Learn from the mistakes of others

Privacy & collection of personal information

Laws regarding the recognition and protection of privacy rights between the States and Territories, and the Commonwealth. The Federal Privacy Act applies to Commonwealth and ACT governments and private businesses, with specific provisions for the health industry. There are no specific privacy laws in South Australia at the state level. State Government agencies are required to comply with the Federal Information Privacy Principles (IPPs) that apply to Commonwealth agencies, and the Federal Code of Fair Information Practice is applied to the State Health Department and agencies that access it’s personal information.

State laws regulate access to personal information via the Freedom of Information Act 1991, State Records Act 1997, Listening and Surveillance Devices Act 1972, and the Telecommunications (Interception) Act 1988.

Privacy Commissioner, “State & Territory Privacy Laws”, South Australia <http://www.privacy.gov.au/privacy_rights/laws/>

Privacy Commissioner, “Federal Privacy Laws”, <http://www.privacy.gov.au/act/index.html>

The Federal Privacy Act contains:

11 Information Privacy Principles (IPPs)

1. data can only be collected for a lawful purpose and directly related to that purpose


2. when collected from the individual, why personal data is collected, under what authority (if any), and who (if any) the data may be shared with


3. when collected generally, the data is relevant, current, and not unnecessarily intrusive


4. personal data is to be protected from unnecessary disclosure


5. record-keepers will take care with data


6. people have access to their own data, unless prevented by law


7. people can have data corrected


8. data should be checked for accuracy, etc before use


9. personal information can only be used for relevant purposes


10. it cannot be used for another purpose without consent or on lawful excuse


11. cannot be disclosed to another agency without consent or lawful excuse

Information Privacy Principles under the Privacy Act 1988 <http://www.privacy.gov.au/publications/ipps.html>

10 National Privacy Principles (NPPs)

1. data can only be collected reasonably and  for a lawful purpose


2. the purpose must be disclosed before data is collected


3. steps must be taken to ensure the quality of the data


4. steps must be taken to ensure the security of the data


5. the polices regarding collection and use of data must be disclosed


6. people must be able to examine and be able to correct data held about them


7. must not use identifiers that are used by other agencies in relation to any particular person


8. wherever lawful and practicable, people must have to opportunity to provide data anonymously


9. there are restrictions on what data can be shared outside of Australia


10. sensitive data can only be collected by consent and according to law

National Privacy Principles (Extracted from the Privacy Amendment (Private Sector) Act 2000) <http://www.privacy.gov.au/publications/npps01.html>

Other relevant Federal laws that impact on privacy include the Telecommunications Act 1997 (Cth), National Health Act 1953 (Cth), Data Matching Program (Assistance and Tax) Act 1990 (Cth) and the Crimes Act 1914 (Cth).

Privacy Commissioner, “Federal Privacy Laws”, <http://www.privacy.gov.au/act/index.html>