PRIVACY ACT 1988

   Privacy Act 1988 REPRINT No. 4
   Consolidated to 29 May 1997
   Contents
  


PRIVACY ACT 1988 -An Act to make provision to protect the privacy
of individuals, and for related purposes
  
  
   WHEREAS Australia is a party to the International Covenant on Civil and
Political Rights, the English text of which is set out in Schedule 2 to the
Human Rights and Equal Opportunity Commission Act 1986 :
   AND WHEREAS, by that Covenant, Australia has undertaken to adopt such
legislative measures as may be necessary to give effect to the right of
persons not to be subjected to arbitrary or unlawful interference with their
privacy, family, home or correspondence:
   AND WHEREAS Australia is a member of the Organisation for Economic
Co-operation and Development:
   AND WHEREAS the Council of that Organisation has recommended that member
countries take into account in their domestic legislation the principles
concerning the protection of privacy and individual liberties set forth in
Guidelines annexed to the recommendation:
   AND WHEREAS Australia has informed that Organisation that it will
participate in the recommendation concerning those Guidelines:
   BE IT THEREFORE ENACTED by the Queen, and the Senate and the House of
Representatives of the Commonwealth of Australia, as follows:
  


PRIVACY ACT 1988 - Part I--Preliminary
  
  
  


PRIVACY ACT 1988 - SECT 1 Short title [see Note 1]
  
  
   This Act may be cited as the Privacy Act 1988 .
  


PRIVACY ACT 1988 - SECT 2 Commencement [see Note 1]
  
  
   This Act commences on a day to be fixed by Proclamation.
  


PRIVACY ACT 1988 - SECT 3 Saving of certain State and Territory
laws
  
  
   It is the intention of the Parliament that this Act is not to affect the
operation of a law of a State or of a Territory that makes provision with
respect to interferences with the privacy of persons (including such a law
relating to credit reporting or the use of information held in connection with
credit reporting) and is capable of operating concurrently with this Act.
  


PRIVACY ACT 1988 - SECT 4 Act to bind the Crown
  
  
   (1) This Act binds the Crown in right of the Commonwealth, of each of the
States, of the Australian Capital Territory, of the Northern Territory and of
Norfolk Island.
   (2) Nothing in this Act renders the Crown in right of the Commonwealth, of
a State, of the Australian Capital Territory, of the Northern Territory or of
Norfolk Island liable to be prosecuted for an offence.
   (3) Nothing in this Act shall be taken to have the effect of making the
Crown in right of a State, of the Australian Capital Territory, of the
Northern Territory or of Norfolk Island an agency for the purposes of this
Act.
  


PRIVACY ACT 1988 - SECT 5 Interpretation of Information Privacy
Principles
  
  
   For the purposes of the interpretation of the Information Privacy
Principles, each Information Privacy Principle shall be treated as if it were
a section of this Act.
  


PRIVACY ACT 1988 - SECT 5A Extension to external Territories
  
  
   This Act extends to all external Territories.
  


PRIVACY ACT 1988 - Part II--Interpretation
  
  
  


PRIVACY ACT 1988 - SECT 6 Interpretation
  
  
   (1) In this Act, unless the contrary intention appears:
  "ACT enactment" has the same meaning as enactment has in the Australian Capital
Territory (Self-Government) Act 1988.
   agency means:
   (a) a Minister; or
   (b) a Department; or
   (c) a body (whether incorporated or not), or a tribunal, established or
appointed for a public purpose by or under a Commonwealth enactment, not
being:
   (i) an incorporated company, society or association; or
   (ii) an organisation within the meaning of the Conciliation and Arbitration
Act 1904 or a branch of such an organisation; or
   (d) a body established or appointed by the Governor-General, or by a
Minister, otherwise than by or under a Commonwealth enactment; or
   (e) a person holding or performing the duties of an office established by
or under, or an appointment made under, a Commonwealth enactment, other than a
person who, by virtue of holding that office, is the Secretary of a
Department; or
   (f) a person holding or performing the duties of an appointment, being an
appointment made by the Governor-General, or by a Minister, otherwise than
under a Commonwealth enactment; or
   (g) a federal court; or
   (h) the Australian Federal Police; or
   (i) an eligible case manager.
  "bank" means:
   (a) the Reserve Bank of Australia; or
   (b) a bank within the meaning of the Banking Act 1959 ; or
   (c) a person who carries on State banking within the meaning of paragraph
51(xiii) of the Constitution.
  "building society" means a society registered or incorporated as a building
society, co-operative housing society or similar society under a law relating
to such societies that is in force in a State or Territory.
  "class member" , in relation to a representative complaint, means any of the
persons on whose behalf the complaint was lodged, but does not include a
person who has withdrawn under section 38B.
  "Code of Conduct" means the Code of Conduct issued under section 18A.
  "commercial credit" means a loan sought or obtained by a person, other than a
loan of a kind referred to in the definition of credit in this subsection.
  "Commissioner" means the Privacy Commissioner.
  "Commissioner of Police" means the Commissioner of Police appointed under the
Australian Federal Police Act 1979 .
  "Commonwealth enactment" means:
   (a) an Act other than:
   (i) the Northern Territory (Self-Government) Act 1978 ; or
   (ii) an Act providing for the administration or government of an external
Territory; or
   (iii) the Australian Capital Territory (Self-Government) Act 1988 ;
   (b) an Ordinance of the Australian Capital Territory;
   (c) an instrument (including rules, regulations or by-laws) made under an
Act to which paragraph (a) applies or under an Ordinance to which paragraph
(b) applies; or
   (d) any other legislation that applies as a law of the Commonwealth (other
than legislation in so far as it is applied by an Act referred to in
subparagraph (a)(i) or (ii)) or as a law of the Australian Capital Territory,
to the extent that it operates as such a law.
  "Commonwealth officer" means a person who holds office under, or is employed by,
the Commonwealth, and includes:
   (a) a person appointed or employed under the Public Service Act 1922;
   (b) a person (other than a person referred to in paragraph (a)) permanently
or temporarily employed by, or in the service of, an agency;
   (c) a member of the Defence Force; and
   (d) a member, staff member or special member of the Australian Federal
Police;
   but does not include a person permanently or temporarily employed in the
Australian Capital Territory Government Service or in the Public Service of
the Northern Territory or of Norfolk Island.
  "consent" means express consent or implied consent.
  "corporation" means a body corporate that:
   (a) is a foreign corporation;
   (b) is a trading corporation formed within the limits of Australia or is a
financial corporation so formed; or
   (c) is incorporated in a Territory, other than the Northern Territory.
  "credit" means a loan sought or obtained by an individual from a credit provider
in the course of the credit provider carrying on a business or undertaking as
a credit provider, being a loan that is intended to be used wholly or
primarily for domestic, family or household purposes.
  "credit card" means any article of a kind commonly known as a credit card,
charge card or any similar article intended for use in obtaining cash, goods
or services by means of loans, and includes any article of a kind commonly
issued by persons carrying on business to customers or prospective customers
of those persons for use in obtaining goods or services from those persons by
means of loans.
  "credit enhancement" , in relation to a loan, means:
   (a) the process of insuring risk associated with purchasing or funding the
loan by means of a securitisation arrangement; or
   (b) any other similar process related to purchasing or funding the loan by
those means.
  "credit information file" , in relation to an individual, means any record that
contains information relating to the individual and is kept by a credit
reporting agency in the course of carrying on a credit reporting business
(whether or not the record is a copy of the whole or part of, or was prepared
using, a record kept by another credit reporting agency or any other person).
  "credit provider" has the meaning given by section 11B, and, for the purposes of
sections 7 and 8 and Parts III, IV and V, is taken to include a mortgage
insurer and a trade insurer.
  "credit report" means any record or information, whether in a written, oral or
other form, that:
   (a) is being or has been prepared by a credit reporting agency; and
   (b) has any bearing on an individual's:
   (i) eligibility to be provided with credit; or
   (ii) history in relation to credit; or
   (iii) capacity to repay credit; and
   (c) is used, has been used or has the capacity to be used for the purpose
of serving as a factor in establishing an individual's eligibility for credit.
  "credit reporting agency" has the meaning given by section 11A.
  "credit reporting business" means a business or undertaking (other than a
business or undertaking of a kind in respect of which regulations made for the
purposes of subsection (5C) are in force) that involves the preparation or
maintenance of records containing personal information relating to individuals
(other than records in which the only personal information relating to
individuals is publicly available information), for the purpose of, or for
purposes that include as the dominant purpose the purpose of, providing to
other persons (whether for profit or reward or otherwise) information on an
individual's:
   (a) eligibility to be provided with credit; or
   (b) history in relation to credit; or
   (c) capacity to repay credit;
   whether or not the information is provided or intended to be provided for
the purposes of assessing applications for credit.
  "credit reporting complaint" means a complaint about an act or practice that, if
established, would be an interference with the privacy of the complainant
because:
   (a) it breached the Code of Conduct; or
   (b) it breached a provision of Part IIIA.
  "credit reporting infringement" means:
   (a) a breach of the Code of Conduct; or
   (b) a breach of a provision of Part IIIA.
  "credit union" means a society or other body of persons that is registered or
incorporated as a credit union or credit society under a law relating to
credit unions or credit societies that is in force in a State or Territory.
  "current credit provider" , in relation to an individual, means a credit
provider who has given, to the individual, credit that has not yet been fully
repaid or otherwise fully discharged.
  "Defence Force" includes the Naval Reserve Cadets, the Australian Cadet Corps
and the Air Training Corps.
  "Department" means a Department within the meaning of the Public Service Act
1922 , other than:
   (a) the Department of the Senate;
   (b) the Department of the House of Representatives;
   (c) the Department of the Parliamentary Library;
   (d) the Department of the Parliamentary Reporting Staff; and
   (e) the Joint House Department.
  "eligible case manager" means an entity (within the meaning of the Employment
Services Act 1994 ):
   (a) that is, or has at any time been, a contracted case manager within the
meaning of that Act; and
   (b) that is not covered by paragraph (a), (b), (c), (d), (e), (f), (g) or
(h) of the definition of agency.
  "eligible communications service" means a postal, telegraphic, telephonic or
other like service, within the meaning of paragraph 51(v) of the Constitution.
  "Federal Court" means the Federal Court of Australia.
  "file number complaint" means a complaint about an act or practice that, if
established, would be an interference with the privacy of the complainant:
   (a) because it breached a guideline issued under section 17; or
   (b) because it involved an unauthorised requirement or request for
disclosure of a tax file number.
  "financial corporation" means a financial corporation within the meaning of
paragraph 51(xx) of the Constitution.
  "foreign corporation" means a foreign corporation within the meaning of
paragraph 51(xx) of the Constitution.
  "Freedom of Information Act" means the Freedom of Information Act 1982.
   generally available publication means a magazine, book, newspaper or other
publication that is or will be generally available to members of the public.
  "guarantee" includes an indemnity given against the default of a borrower in
making a payment in respect of a loan.
  "individual" means a natural person.
  "individual concerned" , in relation to personal information or a record of
personal information, means the individual to whom the information relates.
  "Information Privacy Principle" means any of the Information Privacy Principles
set out in section 14.
  "intelligence agency" means:
   (a) the Australian Security Intelligence Organization;
   (b) the Australian Secret Intelligence Service; or
   (c) the Office of National Assessments.
  "IPP complaint" means a complaint about an act or practice that, if established,
would be an interference with the privacy of the complainant because it
breached an Information Privacy Principle.
  "loan" means a contract, arrangement or understanding under which a person is
permitted to defer payment of a debt, or to incur a debt and defer its
payment, and includes:
   (a) a hire-purchase agreement; and
   (b) such a contract, arrangement or understanding for the hire, lease or
renting of goods or services, other than a contract, arrangement or
understanding under which:
   (i) full payment is made before, or at the same time as, the goods or
services are provided; and
   (ii) in the case of a hiring, leasing or renting of goods--an amount
greater than or equal to the value of the goods is paid as a deposit for the
return of the goods.
  "medical research" includes epidemiological research.
  "mortgage credit" means credit provided in connection with the acquisition,
maintenance or improvement of real property, being credit in respect of which
the real property is security.
  "mortgage insurer" means a corporation that carries on a business or undertaking
(whether for profit, reward or otherwise) that involves providing insurance to
credit providers in respect of mortgage credit given by credit providers to
other persons.
  "Ombudsman" means the Commonwealth Ombudsman.
  "personal information" means information or an opinion (including information or
an opinion forming part of a database), whether true or not, and whether
recorded in a material form or not, about an individual whose identity is
apparent, or can reasonably be ascertained, from the information or opinion.
  "record" means:
   (a) a document;
   (b) a database (however kept); or
   (c) a photograph or other pictorial representation of a person;
   but does not include:
   (d) a generally available publication;
   (e) anything kept in a library, art gallery or museum for the purposes of
reference, study or exhibition;
   (f) Commonwealth records as defined by subsection 3(1) of the Archives Act
1983 that are in the open access period for the purposes of that Act;
   (g) documents placed by or on behalf of a person (other than an agency) in
the memorial collection within the meaning of the Australian War Memorial Act
1980 ; or
   (h) letters or other articles in the course of transmission by post.
  "representative complaint" means a complaint where the persons on whose behalf
the complaint was made include persons other than the complainant, but does
not include a complaint that the Commissioner has determined should no longer
be continued as a representative complaint.
  "Secretary" , in relation to a Department, has the same meaning as in the Public
Service Act 1922 .
  "securitisation arrangement" means an arrangement:
   (a) involving the funding, or proposed funding, of:
   (i) loans that have been, or are to be, provided by a credit provider; or
   (ii) the purchase of loans by a credit provider;
   by issuing instruments or entitlements to investors; and
   (b) under which payments to investors in respect of such instruments or
entitlements are principally derived, directly or indirectly, from such loans.
  "serious credit infringement" means an act done by a person:
   (a) that involves fraudulently obtaining credit, or attempting fraudulently
to obtain credit; or
   (b) that involves fraudulently evading the person's obligations in relation
to credit, or attempting fraudulently to evade those obligations; or
   (c) that a reasonable person would consider indicates an intention, on the
part of the first-mentioned person, no longer to comply with the
first-mentioned person's obligations in relation to credit.
  "solicit" , in relation to personal information, means request a person to
provide that information, or a kind of information in which that information
is included.
  "staff of the Ombudsman" means the persons appointed or employed for the
purposes of section 31 of the Ombudsman Act 1976.
   State includes the Australian Capital Territory and the Northern Territory.
  "tax file number" means a tax file number as defined in Part VA of the Income
Tax Assessment Act 1936 .
  "tax file number information" means information (including information forming
part of a database), whether compiled lawfully or unlawfully, and whether
recorded in a material form or not, that records the tax file number of a
person in a manner connecting it with the person's identity.
  "trade insurer" means a corporation that carries on a business or undertaking
(whether for profit, reward or otherwise) that involves providing insurance to
credit providers in respect of commercial credit given by credit providers to
other persons.
  "trading corporation" means a trading corporation within the meaning of
paragraph 51(xx) of the Constitution.
  "use" , in relation to information, does not include mere disclosure of the
information, but does include the inclusion of the information in a
publication.
   (1A) In order to avoid doubt, it is declared that an ACT enactment is not a
Commonwealth enactment for the purposes of this Act.
   (2) For the purposes of this Act, an act or practice breaches an
Information Privacy Principle if, and only if, it is contrary to, or
inconsistent with, that Information Privacy Principle.
   (3) For the purposes of this Act, an act or practice breaches a guideline
issued under section 17 if, and only if, it is contrary to, or inconsistent
with, the guideline.
   (3A) For the purposes of this Act, an act or practice breaches the Code of
Conduct if, and only if, it is contrary to, or inconsistent with, the Code of
Conduct.
   (4) The definition of individual in subsection (1) shall not be taken to
imply that references to persons do not include persons other than natural
persons.
   (5) For the purposes of this Act, a person shall not be taken to be an
agency merely because the person is the holder of, or performs the duties of:
   (a) a prescribed office;
   (b) an office prescribed by regulations made for the purposes of
subparagraph 4(3)(b)(i) of the Freedom of Information Act 1982;
   (c) an office established by or under a Commonwealth enactment for the
purposes of an agency;
   (d) a judicial office or of an office of magistrate; or
   (e) an office of member of a tribunal that is established by or under a law
of the Commonwealth and that is prescribed for the purposes of this paragraph.
   (5A) For the purposes of the definition of credit reporting business in
subsection (1), information concerning commercial transactions engaged in by
or on behalf of an individual is not to be taken to be information relating to
an individual's:
   (a) eligibility to be provided with credit; or
   (b) history in relation to credit; or
   (c) capacity to repay credit.
   (5B) In considering whether a business or undertaking, carried on by a
credit provider that is a corporation, is a credit reporting business within
the meaning of this Act, the provision of information by the credit provider
to corporations related to it is to be disregarded.
   (5C) The regulations may provide that businesses or undertakings of a
specified kind are not credit reporting businesses within the meaning of this
Act.
   (5D) A reference in this Act to the purchase of a loan includes a reference
to the purchase of rights to receive payments under the loan.
   (6) For the purposes of this Act, the Department of Defence shall be taken
to include the Defence Force.
   (7) Nothing in this Act prevents a complaint from:
   (a) being both a file number complaint and an IPP complaint; or
   (b) being both a file number complaint and a credit reporting complaint.
   (8) For the purposes of this Act, the question whether corporations are
related to each other is determined in the same manner as the question whether
corporations, within the meaning of the Companies Act 1981 , are related to
each other would be determined under that Act.
  


PRIVACY ACT 1988 - SECT 7 Acts and practices of agencies etc.
  
  
   (1) Except so far as the contrary intention appears, a reference in this
Act (other than section 8) to an act or to a practice is a reference to:
   (a) an act done, or a practice engaged in, as the case may be, by an agency
(other than an eligible case manager), a file number recipient, a credit
reporting agency or a credit provider other than:
   (i) an agency specified in any of the following provisions of the Freedom
of Information Act 1982 :
   (A) Schedule 1;
   (B) Part I of Schedule 2;
   (C) Division 1 of Part II of Schedule 2;
   (ii) a federal court;
   (iii) a Minister;
   (iv) the National Crime Authority; or
   (v) a Royal Commission; or
   (b) an act done, or a practice engaged in, as the case may be, by a federal
court or by an agency specified in Schedule 1 to the Freedom of Information
Act 1982 , being an act done, or a practice engaged in, in respect of a matter
of an administrative nature; or
   (c) an act done, or a practice engaged in, as the case may be, by an agency
specified in Division 1 of Part II of Schedule 2 to the F reedom of
Information Act 1982 , other than an act done, or a practice engaged in, in
relation to a record in relation to which the agency is exempt from the
operation of that Act; or
   (cb) an act done, or a practice engaged in, as the case may be, by an
eligible case manager in connection with:
   (i) the provision of case management services (within the meaning of the
Employment Services Act 1994 ) to persons referred to the eligible case
manager under Part 4.3 of that Act; or
   (ii) the performance of functions conferred on the eligible case manager
under that Act; or
   (d) an act done, or a practice engaged in, as the case may be, by a
Minister in relation to the affairs of an agency (other than an eligible case
manager), not being an act done, or a practice engaged in, in relation to an
existing record; or
   (e) an act done, or a practice engaged in, as the case may be, by a
Minister in relation to a record that is in the Minister's possession in his
or her capacity as a Minister and relates to the affairs of an agency (other
than an eligible case manager); or
   (ea) an act done, or a practice engaged in, as the case may be, by a
Minister in relation to the affairs of an eligible case manager, being affairs
in connection with:
   (i) the provision of case management services (within the meaning of the
Employment Services Act 1994 ) to persons referred to the eligible case
manager under Part 4.3 of that Act; or
   (ii) the performance of functions conferred on the eligible case manager
under that Act; or
   (eb) an act done, or a practice engaged in, as the case may be, by a
Minister in relation to a record that is in the Minister's possession in his
or her capacity as a Minister and relates to the affairs of an eligible case
manager, being affairs in connection with:
   (i) the provision of case management services (within the meaning of the
Employment Services Act 1994 ) to persons referred to the eligible case
manager under Part 4.3 of that Act; or
   (ii) the performance of functions conferred on the eligible case manager
under that Act;
   but does not include a reference to an act done, or a practice engaged in,
in relation to a record that has originated with, or has been received from:
   (f) an intelligence agency;
   (g) the Defence Intelligence Organisation or the Defence Signals
Directorate of the Department of Defence; or
   (h) the National Crime Authority.
   (2) Except so far as the contrary intention appears, a reference in this
Act (other than section 8) to an act or to a practice includes, in the
application of this Act otherwise than in respect of the Information Privacy
Principles and the performance of the Commissioner's functions under section
27, a reference to an act done, or a practice engaged in, as the case may be,
by an agency specified in Part II of Schedule 2 to the Freedom of Information
Act 1982 or in Division 1 of Part II of that Schedule other than:
   (a) an intelligence agency;
   (b) the Defence Intelligence Organisation or the Defence Signals
Directorate of the Department of Defence; or
   (c) the National Crime Authority.
   (3) Except so far as the contrary intention appears, a reference in this
Act to doing an act includes a reference to:
   (a) doing an act in accordance with a practice; or
   (b) refusing or failing to do an act.
   (3A) For the purposes of this Act, an act is only to be taken to have been
done, and a practice is only to be taken to have been engaged in, by a credit
provider that is not a corporation if the act is done, or the practice is
engaged in, in the course of, or for the purposes of, banking (other than
State banking not extending beyond the limits of the State concerned) carried
on by the credit provider.
   (4) For the purposes of paragraphs 27(1)(b), (c), (d), (e), (g), (k), (m)
and (n), of subsection 31(2) and of Part VI, this section has effect as if a
reference in subsection (1) of this section to an act done, or to a practice
engaged in, included a reference to an act that is proposed to be done, or to
a practice that is proposed to be engaged in, as the case may be.
  


PRIVACY ACT 1988 - SECT 8 Acts and practices of, and disclosure of
information to, staff of agency etc.
  
  
  
   (1) For the purposes of this Act:
   (a) an act done or practice engaged in by, or information disclosed to, a
person employed by, or in the service of, an agency, file number recipient,
credit reporting agency or credit provider in the performance of the duties of
the person's employment shall be treated as having been done or engaged in by,
or disclosed to, the agency, recipient, credit reporting agency or credit
provider;
   (b) an act done or practice engaged in by, or information disclosed to, a
person on behalf of, or for the purposes of the activities of, an
unincorporated body, being a board, council, committee, sub-committee or other
body established by or under a Commonwealth enactment for the purpose of
assisting, or performing functions in connection with, an agency, shall be
treated as having been done or engaged in by, or disclosed to, the agency; and
   (c) an act done or practice engaged in by, or information disclosed to, a
member, staff member or special member of the Australian Federal Police in the
performance of his or her duties as such a member, staff member or special
member shall be treated as having been done or engaged in by, or disclosed to,
the Australian Federal Police.
   (2) Where:
   (a) an act done or a practice engaged in by a person, in relation to a
record, is to be treated, under subsection (1), as having been done or engaged
in by an agency; and
   (b) that agency is not the record-keeper in relation to that record;
   that act or practice shall be treated as the act or the practice of the
record-keeper in relation to that record.
  


PRIVACY ACT 1988 - SECT 9 Collectors
  
  
   (1) An agency that collects personal information shall be treated, for the
purposes of this Act, as a collector in relation to that information.
   (2) Subject to subsection (3), where personal information is collected by a
person:
   (a) in the course of the person's employment by, or in the service of, an
agency other than the Australian Federal Police; or
   (b) as a member, staff member or special member of the Australian Federal
Police in the performance of his or her duties as such a member, staff member
or special member;
   then, for the purposes of this Act:
   (c) if paragraph (a) applies--the agency first referred to in that
paragraph; and
   (d) if paragraph (b) applies--the Australian Federal Police;
   shall be treated as a collector in relation to that information.
   (3) Where personal information is collected by a person for the purposes of
the activities of, an unincorporated body, being a board, council, committee,
sub-committee or other body established by or under a Commonwealth enactment
for the purpose of assisting, or performing functions connected with, an
agency, that agency shall be treated, for the purposes of this Act, as a
collector in relation to that information.
  


PRIVACY ACT 1988 - SECT 10 Record-keepers
  
  
   (1) Subject to subsections (4) and (5), an agency that is in possession or
control of a record of personal information shall be regarded, for the
purposes of this Act, as the record-keeper in relation to that record.
   (2) Subject to subsections (3), (4) and (5), where a record of personal
information is in the possession or under the control of a person:
   (a) in the course of the person's employment in the service of or by an
agency other than the Australian Federal Police; or
   (b) as a member, staff member or special member of the Australian Federal
Police in the performance of his or her duties as such a member, staff member
or special member;
   then, for the purposes of this Act, the record-keeper in relation to that
record shall be taken to be:
   (c) if paragraph (a) applies--the agency first referred to in that
paragraph; and
   (d) if paragraph (b) applies--the Australian Federal Police.
   (3) Where a record of personal information is in the possession or under
the control of a person for the purposes of the activities of, an
unincorporated body, being a board, council, committee, sub-committee or other
body established by or under a Commonwealth enactment for the purpose of
assisting, or performing functions connected with, an agency, that agency
shall be regarded, for the purposes of this Act, as the record-keeper in
relation to that record.
   (4) Where:
   (a) a record of personal information (not being a record relating to the
administration of the Australian Archives) is in the custody of the Australian
Archives; or
   (b) a record of personal information (not being a record relating to the
administration of the Australian War Memorial) is in the custody of the
Australian War Memorial;
   the agency by or on behalf of which the record was placed in that custody
or, if that agency no longer exists, the agency to whose functions the
contents of the record are most closely related, shall be regarded, for the
purposes of this Act, as the record-keeper in relation to that record.
   (5) Where a record of personal information was placed by or on behalf of an
agency in the memorial collection within the meaning of the Australian War
Memorial Act 1980 , that agency or, if that agency no longer exists, the
agency to whose functions the contents of the record are most closely related,
shall be regarded, for the purposes of this Act, as the record-keeper in
relation to that record.
  


PRIVACY ACT 1988 - SECT 11 File number recipients
  
  
   (1) A person who is (whether lawfully or unlawfully) in possession or
control of a record that contains tax file number information shall be
regarded, for the purposes of this Act, as a file number recipient.
   (2) Subject to subsection (3), where a record that contains tax file number
information is in the possession or under the control of a person:
   (a) in the course of the person's employment in the service of or by a
person or body other than an agency;
   (b) in the course of the person's employment in the service of or by an
agency other than the Australian Federal Police; or
   (c) as a member, staff member or special member of the Australian Federal
Police in the performance of his or her duties as such a member, staff member
or special member;
   then, for the purposes of this Act, the file number recipient in relation
to that record shall be taken to be:
   (d) if paragraph (a) applies--the person's employer;
   (e) if paragraph (b) applies--the agency first referred to in that
paragraph; and
   (f) if paragraph (c) applies--the Australian Federal Police.
   (3) Where a record that contains tax file number information is in the
possession or under the control of a person for the purposes of the activities
of, an unincorporated body, being a board, council, committee, sub-committee
or other body established by or under a Commonwealth enactment for the purpose
of assisting, or performing functions connected with, an agency, that agency
shall be treated, for the purposes of this Act, as the file number recipient
in relation to that record.
  


PRIVACY ACT 1988 - SECT 11A Credit reporting agencies
  
  
   For the purposes of this Act, a person is a credit reporting agency if the
person is a corporation that carries on a credit reporting business.
  


PRIVACY ACT 1988 - SECT 11B Credit providers
  
  
   (1) For the purposes of this Act, but subject to subsection (2), a person
is a credit provider if the person is:
   (a) a bank; or
   (b) a corporation (other than an agency):
   (i) that is a building society; or
   (ii) that is a credit union; or
   (iii) a substantial part of whose business or undertaking is the provision
of loans (including the provision of loans by issuing credit cards); or
   (iv) that carries on a retail business in the course of which it issues
credit cards to members of the public in connection with the sale of goods, or
the supply of services, by the corporation; or
   (v) that:
   (A) carries on a business or undertaking involving the provision of loans
(including the provision of loans by issuing credit cards); and
   (B) is included in a class of corporations determined by the Commissioner
to be credit providers for the purposes of this Act; or
   (c) a person:
   (i) who is not a corporation; and
   (ii) in relation to whom paragraph (b) would apply if the person were a
corporation; or
   (d) an agency that:
   (i) carries on a business or undertaking that involves the making of loans;
and
   (ii) is determined by the Commissioner to be a credit provider for the
purposes of this Act.
   (1A) If an agency is a credit provider because of paragraph (1)(d), Part
IIIA has effect in relation to the carrying on by the agency of a business or
undertaking involving the making of loans despite anything in Part III or in
the Freedom of Information Act 1982 .
   (2) For the purposes of this Act, a corporation that would, but for this
section, be a credit provider is not to be regarded as a credit provider if it
is included in a class of corporations declared by the regulations not to be
credit providers.
   (3) A determination under sub-subparagraph (1)(b)(v)(B) or subparagraph
(1)(d)(ii) is to be made by notice in writing published in the Gazette .
   (4) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901 .
   (4A) Subsection (4B) applies to a person who carries on a business that is
involved in one or both of the following:
   (a) a securitisation arrangement;
   (b) managing loans that are the subject of a securitisation arrangement.
   (4B) While a person to whom this subsection applies is performing a task
that is reasonably necessary for purchasing, funding or managing, or
processing an application for, a loan by means of a securitisation arrangement
(being a loan that has been provided by, or in respect of which application
has been made to, a credit provider):
   (a) the person:
   (i) is taken, for the purposes of this Act, to be another credit provider;
and
   (ii) is subject to the same obligations under this Act as any other credit
provider; and
   (b) for the purposes of this Act, the loan is taken to have been provided
by, or the application for the loan is taken to have been made to, both the
person and the first-mentioned credit provider.
   (4C) Nothing in this Act prevents a report (within the meaning of
subsection 18N(9)) to which section 18N applies being disclosed if:
   (a) the disclosure is reasonably necessary for purchasing, funding or
managing, or processing an application for, a loan by means of a
securitisation arrangement (being a loan that has been provided by, or in
respect of which an application has been made to, a credit provider); and
   (b) the disclosure takes place between a person to whom subsection (4B)
applies in relation to that loan and:
   (i) the credit provider; or
   (ii) another person to whom that subsection applies in relation to that
loan.
   (4D) A reference in subsection (4B) or (4C) to purchasing or funding a loan
by means of a securitisation arrangement includes a reference to credit
enhancement of the loan.
   (4E) A reference in subsection (4B) or (4C) to managing a loan does not
include a reference to an act relating to the collection of overdue payments
in respect of the loan if the act is undertaken by a person whose primary
function in relation to the loan is the collection of overdue payments.
   (5) Subject to subsection (6), while a person is acting as an agent of a
credit provider in performing, on behalf of the credit provider, a task that
is necessary:
   (a) in processing an application for a loan; or
   (b) in managing:
   (i) a loan given by the credit provider; or
   (ii) an account maintained by any person with the credit provider;
   the first-mentioned person:
   (c) is taken, for the purposes of this Act, to be another credit provider;
and
   (d) is subject to the same obligations under this Act as any other credit
provider.
   (6) Nothing in this Act prevents such an agent of a credit provider
disclosing to the credit provider, in the agent's capacity as such an agent, a
report (within the meaning of subsection 18N(9)) to which section 18N applies.
   (7) The reference in subsection (5) to the management of a loan does not
include a reference to any act relating to the collection of payments that are
overdue in respect of the loan.
  


PRIVACY ACT 1988 - SECT 12 Application of Information Privacy
Principles to agency in possession
  
  
  
   For the purposes of this Act, where an agency has possession but not
control of a record of personal information, the Information Privacy
Principles apply in relation to that agency to the extent only of the
obligations or duties to which that agency is subject, otherwise than by
virtue of the operation of this Act, because it is in possession of that
particular record.
  


PRIVACY ACT 1988 - SECT 12A Act not to apply in relation to State
banking or insurance within that State
  
  
  
   Where, but for this section, a provision of this Act:
   (a) would have a particular application; and
   (b) by virtue of having that application, would be a law with respect to,
or with respect to matters including:
   (i) State banking not extending beyond the limits of the State concerned;
or
   (ii) State insurance not extending beyond the limits of the State
concerned;
   the provision is not to have that application.
  


PRIVACY ACT 1988 - Part III--Information Privacy
  
  
  


PRIVACY ACT 1988 - SECT 13 Interferences with privacy
  
  
   For the purposes of this Act, an act or practice is an interference with
the privacy of an individual if, and only if, the act or practice:
   (a) in the case of an act or practice engaged in by an agency (whether or
not the agency is also a file number recipient, credit reporting agency or
credit provider)--breaches an Information Privacy Principle in relation to
personal information that relates to the individual;
   (b) in the case of an act or practice engaged in by a file number recipient
(whether or not the file number recipient is also an agency, credit reporting
agency or credit provider)--breaches a guideline under section 17 in relation
to tax file number information that relates to the individual;
   (ba) constitutes a breach of Part 2 of the Data-matching Program
(Assistance and Tax) Act 1990 or the guidelines in force under that Act;
   (bb) constitutes a breach of the guidelines in force under section 135AA of
the National Health Act 1953 ;
   (c) involves an unauthorised requirement or request for disclosure of the
tax file number of the individual; or
   (d) in the case of an act or practice engaged in by a credit reporting
agency or credit provider (whether or not the credit reporting agency or
credit provider is also an agency or file number recipient)--constitutes a
credit reporting infringement in relation to personal information that relates
to the individual.
  


PRIVACY ACT 1988 - SECT 14 Information Privacy Principles
  
  
   The Information Privacy Principles are as follows:
   INFORMATION PRIVACY PRINCIPLES
   Principle 1
   Manner and purpose of collection of personal
   information
   1. Personal information shall not be collected by a collector for inclusion
in a record or in a generally available publication unless:
   (a) the information is collected for a purpose that is a lawful purpose
directly related to a function or activity of the collector; and
   (b) the collection of the information is necessary for or directly related
to that purpose.
   2. Personal information shall not be collected by a collector by unlawful
or unfair means.
   Principle 2
   Solicitation of personal information from
   individual concerned
   Where:
   (a) a collector collects personal information for inclusion in a record or
in a generally available publication; and
   (b) the information is solicited by the collector from the individual
concerned;
   the collector shall take such steps (if any) as are, in the circumstances,
reasonable to ensure that, before the information is collected or, if that is
not practicable, as soon as practicable after the information is collected,
the individual concerned is generally aware of:
   (c) the purpose for which the information is being collected;
   (d) if the collection of the information is authorised or required by or
under law--the fact that the collection of the information is so authorised or
required; and
   (e) any person to whom, or any body or agency to which, it is the
collector's usual practice to disclose personal information of the kind so
collected, and (if known by the collector) any person to whom, or any body or
agency to which, it is the usual practice of that first-mentioned person, body
or agency to pass on that information.
  
   Principle 3
   Solicitation of personal information generally
   Where:
   (a) a collector collects personal information for inclusion in a record or
in a generally available publication; and
   (b) the information is solicited by the collector;
   the collector shall take such steps (if any) as are, in the circumstances,
reasonable to ensure that, having regard to the purpose for which the
information is collected:
   (c) the information collected is relevant to that purpose and is up to date
and complete; and
   (d) the collection of the information does not intrude to an unreasonable
extent upon the personal affairs of the individual concerned.
  
   Principle 4
   Storage and security of personal information
   A record-keeper who has possession or control of a record that contains
personal information shall ensure:
   (a) that the record is protected, by such security safeguards as it is
reasonable in the circumstances to take, against loss, against unauthorised
access, use, modification or disclosure, and against other misuse; and
   (b) that if it is necessary for the record to be given to a person in
connection with the provision of a service to the record-keeper, everything
reasonably within the power of the record-keeper is done to prevent
unauthorised use or disclosure of information contained in the record.
  
   Principle 5
   Information relating to records kept by record-keeper
   1. A record-keeper who has possession or control of records that contain
personal information shall, subject to clause 2 of this Principle, take such
steps as are, in the circumstances, reasonable to enable any person to
ascertain:
   (a) whether the record-keeper has possession or control of any records that
contain personal information; and
   (b) if the record-keeper has possession or control of a record that
contains such information:
   (i) the nature of that information;
   (ii) the main purposes for which that information is used; and
   (iii) the steps that the person should take if the person wishes to obtain
access to the record.
   2. A record-keeper is not required under clause 1 of this Principle to give
a person information if the record-keeper is required or authorised to refuse
to give that information to the person under the applicable provisions of any
law of the Commonwealth that provides for access by persons to documents.
   3. A record-keeper shall maintain a record setting out:
   (a) the nature of the records of personal information kept by or on behalf
of the record-keeper;
   (b) the purpose for which each type of record is kept;
   (c) the classes of individuals about whom records are kept;
   (d) the period for which each type of record is kept;
   (e) the persons who are entitled to have access to personal information
contained in the records and the conditions under which they are entitled to
have that access; and
   (f) the steps that should be taken by persons wishing to obtain access to
that information.
   4. A record-keeper shall:
   (a) make the record maintained under clause 3 of this Principle available
for inspection by members of the public; and
   (b) give the Commissioner, in the month of June in each year, a copy of the
record so maintained.
  
   Principle 6
   Access to records containing personal information
   Where a record-keeper has possession or control of a record that contains
personal information, the individual concerned shall be entitled to have
access to that record, except to the extent that the record-keeper is required
or authorised to refuse to provide the individual with access to that record
under the applicable provisions of any law of the Commonwealth that provides
for access by persons to documents.
   Principle 7
   Alteration of records containing personal
   information
   1. A record-keeper who has possession or control of a record that contains
personal information shall take such steps (if any), by way of making
appropriate corrections, deletions and additions as are, in the circumstances,
reasonable to ensure that the record:
   (a) is accurate; and
   (b) is, having regard to the purpose for which the information was
collected or is to be used and to any purpose that is directly related to that
purpose, relevant, up to date, complete and not misleading.
   2. The obligation imposed on a record-keeper by clause 1 is subject to any
applicable limitation in a law of the Commonwealth that provides a right to
require the correction or amendment of documents.
   3. Where:
   (a) the record-keeper of a record containing personal information is not
willing to amend that record, by making a correction, deletion or addition, in
accordance with a request by the individual concerned; and
   (b) no decision or recommendation to the effect that the record should be
amended wholly or partly in accordance with that request has been made under
the applicable provisions of a law of the Commonwealth;
   the record-keeper shall, if so requested by the individual concerned, take
such steps (if any) as are reasonable in the circumstances to attach to the
record any statement provided by that individual of the correction, deletion
or addition sought.
   Principle 8
   Record-keeper to check accuracy etc. of
   personal information before use
   A record-keeper who has possession or control of a record that contains
personal information shall not use that information without taking such steps
(if any) as are, in the circumstances, reasonable to ensure that, having
regard to the purpose for which the information is proposed to be used, the
information is accurate, up to date and complete.
   Principle 9
   Personal information to be used only for relevant
   purposes
   A record-keeper who has possession or control of a record that contains
personal information shall not use the information except for a purpose to
which the information is relevant.
   Principle 10
   Limits on use of personal information
   1. A record-keeper who has possession or control of a record that contains
personal information that was obtained for a particular purpose shall not use
the information for any other purpose unless:
   (a) the individual concerned has consented to use of the information for
that other purpose;
   (b) the record-keeper believes on reasonable grounds that use of the
information for that other purpose is necessary to prevent or lessen a serious
and imminent threat to the life or health of the individual concerned or
another person;
   (c) use of the information for that other purpose is required or authorised
by or under law;
   (d) use of the information for that other purpose is reasonably necessary
for enforcement of the criminal law or of a law imposing a pecuniary penalty,
or for the protection of the public revenue; or
   (e) the purpose for which the information is used is directly related to
the purpose for which the information was obtained.
   2. Where personal information is used for enforcement of the criminal law
or of a law imposing a pecuniary penalty, or for the protection of the public
revenue, the record-keeper shall include in the record containing that
information a note of that use.
   Principle 11
   Limits on disclosure of personal information
   1. A record-keeper who has possession or control of a record that contains
personal information shall not disclose the information to a person, body or
agency (other than the individual concerned) unless:
   (a) the individual concerned is reasonably likely to have been aware, or
made aware under Principle 2, that information of that kind is usually passed
to that person, body or agency;
   (b) the individual concerned has consented to the disclosure;
   (c) the record-keeper believes on reasonable grounds that the disclosure is
necessary to prevent or lessen a serious and imminent threat to the life or
health of the individual concerned or of another person;
   (d) the disclosure is required or authorised by or under law; or
   (e) the disclosure is reasonably necessary for the enforcement of the
criminal law or of a law imposing a pecuniary penalty, or for the protection
of the public revenue.
   2. Where personal information is disclosed for the purposes of enforcement
of the criminal law or of a law imposing a pecuniary penalty, or for the
purpose of the protection of the public revenue, the record-keeper shall
include in the record containing that information a note of the disclosure.
   3. A person, body or agency to whom personal information is disclosed under
clause 1 of this Principle shall not use or disclose the information for a
purpose other than the purpose for which the information was given to the
person, body or agency.
  


PRIVACY ACT 1988 - SECT 15 Application of Information Privacy
Principles
  
  
   (1) Information Privacy Principles 1, 2, 3, 10 and 11 apply only in
relation to information collected after the commencement of this Act.
   (2) Information Privacy Principles 4 to 9, inclusive, apply in relation to
information contained in a record in the possession or under the control of an
agency, whether the information was collected before, or is collected after,
the commencement of this Act.
  


PRIVACY ACT 1988 - SECT 16 Agencies to comply with Information
Privacy Principles
  
  
   An agency shall not do an act, or engage in a practice, that breaches an
Information Privacy Principle.
  


PRIVACY ACT 1988 - SECT 17 Guidelines relating to tax file number
information
  
  
   (1) The Commissioner shall, by notice in writing, issue guidelines
concerning the collection, storage, use and security of tax file number
information.
   (2) A guideline issued under subsection (1) is a disallowable instrument
for the purposes of section 46A of the Acts Interpretation Act 1901 .
   (3) In its application under subsection (2) of this section, section 48 of
the Acts Interpretation Act 1901 applies to guidelines issued under subsection
(1) as if paragraph (1)(b) of section 48 were omitted and the following
paragraph substituted:
   "(b) shall, subject to this section, take effect:
   (i) on the first day on which the guidelines are no longer liable to be
disallowed, or to be deemed to be disallowed, under this section; or
   (ii) if the guidelines make provision for their commencement after the day
referred to in subparagraph (i), in accordance with that provision; and".
   (4) Until the first guidelines take effect for the purposes of subsection
(1), the interim guidelines set out in Schedule 2 have effect, for the
purposes of any provision of this Act other than subsection (1), (2) or (3),
as if they were guidelines issued under subsection (1).
  


PRIVACY ACT 1988 - SECT 18 File number recipients to comply with
guidelines
  
  
   A file number recipient shall not do an act, or engage in a practice, that
breaches a guideline issued under section 17.
  


PRIVACY ACT 1988 - SECT 18A Code of Conduct relating to credit
information files and credit reports
  
  
  
   (1) The Commissioner must, by notice published in the Gazette , issue a
Code of Conduct concerning:
   (a) the collection of personal information for inclusion in individuals'
credit information files; and
   (b) the storage of, security of, access to, correction of, use of and
disclosure of personal information included in individuals' credit information
files or in credit reports; and
   (c) the manner in which credit reporting agencies and credit providers are
to handle disputes relating to credit reporting; and
   (d) any other activities, engaged in by credit reporting agencies or credit
providers, that are connected with credit reporting.
   (2) Before issuing the Code of Conduct, the Commissioner must, to the
extent that it is appropriate and practicable to do so, consult with
government, commercial, consumer and other relevant bodies and organisations.
   (3) In preparing the Code of Conduct, the Commissioner must have regard to:
   (a) the Information Privacy Principles and the provisions of Part IIIA; and
   (b) the likely costs to credit reporting agencies and credit providers of
complying with the Code of Conduct.
   (4) The Code of Conduct is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901 .
  


PRIVACY ACT 1988 - SECT 18B Credit reporting agencies and credit
providers to comply with Code of Conduct
  
  
  
   A credit reporting agency or credit provider must not do an act, or engage
in a practice, that breaches the Code of Conduct.
  


PRIVACY ACT 1988 - Part IIIA--Credit Reporting
  
  
  


PRIVACY ACT 1988 - SECT 18C Certain credit reporting only to be
undertaken by corporations
  
  
   (1) A person must not use an eligible communications service in the course
of carrying on a credit reporting business unless the person is a corporation.
   (2) A person must not:
   (a) in the course of trade or commerce:
   (i) between Australia and places outside Australia; or
   (ii) among the States; or
   (iii) between a State and a Territory; or
   (iv) among the Territories; or
   (b) in the course of banking (other than State banking not extending beyond
the limits of the State concerned); or
   (c) in the course of insurance business (other than insurance business
relating to State insurance not extending beyond the limits of the State
concerned); or
   (d) in a Territory;
   carry on a credit reporting business unless the person is a corporation.
   (3) A person must not act on a corporation's behalf in the course of
carrying on a credit reporting business unless the person is a corporation.
   (4) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $30,000.
  


PRIVACY ACT 1988 - SECT 18D Personal information not to be given
to certain persons carrying on credit reporting
  
  
  
   (1) A person must not use an eligible communications service to give to a
person carrying on a credit reporting business personal information in
circumstances to which this section applies unless the last-mentioned person
is a corporation.
   (2) A person must not:
   (a) in the course of trade or commerce:
   (i) between Australia and places outside Australia; or
   (ii) among the States; or
   (iii) between a State and a Territory; or
   (iv) among the Territories; or
   (b) in the course of banking (other than State banking not extending beyond
the limits of the State concerned); or
   (c) in the course of insurance business (other than insurance business
relating to State insurance not extending beyond the limits of the State
concerned); or
   (d) in a Territory;
   give to a person carrying on a credit reporting business personal
information in circumstances to which this section applies unless the
last-mentioned person is a corporation.
   (3) A corporation must not give to a person carrying on a credit reporting
business personal information in circumstances to which this section applies
unless the last-mentioned person is a corporation.
   (4) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $12,000.
   (5) For the purposes of this section, personal information is to be taken
to be given to a person in circumstances to which this section applies if the
person to whom the information is given is likely to use the information in
the course of carrying on a credit reporting business.
  


PRIVACY ACT 1988 - SECT 18E Permitted contents of credit information
files
  
  
   (1) A credit reporting agency must not include personal information in an
individual's credit information file unless:
   (a) the inclusion of the information in the file is reasonably necessary in
order to identify the individual; or
   (b) the information is a record of:
   (i) both:
   (A) a credit provider having sought a credit report in relation to an
individual in connection with an application for credit or commercial credit
made by the individual to the credit provider; and
   (B) the amount of credit or commercial credit sought in the application; or
   (ia) a person who is a credit provider because of the application of
subsection 11B (4B) having sought a credit report in relation to the
individual for the purpose of assessing:
   (A) the risk in purchasing a loan by means of a securitisation arrangement;
or
   (B) the risk in undertaking credit enhancement of a loan that is, or is
proposed to be, purchased or funded by means of a securitisation arrangement;
   being a loan given to, or applied for by, the individual or a person in
relation to whom the individual is, or is proposing to be, a guarantor; or
   (ii) a mortgage insurer having sought a credit report in connection with
the provision of insurance to a credit provider in respect of mortgage credit
given by the credit provider to the individual, or to a person in relation to
whom the individual is, or is proposing to be, a guarantor; or
   (iii) a trade insurer having sought a credit report in connection with the
provision of insurance to a credit provider in respect of commercial credit
given by the credit provider to the individual or another person; or
   (iv) a credit provider having sought a credit report in connection with the
individual having offered to act as guarantor in respect of a loan or an
application for a loan; or
   (v) a credit provider being a current credit provider in relation to the
individual; or
   (vi) credit provided by a credit provider to an individual, being credit in
respect of which:
   (A) the individual is at least 60 days overdue in making a payment,
including a payment that is wholly or partly a payment of interest; and
   (B) the credit provider has taken steps to recover the whole or any part of
the amount of credit (including any amounts of interest) outstanding; or
   (vii) a cheque, for an amount not less than $100, that:
   (A) has been drawn by the individual; and
   (B) has twice been presented and dishonoured; or
   (viii) court judgments made against the individual; or
   (ix) bankruptcy orders made against the individual; or
   (x) the opinion of a credit provider that the individual has, in the
circumstances specified, committed a serious credit infringement; or
   (ba) the information is a record of an overdue payment by the individual as
guarantor under a guarantee given against default by a person (the"borrower" ) in repaying all or any of an amount of credit obtained by the
borrower from a credit provider, and the following subparagraphs apply:
   (i) the credit provider is not prevented under any law of the Commonwealth,
a State or a Territory from bringing proceedings against the individual to
recover the amount of the overdue payment;
   (ii) the credit provider has given the individual notice of the borrower's
default that gave rise to the individual's obligation to make the payment;
   (iii) 60 days have elapsed since the day on which the notice was given;
   (iv) the credit provider has, separately from and in addition to the giving
of the notice referred to in subparagraph (ii), taken steps to recover the
amount of the overdue payment from the individual.
   (c) the information is included in a statement provided by the individual
under subsection 18J(2) for inclusion in the file; or
   (d) the information is included in a note included in the file under
subsection 18F(4) or 18K(5).
   (2) A credit reporting agency must not include in an individual's credit
information file personal information recording the individual's:
   (a) political, social or religious beliefs or affiliations; or
   (b) criminal record; or
   (c) medical history or physical handicaps; or
   (d) race, ethnic origins or national origins; or
   (e) sexual preferences or practices; or
   (f) lifestyle, character or reputation.
   (3) The Commissioner may determine, in writing, the kinds of information
that are, for the purposes of paragraph (1)(a), reasonably necessary to be
included in an individual's credit information file in order to identify the
individual.
   (4) Where the Commissioner so determines, information that is not of a kind
so determined is to be taken not to be information that is permitted to be
included in an individual's credit information file under paragraph (1)(a).
   (5) A determination is to be made by notice published in the Gazette.
   (6) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901 .
   (7) A credit reporting agency must not open a credit information file in
relation to an individual unless it has information, concerning the
individual, to include in the file that is information of a kind referred to
in paragraph (1)(b) or (ba).
   (8) A credit provider must not give to a credit reporting agency personal
information relating to an individual if:
   (a) a credit reporting agency is prohibited, under subsection (1), from
including the information in the individual's credit information file; or
   (b) the credit provider does not have reasonable grounds for believing that
the information is correct; or
   (c) the credit provider did not, at the time of, or before, acquiring the
information, inform the individual that the information might be disclosed to
a credit reporting agency.
  


PRIVACY ACT 1988 - SECT 18F Deletion of information from credit
information files
  
  
   (1) A credit reporting agency must delete from an individual's credit
information file maintained by the credit reporting agency any personal
information of a kind referred to in paragraph 18E(1)(b) or (ba) within 1
month after the end of the maximum permissible period for the keeping of
personal information of that kind.
   (2) For the purposes of subsection (1), the maximum permissible periods for
the keeping of personal information of the kind referred to in paragraph
18E(1)(b) are as follows:
   (a) in the case of information of a kind referred to in subparagraph (i),
(ia), (ii), (iii) or (iv) of that paragraph--the period of 5 years commencing
on the day on which the credit report concerned was sought;
   (b) in the case of information of a kind referred to in subparagraph (v) of
that paragraph--the period of 14 days commencing on the day on which the
credit reporting agency is notified under subsection (5) that the credit
provider concerned is no longer a current credit provider in relation to the
individual concerned;
   (c) in the case of information of a kind referred to in subparagraph (vi)
of that paragraph--the period of 5 years commencing on the day on which the
credit reporting agency was informed of the overdue payment concerned;
   (d) in the case of information of a kind referred to in subparagraph (vii)
of that paragraph--the period of 5 years commencing on the day on which the
second dishonouring of the cheque occurred;
   (e) in the case of information of a kind referred to in subparagraph (viii)
of that paragraph--the period of 5 years commencing on the day on which the
court judgment concerned was made;
   (f) in the case of information of a kind referred to in subparagraph (ix)
of that paragraph--the period of 7 years commencing on the day on which the
bankruptcy order concerned was made;
   (g) in the case of information of a kind referred to in subparagraph (x) of
that paragraph--the period of 7 years commencing on the day on which the
information was included in the credit information file concerned.
   (2A) For the purposes of subsection (1), the maximum permissible period for
the keeping of personal information of the kind referred to in paragraph
18E(1)(ba) is the period of 5 years beginning on the day when the credit
reporting agency is informed of the overdue payment concerned.
   (3) Where:
   (a) a credit reporting agency has been given information that an individual
is overdue in making a payment in respect of credit provided by a credit
provider; and
   (b) the individual ceases to be overdue in making the payment or contends
that he or she is not overdue in making the payment;
   the credit provider must, as soon as practicable, inform the credit
reporting agency that the individual has ceased to be overdue in making the
payment, or contends that he or she is not overdue in making the payment, as
the case may be.
   (4) On being informed that the individual is no longer overdue in making
the payment, or that the individual contends that he or she is not overdue in
making the payment, the credit reporting agency must include in the
individual's credit information file a note to that effect.
   (5) Where a credit provider ceases to be a current credit provider in
relation to an individual, the credit provider must, as soon as practicable,
notify that fact to any credit reporting agency that was previously informed
that the credit provider was a current credit provider in relation to the
individual.
  


PRIVACY ACT 1988 - SECT 18G Accuracy and security of credit
information files and credit reports
  
  
  
   A credit reporting agency in possession or control of a credit information
file, or a credit provider or credit reporting agency in possession or control
of a credit report, must:
   (a) take reasonable steps to ensure that personal information contained in
the file or report is accurate, up-to-date, complete and not misleading; and
   (b) ensure that the file or report is protected, by such security
safeguards as are reasonable in the circumstances, against loss, against
unauthorised access, use, modification or disclosure, and against other
misuse; and
   (c) if it is necessary for the file or report to be given to a person in
connection with the provision of a service to the credit reporting agency or
credit provider, ensure that everything reasonably within the power of the
credit reporting agency or credit provider is done to prevent unauthorised use
or disclosure of personal information contained in the file or report.
  


PRIVACY ACT 1988 - SECT 18H Access to credit information files and
credit reports
  
  
   (1) A credit reporting agency in possession or control of an individual's
credit information file must take reasonable steps to ensure that the
individual can obtain access to that file.
   (2) A credit provider, or a credit reporting agency, in possession or
control of a credit report containing personal information concerning an
individual must take all reasonable steps to ensure that the individual can
obtain access to that report.
   (3) An individual's rights of access under this section may also be
exercised by a person (other than a credit provider, mortgage insurer or trade
insurer) authorised, in writing, by the individual to exercise those rights on
the individual's behalf in connection with:
   (a) an application, or a proposed application, by the individual for a
loan; or
   (b) the individual having sought advice in relation to a loan.
  


PRIVACY ACT 1988 - SECT 18J Alteration of credit information files
and credit reports
  
  
   (1) A credit reporting agency in possession or control of a credit
information file, or a credit provider or credit reporting agency in
possession or control of a credit report, must take reasonable steps, by way
of making appropriate corrections, deletions and additions, to ensure that the
personal information contained in the file or report is accurate, up-to-date,
complete and not misleading.
   (2) Where:
   (a) a credit reporting agency in possession or control of a credit
information file, or a credit provider or credit reporting agency in
possession or control of a credit report, does not amend personal information
contained in that file or report, by making a correction, deletion or
addition, in accordance with a request by the individual concerned; and
   (b) the individual requests the credit reporting agency or credit provider
to include in that file or report a statement provided by the individual of
the correction, deletion or addition sought;
   the credit reporting agency or credit provider must take reasonable steps
to include the statement in the file or report within 30 days after being
requested to do so.
   (3) Where the credit reporting agency or credit provider considers a
statement included pursuant to subsection 18J(2) to be of undue length in the
circumstances, the credit reporting agency or credit provider may refer the
statement to the Commissioner for such reduction as is considered appropriate
and, if the statement is altered, the statement as altered is to be included
in the file or report.
  


PRIVACY ACT 1988 - SECT 18K Limits on disclosure of personal
information by credit reporting agencies
  
  
  
   (1) A credit reporting agency in possession or control of an individual's
credit information file must not disclose personal information contained in
the file to a person, body or agency (other than the individual) unless:
   (a) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of assessing an application
for credit made by the individual to the credit provider; or
   (ab) the information:
   (i) is contained in a credit report given to a person who is a credit
provider because of the application of subsection 11B(4B); and
   (ii) the person requested the report for the purpose of assessing the risk
in purchasing a loan by means of a securitisation arrangement, being a loan
given to or applied for by:
   (A) the individual; or
   (B) a person in relation to whom the individual is, or is proposing to be,
a guarantor; or
   (ac) the information:
   (i) is contained in a credit report given to a person who is a credit
provider because of the application of subsection 11B(4B); and
   (ii) the person requested the report for the purpose of assessing the risk
in undertaking credit enhancement of a loan that is, or is proposed to be,
purchased or funded by means of a securitisation arrangement, being a loan
given to or applied for by:
   (A) the individual; or
   (B) a person in relation to whom the individual is, or is proposing to be,
a guarantor; or
   (b) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of assessing an application
for commercial credit made by a person to the credit provider, and the
individual to whom the report relates has specifically agreed to the report
being given to the credit provider for that purpose; or
   (c) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of assessing whether to
accept the individual as a guarantor in respect of:
   (i) a loan provided by the credit provider to a person other than the
individual; or
   (ii) a loan for which an application has been made by a person other than
the individual to the credit provider;
   and the first-mentioned individual has specifically agreed, in writing, to
the report being given to the credit provider for that purpose; or
   (d) the information is contained in a credit report given to a mortgage
insurer for the purpose of assessing:
   (i) whether to provide insurance to, or the risk of providing insurance to,
a credit provider in respect of mortgage credit given by the credit provider
to the individual; or
   (ii) the risk of the individual defaulting on mortgage credit in respect of
which the mortgage insurer has provided insurance to a credit provider; or
   (iii) the risk of the individual being unable to meet a liability that
might arise under a guarantee entered into, or proposed to be entered into, in
respect of mortgage credit given by a credit provider to another person; or
   (e) the information is contained in a credit report given to a trade
insurer for the purpose of assessing:
   (i) whether to provide insurance to, or the risk of providing insurance to,
a credit provider in respect of commercial credit given by the credit provider
to the individual or another person; or
   (ii) the risk of a person defaulting on commercial credit in respect of
which the trade insurer has provided insurance to a credit provider;
   and the individual to whom the report relates has specifically agreed, in
writing, to the report being given to the trade insurer for that purpose; or
   (f) the credit reporting agency has, at least 30 days before the
disclosure, received information of a kind referred to in subparagraph
18E(1)(b)(vi), and the information is contained in a credit report given to a
credit provider referred to in the credit information file as a credit
provider who is a current credit provider in relation to the individual; or
   (g) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of the collection of
payments that are overdue in respect of credit provided to the individual by
the credit provider; or
   (h) the information is contained in a credit report given to a credit
provider who requested the report for the purpose of the collection of
payments that are overdue in respect of commercial credit provided to a person
by the credit provider, and:
   (i) the individual to whom the report relates has specifically agreed, in
writing, to the report being given to the credit provider for that purpose; or
   (ii) that individual had specifically agreed, in writing, to a credit
report relating to the individual being given to the credit provider for the
purpose of the credit provider assessing the application that the
first-mentioned person made to the credit provider for the provision of the
commercial credit concerned; or
   (iii) the credit provider provided the commercial credit concerned before
the commencement of this section; or
   (j) the information is contained in a credit report given to another credit
reporting agency; or
   (k) the information is contained in a record in which the only personal
information relating to individuals is publicly available information; or
   (m) the disclosure is required or authorised by or under law; or
   (n) the credit reporting agency is satisfied that a credit provider or law
enforcement authority believes on reasonable grounds that the individual has
committed a serious credit infringement and the information is given to that
credit provider or law enforcement authority or to any other credit provider
or law enforcement authority.
   (1A) For the purposes of paragraph (1)(b), the individual's agreement to
the report being given to the credit provider must be in writing unless:
   (a) the report is requested for the purpose of assessing an application for
commercial credit that was at first instance made orally; and
   (b) the application has not yet been made in writing.
   (2) A credit reporting agency must not disclose personal information
contained in an individual's credit information file, or in any other record
containing information derived from the file, that is in the possession or
control of the credit reporting agency if the file or other record contains
personal information that the credit reporting agency would be:
   (a) prohibited from including in an individual's credit information file
under section 18E; or
   (b) required to delete from such a file under section 18F.
   (3) Subsection (2) does not prohibit the credit reporting agency from
disclosing personal information that it would be prohibited from including in
an individual's credit information file under section 18E if:
   (a) the credit reporting agency included the information in a credit
information file or other record before the commencement of this section; and
   (b) the information is information of a kind that the Commissioner has
determined, in writing, to be information that the credit reporting agency may
disclose without contravening that subsection.
   (4) A credit reporting agency that knowingly or recklessly contravenes
subsection (1) or (2) is guilty of an offence punishable, on conviction, by a
fine not exceeding $150,000.
   (5) Where a credit reporting agency discloses personal information
contained in an individual's credit information file, it must include in the
file a note of that disclosure.
   (6) A credit reporting agency must not include in a credit report given to
a credit provider under paragraph (1)(a) any information relating to an
individual's commercial activities (other than information that the credit
reporting agency is permitted under section 18E to include in the individual's
credit information file).
   (7) A determination under paragraph (3)(b) is to be made by notice
published in the Gazette.
   (8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901 .
  


PRIVACY ACT 1988 - SECT 18L Limits on use by credit providers of
personal information contained in credit reports etc.
  
  
  
   (1) A credit provider that is or has been in possession or control of a
credit report must not use the report or any personal information derived from
the report for any purpose other than assessing an application for credit made
to the credit provider by the individual concerned unless:
   (aa) the report was obtained under paragraph 18K (1) (a) or (ab) and the
credit provider uses the report or information for the purpose of assessing
the risk in purchasing a loan by means of a securitisation arrangement, being
a loan given to or applied for by:
   (i) the individual; or
   (ii) a person in relation to whom the individual is, or is proposing to be,
a guarantor; or
   (ab) the report was obtained under paragraph 18K (1) (a) or (ac) and the
credit provider uses the report or information for the purpose of assessing
the risk in undertaking credit enhancement of a loan that is, or is proposed
to be, purchased or funded by means of a securitisation arrangement, being a
loan given to or applied for by:
   (i) the individual; or
   (ii) a person in relation to whom the individual is, or is proposing to be,
a guarantor; or
   (a) the report was obtained under paragraph 18K (1) (b) and the credit
provider uses the report or information for the purpose of assessing an
application for commercial credit made by a person to the credit provider; or
   (b) the report was obtained under paragraph 18K (1) (c) and the credit
provider uses the report or information for the purpose of assessing whether
to accept the individual as a guarantor in respect of:
   (i) a loan provided by the credit provider to a person other than the
individual; or
   (ii) a loan for which an application has been made by a person other than
the individual to the credit provider; or
   (ba) the report was obtained under paragraph 18K (1) (a), (b) or (c) and
the credit provider uses the report or information for the internal management
purposes of the credit provider, being purposes directly related to the
provision or management of loans by the credit provider; or
   (c) the report was obtained under paragraph 18K (1) (f) and the credit
provider uses the information for the purpose of assisting the individual to
avoid defaulting on his or her credit obligations; or
   (d) the credit provider uses the report or information for the purpose of
the collection of payments that are overdue in respect of credit provided to
the individual by the credit provider; or
   (da) the report was obtained under paragraph 18K (1) (h) and the credit
provider uses the report or information for the purpose of the collection of
payments that are overdue in respect of commercial credit provided to a person
by the credit provider; or
   (e) use of the report or information for that other purpose is required or
authorised by or under law; or
   (f) the credit provider believes on reasonable grounds that the individual
has committed a serious credit infringement, and the report or information is
used in connection with that infringement.
   (2) A credit provider that knowingly or recklessly contravenes subsection
(1) is guilty of an offence punishable, on conviction, by a fine not exceeding
$150,000.
   (3) A credit provider that is or has been in possession or control of a
credit report must not:
   (a) use the report unless all personal information concerning individuals
that is not information of a kind referred to in subsection 18E (1) has been
deleted from the report; or
   (b) use any personal information derived from the report if the information
is not information of a kind referred to in subsection 18E (1).
   (4) Where a credit provider has received a credit report for the purpose of
assessing an application for credit made to the credit provider by an
individual, the credit provider must not, in assessing the application, use
information that:
   (a) concerns the individual's commercial activities or commercial credit
worthiness; and
   (b) was obtained from a person or body carrying on a business or
undertaking involving the provision of information about the commercial credit
worthiness of persons;
   unless the individual has specifically agreed to the information being
obtained by the credit provider for that purpose.
   (4A) For the purposes of subsection (4), the individual's agreement to the
information being obtained by the credit provider must be in writing unless:
   (a) the information is obtained for the purpose of assessing an application
for credit that was at first instance made orally; and
   (b) the application has not yet been made in writing.
   (5) References in subsection (3) to information that is not information of
a kind referred to in subsection 18E (1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K (3), not to be in contravention of subsection 18K (2).
   (6) The Commissioner may determine, in writing, the manner in which
information of a kind referred to in subsection (4) may, under that
subsection, be used (including the manner in which an individual's agreement
may be obtained for the purposes of that subsection).
   (7) A determination is to be made by notice published in the Gazette.
   (8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901 .
  


PRIVACY ACT 1988 - SECT 18M Information to be given if an
individual's application for credit is refused
  
  
  
   If:
   (a) a credit provider refuses an application by an individual for credit
(including an application made jointly by that individual and one or more
other persons); and
   (b) the refusal is based wholly or partly on information derived from a
credit report relating to that individual that a credit reporting agency has
given to the credit provider for the purpose of assessing the application;
   the credit provider must give the individual a written notice:
   (c) stating:
   (i) that the application has been refused; and
   (ii) that the refusal was based wholly or partly, as the case requires, on
information derived from a credit report relating to that individual that a
credit reporting agency has given to the credit provider; and
   (iii) the name and address of the credit reporting agency; and
   (d) notifying that individual of his or her right under this Act to obtain
access to his or her credit information file maintained by the credit
reporting agency.
   (2) If:
   (a) a credit provider refuses an application by an individual for credit,
being an application made jointly by that individual and one or more other
persons; and
   (b) the refusal is based wholly or partly on information derived from a
credit report relating to one of those other persons that a credit reporting
agency has given to the credit provider for the purpose of assessing the
application;
   the credit provider must give to that individual a written notice stating:
   (c) that the application has been refused; and
   (d) that the refusal was based wholly or partly, as the case requires, on
information derived from a credit report relating to that person that a credit
reporting agency has given to the credit provider.
   (3) If:
   (a) a credit provider refuses an application by an individual for credit
(including an application made jointly by that individual and one or more
other persons); and
   (b) the refusal is based wholly or partly on information derived from a
credit report relating to another person who was proposing to be a guarantor
in respect of the credit;
   the credit provider must give that individual a written notice stating:
   (c) that the application has been refused; and
   (d) that the refusal was based wholly or partly, as the case requires, on
information derived from a credit report relating to that person that a credit
reporting agency has given to the credit provider.
  


PRIVACY ACT 1988 - SECT 18N Limits on disclosure by credit
providers of personal information contained in reports relating to
credit worthiness etc.
  
  
  
   (1) A credit provider that is or has been in possession or control of a
report must not disclose the report or any personal information derived from
the report to another person for any purpose unless:
   (a) the report or information is disclosed to a credit reporting agency for
the purpose of being used:
   (i) to create a credit information file in relation to the individual
concerned; or
   (ii) to include information in a credit information file, maintained by the
credit reporting agency, in relation to the individual concerned; or
   (b) the individual concerned has specifically agreed to the disclosure of
the report or information to another credit provider for the particular
purpose; or
   (ba) the report or information is disclosed:
   (i) to the guarantor of a loan provided by the credit provider to the
individual concerned; and
   (ii) for any purpose related to the enforcement or proposed enforcement of
the guarantee; or
   (bb) the report or information is disclosed to a mortgage insurer:
   (i) for the purpose of assessing whether to provide insurance to, or the
risk of providing insurance to, a credit provider in respect of mortgage
credit given by the credit provider to the individual concerned or applied for
by the individual concerned to the credit provider; or
   (ii) for the purpose of assessing the risk of the individual defaulting on
mortgage credit in respect of which the mortgage insurer has provided
insurance to the credit provider; or
   (iii) for any purpose arising under a contract for mortgage insurance that
has been entered into between the credit provider and the mortgage insurer; or
   (bc) the report or information is disclosed:
   (i) to a person or body generally recognised and accepted in the community
as being a person appointed, or a body established, for the purpose of
settling disputes between credit providers, acting in their capacity as credit
providers, and their customers; and
   (ii) for the purpose of settling a dispute between the credit provider and
the individual concerned; or
   (bd) the report or information is disclosed:
   (i) to a Minister, Department or authority, of a State or Territory whose
functions or responsibilities include giving assistance (directly or
indirectly) that facilitates the giving of mortgage credit to individuals; and
   (ii) for the purpose of enabling the Minister, Department or authority to
determine the extent of assistance (if any) it will give in relation to the
giving of mortgage credit to the individual concerned; or
   (bda) the report or information is disclosed:
   (i) to a Minister, Department or authority, of a State or Territory whose
functions or responsibilities include the management or supervision of schemes
or arrangements under which assistance is given (directly or indirectly) that
facilitates the giving of mortgage credit to individuals; and
   (ii) for the purpose of enabling the Minister, Department or authority to
manage or supervise any such scheme or arrangement; or
   (be) the report or information:
   (i) is disclosed to a person or body carrying on a business of supplying
goods or services; and
   (ii) is disclosed for the purpose of enabling that person or body to decide
whether to accept, as payment for goods or services supplied to the individual
concerned, payment by means of credit card or electronic transfer of funds;
and
   (iii) does not contain or include any personal information derived from a
credit report, other than:
   (A) information of a kind referred to in paragraph 18E(1)(a); and
   (B) information as to whether the individual has a line of credit with the
credit provider, or funds deposited with the credit provider, sufficient to
meet the payment concerned; or
   (bf) the report or information:
   (i) is disclosed to a person or body that is considering taking an
assignment of, or discharging on the individual's behalf, a debt owed by the
individual to the credit provider; and
   (ii) does not contain or include any personal information derived from a
credit report, other than:
   (A) information of a kind referred to in paragraph 18E(1)(a); and
   (B) information as to the amount of the debt, or the amount required to be
paid in order to discharge the debt; or
   (bg) the report or information is disclosed to a person who is a guarantor
in respect of, or who has provided property as security for, a loan given by
the credit provider to the individual concerned, and:
   (i) the individual has specifically agreed to the disclosure of the report
or information to any such person; or
   (ii) the following circumstances apply:
   (A) the guarantee or security was given before the commencement of this
paragraph;
   (B) the report or information is disclosed for the purpose of giving to the
person information that is relevant to the amount or possible amount of the
person's liability under the contract of guarantee or security;
   (C) the credit provider has, prior to the disclosure, informed the
individual that such disclosures may take place; or
   (bh) the report or information is disclosed to a person for the purpose of
that person considering whether to offer to act as guarantor in respect of, or
to offer property as security for:
   (i) a loan given by the credit provider to the individual concerned; or
   (ii) a loan for which the individual concerned has applied to the credit
provider;
   and the individual has specifically agreed to the disclosure of the report
or information to any such person for that purpose; or
   (c) the report (not being a credit report) or information:
   (i) is disclosed to a person or body carrying on a business or undertaking
that involves the collection of debts on behalf of others; and
   (ii) is disclosed for the purpose of the collection of payments that are
overdue in respect of credit provided to the individual concerned by the
credit provider; and
   (iii) does not contain or include any personal information derived from a
credit report, other than:
   (A) information of a kind referred to in paragraph 18E(1)(a); and
   (B) information of a kind referred to in subparagraph 18E(1)(b)(vi), not
being information that relates to an overdue payment in respect of which a
note to the effect that the individual is no longer overdue in making the
payment has been included, under subsection 18F(4), in the credit information
file from which the credit report was prepared; and
   (C) information of a kind referred to in subparagraph 18E(1)(b)(viii) or
(ix); or
   (ca) the report (not being a credit report) or information:
   (i) is disclosed to a person or body carrying on a business or undertaking
that involves the collection of debts on behalf of others; and
   (ii) is disclosed for the purpose of the collection of payments that are
overdue in respect of commercial credit provided to a person by the credit
provider; and
   (iii) does not contain or include any personal information derived from a
credit report, other than information of a kind referred to in paragraph
18E(1)(a) or subparagraph 18E (1)(b)(viii) or (ix); or
   (d) where the credit provider is a corporation--the report or information
is disclosed to a corporation that is related to the credit provider; or
   (e) the report or information is disclosed to a corporation (including the
professional legal advisers or professional financial advisers of that
corporation) that proposes to use the report or information:
   (i) in the process of considering whether to:
   (A) accept an assignment of a debt owed to the credit provider; or
   (B) accept a debt owed to the credit provider as security for a loan to the
credit provider; or
   (C) purchase an interest in the credit provider (including, in a case where
the credit provider is a corporation, a corporation that is related to the
credit provider); or
   (ii) in connection with exercising rights arising from any acceptance or
purchase of a kind referred to in subparagraph (i); or
   (f) the report or information is disclosed to a person who manages loans
made by the credit provider, for use in managing those loans; or
   (fa) the report or information is disclosed to another credit provider in
the following circumstances:
   (i) the credit provider and the other credit provider have each provided to
the individual concerned mortgage credit in respect of which the same real
property forms all or part of the security;
   (ii) the individual is at least 60 days overdue in making a payment in
respect of the mortgage credit provided by either credit provider;
   (iii) the disclosure is for the purpose of either credit provider deciding
what action to take in relation to the overdue payment; or
   (g) disclosure of the report or information to that other person for the
particular purpose is required or authorised by or under law; or
   (ga) the report or information is disclosed to:
   (i) the individual; or
   (ii) a person (other than a credit provider, mortgage insurer or trade
insurer) authorised, in writing, by the individual to seek access to the
report or information; or
   (gb) the report or information is disclosed in the following circumstances:
   (i) the individual concerned maintains an account with the credit provider;
   (ii) the report or information relates to the operation of the account;
   (iii) the report or information is disclosed to another person who is
authorised by the individual to operate the account;
   (iv) either:
   (A) the report or information contains no information about the credit
worthiness, credit standing, credit history or credit capacity of the
individual concerned, other than basic transaction information; or
   (B) the disclosure takes place in the ordinary course of the other person
operating the account in the way authorised by the individual concerned; or
   (h) the credit provider believes on reasonable grounds that the individual
concerned has committed a serious credit infringement and the report or
information is given to another credit provider or a law enforcement
authority.
   (1A) For the purposes of paragraph (1)(b), the individual's agreement to
the disclosure of the report or information to another credit provider:
   (a) must be in writing unless:
   (i) the disclosure is sought for the purpose of assessing an application
for credit or commercial credit that was initially made orally; and
   (ii) the application has not yet been made in writing; and
   (b) must be given to:
   (i) the credit provider with possession or control of the report or
information; or
   (ii) the other credit provider.
   (1B) For the purposes of paragraphs (1)(bg) and (bh), the individual's
agreement to the disclosure of the report or information must be in writing
unless:
   (a) the disclosure relates to an application for a loan that was initially
made orally; and
   (b) the application has not yet been made in writing.
   (1C) Paragraph (1)(ga) does not affect the operation of paragraph (1)(g) in
relation to an individual obtaining access to credit report under section 18H.
   (1D) For the purposes of paragraph (1)(gb), basic transaction information
is any one or more of the following:
   (a) the account balance;
   (b) the amount of available credit in relation to the account;
   (c) the minimum payment (if any) due on the account;
   (d) information relating to transactions on the account by the other
person.
   (2) A credit provider that knowingly or recklessly contravenes subsection
(1) is guilty of an offence punishable, on conviction, by a fine not exceeding
$150,000.
   (3) A credit provider that is or has been in possession or control of a
credit report, or a report containing personal information derived from a
credit report, must not:
   (a) disclose the report to another person unless all personal information
concerning individuals that is not information of a kind referred to in
subsection 18E(1) has been deleted from the report; or
   (b) disclose to another person any personal information derived from the
report if the information is not information of a kind referred to in
subsection 18E(1).
   (4) References in subsection (3) to information that is not information of
a kind referred to in subsection 18E(1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K(3), not to be in contravention of subsection 18K(2).
   (5) The Commissioner may determine, in writing, the manner in which a
report or personal information derived from a report may, under subsection
(1), be disclosed (including the manner in which an individual's agreement may
be obtained for the purposes of paragraph (1)(b)).
   (6) Where the Commissioner so determines, a report or information that is
disclosed in a manner contrary to the determination is to be taken, except for
the purposes of subsection (2), to have been disclosed contrary to subsection
(1).
   (7) A determination is to be made by notice published in the Gazette.
   (8) A notice so published is a disallowable instrument for the purposes of
section 46A of the Acts Interpretation Act 1901 .
   (9) In this section, unless the contrary intention appears:
  "report" means:
   (a) a credit report; or
   (b) subject to subsection (10), any other record or information, whether in
a written, oral or other form, that has any bearing on an individual's credit
worthiness, credit standing, credit history or credit capacity;
   but does not include a credit report or any other record or information in
which the only personal information relating to individuals is publicly
available information.
   (10) For the purposes of the application of this section to a credit
provider that is not a corporation, a record or information (other than a
credit report) is not taken to be a report for the purposes of this section
unless it is being or has been prepared by or for a corporation.
  


PRIVACY ACT 1988 - SECT 18NA Disclosure by credit providers to
certain persons who gave indemnities
  
  
  
   In respect of a disclosure by a credit provider of a report or information
to a person who, on or after 7 December 1992 and before the commencement of
this section, gave an indemnity against the default of a borrower in making a
payment in respect of a loan given by the credit provider, subparagraph
18N(1)(bg)(ii) has effect as if the reference in sub-subparagraph
18N(1)(bg)(ii)(A) to the commencement of paragraph 18N(1)(bg) were a reference
to the commencement of this section.
  


PRIVACY ACT 1988 - SECT 18P Limits on use or disclosure by
mortgage insurers or trade insurers of personal information contained
in credit reports
  
  
  
   (1) A mortgage insurer that is or has been in possession or control of a
credit report must not use the report or any personal information derived from
the report for any purpose other than:
   (a) assessing whether to provide insurance to, or the risk of providing
insurance to, a credit provider in respect of mortgage credit given by the
credit provider to the individual concerned or applied for by the individual
concerned to the credit provider; or
   (b) assessing the risk of the individual concerned defaulting on mortgage
credit in respect of which the mortgage insurer has provided insurance to a
credit provider; or
   (ba) assessing the risk of the individual concerned being unable to meet a
liability that might arise under a guarantee entered into, or proposed to be
entered into, in respect of mortgage credit given by the credit provider to
another person; or
   (c) any purpose arising under the contract for mortgage insurance that has
been entered into between a credit provider and the mortgage insurer;
   unless use of the report or information for that other purpose is required
or authorised by or under law.
   (2) A trade insurer that is or has been in possession or control of a
credit report must not use the report or any personal information derived from
the report for any purpose other than assessing:
   (a) whether to provide insurance to, or the risk of providing insurance to,
a credit provider in respect of commercial credit given by the credit provider
to another person; or
   (b) the risk of a person defaulting on commercial credit in respect of
which the trade insurer has provided insurance to a credit provider;
   unless use of the report or information for that other purpose is required
or authorised by or under law.
   (3) A mortgage insurer or trade insurer that is or has been in possession
or control of a credit report must not:
   (a) use the report unless all personal information concerning individuals
that is not information of a kind referred to in subsection 18E(1) has been
deleted from the report; or
   (b) use any personal information derived from the report if the information
is not information of a kind referred to in subsection 18E(1).
   (4) References in subsection (3) to information that is not information of
a kind referred to in subsection 18E(1) do not include references to
information the disclosure of which is taken, because of the application of
subsection 18K(3), not to be in contravention of subsection 18K(2).
   (5) A mortgage insurer or trade insurer that is or has been in possession
or control of a credit report must not disclose the report or any personal
information derived from the report to another person for any purpose unless
disclosure of the report or information to that other person for that purpose
is required or authorised by or under law.
   (6) A mortgage insurer or trade insurer that knowingly or recklessly
contravenes subsection (1), (2) or (5) is guilty of an offence punishable, on
conviction, by a fine not exceeding $150,000.
   (7) A reference in this section (other than subsection (3)) to a credit
report is taken to include a reference to a report or information disclosed to
a mortgage insurer under paragraph 18N(1)(bb).
  


PRIVACY ACT 1988 - SECT 18Q Limits on use by certain persons of
personal information obtained from credit providers
  
  
  
   (1) A corporation that has obtained a report or information under paragraph
18N(1)(d) must not:
   (a) use the report or information, or any personal information derived from
the report or information, otherwise than for a purpose for which, or in
circumstances under which, a credit provider would be permitted under section
18L to use the report or information; or
   (b) disclose the report or information, or any personal information derived
from the report or information, to another person otherwise than for a purpose
for which, or in circumstances under which, a credit provider would be
permitted under section 18N to disclose the report or information to another
person.
   (2) A corporation that has obtained a report or information under paragraph
18N(1)(e) must not use the report or information, or any personal information
derived from the report or information, for any purpose other than:
   (a) for use in the process of considering whether to:
   (i) accept an assignment of a debt owed to the credit provider from whom
the report or information was obtained; or
   (ii) accept a debt owed to the credit provider as security for a loan to
the credit provider; or
   (iii) purchase an interest in the credit provider (including, where the
credit provider is a corporation, a corporation that is related to the credit
provider); or
   (b) for use in connection with exercising rights arising from any
acceptance or purchase of a kind referred to in paragraph (a).
   (3) A professional legal adviser or professional financial adviser of a
corporation who has obtained a report or information under paragraph 18N(1)(e)
must not use the report or information, or any personal information derived
from the report or information, for any purpose other than use by the person,
in his or her capacity as such a professional legal or financial adviser, in
connection with advising the corporation:
   (a) whether to accept an assignment of a debt owed to the credit provider
from whom the report or information was obtained; or
   (b) whether to accept a debt owed to the credit provider as a security for
a loan to the credit provider; or
   (c) whether to purchase an interest in the credit provider (including, in a
case where the credit provider is a corporation, a corporation that is related
to the credit provider);
   (d) in connection with exercising rights arising from any acceptance or
purchase of a kind referred to in paragraph (a), (b) or (c);
   unless use of the report or information, or the information so derived, is
required or authorised by or under law.
   (4) A person who has obtained a report or information under paragraph
18N(1)(f) must not use the report or information, or any personal information
derived from the report or information, for any purpose other than use by the
person in managing loans made by the credit provider from whom the person
obtained the report or information, unless use of the report or information,
or the information so derived, for that other purpose is required or
authorised by or under law.
   (5) A person who has obtained a report or information under paragraph
18N(1)(e) or (f) must not disclose the report or information, or any personal
information derived from the report or information, to another person unless
disclosure of the report or information, or the information so derived, is
required or authorised by or under law.
   (6) If:
   (a) a person was, because of the application of subsection 11B(4B), a
credit provider in relation to a loan; and
   (b) the person has ceased to be such a credit provider in relation to the
loan; and
   (c) the person had, while such a credit provider in relation to the loan,
obtained possession or control of a credit report;
   the person must not use the report, or any personal information derived
from the report, otherwise than for a purpose for which, or in circumstances
under which, a credit provider would be permitted under section 18L to use the
report or information.
   (7) Subject to subsection (7A), if:
   (a) a person was, because of the application of subsection 11B(4B), a
credit provider in relation to a loan; and
   (b) the person has ceased to be such a credit provider in relation to the
loan; and
   (c) the person had, while such a credit provider in relation to the loan,
obtained possession or control of a report (within the meaning of subsection
18N(9));
   the person must not disclose the report, or any personal information
derived from the report, to another person otherwise than for the purposes for
which, or in circumstances under which, a credit provider would be permitted
under section 18N to disclose the report or information to another person.
   (7A) For the purposes of the application of subsection (7) to a person
other than a corporation, a record or information (other than a credit report)
is not taken to be a report for the purposes of that subsection unless it is
being or has been prepared by or for a corporation.
   (8) In spite of anything in this section to the contrary, this section does
not impose any obligations on a person in relation to a report or information
obtained under paragraph 18N(1)(e) or (f), or in relation to any personal
information derived from such a report or information, unless:
   (a) the person is a corporation; or
   (b) the credit provider from whom the person obtained the report or
information is a corporation.
   (9) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $30,000.
  


PRIVACY ACT 1988 - SECT 18R False or misleading credit reports
  
  
   (1) A credit reporting agency or credit provider must not give to any other
person or body (whether or not the other person or body is a credit reporting
agency or credit provider) a credit report that contains false or misleading
information.
   (2) A credit reporting agency or credit provider that knowingly or
recklessly contravenes subsection (1) is guilty of an offence punishable, on
conviction, by a fine not exceeding $75,000.
  


PRIVACY ACT 1988 - SECT 18S Unauthorised access to credit
information files or credit reports
  
  
  
   (1) A person must not obtain access to an individual's credit information
file in the possession or control of a credit reporting agency unless the
access is authorised by this Act.
   (2) A person must not obtain access to a credit report in the possession or
control of a credit provider or credit reporting agency unless:
   (a) the person is given the report in accordance with this Act; or
   (b) the access is otherwise authorised by this Act.
   (3) A person who knowingly or recklessly contravenes this section is guilty
of an offence punishable, on conviction, by a fine not exceeding $30,000.
  


PRIVACY ACT 1988 - SECT 18T Obtaining access to credit information
files or credit reports by false pretences
  
  
  
   (1) A person must not, by a false pretence, obtain access to an
individual's credit information file in the possession or control of a credit
reporting agency.
   Penalty: $30,000.
   (2) A person must not, by a false pretence, obtain access to a credit
report in the possession or control of a credit provider or credit reporting
agency.
   Penalty: $30,000.
  


PRIVACY ACT 1988 - SECT 18U Application of section 4B of Crimes
Act
  
  
   Subsection 4B(3) of the Crimes Act 1914 does not apply in relation to an
offence against subsection 18K(4), 18L(2), 18N(2) or 18R(2) or section 18P.
  


PRIVACY ACT 1988 - SECT 18V Application of this Part
  
  
   (1) Subject to this section, this Part applies in relation to any credit
information file, any credit report or any report of a kind referred to in
section 18N, in existence on or after the commencement of this section,
whether or not it was in existence before that commencement.
   (2) Paragraph 18E(8)(c) does not apply in relation to information acquired
by a credit provider before 25 February 1992.
   (3) Section 18F applies in relation to personal information that was,
immediately before 25 February 1992, contained in an individual's credit
information file as if the references to the days mentioned in the paragraphs
of subsection 18F(2) were all references to 25 February 1992.
  


PRIVACY ACT 1988 - Part IV--Privacy Commissioner
  
  
  


PRIVACY ACT 1988 - Division 1--Privacy Commissioner
  
  
  


PRIVACY ACT 1988 - SECT 19 Privacy Commissioner
  
  
   (1) There shall be a Privacy Commissioner, who shall be appointed by the
Governor-General.
   (2) A person is not qualified to be appointed as the Privacy Commissioner
unless the Governor-General is satisfied that the person has appropriate
qualifications, knowledge or experience.
  


PRIVACY ACT 1988 - SECT 20 Terms and conditions of appointment
  
  
   (1) Subject to this section, the Commissioner holds office for such period,
not exceeding 7 years, as is specified in the instrument of the person's
appointment, but is eligible for re-appointment.
   (2) A person who has reached 65 years shall not be appointed as the
Commissioner, and a person shall not be appointed as the Commissioner for a
period extending beyond the day on which the person will reach 65 years.
   (3) The Commissioner holds office on such terms and conditions (if any) in
respect of matters not provided for by this Act as are determined by the
Governor-General.
  


PRIVACY ACT 1988 - SECT 21 Remuneration of Commissioner
  
  
   (1) The Commissioner shall be paid such remuneration as is determined by
the Remuneration Tribunal, but, if no determination of that remuneration by
the Tribunal is in operation, the Commissioner shall be paid such remuneration
as is prescribed.
   (2) The Commissioner shall be paid such allowances as are prescribed.
   (3) This section has effect subject to the Remuneration Tribunal Act 1973.
  


PRIVACY ACT 1988 - SECT 22 Leave of absence
  
  
   (1) Subject to section 87E of the Public Service Act 1922 , the
Commissioner has such recreation leave entitlements as are determined by the
Remuneration Tribunal.
   (2) The Minister may grant the Commissioner leave of absence, other than
recreation leave, on such terms and conditions as to remuneration or otherwise
as the Minister determines.
  


PRIVACY ACT 1988 - SECT 23 Outside employment
  
  
   Except with the approval of the Minister, the Commissioner shall not engage
in paid employment outside the duties of the office of Commissioner.
  


PRIVACY ACT 1988 - SECT 24 Resignation
  
  
   The Commissioner may resign from the office of Commissioner by delivering
to the Governor-General a signed notice of resignation.
  


PRIVACY ACT 1988 - SECT 25 Termination of appointment
  
  
   (1) The Governor-General may terminate the appointment of the Commissioner
by reason of misbehaviour or physical or mental incapacity.
   (2) The Governor-General shall terminate the appointment of the
Commissioner if the Commissioner:
   (a) becomes bankrupt, applies to take the benefit of any law for the relief
of bankrupt or insolvent debtors, compounds with creditors or makes an
assignment of remuneration for their benefit;
   (b) is absent from duty, except on leave of absence, for 14 consecutive
days or for 28 days in any period of 12 months; or
   (c) contravenes section 23.
  


PRIVACY ACT 1988 - SECT 26 Acting Commissioner
  
  
   The Minister may appoint a person to act as Commissioner:
   (a) during a vacancy in the office of Commissioner, whether or not an
appointment has previously been made to the office; or
   (b) during any period, or during all periods, when the Commissioner is
absent from duty or from Australia, or is, for any other reason, unable to
perform the functions of the office of Commissioner;
   but a person appointed to act during a vacancy shall not continue so to act
for more than 12 months.
  


PRIVACY ACT 1988 - Division 2--Functions of Commissioner
  
  
  


PRIVACY ACT 1988 - SECT 27 Functions of Commissioner in relation to
interferences with privacy
  
  
  
   (1) Subject to this Part, the Commissioner has the following functions:
   (a) to investigate an act or practice of an agency that may breach an
Information Privacy Principle and, where the Commissioner considers it
appropriate to do so, to endeavour, by conciliation, to effect a settlement of
the matters that gave rise to the investigation;
   (b) to examine (with or without a request from a Minister) a proposed
enactment that would require or authorise acts or practices of an agency that
might, in the absence of the enactment, be interferences with the privacy of
individuals or which may otherwise have any adverse effects on the privacy of
individuals and to ensure that any adverse effects of such proposed enactment
on the privacy of individuals are minimised;
   (c) to undertake research into, and to monitor developments in, data
processing and computer technology (including data-matching and data-linkage)
to ensure that any adverse effects of such developments on the privacy of
individuals are minimised, and to report to the Minister the results of such
research and monitoring;
   (d) to promote an understanding and acceptance of the Information Privacy
Principles and of the objects of those Principles;
   (e) to prepare, and to publish in such manner as the Commissioner considers
appropriate, guidelines for the avoidance of acts or practices of an agency
that may or might be interferences with the privacy of individuals or which
may otherwise have any adverse effects on the privacy of individuals;
   (f) to provide advice (with or without a request) to a Minister or an
agency on any matter relevant to the operation of this Act;
   (g) to maintain, and to publish annually, a record (to be known as the
Personal Information Digest) of the matters set out in records maintained by
record-keepers in accordance with clause 3 of Information Privacy Principle 5;
   (h) to conduct audits of records of personal information maintained by
agencies for the purpose of ascertaining whether the records are maintained
according to the Information Privacy Principles;
   (j) whenever the Commissioner thinks it necessary, to inform the Minister
of action that needs to be taken by an agency in order to achieve compliance
by the agency with the Information Privacy Principles;
   (k) to examine (with or without a request from a Minister) a proposal for
data matching or data linkage that may involve an interference with the
privacy of individuals or which may otherwise have any adverse effects on the
privacy of individuals and to ensure that any adverse effects of such proposal
on the privacy of individuals are minimised;
   (m) for the purpose of promoting the protection of individual privacy, to
undertake educational programs on the Commissioner's own behalf or in
co-operation with other persons or authorities acting on behalf of the
Commissioner;
   (n) to encourage corporations to develop programs for the handling of
records of personal information that are consistent with the Guidelines on the
Protection of Privacy and Transborder Flows of Personal Data issued by the
Organisation for Economic Co-operation and Development;
   (o) to do anything incidental or conducive to the performance of any of the
preceding functions;
   (p) to issue guidelines under the Data-matching Program (Assistance and
Tax) Act 1990;
   (pa) to issue guidelines under section 135AA of the National Health Act
1953;
   (q) to monitor and report on the adequacy of equipment and user safeguards;
   (r) may, and if requested to do so, shall make reports and recommendations
to the Minister in relation to any matter that concerns the need for or the
desirability of legislative or administrative action in the interests of the
privacy of individuals.
   (2) The Commissioner has power to do all things that are necessary or
convenient to be done for or in connection with the performance of his or her
functions under subsection (1).
  


PRIVACY ACT 1988 - SECT 28 Functions of Commissioner in relation to
tax file numbers
  
  
   (1) In addition to the functions under sections 27 and 28A, the
Commissioner has the following functions in relation to tax file numbers:
   (a) to issue guidelines under section 17;
   (b) to investigate acts or practices of file number recipients that may
breach guidelines issued under section 17;
   (c) to investigate acts or practices that may involve unauthorised requests
or requirements for the disclosure of tax file numbers;
   (d) to examine the records of the Commissioner of Taxation to ensure that:
   (i) he or she is not using tax file number information for purposes beyond
his or her powers; and
   (ii) he or she is taking adequate measures to prevent the unlawful
disclosure of the tax file number information that he or she holds;
   (e) to conduct audits of records of tax file number information maintained
by file number recipients for the purpose of ascertaining whether the records
are maintained according to any relevant guidelines issued under section 17;
   (f) to evaluate compliance with guidelines issued under section 17;
   (g) to provide advice (with or without a request) to file number recipients
on their obligations under the Taxation Administration Act 1953 with regard to
the confidentiality of tax file number information and on any matter relevant
to the operation of this Act;
   (h) to monitor the security and accuracy of tax file number information
kept by file number recipients;
   (j) to do anything incidental or conducive to the performance of any of the
preceding functions.
   (2) The Commissioner has power to do all things that are necessary or
convenient to be done for or in connection with the performance of his or her
functions under subsection (1).
  


PRIVACY ACT 1988 - SECT 28A Functions of Commissioner in relation
to credit reporting
  
  
   (1) In addition to the functions under sections 27 and 28, the Commissioner
has the following functions in relation to credit reporting:
   (a) to develop the Code of Conduct in consultation with government,
commercial, consumer and other relevant bodies and organisations;
   (b) to investigate an act or practice of a credit reporting agency or
credit provider that may constitute a credit reporting infringement and, where
the Commissioner considers it appropriate to do so, to endeavour, by
conciliation, to effect a settlement of the matters that gave rise to the
investigation;
   (c) to promote an understanding and acceptance of:
   (i) the Code of Conduct and the provisions of Part IIIA; and
   (ii) the objects of those provisions;
   (d) to make such determinations as the Commissioner is empowered to make
under section 11B or Part IIIA; and
   (e) to prepare, and to publish in such manner as the Commissioner considers
appropriate, guidelines for the avoidance of acts or practices of a credit
reporting agency or credit provider that may or might be interferences with
the privacy of individuals;
   (f) to provide advice (with or without a request) to a Minister, a credit
reporting agency or a credit provider on any matter relevant to the operation
of this Act;
   (g) to conduct audits of credit information files maintained by credit
reporting agencies, and credit reports in the possession, or under the
control, of credit providers or credit reporting agencies, for the purpose of
ascertaining whether the files or reports are maintained in accordance with
the Code of Conduct and the provisions of Part IIIA;
   (h) to monitor the security and accuracy of personal information contained
in credit information files maintained by credit reporting agencies and in
credit reports in the possession, or under the control, of credit providers or
credit reporting agencies;
   (j) to examine the records of credit reporting agencies and credit
providers to ensure that:
   (i) credit reporting agencies and credit providers are not using personal
information contained in credit information files and credit reports for
unauthorised purposes; and
   (ii) credit reporting agencies and credit providers are taking adequate
measures to prevent the unlawful disclosure of personal information contained
in credit information files and credit reports;
   (k) for the purpose of promoting the protection of individual privacy, to
undertake educational programs on the Commissioner's own behalf or in
co-operation with other persons or authorities on the Commissioner's behalf;
   (m) to do anything incidental or conducive to the performance of any of the
preceding functions.
   (2) The Commissioner has power to do all things that are necessary or
convenient to be done for or in connection with the performance of his or her
functions under subsection (1).
  


PRIVACY ACT 1988 - SECT 29 Commissioner to have regard to certain
matters
  
  
   In the performance of his or her functions, and the exercise of his or her
powers, under this Act, the Commissioner shall:
   (a) have due regard for the protection of important human rights and social
interests that compete with privacy, including the general desirability of a
free flow of information and the recognition of the right of government and
business to achieve their objectives in an efficient way;
   (b) take account of:
   (i) international obligations accepted by Australia, including those
concerning the international technology of communications; and
   (ii) developing general international guidelines relevant to the better
protection of individual privacy;
   (c) ensure that his or her recommendations and guidelines are, within the
limitations of the powers of the Commonwealth, capable of acceptance,
adaptation and extension throughout Australia; and
   (d) ensure that his or her directions and guidelines are consistent with:
   (i) the Information Privacy Principles; and
   (ii) (where applicable) the Code of Conduct and the provisions of Part
IIIA.
  


PRIVACY ACT 1988 - Division 3--Reports by Commissioner
  
  
  


PRIVACY ACT 1988 - SECT 30 Reports following investigation of act
or practice
  
  
   (1) Where the Commissioner has investigated an act or practice without a
complaint having been made under section 36, the Commissioner may report to
the Minister about the act or practice, and shall do so:
   (a) if so directed by the Minister; or
   (b) if the Commissioner:
   (i) thinks that the act or practice is an interference with the privacy of
an individual; and
   (ii) has not considered it appropriate to endeavour to effect a settlement
of the matters that gave rise to the investigation or has endeavoured without
success to effect such a settlement.
   (2) Where the Commissioner reports under subsection (1) about an act done
in accordance with a practice, the Commissioner shall also report to the
Minister about the practice.
   (3) Where, after an investigation under paragraph 27(1)(a), 28(1)(b) or (c)
or 28A(1)(b) of an act or practice of an agency, file number recipient, credit
reporting agency or credit provider, the Commissioner is required by virtue of
paragraph (1)(b) of this section to report to the Minister about the act or
practice, the Commissioner:
   (a) shall set out in the report his or her findings and the reasons for
those findings;
   (b) may include in the report any recommendations by the Commissioner for
preventing a repetition of the act or a continuation of the practice;
   (c) may include in the report any recommendation by the Commissioner for
either or both of the following:
   (i) the payment of compensation in respect of a person who has suffered
loss or damage as a result of the act or practice;
   (ii) the taking of other action to remedy or reduce loss or damage suffered
by a person as a result of the act or practice;
   (d) shall serve a copy of the report on the agency, file number recipient,
credit reporting agency or credit provider concerned and the Minister (if any)
responsible for the agency, recipient, credit reporting agency or credit
provider; and
   (e) may serve a copy of the report on any person affected by the act or
practice.
   (4) Where, at the end of 60 days after a copy of a report about an act or
practice of an agency, file number recipient, credit reporting agency or
credit provider was served under subsection (3), the Commissioner:
   (a) still thinks that the act or practice is an interference with the
privacy of an individual; and
   (b) is not satisfied that reasonable steps have been taken to prevent a
repetition of the act or a continuation of the practice;
   the Commissioner shall give to the Minister a further report that:
   (c) incorporates the first-mentioned report and any document that the
Commissioner has received, in response to the first-mentioned report, from the
agency, file number recipient, credit reporting agency or credit provider;
   (d) states whether, to the knowledge of the Commissioner, any action has
been taken as a result of the findings, and recommendations (if any), set out
in the first-mentioned report and, if so, the nature of that action; and
   (e) states why the Commissioner is not satisfied that reasonable steps have
been taken to prevent a repetition of the act or a continuation of the
practice;
   and shall serve a copy of the report on the Minister (if any) responsible
for the agency, recipient, credit reporting agency or credit provider.
   (5) The Minister shall cause a copy of a report given to the Minister under
subsection (4) to be laid before each House of the Parliament within 15
sitting days of that House after the report is received by the Minister.
  


PRIVACY ACT 1988 - SECT 31 Report following examination of proposed
enactment
  
  
   (1) Where the Commissioner has examined a proposed enactment under
paragraph 27(1)(b), subsections (2) and (3) of this section have effect.
   (2) If the Commissioner thinks that the proposed enactment would require or
authorise acts or practices of an agency that would be interferences with the
privacy of individuals, the Commissioner shall:
   (a) report to the Minister about the proposed enactment; and
   (b) include in the report any recommendations he or she wishes to make for
amendment of the proposed enactment to ensure that it would not require or
authorise such acts or practices.
   (3) Otherwise, the Commissioner may report to the Minister about the
proposed enactment, and shall do so if so directed by the Minister.
   (4) Where the Privacy Commissioner is of the belief that it is in the
public interest that the proposed enactment should be the subject of a further
report, the Commissioner may give to the Minister a further report setting out
the Commissioner's reasons for so doing.
   (5) The Minister shall cause a copy of a report given under subsection (4)
to be laid before each House of the Parliament as soon as practicable, and no
later than 15 sitting days of that House, after the report is received by the
Minister.
  


PRIVACY ACT 1988 - SECT 32 Report following monitoring of certain
activities
  
  
   (1) Where the Commissioner, in the performance of the function referred to
in paragraph 27(1)(c), (h), (j), (k), (m) or (r), 28(1)(e), (f) or (h) or
28A(1)(g), (h), (j) or (k), has monitored an activity or conducted an audit,
the Commissioner may report to the Minister about that activity or audit, and
shall do so if so directed by the Minister.
   (2) Where the Privacy Commissioner is of the belief that it is in the
public interest that the activity should be the subject of a further report,
the Commissioner may give to the Minister a further report setting out the
Commissioner's reasons for so doing.
   (3) The Minister shall cause a copy of a report given under subsection (2)
to be laid before each House of the Parliament as soon as practicable, and no
later than 15 sitting days of that House, after the report is received by the
Minister.
  


PRIVACY ACT 1988 - SECT 33 Exclusion of certain matters from
reports
  
  
   (1) In setting out findings, opinions and reasons in a report to be given
under section 30, 31 or 32, the Commissioner may exclude a matter if the
Commissioner considers it desirable to do so having regard to the obligations
of the Commissioner under subsections (2) and (3).
   (2) In deciding under subsection (1) whether or not to exclude matter from
a report, the Commissioner shall have regard to the need to prevent:
   (a) prejudice to the security, defence or international relations of
Australia;
   (b) prejudice to relations between the Commonwealth Government and the
Government of a State or between the Government of a State and the Government
of another State;
   (c) the disclosure of deliberations or decisions of the Cabinet, or of a
Committee of the Cabinet, of the Commonwealth or of a State;
   (d) the disclosure of deliberations or advice of the Federal Executive
Council or the Executive Council of a State;
   (da) the disclosure of the deliberations or decisions of the Australian
Capital Territory Executive or of a committee of that Executive;
   (e) the disclosure, or the ascertaining by a person, of the existence or
identity of a confidential source of information in relation to the
enforcement of the criminal law;
   (f) the endangering of the life or safety of any person;
   (g) prejudice to the proper enforcement of the law or the protection of
public safety;
   (h) the disclosure of information the disclosure of which is prohibited,
absolutely or subject to qualifications, by or under another enactment;
   (j) the unreasonable disclosure of the personal affairs of any person; and
   (k) the unreasonable disclosure of confidential commercial information.
   (3) The Commissioner shall try to achieve an appropriate balance between
meeting the need referred to in subsection (2) and the desirability of
ensuring that interested persons are sufficiently informed of the results of
the Commissioner's investigation, examination or monitoring.
   (4) Where the Commissioner excludes a matter from a report, he or she shall
give to the Minister a report setting out the excluded matter and his or her
reasons for excluding the matter.
  


PRIVACY ACT 1988 - Division 4--Miscellaneous
  
  
  


PRIVACY ACT 1988 - SECT 34 Provisions relating to documents exempt
under the Freedom of Information Act 1982
  
  
  
   (1) The Commissioner shall not, in connection with the performance of the
functions referred to in section 27, give to a person information as to the
existence or non-existence of a document where information as to the existence
or non-existence of that document would, if included in a document of an
agency, cause the last-mentioned document to be an exempt document by virtue
of section 33 or 33A, or subsection 37(1), of the Freedom of Information Act
1982 .
   (2) The Commissioner shall not, in connection with the performance of the
functions referred to in section 27, give to a person information:
   (a) about the contents of a document of an agency, or the contents of an
official document of a Minister, being a document that is an exempt document;
or
   (b) about exempt matter contained in a document of an agency or in an
official document of a Minister.
   (3) An expression used in this section and in the Freedom of Information
Act 1982 has the same meaning in this section as in that Act.
  


PRIVACY ACT 1988 - SECT 35 Direction where refusal or failure to
amend exempt document
  
  
   (1) Where:
   (a) an application made under subsection 55(1) of the Freedom of
Information Act 1982 for review of a decision under that Act refusing access
to a document has been finally determined or otherwise disposed of;
   (b) the period within which an appeal may be made to the Federal Court has
expired or, if such an appeal has been instituted, the appeal has been
determined;
   (c) the effect of the review and any appeal is that access is not to be
given to the document;
   (d) the applicant has requested the agency concerned to amend the document;
   (e) the applicant has complained to the Commissioner under this Act about
the refusal or failure of the agency to amend the document;
   (f) the Commissioner has, as a result of the complaint, recommended under
subsection 30(3) of this Act that the agency amend the document, or amend a
part of the document, to which the applicant has been refused access; and
   (g) as at the end of 60 days after a copy of the report containing the
recommendation was served on the agency, the Commissioner:
   (i) still thinks that the agency should amend the document in a particular
manner; and
   (ii) is not satisfied that the agency has amended the document in that
manner;
   the Commissioner may direct the agency to add to the document an
appropriate notation setting out particulars of the amendments of the document
that the Commissioner thinks should be made.
   (2) An agency shall comply with a direction given in accordance with
subsection (1).
   (3) In subsection (1),"amend" , in relation to a document, means amend by making a correction,
deletion or addition.
   (4) An expression used in this section and in the Freedom of Information
Act 1982 has the same meaning in this section as in that Act.
  


PRIVACY ACT 1988 - Part V--Investigations
  
  
  


PRIVACY ACT 1988 - Division 1--Investigation of Complaints and
Investigations on the Commissioner's Initiative
  
  
  
  



PRIVACY ACT 1988 - SECT 36 Complaints
  
  
   (1) An individual may complain to the Privacy Commissioner about an act or
practice that may be an interference with the privacy of the individual.
   (2) In the case of an act or practice that may be an interference with the
privacy of 2 or more individuals, any one of those individuals may make a
complaint under subsection (1) on behalf of all of the individuals.
   (2A) In the case of a representative complaint, this section has effect
subject to section 38.
   (3) A complaint shall be in writing.
   (4) It is the duty of:
   (a) members of the staff of the Human Rights and Equal Opportunity
Commission; and
   (b) members of the staff of the Ombudsman who have had powers of the
Commissioner delegated to them under section 99;
   to provide appropriate assistance to a person who wishes to make a
complaint and requires assistance to formulate the complaint.
   (5) The complaint shall specify the respondent to the complaint.
   (6) In the case of a complaint about an act or practice of an agency:
   (a) if the agency is an individual or a body corporate, the agency shall be
the respondent; and
   (b) if the agency is an unincorporated body, the principal executive of the
agency shall be the respondent.
   (7) In the case of a complaint about an act or practice of a person other
than an agency, that person shall be the respondent.
  


PRIVACY ACT 1988 - SECT 37 Principal executive of agency
  
  
   For the purposes of this Part, the principal executive of an agency of a
kind specified in column 1 of an item in the following table is the person
specified in column 2 of the item:
  

  
   Item
  
  
   Column 1
   Agency
  
   Column 2
   Principal executive
  
   1
  
   Department
  
   The Secretary of the Department
  
   2
  
   An unincorporated body, or a tribunal, referred to in paragraph (c) of the
definition of agency in subsection 6(1)
  
   The chief executive officer of the body or tribunal
  
   3
  
   A body referred to in paragraph (d) of the definition of "agency" in
subsection 6(1)
  
   The chief executive officer of the body
  
   4
  
  
   A federal court
  
   The registrar or principal registrar of the court or the person occupying
an equivalent office
  
   5
  
   The Australian Federal Police
  
   The Commissioner of Police
  
   6
  
   An eligible case manager that is an individual
  
   The individual
  
   7
  
   An eligible case manager that is not an individual
  
   The individual primarily responsible for the management of the eligible
case manager
  
  
  


PRIVACY ACT 1988 - SECT 38 Conditions for making a representative
complaint
  
  
   (1) A representative complaint may be lodged under section 36 only if:
   (a) the class members have complaints against the same person; and
   (b) all the complaints are in respect of, or arise out of, the same,
similar or related circumstances; and
   (c) all the complaints give rise to a substantial common issue of law or
fact.
   (2) A representative complaint under section 36 must:
   (a) describe or otherwise identify the class members; and
   (b) specify the nature of the complaints made on behalf of the class
members; and
   (c) specify the nature of the relief sought; and
   (d) specify the questions of law or fact that are common to the complaints
of the class members.
   In describing or otherwise identifying the class members, it is not
necessary to name them or specify how many there are.
   (3) A representative complaint may be lodged without the consent of class
members.
  


PRIVACY ACT 1988 - SECT 38A Commissioner may determine that a
complaint is not to continue as a representative complaint
  
  
  
   (1) The Commissioner may, on application by the respondent or on his or her
own initiative, determine that a complaint should no longer continue as a
representative complaint.
   (2) The Commissioner may only make such a determination if the Commissioner
is satisfied that it is in the interests of justice to do so for any of the
following reasons:
   (a) the costs that would be incurred if the complaint were to continue as a
representative complaint are likely to exceed the costs that would be incurred
if each class member lodged a separate complaint;
   (b) the representative complaint will not provide an efficient and
effective means of dealing with the complaints of the class members;
   (c) the complaint was not brought in good faith as a representative
complaint;
   (d) it is otherwise inappropriate that the complaints be pursued by means
of a representative complaint.
   (3) If the Commissioner makes such a determination:
   (a) the complaint may be continued as a complaint by the complainant on his
or her own behalf against the respondent; and
   (b) on the application of a person who was a class member for the purposes
of the former representative complaint, the Commissioner may join that person
as a complainant to the complaint as continued under paragraph (a).
  


PRIVACY ACT 1988 - SECT 38B Additional rules applying to the
determination of representative complaints
  
  
  
   (1) The Commissioner may, on application by a class member, replace the
complainant with another class member, where it appears to the Commissioner
that the complainant is not able adequately to represent the interests of the
class members.
   (2) A class member may, by notice in writing to the Commissioner, withdraw
from a representative complaint at any time before the Commissioner begins to
hold an inquiry into the complaint.
   (3) The Commissioner may at any stage direct that notice of any matter be
given to a class member or class members.
  


PRIVACY ACT 1988 - SECT 38C Amendment of representative complaints
  
  
   If the Commissioner is satisfied that a complaint could be dealt with as a
representative complaint if the class of persons on whose behalf the complaint
is lodged is increased, reduced or otherwise altered, the Commissioner may
amend the complaint so that the complaint can be dealt with as a
representative complaint.
  


PRIVACY ACT 1988 - SECT 39 Class member for representative complaint
not entitled to lodge individual complaint
  
  
  
   A person who is a class member for a representative complaint is not
entitled to lodge a complaint in respect of the same subject matter.
  


PRIVACY ACT 1988 - SECT 40 Investigations
  
  
   (1) The Commissioner shall investigate an act or practice if:
   (a) the act or practice may be an interference with the privacy of an
individual; and
   (b) a complaint about the act or practice has been made under section 36.
   (2) The Commissioner may investigate an act or practice if:
   (a) the act or practice may be an interference with the privacy of an
individual; and
   (b) the Commissioner thinks it is desirable that the act or practice be
investigated.
  


PRIVACY ACT 1988 - SECT 41 Circumstances in which Commissioner may
decide not to investigate or may defer investigation
  
  
  
   (1) The Commissioner may decide not to investigate, or not to investigate
further, an act or practice about which a complaint has been made under
section 36 if the Commissioner is satisfied that:
   (a) the act or practice is not an interference with the privacy of an
individual;
   (b) although a complaint has been made to the Commissioner about the act or
practice, the complainant has not complained to the respondent;
   (c) the complaint was made more than 12 months after the complainant became
aware of the act or practice;
   (d) the complaint is frivolous, vexatious, misconceived or lacking in
substance;
   (e) the act or practice is the subject of an application under another
Commonwealth enactment and the subject--matter of the complaint has been, or
is being, dealt with adequately under that enactment; or
   (f) the act or practice could be made the subject of an application under
another Commonwealth enactment for a more appropriate remedy.
   (2) The Commissioner may decide not to investigate, or not to investigate
further, an act or practice about which a complaint has been made under
section 36 if the Commissioner is satisfied that the complainant has
complained to the respondent about the act or practice and either:
   (a) the respondent has dealt, or is dealing, adequately with the complaint;
or
   (b) the respondent has not yet had an adequate opportunity to deal with the
complaint.
   (3) The Commissioner may defer the investigation or further investigation
of an act or practice about which a complaint has been made under section 36
if:
   (a) an application has been made by the respondent for a determination
under section 72 in relation to the act or practice; and
   (b) the Commissioner is satisfied that the interests of persons affected by
the act or practice would not be unreasonably prejudiced if the investigation
or further investigation were deferred until the application had been disposed
of.
   (4) Where an act or practice may be an interference with the privacy of an
individual solely because it may breach Information Privacy Principle 7, the
Commissioner shall not investigate the act or practice except to the extent
that it is an interference with the privacy of a person who is, or persons
each of whom is:
   (a) an Australian citizen; or
   (b) a person whose continued presence in Australia is not subject to a
limitation as to time imposed by law.
  


PRIVACY ACT 1988 - SECT 42 Preliminary inquiries
  
  
   Where a complaint has been made to the Commissioner, the Commissioner may,
for the purpose of determining:
   (a) whether the Commissioner has power to investigate the matter to which
the complaint relates; or
   (b) whether the Commissioner may, in his or her discretion, decide not to
investigate the matter;
   make inquiries of the respondent.
  


PRIVACY ACT 1988 - SECT 43 Conduct of investigations
  
  
   (1) Before commencing an investigation of a matter to which a complaint
relates, the Commissioner shall inform the respondent that the matter is to be
investigated.
   (2) An investigation under this Division shall be conducted in private but
otherwise in such manner as the Commissioner thinks fit.
   (3) The Commissioner may, for the purposes of an investigation, obtain
information from such persons, and make such inquiries, as he or she thinks
fit.
   (4) Subject to subsection (5), it is not necessary for a complainant or
respondent to be afforded an opportunity to appear before the Commissioner in
connection with an investigation under this Division.
   (5) The Commissioner shall not make a finding under section 52 that is
adverse to a complainant or respondent unless the Commissioner has afforded
the complainant or respondent an opportunity to appear before the Commissioner
and to make submissions, orally, in writing or both, in relation to the matter
to which the investigation relates.
   (6) Where the Commissioner affords an agency or person an opportunity to
appear before the Commissioner under subsection (5), the agency or person may,
with the approval of the Commissioner, be represented by another person.
   (7) Where, in connection with an investigation of a matter under this
Division, the Commissioner proposes to afford the complainant or respondent an
opportunity to appear before the Commissioner and to make submissions under
subsection (5), or proposes to make a requirement of a person under section
44, the Commissioner shall, if he or she has not previously informed the
responsible Minister (if any) that the matter is being investigated, inform
that Minister accordingly.
   (8) The Commissioner may, either before or after the completion of an
investigation under this Division, discuss any matter that is relevant to the
investigation with a Minister concerned with the matter.
   (9) Where the Commissioner forms the opinion, either before or after
completing an investigation under this Division, that there is evidence that
an officer of an agency has been guilty of a breach of duty or of misconduct
and that the evidence is, in all the circumstances, of sufficient force to
justify the Commissioner doing so, the Commissioner shall bring the evidence
to the notice of:
   (a) an appropriate officer of an agency; or
   (b) if the Commissioner thinks that there is no officer of an agency to
whose notice the evidence may appropriately be drawn--an appropriate Minister.
  


PRIVACY ACT 1988 - SECT 44 Power to obtain information and
documents
  
  
   (1) If the Commissioner has reason to believe that a person has information
or a document relevant to an investigation under this Division, the
Commissioner may give to the person a written notice requiring the person:
   (a) to give the information to the Commissioner in writing signed by the
person or, in the case of a body corporate, by an officer of the body
corporate; or
   (b) to produce the document to the Commissioner.
   (2) A notice given by the Commissioner under subsection (1) shall state:
   (a) the place at which the information or document is to be given or
produced to the Commissioner; and
   (b) the time at which, or the period within which, the information or
document is to be given or produced.
   (2A) If documents are produced to the Commissioner in accordance with a
requirement under subsection (1), the Commissioner:
   (a) may take possession of, and may make copies of, or take extracts from,
the documents; and
   (b) may retain possession of the documents for any period that is necessary
for the purposes of the investigation to which the documents relate; and
   (c) during that period must permit a person who would be entitled to
inspect any one or more of the documents if they were not in the
Commissioner's possession to inspect at all reasonable times any of the
documents that the person would be so entitled to inspect.
   (3) If the Commissioner has reason to believe that a person has information
relevant to an investigation under this Division, the Commissioner may give to
the person a written notice requiring the person to attend before the
Commissioner at a time and place specified in the notice to answer questions
relevant to the investigation.
   (4) This section is subject to sections 69 and 70 but it has effect
regardless of any other enactment.
   (5) A person is not liable to a penalty under the provisions of any other
enactment because he or she gives information, produces a document or answers
a question when required to do so under this Division.
  


PRIVACY ACT 1988 - SECT 45 Power to examine witnesses
  
  
   (1) The Commissioner may administer an oath or affirmation to a person
required under section 44 to attend before the Commissioner and may examine
such a person on oath or affirmation.
   (2) The oath or affirmation to be taken or made by a person for the
purposes of this section is an oath or affirmation that the answers the person
will give will be true.
  


PRIVACY ACT 1988 - SECT 46 Directions to persons to attend
compulsory conference
  
  
   (1) For the purposes of performing the Commissioner's functions in relation
to a complaint, the Commissioner may, by written notice, direct:
   (a) the complainant;
   (b) the respondent; and
   (c) any other person who, in the opinion of the Commissioner, is likely to
be able to provide information relevant to the matter to which the complaint
relates or whose presence at the conference is, in the opinion of the
Commissioner, likely to assist in connection with the performance of the
Commissioner's functions in relation to the complaint;
   to attend, at a time and place specified in the notice, a conference
presided over by the Commissioner.
   (2) A person who has been directed to attend a conference and, without
reasonable excuse:
   (a) fails to attend as required by the direction; or
   (b) fails to attend from day to day unless excused, or released from
further attendance, by the Commissioner;
   is guilty of an offence punishable on conviction:
   (c) in the case of an individual--by a fine not exceeding $1,000 or
imprisonment for a period not exceeding 6 months, or both; or
   (d) in the case of a body corporate--by a fine not exceeding $5,000.
   (3) A person who has been directed under subsection (1) to attend a
conference is entitled to be paid by the Commonwealth a reasonable sum for the
person's attendance at the conference.
   (4) The Commissioner may, in a notice given to a person under subsection
(1), require the person to produce such documents at the conference as are
specified in the notice.
  


PRIVACY ACT 1988 - SECT 47 Conduct of compulsory conference
  
  
   (1) The Commissioner may require a person attending a conference under this
Division to produce a document.
   (2) A conference under this Division shall be held in private and shall be
conducted in such manner as the Commissioner thinks fit.
   (3) A body of persons, whether corporate or unincorporate, that is directed
under section 46 to attend a conference shall be deemed to attend if a member,
officer or employee of that body attends on behalf of that body.
   (4) Except with the consent of the Commissioner:
   (a) an individual is not entitled to be represented at the conference by
another person; and
   (b) a body of persons, whether corporate or unincorporate, is not entitled
to be represented at the conference by a person other than a member, officer
or employee of that body.
  


PRIVACY ACT 1988 - SECT 48 Complainant and certain other persons to
be informed of various matters
  
  
  
   Where the Commissioner decides not to investigate, or not to investigate
further, a matter to which a complaint relates, the Commissioner shall, as
soon as practicable and in such manner as the Commissioner thinks fit, inform
the complainant and the respondent of the decision and of the reasons for the
decision.
  


PRIVACY ACT 1988 - SECT 49 Investigation under section 40 to cease
if certain offences may have been committed
  
  
  
   (1) Where, in the course of an investigation under section 40, the
Commissioner forms the opinion that a tax file number offence or a credit
reporting offence may have been committed, the Commissioner shall:
   (a) inform the Commissioner of Police or the Director of Public
Prosecutions of that opinion;
   (b) in the case of an investigation under subsection 40(1), give a copy of
the complaint to the Commissioner of Police or the Director of Public
Prosecutions, as the case may be; and
   (c) subject to subsection (3), discontinue the investigation except to the
extent that it concerns matters unconnected with the offence that the
Commissioner believes may have been committed.
   (2) If, after having been informed of the Commissioner's opinion under
paragraph (1)(a), the Commissioner of Police or the Director of Public
Prosecutions, as the case may be, decides that the matter will not be, or will
no longer be, the subject of proceedings for an offence, he or she shall give
a written notice to that effect to the Commissioner.
   (3) Upon receiving such a notice the Commissioner may continue the
investigation discontinued under paragraph (1)(c).
   (4) In subsection (1):
  "credit reporting offence" means:
   (a) an offence against subsection 18C(4), 18D(4), 18K(4), 18L(2), 18N(2),
18R(2) or 18S(3) or section 18T; or
   (b) an offence against section 6, 7 or 7A, or paragraph 86(1)(a), of the
Crimes Act 1914 , being an offence that relates to an offence referred to in
paragraph (a) of this definition.
  "tax file number offence" means:
   (a) an offence against section 8WA or 8WB of the Taxation Administration
Act 1953 ; or
   (b) an offence against section 6, 7 or 7A, or paragraph 86(1)(a), of the
Crimes Act 1914 , being an offence that relates to an offence referred to in
paragraph (a) of this definition.
  


PRIVACY ACT 1988 - SECT 50 Reference of matters to other
authorities
  
  
   (1) In this section:
  "Human Rights and Equal Opportunity Commission" includes a person performing
functions of that Commission."Merit Protection Act" means the Merit Protection (Australian Government
Employees) Act 1984 .
  "Merit Protection Agency" means the Merit Protection and Review Agency
established by the Merit Protection Act.
  "Ombudsman" means the Commonwealth Ombudsman.
   (2) Where, before the Commissioner commences, or after the Commissioner has
commenced, to investigate a matter to which a complaint relates, the
Commissioner forms the opinion that:
   (a) a complaint relating to that matter has been, or could have been, made
by the complainant:
   (i) to the Human Rights and Equal Opportunity Commission under Division 3
of Part II of the Human Rights and Equal Opportunity Commission Act 1986 ; or
   (ii) to the Ombudsman under the Ombudsman Act 1976 ; or
   (b) an application with respect to that matter has been, or could have
been, made by the complainant to the Merit Protection Agency under section 47
of the Merit Protection Act;
   and that that matter could be more conveniently or effectively dealt with
by the Human Rights and Equal Opportunity Commission, the Ombudsman, or the
Merit Protection Agency, as the case may be, the Commissioner may decide not
to investigate the matter, or not to investigate the matter further, as the
case may be, and, if the Commissioner so decides, he or she shall:
   (c) transfer the complaint to the Human Rights and Equal Opportunity
Commission, the Ombudsman or the Merit Protection Agency;
   (d) give notice in writing to the complainant stating that the complaint
has been so transferred; and
   (e) give to the Human Rights and Equal Opportunity Commission, the
Ombudsman or the Merit Protection Agency any information or documents that
relate to the complaint and are in the possession, or under the control, of
the Commissioner.
   (3) A complaint transferred under subsection (2) shall be taken to be:
   (a) a complaint made:
   (i) to the Human Rights and Equal Opportunity Commission under Division 3
of Part II of the Human Rights and Equal Opportunity Commission Act 1986 ; or
   (ii) to the Ombudsman under the Ombudsman Act 1976 ; or
   (b) an application made to the Merit Protection Agency under section 47 of
the Merit Protection Act;
   as the case requires.
  


PRIVACY ACT 1988 - SECT 51 Effect of investigation by
Auditor-General
  
  
   Where the Commissioner becomes aware that a matter being investigated by
the Commissioner is, or is related to, a matter that is under investigation by
the Auditor-General, the Commissioner shall not, unless the Commissioner and
Auditor-General agree to the contrary, continue to investigate the matter
until the investigation by the Auditor-General has been completed.
  


PRIVACY ACT 1988 - Division 2--Determinations following investigation
of complaints
  
  
  


PRIVACY ACT 1988 - SECT 52 Determination of the Commissioner
  
  
   (1) After investigating a complaint, the Commissioner may:
   (a) make a determination dismissing the complaint; or
   (b) find the complaint substantiated and make a determination that includes
one or more of the following:
   (i) a declaration:
   (A) where the principal executive of an agency is the respondent--that the
agency has engaged in conduct constituting an interference with the privacy of
an individual and should not repeat or continue such conduct; or
   (B) in any other case--that the respondent has engaged in conduct
constituting an interference with the privacy of an individual and should not
repeat or continue such conduct;
   (ii) a declaration that the respondent should perform any reasonable act or
course of conduct to redress any loss or damage suffered by the complainant;
   (iii) a declaration that the complainant is entitled to a specified amount
by way of compensation for any loss or damage suffered by reason of the act or
practice the subject of the complaint;
   (iv) a declaration that it would be inappropriate for any further action to
be taken in the matter.
   (1A) The loss or damage referred to in paragraph (1)(b) includes injury to
the complainant's feelings or humiliation suffered by the complainant.
   (1B) A determination of the Commissioner under subsection (1) is not
binding or conclusive between any of the parties to the determination.
   (2) The Commissioner shall, in a determination, state any findings of fact
upon which the determination is based.
   (3) In a determination under paragraph (1)(a) or (b) (other than a
determination made on a representative complaint), the Commissioner may
include a declaration that the complainant is entitled to a specified amount
to reimburse the complainant for expenses reasonably incurred by the
complainant in connection with the making of the complaint and the
investigation of the complaint.
   (3A) In a determination under subparagraph (1)(b)(i) or (ii) that concerns
a breach of Information Privacy Principle 7 or section 18J, the Commissioner
may include an order that:
   (a) an agency or respondent make an appropriate correction, deletion or
addition to a record, or to a credit information file or credit report, as the
case may be; or
   (b) an agency or respondent attach to a record, or include in a credit
information file or credit report, as the case may be, a statement provided by
the complainant of a correction, deletion or addition sought by the
complainant.
   (4) A determination by the Commissioner under subparagraph (1)(b)(iii) on a
representative complaint:
   (a) may provide for payment of specified amounts or of amounts worked out
in a manner specified by the Commissioner; and
   (b) if the Commissioner provides for payment in accordance with paragraph
(a), must make provision for the payment of the money to the complainants
concerned.
   (5) If the Commissioner makes a determination under subparagraph
(1)(b)(iii) on a representative complaint, the Commissioner may give such
directions (if any) as he or she thinks just in relation to:
   (a) the manner in which a class member is to establish his or her
entitlement to the payment of an amount under the determination; and
   (b) the manner for determining any dispute regarding the entitlement of a
class member to the payment.
   (6) In this section:
  "complainant" , in relation to a representative complaint, means the class
members.
  


PRIVACY ACT 1988 - SECT 53 Determination must identify the class
members who are to be affected by the determination
  
  
  
   A determination under section 52 on a representative complaint must
describe or otherwise identify those of the class members who are to be
affected by the determination.
  


PRIVACY ACT 1988 - Division 3--Enforcement of determinations involving
respondents other than Commonwealth agencies
  
  
  
  



PRIVACY ACT 1988 - SECT 54 Application of Division
  
  
   (1) This Division applies to a determination made under section 52 after
the commencement of this Division, except where the respondent to the
determination is an agency or the principal executive of an agency.
   (2) In this section:
  "agency" does not include an eligible case manager.
  


PRIVACY ACT 1988 - SECT 55 Proceedings in the Federal Court to
enforce a determination
  
  
   (1) The Commissioner or the complainant may commence proceedings in the
Federal Court for an order to enforce a determination to which this Division
applies.
   (2) If the Court is satisfied that the respondent has engaged in conduct
that constitutes an interference with the privacy of the complainant, the
Court may make such orders (including a declaration of right) as it thinks
fit.
   (3) The Court may, if it thinks fit, grant an interim injunction pending
the determination of the proceedings.
   (4) The Court is not to require a person, as a condition of granting an
interim injunction, to give an undertaking as to damages.
   (5) In the proceedings, the question whether the respondent has engaged in
conduct that constitutes an interference with the privacy of the complainant
is to be dealt with by the Court by way of a hearing de novo, but the Court
may receive as evidence any of the following:
   (a) a copy of the Commissioner's written reasons for the determination;
   (b) a copy of any document that was before the Commissioner;
   (c) a copy of a record (including any tape recording) of any appearance
before the Commissioner (including any oral submissions made) pursuant to
subsection 43(5).
   (6) In this section:
  "complainant" , in relation to a representative complaint, means any of the
class members.
  


PRIVACY ACT 1988 - Division 4--Review and enforcement of
determinations involving Commonwealth agencies
  
  
  
  



PRIVACY ACT 1988 - SECT 57 Application of Division
  
  
   (1) This Division applies to a determination that is made under section 52
and has an agency, or the principal executive of an agency, as the respondent.
   (2) In this section:
  "agency" does not include an eligible case manager.
  


PRIVACY ACT 1988 - SECT 58 Obligations of respondent agency
  
  
   If an agency is the respondent to a determination to which this Division
applies:
   (a) the agency must not repeat or continue conduct that is covered by a
declaration included in the determination under subparagraph 52(1)(b)(i); and
   (b) the agency must perform the act or course of conduct that is covered by
a declaration included in the determination under subparagraph 52(1)(b)(ii).
  


PRIVACY ACT 1988 - SECT 59 Obligations of principal executive of
agency
  
  
   If the principal executive of an agency is the respondent to a
determination to which this Division applies, the principal executive must
take all such steps as are reasonably within his or her power to ensure:
   (a) that the terms of the determination are brought to the notice of all
members, officers and employees of the agency whose duties are such that they
may engage in conduct of the kind to which the determination relates; and
   (b) that no member, officer or employee of the agency repeats or continues
conduct that is covered by a declaration included in the determination under
subparagraph 52(1)(b)(i); and
   (c) the performance of any act or course of conduct that is covered by a
declaration included in the determination under subparagraph 52(1)(b)(ii).
  


PRIVACY ACT 1988 - SECT 60 Compensation and expenses
  
  
   (1) If a determination to which this Division applies includes a
declaration of the kind referred to in subparagraph 52(1)(b)(iii) or
subsection 52(3), the complainant is entitled to be paid the amount specified
in the declaration.
   (2) If the respondent is an agency that has the capacity to sue and be
sued, the amount is recoverable as a debt due by the agency to the
complainant. In any other case, the amount is recoverable as a debt due by the
Commonwealth to the complainant.
   (3) In this section:
  "complainant" , in relation to a representative complaint, means a class member.
  


PRIVACY ACT 1988 - SECT 61 Review of determinations regarding
compensation and expenses
  
  
   (1) Application may be made to the Administrative Appeals Tribunal for
review of:
   (a) a declaration of the kind referred to in subparagraph 52(1)(b)(iii) or
subsection 52(3) that is included in a determination to which this Division
applies; or
   (b) a decision of the Commissioner refusing to include such a declaration
in a determination to which this Division applies.
   (2) An agency, or the principal executive of an agency, may not apply for
review without the permission of the Minister.
   (3) In exercising powers in relation to an application under subsection
(1), the Tribunal must be constituted by a presidential member who is a Judge
and 2 other members who are not Judges. This subsection has effect subject to
subsection 21(1A) of the Administrative Appeals Tribunal Act 1975 .
   (4) Terms used in subsection (3) that are also used in the Administrative
Appeals Tribunal Act 1975 have the same meanings as in that Act.
  


PRIVACY ACT 1988 - SECT 62 Enforcement of determination against an
agency
  
  
   (1) If an agency fails to comply with section 58, an application may be
made to the Federal Court for an order directing the agency to comply.
   (2) If the principal executive of an agency fails to comply with section
59, an application may be made to the Federal Court for an order directing the
principal executive to comply.
   (3) The application may be made by the Commissioner or by the complainant.
In the case of a representative complaint,"complainant" means a class member.
   (4) On an application under this section, the Federal Court may make such
other orders as it thinks fit with a view to securing compliance by the
respondent.
   (5) An application may not be made under this section in relation to a
determination under section 52 until:
   (a) the time has expired for making an application under section 61 for
review of the determination; or
   (b) if such an application is made, the decision of the Administrative
Appeals Tribunal on the application has come into operation.
  


PRIVACY ACT 1988 - Division 5--Miscellaneous
  
  
  


PRIVACY ACT 1988 - SECT 63 Legal assistance
  
  
   (1) If:
   (a) the Commissioner has dismissed a file number complaint; and
   (b) the respondent to the complaint is not an agency or the principal
executive of an agency;
   the respondent may apply to the Attorney-General for assistance under this
section.
   (2) A person who:
   (a) has commenced or proposes to commence proceedings in the Federal Court
under section 55; or
   (b) has engaged in conduct or is alleged to have engaged in conduct in
respect of which proceedings have been commenced in the Federal Court under
section 55;
   may apply to the Attorney-General for the provision of assistance under
this section in respect of the proceedings.
   (3) If the Attorney-General is satisfied that in all the circumstances it
is reasonable to grant an application made under this section, he or she may
authorise the provision by the Commonwealth to the applicant of:
   (a) in the case of an application under subsection (1)--such financial
assistance in connection with the investigation of the complaint as the
Attorney-General determines; or
   (b) in the case of an application under subsection (2)--such legal or
financial assistance in respect of the proceeding as the Attorney-General
determines.
   (4) An authorisation under subsection (3) may be made subject to such
conditions (if any) as the Attorney-General determines.
   (5) In considering an application made under this section, the
Attorney-General must have regard to any hardship to the applicant that
refusal of the application would involve.
  


PRIVACY ACT 1988 - SECT 64 Commissioner not to be sued
  
  
   Neither the Commissioner nor a person acting under his or her direction or
authority is liable to an action, suit or proceeding in relation to an act
done or omitted to be done in good faith in the exercise or purported exercise
of any power or authority conferred by this Act.
  


PRIVACY ACT 1988 - SECT 65 Failure to attend etc. before
Commissioner
  
  
   (1) A person shall not, without reasonable excuse:
   (a) refuse or fail to attend before the Commissioner; or
   (b) refuse or fail to be sworn or make an affirmation;
   when so required under this Act.
   Penalty: $2,000 or imprisonment for 12 months, or both.
   (2) A person shall not, without reasonable excuse, wilfully obstruct,
hinder or resist the Commissioner in the performance of his or her functions
under this Act.
   Penalty: $2,000 or imprisonment for 12 months, or both.
   (3) A person shall not furnish information or make a statement to the
Commissioner knowing that it is false or misleading in a material particular.
   Penalty: $2,000 or imprisonment for 12 months, or both.
  


PRIVACY ACT 1988 - SECT 66 Failure to give information etc.
  
  
   (1) A person shall not refuse or fail, without reasonable excuse:
   (a) to give information; or
   (b) to answer a question or produce a document or record;
   when so required under this Act.
   Penalty:
   (a) in the case of an individual--$2,000 or imprisonment for 12 months, or
both; or
   (b) in the case of a body corporate--$10,000.
   (2) For the purposes of subsections (3) to (11) (inclusive):
  "document" includes a record.
  "information" includes an answer to a question.
   (3) Subject to subsections (4), (7) and (10), it is a reasonable excuse for
the purposes of subsection (1) for an individual:
   (a) to refuse or fail to give information when so required under this Act;
or
   (b) to refuse or fail to produce a document when so required under this
Act;
   that giving the information, or producing the document, as the case may be,
might tend to incriminate the individual or make the individual liable to
forfeiture or a penalty.
   (4) Subsection (3) does not apply in relation to a failure or refusal by an
individual to give information, or to produce a document, on the ground that
giving the information or producing the document might tend to prove his or
her guilt of an offence against, or make him or her liable to forfeiture or a
penalty under, a law of the Commonwealth or of a Territory, if the Director of
Public Prosecutions has given the individual a written undertaking under
subsection (5).
   (5) An undertaking by the Director of Public Prosecutions shall:
   (a) be an undertaking that:
   (i) information given, or a document produced, by the individual; or
   (ii) any information or document obtained as a direct or indirect
consequence of the giving of the information, or the production of the
document;
   will not be used in evidence in any proceedings for an offence against a
law of the Commonwealth or of a Territory, or in any disciplinary proceedings,
against the individual, other than proceedings in respect of the falsity of
evidence given by the individual;
   (b) state that, in the opinion of the Director of Public Prosecutions,
there are special reasons why, in the public interest, the information or
document should be available to the Commissioner; and
   (c) state the general nature of those reasons.
   (6) The Commissioner may recommend to the Director of Public Prosecutions
that an individual who has been, or is to be, required under this Act to give
information or produce a document be given an undertaking under subsection
(5).
   (7) Subsection (3) does not apply in relation to a failure or refusal by an
individual to give information, or to produce a document, on the ground that
giving the information or producing the document might tend to prove his or
her guilt of an offence against, or make him or her liable to forfeiture or a
penalty under, a law of a State, if the Attorney-General of the State, or a
person authorised by that Attorney-General (being the person holding the
office of Director of Public Prosecutions, or a similar office, of the State)
has given the individual a written undertaking under subsection (8).
   (8) An undertaking by the Attorney-General of the State, or authorised
person, shall:
   (a) be an undertaking that:
   (i) information given, or a document produced, by the individual; or
   (ii) any information or document obtained as a direct or indirect
consequence of the giving of the information, or the production of the
document;
   will not be used in evidence in any proceedings for an offence against a
law of the State, or in any disciplinary proceedings, against the individual,
other than proceedings in respect of the falsity of evidence given by the
individual;
   (b) state that, in the opinion of the person giving the undertaking, there
are special reasons why, in the public interest, the information or document
should be available to the Commissioner; and
   (c) state the general nature of those reasons.
   (9) The Commissioner may recommend to the Attorney-General of a State that
an individual who has been, or is to be, required under this Act to give
information or produce a document be given an undertaking under subsection
(8).
   (10) For the purposes of subsection (1):
   (a) it is not a reasonable excuse for a body corporate to refuse or fail to
produce a document that production of the document might tend to incriminate
the body corporate or make it liable to forfeiture or a penalty; and
   (b) it is not a reasonable excuse for an individual to refuse or fail to
produce a document that is, or forms part of, a record of an existing or past
business (not being, if the individual is or has been an employee, a document
that sets out details of earnings received by the individual in respect of his
or her employment and does not set out any other information) that production
of the document might tend to incriminate the individual or make the
individual liable to forfeiture or a penalty.
   (11) Subsections (4), (7) and (10) do not apply where proceedings, in
respect of which giving information or producing a document might tend to
incriminate an individual or make an individual liable to forfeiture or a
penalty, have been commenced against the individual and have not been finally
dealt with by a court or otherwise disposed of.
  


PRIVACY ACT 1988 - SECT 67 Protection from civil actions
  
  
   Civil proceedings do not lie against a person in respect of loss, damage or
injury of any kind suffered by another person because of any of the following
acts done in good faith:
   (a) the making of a complaint under this Act;
   (b) the making of a statement to, or the giving of a document or
information to, the Commissioner, whether or not pursuant to a requirement
under section 44.
  


PRIVACY ACT 1988 - SECT 68 Power to enter premises
  
  
   (1) Subject to subsection (3), for the purposes of the performance by the
Commissioner of his or her functions under this Act, a person authorised by
the Commissioner for the purposes of this section may, at any reasonable time
of the day, enter premises occupied by an agency, a file number recipient, a
credit reporting agency or a credit provider and inspect any documents that
are kept at those premises and that are relevant to the performance of those
functions, other than documents in respect of which the Attorney-General has
furnished a certificate under subsection 70(1) or (2).
   (2) The occupier or person in charge of the premises shall provide the
authorised person with all reasonable facilities and assistance for the
effective exercise of the authorised person's powers under subsection (1).
   (3) A person shall not enter under subsection (1) premises other than
premises that are occupied by an agency unless:
   (a) the occupier of the premises has consented to the person entering the
premises; or
   (b) the person is authorised, pursuant to a warrant issued under subsection
(4), to enter the premises.
   (4) If, on an application made by a person authorised by the Commissioner
under subsection (1), a Magistrate is satisfied, by information on oath, that
it is reasonably necessary, for the purposes of the performance by the
Commissioner of his or her functions under this Act, that the person be
empowered to enter the premises, the Magistrate may issue a warrant
authorising the person, with such assistance as the person thinks necessary,
to enter the premises, if necessary by force, for the purpose of exercising
those powers.
   (5) A warrant issued under subsection (4) shall state:
   (a) whether entry is authorised to be made at any time of the day or during
specified hours of the day; and
   (b) a day, not being later than one month after the day on which the
warrant was issued, at the end of which the warrant ceases to have effect.
   (6) Nothing in subsection (1) restricts the operation of any other
provision of this Part.
  


PRIVACY ACT 1988 - SECT 69 Restrictions on Commissioner obtaining
personal information and documents
  
  
  
   (1) Information relating to an individual shall not be furnished, in
connection with a complaint, in such a manner as to reveal the individual's
identity, unless the individual has made the complaint or has consented to the
information being so furnished.
   (2) A document that contains information relating to an individual and that
reveals the individual's identity shall not be produced, in connection with a
complaint, unless:
   (a) the person has made the complaint or has consented to the document
being so produced; or
   (b) the document is a copy of another document and has had deleted from it
such information as reveals the identity of the person.
   (3) A person shall not furnish, in connection with a complaint, prescribed
information that relates to an individual other than the complainant and does
not also relate to the complainant.
   (4) A person shall not furnish, in connection with a complaint, prescribed
information that relates both to the complainant and to another individual,
unless the information is so furnished in such a manner as not to reveal the
identity of the other person.
   (5) A person shall not produce, in connection with a complaint, a
prescribed document containing information that relates to an individual other
than the complainant and does not also relate to the complainant, unless the
document is a copy of another prescribed document and has had that information
deleted from it.
   (6) A person shall not produce, in connection with a complaint, a
prescribed document containing information that relates both to the
complainant and to another individual, unless the document is a copy of
another prescribed document and has had deleted from it such information as
reveals the identity of the other individual.
   (7) This section has effect notwithstanding any other provision of this
Part.
   (8) A reference in this section to furnishing information, or to producing
a document, in connection with a complaint is a reference to furnishing the
information, or to producing the document, as the case may be, to the
Commissioner in connection with the performance or exercise by the
Commissioner, in relation to that complaint, of the Commissioner's functions
or powers.
   (9) In this section:
  "complaint" means a complaint under section 36.
  "document" includes any other record.
  "prescribed document" means a document that was furnished or obtained under or
for the purposes of a relevant law or a copy of such a document.
  "prescribed information" means information that the person furnishing the
information acquired by reason of holding or having held an office, or being
or having been employed, under or for the purposes of a relevant law.
  "relevant law" means a taxation law or a law of the Commonwealth relating to
census and statistics.
  "taxation law" means:
   (a) an Act of which the Commissioner of Taxation has the general
administration (other than an Act prescribed for the purposes of paragraph (b)
of the definition of taxation law in section 2 of the Taxation Administration
Act 1953) ; or
   (b) regulations under an Act referred to in paragraph (a) of this
definition.
  


PRIVACY ACT 1988 - SECT 70 Certain documents and information not
required to be disclosed
  
  
   (1) Where the Attorney-General furnishes to the Commissioner a certificate
certifying that the giving to the Commissioner of information concerning a
specified matter (including the giving of information in answer to a
question), or the production to the Commissioner of a specified document or
other record, would be contrary to the public interest because it would:
   (a) prejudice the security, defence or international relations of
Australia;
   (b) involve the disclosure of communications between a Minister of the
Commonwealth and a Minister of a State, being a disclosure that would
prejudice relations between the Commonwealth Government and the Government of
a State;
   (c) involve the disclosure of deliberations or decisions of the Cabinet or
of a Committee of the Cabinet;
   (d) involve the disclosure of deliberations or advice of the Executive
Council;
   (e) prejudice the conduct of an investigation or inquiry into crime or
criminal activity that is currently being pursued, or prejudice the fair trial
of any person;
   (f) disclose, or enable a person to ascertain, the existence or identity of
a confidential source of information in relation to the enforcement of the
criminal law;
   (g) prejudice the effectiveness of the operational methods or investigative
practices or techniques of agencies responsible for the enforcement of the
criminal law; or
   (h) endanger the life or physical safety of any person;
   the Commissioner is not entitled to require a person to give any
information concerning the matter or to produce the document or other record.
   (2) Without limiting the operation of subsection (1), where the
Attorney-General furnishes to the Commissioner a certificate certifying that
the giving to the Commissioner of information as to the existence or
non-existence of information concerning a specified matter (including the
giving of information in answer to a question) or as to the existence or
non-existence of any document or other record required to be produced to the
Commissioner would be contrary to the public interest:
   (a) by reason that it would prejudice the security, defence or
international relations of Australia; or
   (b) by reason that it would prejudice the proper performance of the
functions of the National Crime Authority;
   the Commissioner is not entitled, pursuant to this Act, to require a person
to give any information as to the existence or non-existence of information
concerning that matter or as to the existence of that document or other
record.
  


PRIVACY ACT 1988 - Part VI--Public Interest Determinations about
Certain Acts and Practices
  
  
  
  



PRIVACY ACT 1988 - SECT 71 Interpretation
  
  
   For the purposes of this Part, a person is interested in an application
made under section 73 if, and only if, the Commissioner is of the opinion that
the person has a real and substantial interest in the application.
  


PRIVACY ACT 1988 - SECT 72 Power to make, and effect of,
determinations
  
  
   Subject to this Part, where the Commissioner is satisfied that:
   (a) an act or practice of an agency breaches, or may breach, an Information
Privacy Principle; and
   (b) the public interest in the agency doing the act, or engaging in the
practice, outweighs to a substantial degree the public interest in adhering to
that Information Privacy Principle;
   the Commissioner may make a written determination to that effect and, if
the Commissioner does so, the fact that the act or practice breaches that
Information Privacy Principle shall:
   (c) if the agency does the act while the determination is in force; or
   (d) in so far as the agency engages in the practice while the determination
is in force;
   as the case may be, be disregarded for the purpose of section 16.
  


PRIVACY ACT 1988 - SECT 73 Application by agency
  
  
   (1) An agency may apply in accordance with the regulations for a
determination under section 72 about an act or practice.
   (2) The National Health and Medical Research Council may make an
application under subsection (1) on behalf of other agencies concerned with
medical research or the provision of health care.
   (3) Where an application is made by virtue of subsection (2), a reference
in the succeeding provisions of this Part to the agency is a reference to the
National Health and Medical Research Council.
   (4) Where the Commissioner makes a determination under section 72 on an
application made by virtue of subsection (2), that section has effect, in
relation to each of the agencies on whose behalf the application was made as
if the determination had been made on an application by that agency.
  


PRIVACY ACT 1988 - SECT 74 Publication of application
  
  
   (1) Subject to subsection (2), the Commissioner shall publish, in such
manner as he or she thinks fit, notice of the receipt by the Commissioner of
an application.
   (2) The Commissioner shall not, except with the consent of the agency,
permit the disclosure to another body or person of information contained in a
document provided by an agency as part of, or in support of, an application if
the agency has informed the Commissioner in writing that the agency claims
that the document is an exempt document within the meaning of Part IV of the
Freedom of Information Act 1982 .
  


PRIVACY ACT 1988 - SECT 75 Draft determination
  
  
   (1) The Commissioner shall prepare a draft of his or her proposed
determination in relation to the application.
   (2) The Commissioner shall send to the agency, and to each person (if any)
other than the agency who is interested in the application, a written
invitation to notify the Commissioner, within the period specified in the
invitation, whether or not the agency or other person wishes the Commissioner
to hold a conference about the draft determination.
   (3) An invitation under subsection (2) shall specify a period that begins
on the day on which the invitation is sent and is not shorter than the
prescribed period.
  


PRIVACY ACT 1988 - SECT 76 Conference
  
  
   (1) If an agency or person notifies the Commissioner, within the period
specified in an invitation sent to the agency or person, that the agency or
person wishes a conference to be held about the draft determination, the
Commissioner shall hold such a conference.
   (2) The Commissioner shall fix a day, time and place for the holding of the
conference.
   (3) The day fixed shall not be more than 30 days after the latest day on
which a period specified in any of the invitations sent in relation to the
draft determination expires.
   (4) The Commissioner shall give notice of the day, time and place of the
conference to the agency and to each person to whom an invitation was sent.
  


PRIVACY ACT 1988 - SECT 77 Conduct of conference
  
  
   (1) At the conference, the agency is entitled to be represented by a person
who is, or persons each of whom is, an officer or employee of the agency.
   (2) At the conference, a person to whom an invitation was sent, or any
other person who is interested in the application and whose presence at the
conference is considered by the Commissioner to be appropriate, is entitled to
attend and participate personally or, in the case of a body corporate, to be
represented by a person who is, or persons each of whom is, a director,
officer or employee of the body corporate.
   (3) The Commissioner may exclude from the conference a person who:
   (a) is entitled neither to participate in the conference nor to represent a
person who is entitled to be represented at the conference;
   (b) uses insulting language at the conference;
   (c) creates, or takes part in creating or continuing, a disturbance at the
conference; or
   (d) repeatedly disturbs the conference.
  


PRIVACY ACT 1988 - SECT 78 Determination of application
  
  
   The Commissioner shall, after complying with this Part in relation to the
application, make:
   (a) such determination under section 72 as he or she considers appropriate;
or
   (b) a written determination dismissing the application.
  


PRIVACY ACT 1988 - SECT 79 Making of determination
  
  
   (1) The Commissioner shall, in making a determination, take account of all
matters raised at the conference.
   (2) The Commissioner shall, in making a determination, take account of all
submissions about the application that have been made, whether at a conference
or not, by the agency or any person.
   (3) The Commissioner shall include in a determination a statement of the
reasons for the determination.
  


PRIVACY ACT 1988 - SECT 80 Determinations disallowable
  
  
   (1) A determination referred to in paragraph 78 (a) is a disallowable
instrument for the purposes of section 46A of the Acts Interpretation Act
1901.
   (2) Section 48 of the Acts Interpretation Act 1901 applies to a
determination referred to in paragraph 78 (a) as if paragraph (1) (b) of
section 48 were omitted and the following paragraph substituted:
   (b) subject to this section, shall take effect on the first day on which
the determination is no longer liable to be disallowed, or to be deemed to be
disallowed, under this section; and.
  


PRIVACY ACT 1988 - Part VII--Privacy Advisory Committee
  
  
  


PRIVACY ACT 1988 - SECT 81 Interpretation
  
  
   In this Part, unless the contrary intention appears:
  "Advisory Committee" means the Privacy Advisory Committee established by
subsection 82(1).
  "member" means a member of the Advisory Committee.
  


PRIVACY ACT 1988 - SECT 82 Establishment and membership
  
  
   (1) A Privacy Advisory Committee is established.
   (2) The Advisory Committee shall consist of:
   (a) the Commissioner; and
   (b) not more than 6 other members.
   (3) A member other than the Commissioner:
   (a) shall be appointed by the Governor-General; and
   (b) shall be appointed as a part-time member.
   (4) An appointed member holds office, subject to this Act, for such period,
not exceeding 5 years, as is specified in the instrument of the member's
appointment, but is eligible for re-appointment.
   (5) The Commissioner shall be convenor of the Committee.
   (6) The Governor-General shall so exercise the power of appointment
conferred by subsection (3) that a majority of the appointed members are
persons who are neither officers nor employees, nor members of the staff of an
authority or instrumentality, of the Commonwealth.
   (7) Of the appointed members:
   (a) at least one shall be a person who has had at least 5 years' experience
at a high level in industry, commerce, public administration or the service of
a government or an authority of a government;
   (b) at least one shall be a person who has had at least 5 years' experience
in the trade union movement;
   (c) at least one shall be a person who has had extensive experience in
electronic data-processing;
   (d) at least one shall be appointed to represent general community
interests, including interests relating to social welfare; and
   (e) at least one shall be a person who has had extensive experience in the
promotion of civil liberties.
   (8) A person who has reached 65 years shall not be appointed as a member.
   (9) A person shall not be appointed as a member for a period that extends
beyond the time at which the person will reach 65 years.
   (10) An appointed member holds office on such terms and conditions (if any)
in respect of matters not provided for by this Act as are determined, in
writing, by the Governor-General.
   (11) The performance of a function of the Advisory Committee is not
affected because of a vacancy or vacancies in the membership of the Advisory
Committee.
  


PRIVACY ACT 1988 - SECT 83 Functions
  
  
   The functions of the Advisory Committee are:
   (a) on its own initiative, or when requested by the Commission, to advise
the Commissioner on matters relevant to his or her functions;
   (b) to recommend material to the Commissioner for inclusion in guidelines
to be issued by the Commissioner pursuant to his or her functions; and
   (c) subject to any direction given by the Commissioner, to engage in and
promote community education, and community consultation, in relation to the
protection of individual privacy.
  


PRIVACY ACT 1988 - SECT 84 Leave of absence
  
  
   The convenor may, on such terms and conditions as the convenor thinks fit,
grant to another member leave to be absent from a meeting of the Advisory
Committee.
  


PRIVACY ACT 1988 - SECT 85 Removal and resignation of members
  
  
   (1) The Governor-General may terminate the appointment of an appointed
member for misbehaviour or physical or mental incapacity.
   (2) The Governor-General shall terminate the appointment of an appointed
member if the member:
   (a) becomes bankrupt, applies to take the benefit of any law for the relief
of bankrupt or insolvent debtors, compounds with the member's creditors or
makes an assignment of the member's remuneration for their benefit;
   (b) fails, without reasonable excuse, to comply with the member's
obligations under section 86; or
   (c) is absent, without the leave of the convenor, from 3 consecutive
meetings of the Advisory Committee.
   (3) An appointed member may resign from office by delivering a signed
notice of resignation to the Governor-General.
  


PRIVACY ACT 1988 - SECT 86 Disclosure of interests of members
  
  
   (1) A member who has a direct or indirect pecuniary interest in a matter
being considered or about to be considered by the Advisory Committee, being an
interest that could conflict with the proper performance of that member's
functions in relation to the consideration of the matter, shall, as soon as
practicable after the relevant facts have come to the knowledge of that
member, disclose the nature of that interest at a meeting of the Advisory
Committee.
   (2) A disclosure under subsection (1) at a meeting of the Advisory
Committee shall be recorded in the minutes of the meeting.
  


PRIVACY ACT 1988 - SECT 87 Meetings of Advisory Committee
  
  
   (1) The convenor may convene such meetings of the Advisory Committee as the
convenor considers necessary for the performance of the Committee's functions.
   (2) Meetings of the Advisory Committee shall be held at such places and at
such times as the convenor determines.
   (3) The convenor shall preside at all meetings of the Advisory Committee at
which the convenor is present.
   (4) If, at a meeting of the Advisory Committee, the convenor is not
present, the members who are present shall elect one of their number to
preside at the meeting.
   (5) At a meeting of the Advisory Committee:
   (a) 3 members constitute a quorum;
   (b) all questions shall be decided by a majority of votes of the members
present and voting; and
   (c) the person presiding has a deliberative vote and, in the event of an
equality of votes, also has a casting vote.
   (6) The Advisory Committee shall keep a record of its proceedings.
  


PRIVACY ACT 1988 - SECT 88 Travel allowance
  
  
   An appointed member is entitled to be paid travelling allowance in
accordance with the regulations.
  


PRIVACY ACT 1988 - Part VIII--Obligations of Confidence
  
  
  


PRIVACY ACT 1988 - SECT 89 Obligations of confidence to which Part
applies
  
  
   Unless the contrary intention appears, a reference in this Part to an
obligation of confidence is a reference to an obligation of confidence:
   (a) to which an agency or a Commonwealth officer is subject, however the
obligation arose; or
   (b) that arises under or by virtue of the law in force in the Australian
Capital Territory.
  


PRIVACY ACT 1988 - SECT 90 Application of Part
  
  
   (1) This Part applies where a person (in this Part called a"confidant" ) is subject to an obligation of confidence to another person (in
this Part called a"confider" ) in respect of personal information, whether the information relates
to the confider or to a third person, being an obligation in respect of a
breach of which relief may be obtained (whether in the exercise of a
discretion or not) in legal proceedings.
   (2) This Part does not apply where a criminal penalty only may be imposed
in respect of the breach.
  


PRIVACY ACT 1988 - SECT 91 Effect of Part on other laws
  
  
   This Part does not, except to the extent that it does so expressly or by
necessary implication, limit or restrict the operation of any other law or of
any principle or rule of the common law or of equity, being a law, principle
or rule:
   (a) under or by virtue of which an obligation of confidence exists; or
   (b) that has the effect of restricting or prohibiting, or imposing a
liability (including a criminal liability) on a person in respect of, a
disclosure or use of information.
  


PRIVACY ACT 1988 - SECT 92 Extension of certain obligations of
confidence
  
  
   Where a person has acquired personal information about another person and
the first-mentioned person knows or ought reasonably to know that the person
from whom he or she acquired the information was subject to an obligation of
confidence with respect to the information, the first-mentioned person,
whether he or she is in the Australian Capital Territory or not, is subject to
a like obligation.
  


PRIVACY ACT 1988 - SECT 93 Relief for breach etc. of certain
obligations of confidence
  
  
   (1) A confider may recover damages from a confidant in respect of a breach
of an obligation of confidence with respect to personal information.
   (2) Subsection (1) does not limit or restrict any other right that the
confider has to relief in respect of the breach.
   (3) Where an obligation of confidence exists with respect to personal
information about a person other than the confider, whether the obligation
arose under a contract or otherwise, the person to whom the information
relates has the same rights against the confidant in respect of a breach or
threatened breach of the obligation as the confider has.
  


PRIVACY ACT 1988 - SECT 94 Jurisdiction of courts
  
  
   (1) The jurisdiction of the courts of the Australian Capital Territory
extends to matters arising under this Part.
   (2) Subsection (1) does not deprive a court of a State or of another
Territory of any jurisdiction that it has.
  


PRIVACY ACT 1988 - Part IX--Miscellaneous
  
  
  


PRIVACY ACT 1988 - SECT 95 Medical research guidelines
  
  
   (1) The National Health and Medical Research Council may, with the approval
of the Commissioner, issue guidelines for the protection of privacy in the
conduct of medical research.
   (2) The Commissioner shall not approve the issue of guidelines unless he or
she is satisfied that the public interest in the promotion of research of the
kind to which the guidelines relate outweighs to a substantial degree the
public interest in maintaining adherence to the Information Privacy
Principles.
   (3) Guidelines shall be issued by being published in the Gazette .
   (4) Where:
   (a) but for this subsection, an act done by an agency would breach an
Information Privacy Principle; and
   (b) the act is done in the course of medical research and in accordance
with guidelines under subsection (1);
   the act shall be regarded as not breaching that Information Privacy
Principle.
   (5) Where the Commissioner refuses to approve the issue of guidelines under
subsection (1), an application may be made to the Administrative Appeals
Tribunal for review of the Commissioner's decision.
  


PRIVACY ACT 1988 - SECT 96 Non-disclosure of private information
  
  
   (1) A person who is, or has at any time been, the Commissioner or a member
of the staff referred to in section 43 of the Human Rights and Equal
Opportunity Commission Act 1986 or is acting, or has at any time acted, on
behalf of the Commissioner shall not, either directly or indirectly, except in
the performance of a duty under or in connection with this Act or in the
course of acting on behalf of the Commissioner:
   (a) make a record of, or divulge or communicate to any person, any
information relating to the affairs of another person acquired by the
first-mentioned person because of that person's office or employment under or
for the purposes of this Act or because of that person acting, or having
acted, on behalf of the Commissioner;
   (b) make use of any such information; or
   (c) produce to any person a document relating to the affairs of another
person furnished for the purposes of this Act.
   Penalty: $5,000 or imprisonment for 1 year, or both.
   (2) A person who is, or has at any time been, the Commissioner, or a member
of the staff referred to in section 43 of the Human Rights and Equal
Opportunity Commission Act 1986 or is acting, or has at any time acted, on
behalf of the Commissioner shall not be required:
   (a) to divulge or communicate to a court any information relating to the
affairs of another person acquired by the first-mentioned person because of
that person's office or employment under or for the purposes of this Act or
because of that person acting, or having acted, on behalf of the Commissioner;
or
   (b) to produce in a court a document relating to the affairs of another
person of which the first-mentioned person has custody, or to which that
person has access, because of that person's office or employment under or for
the purposes of this Act or because of that person acting, or having acted, on
behalf of the Commissioner;
   except where it is necessary to do so for the purposes of this Act.
   (3) Nothing in this section prohibits a person from:
   (a) making a record of information that is, or is included in a class of
information that is, required or permitted by an Act to be recorded, if the
record is made for the purposes of or pursuant to that Act; or
   (b) divulging or communicating information, or producing a document, that
is, or is included in a class of information that is or class of documents
that are, required or permitted by an Act to be divulged, communicated or
produced, as the case may be, if the information is divulged or communicated,
or the document is produced, for the purposes of or under that Act.
   (4) Nothing in subsection (2) prevents a person being required, for the
purposes of or under an Act, to divulge or communicate information, or to
produce a document, that is, or is included in a class of information that is,
or class of documents that are, required or permitted by that Act to be
divulged, communicated or produced.
   (5) In this section:
  "court" includes any tribunal, authority or person having power to require the
production of documents or the answering of questions.
  "produce" includes permit access to.
  


PRIVACY ACT 1988 - SECT 97 Annual report
  
  
   (1) The Commissioner shall, as soon as practicable after 30 June in each
year, give to the Minister a report of the operation of this Act during that
year.
   (2) Without limiting the generality of subsection (1), the report shall
include a statement of the performance of the Commissioner's functions under
paragraphs 27(1)(n) and 28(1)(a) and (f).
   (3) The Minister shall cause a copy of the report to be laid before each
House of the Parliament within 15 sitting days of that House after the day on
which he or she receives the report.
  


PRIVACY ACT 1988 - SECT 98 Injunctions
  
  
   (1) Where a person has engaged, is engaging or is proposing to engage in
any conduct that constituted or would constitute a contravention of this Act,
the Federal Court may, on the application of the Commissioner or any other
person, grant an injunction restraining the person from engaging in the
conduct and, if in the court's opinion it is desirable to do so, requiring the
person to do any act or thing.
   (2) Where:
   (a) a person has refused or failed, or is refusing or failing, or is
proposing to refuse or fail, to do an act or thing; and
   (b) the refusal or failure was, is, or would be a contravention of this
Act;
   the Federal Court may, on the application of the Commissioner or any other
person, grant an injunction requiring the first-mentioned person to do that
act or thing.
   (3) Where an application is made to the court for an injunction under this
section, the court may, if in the court's opinion it is desirable to do so,
before considering the application, grant an interim injunction restraining a
person from engaging in conduct of the kind referred to in that subsection
pending the determination of the application.
   (4) The court may discharge or vary an injunction granted under this
section.
   (5) The power of the court to grant an injunction restraining a person from
engaging in conduct of a particular kind may be exercised:
   (a) if the court is satisfied that the person has engaged in conduct of
that kind--whether or not it appears to the court that the person intends to
engage again, or to continue to engage, in conduct of that kind; or
   (b) if it appears to the court that, in the event that an injunction is not
granted, it is likely that the person will engage in conduct of that
kind--whether or not the person has previously engaged in conduct of that kind
and whether or not there is an imminent danger of substantial damage to any
person if the first-mentioned person engages in conduct of that kind.
   (6) The power of the court to grant an injunction requiring a person to do
a particular act or thing may be exercised:
   (a) if the court is satisfied that the person has refused or failed to do
that act or thing--whether or not it appears to the court that the person
intends to refuse or fail again, or to continue to refuse or fail, to do that
act or thing; or
   (b) if it appears to the court that, in the event that an injunction is not
granted, it is likely that the person will refuse or fail to do that act or
thing--whether or not the person has previously refused or failed to do that
act or thing and whether or not there is an imminent danger of substantial
damage to any person if the first-mentioned person refuses or fails to do that
act or thing.
   (7) Where the Commissioner makes an application to the court for the grant
of an injunction under this section, the court shall not require the
Commissioner or any other person, as a condition of the granting of an interim
injunction, to give any undertakings as to damages.
   (8) The powers conferred on the court under this section are in addition
to, and not in derogation of, any powers of the court, whether conferred by
this Act or otherwise.
  


PRIVACY ACT 1988 - SECT 99 Delegation
  
  
   The Commissioner may delegate to either a member of the staff of the Human
Rights and Equal Opportunity Commission or a member of the staff of the
Ombudsman all or any of the powers conferred on the Commissioner by this Act,
other than a power conferred by section 52 or a power in connection with the
performance of the function of the Commissioner set out in paragraph 28(1)(a).
  


PRIVACY ACT 1988 - SECT 99A Conduct of directors, servants and
agents
  
  
   (1) Where, in proceedings for an offence against this Act, it is necessary
to establish the state of mind of a body corporate in relation to particular
conduct, it is sufficient to show:
   (a) that the conduct was engaged in by a director, servant or agent of the
body corporate within the scope of his or her actual or apparent authority;
and
   (b) that the director, servant or agent had the state of mind.
   (2) Any conduct engaged in on behalf of a body corporate by a director,
servant or agent of the body corporate within the scope of his or her actual
or apparent authority is to be taken, for the purposes of a prosecution for an
offence against this Act, to have been engaged in also by the body corporate
unless the body corporate establishes that the body corporate took reasonable
precautions and exercised due diligence to avoid the conduct.
   (3) Where, in proceedings for an offence against this Act, it is necessary
to establish the state of mind of a person other than a body corporate in
relation to particular conduct, it is sufficient to show:
   (a) that the conduct was engaged in by a servant or agent of the person
within the scope of his or her actual or apparent authority; and
   (b) that the servant or agent had the state of mind.
   (4) Any conduct engaged in on behalf of a person other than a body
corporate by a servant or agent of a person within the scope of his or her
actual or apparent authority is to be taken, for the purposes of a prosecution
for an offence against this Act, to have been engaged in also by the
first-mentioned person unless the first-mentioned person establishes that the
first-mentioned person took reasonable precautions and exercised due diligence
to avoid the conduct.
   (5) Where:
   (a) a person other than a body corporate is convicted of an offence; and
   (b) the person would not have been convicted of the offence if subsections
(3) and (4) had not been enacted;
   the person is not liable to be punished by imprisonment for that offence.
   (6) A reference in subsection (1) or (3) to the state of mind of a person
includes a reference to:
   (a) the knowledge, intention, opinion, belief or purpose of the person; and
   (b) the person's reasons for the intention, opinion, belief or purpose.
   (7) A reference in this section to a director of a body corporate includes
a reference to a constituent member of a body corporate incorporated for a
public purpose by a law of the Commonwealth, of a State or of a Territory.
   (8) A reference in this section to engaging in conduct includes a reference
to failing or refusing to engage in conduct.
   (9) A reference in this section to an offence against this Act includes a
reference to an offence created by section 5, 6, 7 or 7A, or subsection 86
(1), of the Crimes Act 1914 , being an offence that relates to this Act.
  


PRIVACY ACT 1988 - SECT 100 Regulations
  
  
   The Governor-General may make regulations, not inconsistent with this Act,
prescribing matters:
   (a) required or permitted by this Act to be prescribed; or
   (b) necessary or convenient to be prescribed for carrying out or giving
effect to this Act.
  


PRIVACY ACT 1988 - Part X--Amendments of Other Acts
  
  
  


PRIVACY ACT 1988 - SECT 101 Amendments of other Acts
  
  
   (1) The Acts specified in Schedule 1 are amended as set out in Schedule 1.
   (2) Section 27A of the Freedom of Information Act 1982 as amended by this
Act applies in relation to:
   (a) a request that is received after the commencement of this Act; and
   (b) a request that was received before that commencement if a decision to
grant access under the Freedom of Information Act 1982 to the document to
which the request related had not been made before that commencement by the
officer or Minister dealing with the request or a person reviewing, under
section 54 of that Act, a decision refusing to grant that access.
  
  
  
  


PRIVACY ACT 1988 -SCHEDULE
  
  
   Section 10
  
 AMENDMENTS OF OTHER ACTS Freedom of Information Act 1982 [published
separately]
   Human Rights and Equal Opportunity Commission Act 1986 [published
separately]
   Merit Protection (Australian Government Employees) Act 1984 [published
separately]
   Ombudsman Act 1976 [published separately]
  
  

  


PRIVACY ACT 1988 -SCHEDULE 2
  
  
   Section 17
  
 INTERIM GUIDELINES CONCERNING THE COLLECTION, STORAGE, USE AND SECURITY OF
TAX FILE NUMBER INFORMATION INTRODUCTION
   A breach of these guidelines amounts to an interference with the privacy of
an individual giving rise to a right to complain to the Privacy Commissioner
and a right to seek compensation.
   1. GENERAL
   1.1 The tax file number is not to be used as a national identification
system by whatever means.
   1.2 Tax file number recipients shall not collect, record, use or disclose
tax file number information in an unauthorised manner and, in particular,
shall not act in an unauthorised manner to use tax file number information as
a means of matching personal information about a person.
   1.3 The Commissioner of Taxation shall publicise in a generally available
publication information relating to:
   (a) the persons or bodies who are authorised by law to require or request
another person to quote that person's tax file number;
   (b) the specific purposes for which such a requirement or request may be
made;
   (c) the prohibitions on the use and disclosure of tax file number
information; and
   (d) the penalties that apply to unauthorised acts and practices in relation
to tax file number information;
   together with information as to where detailed particulars relating to
these matters can be obtained.
   2. COLLECTION OF TAX FILE NUMBER INFORMATION
   2.1 Tax file number recipients shall take all reasonable steps in the
circumstances to ensure that staff whose duties include collecting tax file
number information are informed of:
   (a) the circumstances in which tax file number information may be
collected;
   (b) the need to protect the privacy of the person to whom that information
relates; and
   (c) the penalties that apply to unauthorised acts and practices in relation
to tax file number information.
   2.2 Tax file number recipients collecting tax file number information shall
take all reasonable steps in the circumstances to ensure that the manner of
collection takes account of the rights of persons to control the accumulation
and dissemination of information relating to themselves.
   3. STORAGE AND SECURITY OF TAX FILE NUMBER INFORMATION
   3.1 Tax file number recipients shall take all reasonable steps in the
circumstances to:
   (a) introduce information handling procedures to protect the privacy of
individuals in relation to their tax file number information;
   (b) make staff aware of the rights of individuals to privacy in relation to
their tax file number information; and
   (c) make staff aware of the penalties relating to unauthorised acts and
practices in relation to such information.
   3.2 Tax file number recipients holding tax file number information shall
take all reasonable steps in the circumstances to ensure that security
safeguards and procedures are in place to prevent unauthorised access to,
modification or disclosure of, and loss of, such information, whether that
information is stored in physical or electronic form.
   3.3 Tax file number recipients shall take all reasonable steps in the
circumstances to ensure that access to records which contain tax file number
information for authorised purposes is confined to persons who have a need for
access to such information for the purpose of carrying out tax-related
functions of the tax file number recipient.
   4. USE AND DISCLOSURE OF TAX FILE NUMBER INFORMATION
   4.1 Tax file number recipients shall take all reasonable steps in the
circumstances to ensure that staff with access to tax file number information
are informed of the prohibitions on the use and disclosure of such information
and of the penalties that apply to breach of those prohibitions.
   4.2 Tax file number recipients shall not use tax file number information
for other than authorised purposes.
   4.3 Without limiting the application of 4.2 to any other circumstances:
   (a) an employer or investment body shall not use a tax file number for the
purposes of building up a database on individuals for its own purposes;
   (b) an employer or investment body shall not cross-match tax file number
information with other information held about a person to carry out activities
which do not relate to obligations under a taxation law; and
   (c) Government agencies, including the Commissioner of Taxation, shall not
directly or indirectly disclose tax file number information or use tax file
number information to cross-match information about a person, except in
authorised circumstances, for example, disclosure to an agency or person in
specified cases expressly approved by the Parliament under sections 16 and 16A
of the Income Tax Assessment Act 1936 or otherwise.
   5. PUBLICITY
   5.1 Publication by the Commissioner of Taxation pursuant to guideline 1.3
shall be made prior to any obligation to quote a tax file number arising as a
result of the Taxation Laws Amendment (Tax File Numbers) Act 1988 .
   6. CESSATION OF EMPLOYMENT AND INVESTMENT
   6.1 Tax file number recipients shall destroy tax file number information
held by them as employers or as investment bodies in relation to their former
employees/investors in accordance with guidelines issued by the Privacy
Commissioner.
   7. MEANING OF TERMS IN INTERIM GUIDELINES
   7.1"Tax file number recipient" means file number recipient.
   7.2"Investment body" means a person who is an investment body for the purposes of
Part VA of the Income Tax Assessment Act 1936 .
   7.3"Employer means" an employer to whom a person may quote a tax file number in
relation to their employment.
  
  
  


PRIVACY ACT 1988 -NOTE
  
  
   1. The Privacy Act 1988 as shown in this reprint comprises Act No. 119,
1988 amended as indicated in the Tables below.
   The Privacy Act 1988 was modified by the Australian Capital Territory
Government Service (Consequential Provisions) Act 1994 (No. 92, 1994) as
amended by the Employment Services (Consequential Amendments) Act 1994 (No.
177, 1994). The modifications are not incorporated in this reprint.
   The Privacy Act 1988 was modified by the Banking (State Bank of South
Australia and Other Matters) Act 1994 (No. 69, 1994) see Table A.
   Table of Acts
  

  
   Act
  
   Number
   and year
  
   Date
   of Assent
  
   Date of commencement
  
   Application, saving or transitional provisions
  
  


  
   P rivacy Act 1988
  
   119, 1988
  
   14 Dec 1988
  
   1 Jan 1989 ( see Gazette 1988, No. S399)
  
  
   Law and Justice Legislation Amendment Act 1989
  
   11, 1990
  
   17 Jan 1990
  
   Part 1 (ss. 1, 2): Royal Assent
   Part 3 (ss. 6, 7): Royal Assent
   Ss. 8-10: 17 July 1990
   Ss. 12, 13 and 51(1)(b), (2): 17 Jan 1990 ( see s. 2(5))
   Remainder: 14 Feb 1990
  
   --
  
   Defence Legislation Amendment Act 1990
  
   75, 1990
  
   22 Oct 1990
  
   S. 5: Royal Assent ( a )
  
   --
  
   Privacy Amendment Act 1990
  
   116, 1990
  
   24 Dec 1990
  
   24 Sept 1991
  
   S. 25 (ad. by 136, 1991, s. 21)
  
   as amended by
  
  
  
  
  
   Law and Justice Legislation Amendment Act 1991
  
   136, 1991
  
   12 Sept 1991
  
   Part 4 (s. 21): 24 Sept 1991 ( b )
  
   --
  
   Law and Justice Legislation Amendment Act (No. 3) 1992
  
   165, 1992
  
   11 Dec 1992
  
   S. 4: ( c )
  
   --
  
   Data-matching Program (Assistance and Tax) Act 1990
  
   20, 1991
  
   23 Jan 1991
  
   23 Jan 1991
  
   --
  
   Crimes Legislation Amendment Act 1991
  
   28, 1991
  
   4 Mar 1991
  
   S. 74(1): Royal Assent ( d )
  
   --
  
   Industrial Relations Legislation Amendment Act 1991
  
   122, 1991
  
   27 June 1991
  
   Ss. 4(1), 10(b) and 15-20: 1 Dec 1988
   Ss. 28(b)-(e), 30 and 31: 10 Dec 1991 ( see Gazette 1991, No. S332)
   Remainder: Royal Assent
  
   S. 31(2)
  
   Law and Justice Legislation Amendment Act 1991
  
   136, 1991
  
   12 Sept 1991
  
   Part 3 (ss. 10-20): ( e )
  
   --
  
   Social Security Legislation Amendment Act (No. 4) 1991
  
   194, 1991
  
   13 Dec 1991
  
   S. 74 (Schedule 5 [Part 2]): ( f )
  
   --
  
   Law and Justice Legislation Amendment Act (No. 4) 1992
  
   143, 1992
  
   7 Dec 1992
  
   7 Dec 1992
  
   S. 2(2) and (3)
  
   National Health Amendment Act 1993
  
   28, 1993
  
   9 June 1993
  
   9 June 1993
  
   --
  
   Law and Justice Legislation Amendment Act 1993
  
   13, 1994
  
   18 Jan 1994
  
   S. 22: 13 Jan 1993
   Part 6 (ss. 27-41): 11 Apr 1994 ( see Gazette 1994,
   No. S126)
   Remainder: Royal Assent
  
   S. 16
  
   Law and Justice Legislation Amendment Act 1994
  
   84, 1994
  
   23 June 1994
  
   S. 71: Royal Assent ( g )
  
   --
  
   Australian Capital Territory Government Service (Consequential Provisions)
Act 1994
  
   92, 1994
  
   29 June 1994
  
   1 July 1994 ( see Gazette 1994, No. S256)
  
   --
  
   Employment Services (Consequential Amendments) Act 1994
  
   177, 1994
  
   19 Dec 1994
  
   Ss. 1, 2(1), (3) and Part 2 (ss. 3-8): 19 Dec 1994 ( see
   s. 2(1))
   S. 2(2) and Div. 4 of Part 6 (ss. 32-39): Royal Assent
   Remainder: 1 Jan 1995 ( see s. 2(3) and Gazette 1994, No. S472)
  
   S. 19
  
   Human Rights Legislation Amendment Act 1995
  
   59, 1995
  
   28 June 1995
  
   S. 3 (item 25): 30 Oct 1992
   Remainder: Royal Assent
  
   Ss. 4 and 5
  
   Statute Law Revision Act 1996
  
   43, 1996
  
   25 Oct 1996
  
   Schedule 4 (item 122): Royal Assent ( h )
  
   --
  
   Law and Justice Legislation Amendment Act 1997
  
   34, 1997
  
   17 Apr 1997
  
   Schedule 13: Royal Assent ( i )
  
   --
  
  
   ( a ) The Privacy Act 1988 was amended by section 5 only of the Defence
Legislation Amendment Act 1990 , subsection 2(1) of which provides as follows:
   "(1) Subject to this section, this Act commences on the day on which it
receives the Royal Assent."
   ( b ) The Privacy Amendment Act 1990 was amended by Part 4 (section 21)
only of the Law and Justice Legislation Amendment Act 1991 , subsection 2(3)
of which provides as follows:
   "(3) Part 4 commences on 24 September 1991."
   ( c ) The Privacy Amendment Act 1990 was amended by section 4 only of the
Law and Justice Legislation Amendment Act (No. 3) 1992 , subsections 2(1) and
(6) of which provide as follows:
   "(1) Subject to this section, this Act commences on the day on which it
receives the Royal Assent.
   "(6) The amendment of the Privacy Amendment Act 1990 made by this Act is
taken to have commenced immediately after the commencement of section 18 of
that Act."
   Section 18 commenced on 24 September 1991.
   ( d ) The Privacy Act 1988 was amended by subsection 74(1) only of the
Crimes Legislation Amendment Act 1991 , subsection 2(1) of which provides as
follows:
   "(1) Subject to this section, this Act commences on the day on which it
receives the Royal Assent."
   ( e ) The Privacy Act 1988 was amended by Part 3 (sections 10-20) only of
the Law and Justice Legislation Amendment Act 1991 , subsection 2(2) of which
provides as follows:
   "(2) Part 3 commences immediately after the commencement of the Privacy
Amendment Act 1990 ."
   The Privacy Amendment Act 1990 came into operation on 24 September 1991.
   ( f ) The Privacy Act 1988 was amended by section 74 (Schedule 5 [Part 2])
only of the Social Security Legislation Amendment Act (No. 4) 1991 ,
subsection 2(13) of which provides as follows:
   "(13) Part 2 of Schedule 5 is taken to have commenced immediately after the
commencement of the Data-matching Program (Assistance and Tax) Act 1990 ."
   The Data-matching Program (Assistance and Tax) Act 1990 came into operation
on 23 January 1991.
   ( g ) The Privacy Act 1988 was amended by section 71 only of the Law and
Justice Legislation Amendment Act 1994 , subsection 2(1) of which provides as
follows:
   "(1) Subject to this section, this Act commences on the day on which it
receives the Royal Assent."
   ( h ) The Privacy Act 1988 was amended by Schedule 4 (item 122) only of the
Statute Law Revision Act 1996 , subsection 2(1) of which provides as follows:
   "(1) Subject to subsections (2)and (3), this Act commences on the day on
which it receives the Royal Assent."
   ( i ) The Privacy Act 1988 was amended by Schedule 13 only of the Law and
Justice Legislation Amendment Act 1997 , subsection 2(1) of which provides as
follows:
   "(1) Subject to this section, this Act commences on the day on which it
receives the Royal Assent."
  
   Table of Amendments
  

  
   ad. = added or inserted am. = amended rep. = repealed rs. = repealed and
substituted
  
  


  
   Provision affected
  
   How affected
  
   S. 3
  
   am. No. 116, 1990
  
   S. 4
  
   am. No. 92, 1994
  
   S. 5A
  
   ad. No. 116, 1990
  
   S. 6
  
   am. Nos. 11 and 116, 1990; Nos. 28 and 136, 1991; No.143,1992; Nos. 13, 92
and 177, 1994; No. 34, 1997
  
   S. 7
  
   am. Nos. 75 and 116, 1990; Nos. 13, 84, 92 and 177, 1994
  
   S. 8
  
   am. No. 116, 1990; No. 28, 1991
  
   Ss. 9-11
  
   am. No. 28, 1991
  
   S. 11A
  
   ad. No. 116, 1990
  
   S. 11B
  
   ad. No. 116, 1990
  
  
   am. No. 136, 1991; No. 143, 1992; No. 34, 1997
  
   S. 12A
  
   ad. No. 116, 1990
  
   S. 13
  
   am. No. 116, 1990; Nos. 20 and 194, 1991; No. 28, 1993
  
   S. 17
  
   am. No. 116, 1990
  
   Ss. 18A, 18B
  
   ad. No. 116, 1990
  
   Part IIIA
   (ss. 18C-18V)
  
   ad. No. 116, 1990
  
   Ss. 18C, 18D
  
   ad. No. 116, 1990
  
   Ss. 18E, 18F
  
   ad. No. 116, 1990
  
  
   am. No. 143, 1992; No. 34, 1997
  
   S. 18G
  
   ad. No. 116, 1990
  
   S. 18H
  
   ad. No. 116, 1990
  
  
   am. No. 136, 1991
  
   S. 18J
  
   ad. No. 116, 1990
  
   Ss. 18K, 18L
  
   ad. No. 116, 1990
  
  
   am. No. 136, 1991; No. 143, 1992
  
   S. 18M
  
   ad. No. 116, 1990
  
  
   rs. No. 136, 1991
  
  
   am. No. 143, 1992
  
   S. 18N
  
   ad. No. 116, 1990
  
  
   am. No. 136, 1991; No. 143, 1992; No. 13, 1994
  
   S. 18NA
  
   ad. No. 34, 1997
  
   Ss. 18O-18Q
  
   ad. No. 116, 1990
  
  
   am. No. 136, 1991; No. 143, 1992
  
   Ss. 18R-18U
  
   ad. No. 116, 1990
  
   S. 18V
  
   ad. No. 116, 1990
  
  
   am. No. 136, 1991
  
   S. 19
  
   am. No. 59, 1995
  
   S. 21
  
   am. No. 43, 1996
  
   S. 22
  
   rs. No. 122, 1991
  
   S. 25
  
   am. No. 122, 1991
  
   S. 27
  
   am. No. 20, 1991; No. 28, 1993
  
   S. 28
  
   am. No. 116, 1990
  
   S. 28A
  
   ad. No. 116, 1990
  
   Ss. 29, 30
  
   am. No. 116, 1990
  
   S. 31
  
   am. No. 20, 1991
  
   S. 32
  
   am. No. 116, 1990 (as am. by No. 165, 1992); No. 20, 1991
  
   S. 33
  
   am. No. 92, 1994
  
   S. 36
  
   am. No. 11, 1990; No. 13, 1994
  
   S. 37
  
   am. Nos. 92 and 177, 1994
  
   S. 38
  
   rs. No. 13, 1994
  
   Ss. 38A-38C
  
   ad. No. 13, 1994
  
   S. 39
  
   rs. No. 13, 1994
  
   S. 44
  
   am. No. 34, 1997
  
   S. 49
  
   am. No. 116, 1990
  
   S. 52
  
   am. No. 116, 1990; No. 13, 1994
  
   S. 53
  
   rs. No. 13, 1994
  
   Div. 3 of Part V
   (ss. 54-59)
  
   rep. No. 13, 1994
  
   Div. 3 of Part V
   (ss. 54-56)
  
   ad. No. 13, 1994
   rep. No. 59, 1995
  
  
  
   Div. 3 of Part V
   (ss. 54, 55)
  
   ad. No. 59, 1995
  
   S. 54
  
   rs. No. 13, 1994
  
  
   am. No. 177, 1994
  
  
   rs. No. 59, 1995
  
   S. 55
  
   rs. No. 13, 1994; No. 59, 1995
  
   S. 56
  
   rs. No. 13, 1994
  
  
   rep. No. 59, 1995
  
   Ss. 57-59
  
   rep. No. 13, 1994
  
   Heading to Div. 4 of Part V
  
   am. No. 116, 1990
  
  
   rep. No. 13, 1994
  
   Div. 4 of Part V
   (ss. 60-63)
  
   rep. No. 13, 1994
  
   Div. 4 of Part V
   (ss. 57-62)
  
   ad. No. 13, 1994
  
   S. 57
  
   rs. No. 13, 1994
  
  
   am. No. 177, 1994
  
   Ss. 58, 59
  
   rs. No. 13, 1994
  
   S. 60
  
   am. No. 116, 1990
  
  
   rs. No. 13, 1994
  
   Ss. 61, 62
  
   rs. No. 13, 1994
  
   Div. 5 of Part V
  
  
   S. 63
  
   rs. No. 13, 1994
  
  
   am. No. 59, 1995
  
   S. 68
  
   am. No. 116, 1990
  
   S. 99
  
   am. No. 11, 1990
  
   S. 99A
  
   ad. No. 116, 1990
  
  
   A
   MODIFICATIONS
   Banking (State Bank of South Australia and Other Matters) Act 1994 (No. 69,
1994)
   Part 2.3--Modifications of the"Privacy Act 1988" Relating to the Restructuring of the State Bank of South
Australia
   Division 1--Preliminary
   12 Object of Part
   The object of this Part is to facilitate the restructuring of the State
Bank of South Australia by modifying the effect of the Privacy Act 1988 .
   13 Interpretation
   An expression used in this Part and in the Privacy Act 1988 has the same
meaning in this Part as it has in that Act.
   14. Definitions
   In this Part:
  "account" includes a deposit or loan.
  "appointed day" has the same meaning as in the State Bank (Corporatisation) Act
1994 of South Australia.
  "borrower" has a meaning corresponding to"loan" .
  "designated subsidiary of the State Bank of South Australia" means a company
that is an SBSA subsidiary within the meaning of the State Bank
(Corporatisation) Act 1994 of South Australia.
  "eligible customer" , in relation to a person, means:
   (a) an individual who is, or has sought to become:
   (i) a customer of the person within the ordinary meaning of that
expression; or
   (ii) a depositor with the person; or
   (iii) a borrower from the person; or
   (b) a guarantor or prospective guarantor of an individual who is, or has
sought to become, a borrower from the person.
  "re-transfer provision" means:
   (a) section 16 of the State Bank (Corporatisation) Act 1994 of South
Australia; or
   (b) a corresponding provision of a law of another State or of a Territory.
  "transfer provision" means:
   (a) section 7 of the State Bank (Corporatisation) Act 1994 of South
Australia; or
   (b) a corresponding provision of a law of another State or of a Territory.
   15 State banking
   (1) Section 12A of the Privacy Act 1988 has effect as if the provisions of
this Part were provisions of that Act.
   (2) A reference in the Privacy Act 1988 to State banking does not include a
reference to State banking to the extent to which the matter of State banking
has been referred to the Parliament under section 21 of the State Bank
(Corporatisation) Act 1994 of South Australia.
   Division 2--Transfers of loans--transferee bank deemed to have provided
credit
   16 Transfers to Bank of South Australia Limited
   (1) This section applies if:
   (a) a loan or prospective loan is transferred on a particular day (the"transfer day" ) under a transfer provision to Bank of South Australia Limited
from:
   (i) the State Bank of South Australia; or
   (ii) a designated subsidiary of the State Bank of South Australia; and
   (b) immediately before the transfer, the loan or prospective loan was
credit provided by the State Bank of South Australia or the designated
subsidiary, as the case may be.
   (2) This Part and the Privacy Act 1988 have effect, on and after the
transfer day, as if the loan or prospective loan were credit provided by Bank
of South Australia Limited instead of by the State Bank of South Australia or
the designated subsidiary, as the case requires.
   17 Re-transfers to the State Bank of South Australia or a designated
subsidiary of the State Bank of South Australia
   (1) This section applies if:
   (a) a loan or prospective loan is transferred on a particular day (the"re-transfer day" ) under a re-transfer provision from Bank of South Australia
Limited to:
   (i) the State Bank of South Australia; or
   (ii) a designated subsidiary of the State Bank of South Australia; and
   (b) immediately before the transfer, the loan or prospective loan was
credit provided by Bank of South Australia Limited.
   (2) This Part and the Privacy Act 1988 have effect, on and after the
re-transfer day, as if the loan or prospective loan were credit provided by
the State Bank of South Australia or by the designated subsidiary, as the case
requires, instead of by Bank of South Australia Limited.
   Division 3--Disclosure of reports
   Subdivision A--Transfers to Bank of South Australia Limited
   18 Disclosure of information about transferred eligible customers
   (1) This section applies to the disclosure of a report (within the meaning
of subsection 18N(9) of the Privacy Act 1988 ) or any personal information
derived from such a report if:
   (a) the disclosure is by:
   (i) the State Bank of South Australia; or
   (ii) a designated subsidiary of the State Bank of South Australia; or
   (iii) an agent of a body covered by subparagraph (i) or (ii); and
   (b) the report or information is disclosed to:
   (i) Bank of South Australia Limited; or
   (ii) an agent of Bank of South Australia Limited; and
   (c) the report or information relates to the affairs of an individual who:
   (i) was an eligible customer of the State Bank of South Australia or the
designated subsidiary, as the case may be; and
   (ii) became an eligible customer of Bank of South Australia Limited as a
result of the operation of a transfer provision; and
   (d) the report or information is disclosed for the purposes of facilitating
the operation of a transfer provision in relation to the individual.
   (2) The disclosure does not breach:
   (a) the Privacy Act 1988 ; or
   (b) the Code of Conduct.
   Subdivision B--Re-transfers to the State Bank of South Australia or to a
designated subsidiary of the State Bank of South Australia
   19 Disclosure of information where account is re-transferred to the State
Bank of South Australia or to a designated subsidiary of the State Bank of
South Australia
   (1) This section applies to the disclosure of a report (within the meaning
of subsection 18N(9) of the Privacy Act 1988 ) or any personal information
derived from such a report if:
   (a) the disclosure is by:
   (i) Bank of South Australia Limited; or
   (ii) an agent of Bank of South Australia Limited; and
   (b) the report or information is disclosed to:
   (i) the State Bank of South Australia; or
   (ii) a designated subsidiary of the State Bank of South Australia; or
   (iii) an agent of a body covered by subparagraph (i) or (ii); and
   (c) the report relates to the affairs of an eligible customer of the State
Bank of South Australia or of the designated subsidiary, as the case requires,
whose account was transferred to that Bank or subsidiary from Bank of South
Australia Limited as a result of the operation of a re-transfer provision; and
   (d) the report or information is disclosed for the purposes of facilitating
the operation of the re-transfer provision in relation to the eligible
customer.
   (2) The disclosure does not breach:
   (a) the Privacy Act 1988 ; or
   (b) the Code of Conduct.
   Subdivision C--Management of accounts by Bank of South Australia Limited
   20 Disclosure of information where Bank of South Australia Limited manages
the account of an eligible customer of the State Bank of South Australia or a
designated subsidiary of the State Bank of South Australia
   (1) This section applies to the disclosure of a report (within the meaning
of subsection 18N(9) of the Privacy Act 1988 ) or any personal information
derived from such a report if:
   (a) the disclosure is by:
   (i) the State Bank of South Australia; or
   (ii) a designated subsidiary of the State Bank of South Australia; or
   (iii) an agent of a body covered by subparagraph (i) or (ii); and
   (b) the report or information is disclosed to Bank of South Australia
Limited; and
   (c) the report or information relates to the affairs of an eligible
customer of the State Bank of South Australia or of the designated subsidiary,
as the case may be; and
   (d) an account of the eligible customer is being managed by Bank of South
Australia Limited as agent for the State Bank of South Australia or the
designated subsidiary, as the case may be; and
   (e) the report or information is disclosed for the purposes of facilitating
the management of the account.
   (2) The disclosure does not breach:
   (a) the Privacy Act 1988 ; or
   (b) the Code of Conduct.
   Subdivision D--Dissolution of designated subsidiaries of the State Bank of
South Australia
   21 Disclosure of information where a designated subsidiary of the State
Bank of South Australia is about to be dissolved
   (1) This section applies if:
   (a) a designated subsidiary of the State Bank of South Australia is
proposed to be dissolved under subsection 23(1) of the State Bank
(Corporatisation) Act 1994 of South Australia; and
   (b) as a result of the dissolution, an account with the designated
subsidiary will be vested in the State Bank of South Australia under
subsection 23(2) of that Act.
   (2) In applying paragraph 18N(1)(d) of the Privacy Act 1988 to a disclosure
that is relevant to that account, the designated subsidiary is taken to be
related to the State Bank of South Australia.
   Division 4--Authorities and notifications
   Subdivision A--Transfers to Bank of South Australia Limited
   22 Authorities relating to the State Bank of South Australia or a
designated subsidiary of the State Bank of South Australia deemed to relate to
Bank of South Australia Limited
   (1) This section applies to an authority (however described) given under
the Privacy Act 1988 if:
   (a) the authority was given to:
   (i) the State Bank of South Australia; or
   (ii) a designated subsidiary of the State Bank of South Australia; and
   (b) the authority authorised the State Bank of South Australia or the
designated subsidiary, as the case may be, to disclose, use or receive:
   (i) a credit report; or
   (ii) any other information that has or has had any bearing on an
individual's credit worthiness, credit standing, credit history or credit
capacity; and
   (c) the authority relates to the affairs of an individual who:
   (i) was an eligible customer of the State Bank of South Australia or the
designated subsidiary, as the case may be; and
   (ii) became an eligible customer of Bank of South Australia Limited on a
particular day (the"transfer day" ) as a result of the operation of a transfer provision.
   (2) This Part and the Privacy Act 1988 have effect, on and after the
transfer day, as if the authority had been given to, and had so authorised,
Bank of South Australia Limited instead of the State Bank of South Australia
or the designated subsidiary, as the case requires.
   23 Notifications given by the State Bank of South Australia or a designated
subsidiary of the State Bank of South Australia deemed to have been given by
Bank of South Australia Limited
   (1) This section applies to a notification (however described) given under
the Privacy Act 1988 if:
   (a) the notification was given by:
   (i) the State Bank of South Australia; or
   (ii) a designated subsidiary of the State Bank of South Australia; and
   (b) the notification was given to an individual who:
   (i) was an eligible customer of the State Bank of South Australia or the
designated subsidiary, as the case may be; and
   (ii) became an eligible customer of Bank of South Australia Limited on a
particular day (the"transfer day" ) as a result of the operation of a transfer provision.
   (2) This Part and the Privacy Act 1988 have effect, on and after the
transfer day, as if the notification had been given by Bank of South Australia
Limited instead of by the State Bank of South Australia or the designated
subsidiary, as the case requires.
   Subdivision B--Re-transfers to the State Bank of South Australia or to a
designated subsidiary of the State Bank of South Australia
   24 Authorities relating to Bank of South Australia Limited deemed to relate
to the State Bank of South Australia or the designated subsidiary concerned
   (1) This section applies to an authority (however described) given under
the Privacy Act 1988 if:
   (a) the authority was given to Bank of South Australia Limited; and
   (b) the authority authorised Bank of South Australia Limited to disclose,
use or receive:
   (i) a credit report; or
   (ii) any other information that has or has had any bearing on an
individual's credit worthiness, credit standing, credit history or credit
capacity; and
   (c) the authority relates to the affairs of an individual who:
   (i) was an eligible customer of Bank of South Australia Limited; and
   (ii) became an eligible customer of the State Bank of South Australia or a
designated subsidiary of the State Bank of South Australia on a particular day
(the"re-transfer day" ) as a result of the operation of a re-transfer provision.
   (2) The Privacy Act 1988 has effect, on and after the re-transfer day, as
if the authority had been given to, and had so authorised, the State Bank of
South Australia or the designated subsidiary, as the case requires, instead of
Bank of South Australia Limited.
   25 Notifications given by Bank of South Australia Limited deemed to have
been given by the State Bank of South Australia or the designated subsidiary
concerned
   (1) This section applies to a notification (however described) given under
the Privacy Act 1988 if:
   (a) the notification was given by Bank of South Australia Limited; and
   (b) the notification was given to an individual who:
   (i) was an eligible customer of Bank of South Australia Limited; and
   (ii) became an eligible customer of the State Bank of South Australia or a
designated subsidiary of the State Bank of South Australia on a particular day
(the"re-transfer day" ) as a result of the operation of a re-transfer provision.
   (2) The Privacy Act 1988 has effect, on and after the re-transfer day, as
if the notification had been given by the State Bank of South Australia or the
designated subsidiary, as the case requires, instead of by Bank of South
Australia Limited.
   Division 5--Deletion of information from credit information files
   Subdivision A--Transfers to Bank of South Australia Limited
   26 Credit reporting agencies that have been given information about overdue
payments
   (1) This section applies if:
   (a) the State Bank of South Australia or a designated subsidiary of the
State Bank of South Australia was a credit provider in relation to credit
provided to an individual; and
   (b) as a result of the operation of a transfer provision, the individual's
account was transferred to Bank of South Australia Limited on a particular day
(the"transfer day" ); and
   (c) a credit reporting agency had been given information that the
individual was overdue in making a payment in respect of the credit provided
by the State Bank of South Australia or the designated subsidiary, as the case
may be.
   (2) This Division and subsection 18F(3) of the Privacy Act 1988 have
effect, on and after the transfer day, as if the credit reporting agency had
been given information that the individual was overdue in making a payment in
respect of credit provided by Bank of South Australia Limited.
   27 Credit reporting agencies that have previously been informed about
current credit provider status
   (1) This section applies if:
   (a) the State Bank of South Australia or a designated subsidiary of the
State Bank of South Australia was a credit provider in relation to credit
provided to an individual; and
   (b) as a result of the operation of a transfer provision, the individual's
account was transferred to Bank of South Australia Limited on a particular day
(the"transfer day" ); and
   (c) a credit reporting agency had previously been informed that the State
Bank of South Australia or the designated subsidiary, as the case may be, was
a current credit provider in relation to the individual.
   (2) This Division and subsection 18F(5) of the Privacy Act 1988 have
effect, on and after the transfer day, as if the credit reporting agency had
previously been informed that Bank of South Australia Limited was a current
credit provider in relation to the individual.
   28 Credit provider ceasing to be current credit provider
   An obligation is not imposed on the State Bank of South Australia, or a
designated subsidiary of the State Bank of South Australia, under subsection
18F(5) of the Privacy Act 1988 merely because of the operation of a transfer
provision.
   Subdivision B--Re-transfers to the State Bank of South Australia or to a
designated subsidiary of the State Bank of South Australia
   29 Credit reporting agencies that have been given information about overdue
payments
   (1) This section applies if:
   (a) Bank of South Australia Limited was a credit provider in relation to
credit provided to an individual; and
   (b) as a result of the operation of a re-transfer provision, the
individual's account was transferred to the State Bank of South Australia or
to a designated subsidiary of the State Bank of South Australia on a
particular day (the"re-transfer day" ); and
   (c) a credit reporting agency had been given information that the
individual is overdue in making a payment in respect of the credit provided by
Bank of South Australia Limited.
   (2) Subsection 18F(3) of the Privacy Act 1988 has effect, on and after the
re-transfer day, as if the credit reporting agency had been given information
that the individual was overdue in making a payment in respect of credit
provided by the State Bank of South Australia or the designated subsidiary, as
the case requires.
   30 Credit reporting agencies that have previously been informed about
current credit provider status
   (1) This section applies if:
   (a) Bank of South Australia Limited was a credit provider in relation to
credit provided to an individual; and
   (b) as a result of the operation of a re-transfer provision, the
individual's account was transferred to the State Bank of South Australia or
to a designated subsidiary of the State Bank of South Australia on a
particular day (the"re-transfer day" ); and
   (c) a credit reporting agency had previously been informed that Bank of
South Australia Limited was a current credit provider in relation to the
individual.
   (2) Subsection 18F(5) of the Privacy Act 1988 has effect, on and after the
re-transfer day, as if the credit reporting agency had previously been
informed that the State Bank of South Australia or the designated subsidiary,
as the case requires, was a current credit provider in relation to the
individual.
   31 Credit provider ceasing to be current credit provider
   An obligation is not imposed on Bank of South Australia Limited under
subsection 18F(5) of the Privacy Act 1988 merely because of the operation of a
re-transfer provision.
   Division 6--Banks to publish information about the operation of this Part
   32 Publication of information about the operation of this Part
   (1) On or before the appointed day, or as soon as practicable after that
day, the State Bank of South Australia or Bank of South Australia Limited must
prepare a written statement setting out information about:
   (a) the kinds of reports and information that will be, or that have been,
disclosed under section 18; and
   (b) the kinds of authorities and notifications that will be, or have been,
affected by the operation of sections 22 and 23.
   (2) The statement must not be prepared in a manner that is likely to enable
the identification of a particular eligible customer.
   (3) As soon as practicable after the preparation of the statement, the
State Bank of South Australia or Bank of South Australia Limited, as the case
requires, must make copies of the statement generally available to:
   (a) in any case--its eligible customers; and
   (b) if the statement is prepared by the State Bank of South Australia--the
eligible customers of Bank of South Australia Limited.
   (4) For the purposes of the Privacy Act 1988 , a contravention of this
section is taken to be a credit reporting infringement by the State Bank of
South Australia and Bank of South Australia Limited.
   Division 7--This Part to be disregarded in determining the meaning that a
provision of the Privacy Act 1988 has apart from this Part
   33 This Part to be disregarded in determining the meaning that a provision
of the"Privacy Act 1988" has apart from this Part
   In determining the meaning that a provision of the Privacy Act 1988 has
apart from this Part, this Part is to be disregarded.