Privacy Law
Privacy law relates to the use that businesses, governments and other bodies may make of personal information that they have collected or acquired about an identifiable individual. As such it has two sides:
- the businesses, governments and other bodies that want to use that information for commercial gain (in the case of businesses) or to further their aims (in the case of governments and other bodies); and
- the individuals whose personal information is being collected, stored and used by businesses, governments and other bodies.
Whilst there are privacy acts in most Australian states, the main piece of legislation is the Federal government’s Privacy Act 1988 (Cth), which was recently amended to broaden its application to businesses, as well as government bodies.
The personal information that the privacy laws apply to is information that relates to an individual. This is usually their name, contact details such as their address, telephone number, mobile number and email address, credit card details and other information your business or organisation may collect on them.
The Federal privacy laws provide a set of guidelines called the “Australian Privacy Principles” or “APPs” that organisations are to adhere to in relation to the collection, storage and use of personal information of individuals.
There are 13 APPs arranged into 5 groups or parts, as set out below:
Part 1 Consideration of personal information privacy – these relate to the systems that organisations need to have in place to manage personal information, including having a clearly expressed and up-to-date privacy policy and allowing individuals the option of not identifying themselves. This part also contains requirements relating to the implementation of practices, procedures and systems that will ensure an entity’s compliance with the APPs.
Part 2 Collection of Personal Information – this part provides that an organisation shall only collect personal information unless it is reasonably necessary for, or directly related to, an organisation’s functions or activities. Additional requirements are set for collection of sensitive personal information, being information relating to an individual’s health, religious belief, political affiliations, race and sexual preferences. Sensitive personal information can only be collected if it is reasonably necessary for the organisations functions or activities AND the individual consents to its collection, storage and use.
Part 3 Dealing with Personal Information – if an organisation collects personal information for one purpose it must not use or disclose it for a different purpose unless the individual consents to that secondary purpose. This part sets out the general prohibition on use or disclosure of personal information for the purpose of direct marketing as well as restrictions on the disclosure of personal information outside of Australia.
Part 4 Integrity of Personal Information – this part is concerned with ensuring that the personal information held by organisations is the accurate, up-to-date and complete. This part also seeks to ensure that personal information is protected from misuse, interference, loss or unauthorised access, modification or disclosure.
Part 5 Access to and Correction of Personal Information – this part sets out procedures for individuals to access their personal information and if necessary correct it. They also set out how personal information and the Privacy Act interact with the Federal government’s freedom of information laws.
Businesses with a turnover of less than $3 Million are not required to comply with the Privacy Act. However, this is NOT the case if your business deals in personal information (such as selling personal information for the purposes of direct marketing information) or where it collects sensitive personal information.
Call us today to see if you COMPLY with the privacy laws.
Not sure where to start?
We're here to make it easy. Call or email us today.