Key Definitions and Provisions | Working With the Law

Privacy Law

Key Definitions for APP Provisions

Coming back to the Australian Privacy Principals and their operational provisions, the following definitions need to be understood.

Collect

There is no limit to the sources from which information may be obtained to qualify as collection. However, an organisation is said to collect personal information only if it gathers, acquires or obtains the information for inclusion in a record or generally available publication. If the information is not recorded then collection has not occurred. Therefore merely coming by personal information in a media article is not collection, unless it is saved or filed for later, and being told something verbally is not collection unless notes are taken at some stage, or a recording is made.

Hold

An organisation is said to hold personal information about a person if it has possession or control of a record of it. It includes instances where there is no physical possession, but only a legal right to control it.

De-identify

To de-identify information is to take any record of personal information and remove or alter details so that the individual it is about can no longer be identified. This includes not only names, but information from which the individual can be identified.

Organisation

An organisation is a private entity. The act also covers government bodies, which it calls agencies and applies slightly different rules, but we are not concerned with those. An organisation can be any of the following:

an individual (including a sole trader)
a body corporate
a partnership
any other unincorporated association, or
a trust

The reference to ‘an individual (including a sole trader)’ is about people doing business in their individual capacity. There is no law against gossip and casual chatter!

Exclusion of Small Business Operators

Excluded from the definition of Organisation are ‘small businesses operators’ and political parties. For purposes of the Act, a ‘small business operator’ is defined as an individual, body corporate, partnership, unincorporated association or trust that carries on one or more small businesses, each one having an annual turnover of $3 million or less. If any business operation is greater than this, then an organisation are not a ‘small business operator.’ The word ‘business’ is not defined , but is used so as to refer to more than just commercial operations.

Exceptions to the Exclusion

Even if each of a business’ operations are small enough to be exempt from the Act, they are nevertheless not exempt if they involve:

providing a health service to an individual and holding health information,
disclosing personal information about another individual to anyone else for payment,
providing payment for the collection of personal information about another individual from anyone else,
is a contracted service provider to the Commonwealth,
is a credit reporting body.
where a special exception applies, such as a business choosing to be an (See sections 6E & 6EA).

Permitted General Situation

There are some APP’s that do not apply if a permitted general situation arises. These situations are described in section 16A. These include:

lessening or preventing a serious threat to the life, health or safety of any individual, or to public health or safety
taking appropriate action in relation to suspected unlawful activity or serious misconduct
locating a person reported as missing
asserting a legal or equitable claim
conducting an alternative dispute resolution process

Permitted Health Situation

APP’s 3 and 6 do not apply where a permitted health situation arises. These situations are described in section n16B and include:

Where it is necessary to provide a health service to the individual, and either collection is required or authorised by law or the information is collected in compliance with rules of a competent medical body that deals with obligations of professional confidentiality, which bind the organisation.
Where collection is necessary for medical research or statistical analysis, or management funding and monitoring of a health service, and where de-identified information is useless, it is impracticable to obtain the individual’s consent, and either collection is required by law, or collection is done according to the rules of a medical body, or it is done under guidelines approved under section 95A.
Where use or disclosure is necessary for medical research or statistical analysis, it is impracticable to obtain consent, the use or disclosure is done under guidelines approved under section 95A, and the organisation reasonably believes that the recipient with not disclose the information.
Where the organisation has obtained the information while providing a health service and disclosure is necessary to reduce or prevent a serious threat to life, health or safety of a genetic relative of the individual, and use or disclosure is in accordance with guidelines approved under section 95A, and the recipient is a genetic relative of the individual.
Where the organisation provides a health service to the individual who is physically or legally incapable of giving consent or communicating it and the recipient is a person responsible for the individual. Also another person – a carer – must be satisfied that disclosure is necessary to provide appropriate care or treatment or that disclosure is made compassionately. The disclosure must not be contrary to any wish expressed by the individual before they became unable to give or communicate consent. Disclosure is to be limited to what is reasonable and necessary.

Personal Information

Personal information is defined as any ‘information or opinion about an identified individual, or an individual who is readily identifiable. It is irrelevant whether the information is true or not and whether it is recorded in a material form. It can be just a belief held by someone.

Primary Purpose

The purposes for the use and disclosure of personal information is divided into the primary purpose and secondary purposes. The primary purpose is that for which the information was provided. An organisation is free to deal with information for that purpose.

Reasonable Expectation

Reasonableness is a concept that appears in a multitude of places throughout the law. It brings notions of what is fair to expect of a person and what is fair of them to do or think. Eg: the reasonable man test. A reasonable expectation is an expectation conceived of fairly and rationally, based on available facts, and which would be expected of a person with average mental faculties.

Reasonable Step

What constitutes a reasonable step in the protection of personal information depends on the sensitivity of the information, the nature of the organisation (size, resources, business model), the possible consequences to the person of taking no steps, the likely harm arising from taking any proposed step, and the practicability of any proposed step.

Secondary Purpose

The primary purpose in dealing with information is that for which the information was provided, while a secondary purpose is any other purpose. There are conditions under which some possible secondary purposes are allowable.

Sensitive Information

Sensitive information is information about an individual’s:

racial or ethnic origin,
religious beliefs or affiliations
philosophical beliefs,
political opinions or membership of a political association,
membership of a professional or trade association or trade union,
criminal record,
sexual orientation or practices,
health,
genetics,
biometrics (for identification purposes).

Main Operational Provisions

Section 13 – Interferences with privacy

An act or practice of an organisation is an interference with the privacy of an individual if it breaches the Australian Privacy Principles. (There are further, less important conditions under which an interference may be seen to occur). See also Section 15, which forbids any act conflicting with the APP’s.

Section 13B – Related bodies corporate

The collection of personal information by a body corporate from a related body corporate, about an individual (other than sensitive information) is not an interference with the privacy of an individual. This also applies to the disclosure of information by one body corporate to a related body corporate. These are special rules that allow the free transfer of information within corporate groups.

It does not apply to bodies corporate that are not organisations, as defined above.

Section 13C – Change in partnership because of change in partners

Where a partnership dissolves and is renewed due to a change in partners and at least one person remains a partner, then the old partnership is free to communicate personal information to the new partnership.

Section 16 – Personal, family or household affairs

This section re-affirms that the APP’s do not apply to individuals, acting simply as individuals, in private or family affairs.