCLOSURE OF CREDIT REPORTING INFORMATION THAT IS DE-IDENTIFIED  

    Use or disclosure

    20M(1)  
    If:


    (a) a credit reporting body holds credit reporting information; and


    (b) the information (the de-identified information ) is de-identified;

    the body must not use or disclose the de-identified information.

    20M(2)  
    Subsection (1) does not apply to the use or disclosure of the de-identified information if:


    (a) the use or disclosure is for the purposes of conducting research in relation to credit; and


    (b) the credit reporting body complies with the rules made under subsection (3). Commissioner may make rules

    20M(3)  
    The Commissioner may, by legislative instrument, make rules relating to the use or disclosure by a credit reporting body of de-identified information for the purposes of conducting research in relation to credit.

    20M(4)  
    Without limiting subsection (3), the rules may relate to the following matters:


    (a) the kinds of de-identified information that may or may not be used or disclosed for the purposes of conducting the research;


    (b) whether or not the research is research in relation to credit;


    (c) the purposes of conducting the research;


    (d) consultation about the research;


    (e) how the research is conducted.

    Subdivision E - Integrity of credit reporting information  

    SECTION 20N   QUALITY OF CREDIT REPORTING INFORMATION  

    20N(1)  
    A credit reporting body must take such steps as are reasonable in the circumstances to ensure that the credit information the body collects is accurate, up-to-date and complete.

    20N(2)  
    A credit reporting body must take such steps as are reasonable in the circumstances to ensure that the credit reporting information the body uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up-to-date, complete and relevant.

    20N(3)  
    Without limiting subsections (1) and (2), a credit reporting body must:


    (a) enter into agreements with credit providers that require the providers to ensure that credit information that they disclose to the body under section 21D is accurate, up-to-date and complete; and


    (b) ensure that regular audits are conducted by an independent person to determine whether those agreements are being complied with; and


    (c) identify and deal with suspected breaches of those agreements.

    SECTION 20P   FALSE OR MISLEADING CREDIT REPORTING INFORMATION  

    Offence

    20P(1)  
    A credit reporting body commits an offence if:


    (a) the body uses or discloses credit reporting information under this Division (other than subsections 20D(2) and 20T(4)); and


    (b) the information is false or misleading in a material particular.

    Penalty: 200 penalty units.

    Civil penalty

    20P(2)  
    A credit reporting body must not use or disclose credit reporting information under this Division (other than subsections 20D(2) and 20T(4)) if the information is false or misleading in a material particular.

    Civil penalty: 2,000 penalty units.

    SECTION 20Q   SECURITY OF CREDIT REPORTING INFORMATION  

    20Q(1)  
    If a credit reporting body holds credit reporting information, the body must take such steps as are reasonable in the circumstances to protect the information:


    (a) from misuse, interference and loss; and


    (b) from unauthorised access, modification or disclosure.

    20Q(2)  
    Without limiting subsection (1), a credit reporting body must:


    (a) enter into agreements with credit providers that require the providers to protect credit reporting information that is disclosed to them under this Division:


    (i) from misuse, interference and loss; and

    (ii) from unauthorised access, modification or disclosure; and


    (b) ensure that regular audits are conducted by an independent person to determine whether those agreements are being complied with; and


    (c) identify and deal with suspected breaches of those agreements.

    Subdivision F - Access to, and correction of, information  

    SECTION 20R   ACCESS TO CREDIT REPORTING INFORMATION  

    Access

    20R(1)  
    If a credit reporting body holds credit reporting information about an individual, the body must, on request by an access seeker in relation to the information, give the access seeker access to the information. Exceptions to access

    20R(2)  
    Despite subsection (1), the credit reporting body is not required to give the access seeker access to the credit reporting information to the extent that:


    (a) giving access would be unlawful; or


    (b) denying access is required or authorised by or under an Australian law or a court/tribunal order; or


    (c) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body. Dealing with requests for access

    20R(3)  
    The credit reporting body must respond to the request within a reasonable period, but not longer than 10 days, after the request is made. Means of access

    20R(4)  
    If the credit reporting body gives access to the credit reporting information, the access must be given in the manner set out in the registered CR code. Access charges

    20R(5)  
    If a request under subsection (1) in relation to the individual has not been made to the credit reporting body in the previous 12 months, the body must not charge the access seeker for the making of the request or for giving access to the information.

    20R(6)  
    If subsection (5) does not apply, any charge by the credit reporting body for giving access to the information must not be excessive and must not apply to the making of the request. Refusal to give access

    20R(7)  
    If the credit reporting body refuses to give access to the information because of subsection (2), the body must give the access seeker a written notice that:


    (a) sets out the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and


    (b) states that, if the access seeker is not satisfied with the response to the request, the access seeker may:


    (i) access a recognised external dispute resolution scheme of which the body is a member; or

    (ii) make a complaint to the Commissioner under Part V.

    SECTION 20S   CORRECTION OF CREDIT REPORTING INFORMATION  

    20S(1)  
    If:


    (a) a credit reporting body holds credit reporting information about an individual; and


    (b) the body is satisfied that, having regard to a purpose for which the information is held by the body, the information is inaccurate, out-of-date, incomplete, irrelevant or misleading;

    the body must take such steps (if any) as are reasonable in the circumstances to correct the information to ensure that, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete, relevant and not misleading.

    20S(2)  
    If:


    (a) the credit reporting body corrects credit reporting information under subsection (1); and


    (b) the body has previously disclosed the information under this Division (other than subsections 20D(2) and 20T(4));

    the body must, within a reasonable period, give each recipient of the information written notice of the correction.

    20S(3)  
    Subsection (2) does not apply if:


    (a) it is impracticable for the credit reporting body to give the notice under that subsection; or


    (b) the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notice under that subsection.

    SECTION 20T   INDIVIDUAL MAY REQUEST THE CORRECTION OF CREDIT INFORMATION ETC.  

    Request

    20T(1)  
    An individual may request a credit reporting body to correct personal information about the individual if:


    (a) the personal information is:


    (i) credit information about the individual; or

    (ii) CRB derived information about the individual; or

    (iii) CP derived information about the individual; and


    (b) the body holds at least one kind of the personal information referred to in paragraph (a). Correction

    20T(2)  
    If the credit reporting body is satisfied that the personal information is inaccurate, out-of-date, incomplete, irrelevant or misleading, the body must take such steps (if any) as are reasonable in the circumstances to correct the information within:


    (a) the period of 30 days that starts on the day on which the request is made; or


    (b) such longer period as the individual has agreed to in writing. Consultation

    20T(3)  
    If the credit reporting body considers that the body cannot be satisfied of the matter referred to in subsection (2) in relation to the personal information without consulting either or both of the following (the interested party ):


    (a) another credit reporting body that holds or held the information and that has an Australian link;


    (b) a credit provider that holds or held the information and that has an Australian link;

    the body must consult that interested party, or those interested parties, about the individual's request.

    20T(4)  
    The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection. No charge

    20T(5)  
    The credit reporting body must not charge the individual for the making of the request or for correcting the information.

    SECTION 20U   NOTICE OF CORRECTION ETC. MUST BE GIVEN  

    20U(1)  
    This section applies if an individual requests a credit reporting body to correct personal information under subsection 20T(1). Notice of correction etc.

    20U(2)  
    If the credit reporting body corrects the personal information under subsection 20T(2), the body must, within a reasonable period:


    (a) give the individual written notice of the correction; and


    (b) if the body consulted an interested party under subsection 20T(3) about the individual's request - give the party written notice of the correction; and


    (c) if the correction relates to information that the body has previously disclosed under this Division (other than subsections 20D(2) and 20T(4)) - give each recipient of the information written notice of the correction.

    20U(3)  
    If the credit reporting body does not correct the personal information under subsection 20T(2), the body must, within a reasonable period, give the individual written notice that:


    (a) states that the correction has not been made; and


    (b) sets out the body's reasons for not correcting the information (including evidence substantiating the correctness of the information); and


    (c) states that, if the individual is not satisfied with the response to the request, the individual may:


    (i) access a recognised external dispute resolution scheme of which the body is a member; or

    (ii) make a complaint to the Commissioner under Part V.
    Exceptions

    20U(4)  
    Paragraph (2)(c) does not apply if it is impracticable for the credit reporting body to give the notice under that paragraph.

    20U(5)  
    Subsection (2) or (3) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notice under that subsection.

    Subdivision G - Dealing with credit reporting information after the retention period ends etc.  

    SECTION 20V   DESTRUCTION ETC. OF CREDIT REPORTING INFORMATION AFTER THE RETENTION PERIOD ENDS  

    20V(1)  
    This section applies if:


    (a) a credit reporting body holds credit information about an individual; and


    (b) the retention period for the information ends.

    Note:

    There is no retention period for identification information or credit information of a kind referred to in paragraph 6N(k).

    Destruction etc. of credit information

    20V(2)  
    The credit reporting body must destroy the credit information, or ensure that the information is de-identified, within 1 month after the retention period for the information ends.

    Civil penalty: 1,000 penalty units.

    20V(3)  
    Despite subsection (2), the credit reporting body must neither destroy the credit information nor ensure that the information is de-identified, if immediately before the retention period ends:


    (a) there is a pending correction request in relation to the information; or


    (b) there is a pending dispute in relation to the information.

    Civil penalty: 500 penalty units.

    20V(4)  
    Subsection (2) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit information. Destruction etc. of CRB derived information

    20V(5)  
    The credit reporting body must destroy any CRB derived information about the individual that was derived from the credit information, or ensure that the CRB derived information is de-identified:


    (a) if:


    (i) the CRB derived information was derived from 2 or more kinds of credit information; and

    (ii) the body is required to do a thing referred to in subsection (2) to one of those kinds of credit information;
    at the same time that the body does that thing to that credit information; or


    (b) otherwise - at the same time that the body is required to do a thing referred to in subsection (2) to the credit information from which the CRB derived information was derived.

    Civil penalty: 1,000 penalty units.

    20V(6)  
    Despite subsection (5), the credit reporting body must neither destroy the CRB derived information nor ensure that the information is de-identified, if immediately before the retention period ends:


    (a) there is a pending correction request in relation to the information; or


    (b) there is a pending dispute in relation to the information.

    Civil penalty: 500 penalty units.

    20V(7)  
    Subsection (5) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the CRB derived information.

    SECTION 20W   20W   RETENTION PERIOD FOR CREDIT INFORMATION - GENERAL  


    The following table sets out the retention period for credit information:


    (a) that is information of a kind referred to in an item of the table; and


    (b) that is held by a credit reporting body.


    Retention period
    Item If the credit information is ... the retention period for the information is ...
    1 consumer credit liability information the period of 2 years that starts on the day on which the consumer credit to which the information relates is terminated or otherwise ceases to be in force.
    2 repayment history information the period of 2 years that starts on the day on which the monthly payment to which the information relates is due and payable.
    3 information of a kind referred to in paragraph 6N(d) or (e) the period of 5 years that starts on the day on which the information request to which the information relates is made.
    4 default information the period of 5 years that starts on the day on which the credit reporting body collects the information.
    5 payment information the period of 5 years that starts on the day on which the credit reporting body collects the default information to which the payment information relates.
    6 new arrangement information within the meaning of subsection 6S(1) the period of 2 years that starts on the day on which the credit reporting body collects the default information referred to in that subsection.
    7 new arrangement information within the meaning of subsection 6S(2) the period of 2 years that starts on the day on which the credit reporting body collects the information about the opinion referred to in that subsection.
    8 court proceedings information the period of 5 years that starts on the day on which the judgement to which the information relates is made or given.
    9 information of a kind referred to in paragraph 6N(l) the period of 7 years that starts on the day on which the credit reporting body collects the information.

    SECTION 20X   RETENTION PERIOD FOR CREDIT INFORMATION - PERSONAL INSOLVENCY INFORMATION  

    20X(1)  
    The following table has effect:


    Item If personal insolvency information relates to ... the retention period for the information is whichever of the following periods ends later ...
    1 a bankruptcy of an individual (a) the period of 5 years that starts on the day on which the individual becomes a bankrupt;
    (b) the period of 2 years that starts on the day the bankruptcy ends.
    2 a personal insolvency agreement to which item 3 of this table does not apply (a) the period of 5 years that starts on the day on which the agreement is executed;
    (b) the period of 2 years that starts on the day the agreement is terminated or set aside under the Bankruptcy Act.
    3 a personal insolvency agreement in relation to which a certificate has been signed under section 232 of the Bankruptcy Act (a) the period of 5 years that starts on the day on which the agreement is executed;
    (b) the period that ends on the day on which the certificate is signed.
    4 a debt agreement to which item 5 of this table does not apply (a) the period of 5 years that starts on the day on which the agreement is made;
    (b) the period of 2 years that starts on the day:
     (i) the agreement is terminated under the Bankruptcy Act; or
     (ii) an order declaring that all the agreement is void is made under that Act.
    5 a debt agreement that ends under section 185N of the Bankruptcy Act (a) the period of 5 years that starts on the day on which the agreement is made;
    (b) the period that ends on the day on which the agreement ends.

    Debt agreement proposals

    20X(2)  
    If personal insolvency information relates to a debt agreement proposal, the retention period for the information is the period that ends on the day on which:


    (a) the proposal is withdrawn; or


    (b) the proposal is not accepted under section 185EC of the Bankruptcy Act; or


    (c) the acceptance of the proposal for processing is cancelled under section 185ED of that Act; or


    (d) the proposal lapses under section 185G of that Act. Control of property

    20X(3)  
    If personal insolvency information relates to a direction given, or an order made, under section 50 of the Bankruptcy Act, the retention period for the information is the period that ends on the day on which the control of the property to which the direction or order relates ends.

    Note:

    See subsection 50(1B) of the Bankruptcy Act for when the control of the property ends.

    20X(4)  
    If the personal insolvency information relates to an authority signed under section 188 of the Bankruptcy Act, the retention period for the information is the period that ends on the day on which the property to which the authority relates is no longer subject to control under Division 2 of Part X of that Act. Interpretation

    20X(5)  
    An expression used in this section that is also used in the Bankruptcy Act has the same meaning in this section as it has in that Act.

    SECTION 20Y   DESTRUCTION OF CREDIT REPORTING INFORMATION IN CASES OF FRAUD  

    20Y(1)  
    This section applies if:


    (a) a credit reporting body holds credit reporting information about an individual; and


    (b) the information relates to consumer credit that has been provided by a credit provider to the individual, or a person purporting to be the individual; and


    (c) the body is satisfied that:


    (i) the individual has been a victim of fraud (including identity fraud); and

    (ii) the consumer credit was provided as a result of that fraud.
    Destruction of credit reporting information

    20Y(2)  
    The credit reporting body must:


    (a) destroy the credit reporting information; and


    (b) within a reasonable period after the information is destroyed:


    (i) give the individual a written notice that states that the information has been destroyed and sets out the effect of subsection (4); and

    (ii) give the credit provider a written notice that states that the information has been destroyed.

    Civil penalty: 1,000 penalty units.

    20Y(3)  
    Subsection (2) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit reporting information. Notification of destruction to third parties

    20Y(4)  
    If:


    (a) a credit reporting body destroys credit reporting information about an individual under subsection (2); and


    (b) the body has previously disclosed the information to one or more recipients under Subdivision D of this Division;

    the body must, within a reasonable period after the destruction, notify those recipients of the destruction and the matters referred to in paragraph (1)(c).

    Civil penalty: 500 penalty units.

    20Y(5)  
    Subsection (4) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notification.

    SECTION 20Z   DEALING WITH INFORMATION IF THERE IS A PENDING CORRECTION REQUEST ETC.  

    20Z(1)  
    This section applies if a credit reporting body holds credit reporting information about an individual and either:


    (a) subsection 20V(3) applies in relation to the information; or


    (b) subsection 20V(6) applies in relation to the information. Notification of Commissioner

    20Z(2)  
    The credit reporting body must, as soon as practicable, notify in writing the Commissioner of the matter referred to in paragraph (1)(a) or (b) of this section.

    Civil penalty: 1,000 penalty units.

    Use or disclosure

    20Z(3)  
    The credit reporting body must not use or disclose the information under Subdivision D of this Division.

    Civil penalty: 2,000 penalty units.

    20Z(4)  
    However, the credit reporting body may use or disclose the information under this subsection if:


    (a) the use or disclosure is for the purposes of the pending correction request, or pending dispute, in relation to the information; or


    (b) the use or disclosure of the information is required by or under an Australian law or