Use or disclosure

6.1 If an organisation has possession or control over personal information about an individual that was collected for a particular purpose (aka the primary purpose), the entity must not use or disclose the information for another purpose (aka the secondary purpose).

 

A Primary purpose is that which is immediate or obvious or which is stated to the individual, while a secondary purpose is something on the side, or which may arise subsequently, or may be in the back of the collector's mind. This is important terminology to be aware of in the interpretation of the Act.

 

Exceptions to the above include where:

​

• the individual has consented expressly or impliedly to the use or disclosure of the information (See section 6(1)).

• the individual would reasonably expect the organisation to use or disclose the information for a secondary purpose which is related to the primary purpose. ( requires a direct relationship to the primary purpose)

• use or disclosure of the information is required or authorised by law or a court order

• a exists

• the information is provided to the police or other government enforcement body. Under APP 6.5, the individual must be notified of such disclosure.

 

Reasonable Expectation

The OAIC characterises reasonable expectation as based on what a reasonable person, if properly informed, would expect in the circumstances. It exemplifies a reasonable expectation as where the individual makes a complaint in the media about the organisation, giving rise to a right for the organisation to defend itself by releasing certain personal information. Given the distance between a public battle and the basis on which most personal information would be given to most organisations, this seems more a moral imputation of a right of self defence rather than recognition of a plausible related purpose – and thus not acceptable to a court as an interpretation of this statute. Perhaps better examples would be when an employee sues an employer for an employment-related matter, or where a client who is reasonably expected to present a risk of some kind, actually causes such harm (maybe to a worker or contractor), the employer’s self defence in the midst of known contingencies is a reasonably expected secondary purpose, so it can prepare for litigation by using personal information.

 

Related Bodies Corporate

6.6 If the organisation is a corporation and collects information from a related corporation, then the primary purpose for the original collection still applies.

​