privacy-amendment-private-sector-act-2000.pdf, p.8
Omit 'interferences with the privacy of persons' and substitute 'the collection, holding, use, correction, disclosure or transfer of personal information'.
1 Section 3
Substitute 'the collection, holding, use, correction, disclosure or transfer of personal information'
Omit 'interferences with the privacy of persons'
privacy-amendment-private-sector-act-2000.pdf, p.10
10 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.63
Enforcement of determinations and evidentiary certificates
100 Application
Temporal intervals apply to determinations and evidentiary certificates.
Obligation applies to determinations and evidentiary certificates
Insert 'or the Federal Magistrates Court' after 'Federal Court'
101 Subsections 62(1) and (2)
Federal Court or Federal Magistrates Court
Omit 'Federal Court', substitute 'court'.
102 Subsection 62(4)
103 Paragraphs 63(2)(a) and (b)
No application can enforce a determination relating to a code complaint or an NPP complaint.
104 After subsection 63(2)
Subsection (2) does not permit an application relating to proceedings under section 55A.
privacy-amendment-private-sector-act-2000.pdf, p.64
No liability for acts done in good faith under the Act or code.
105 At the end of section 64
No liability implies a duty to act in good faith.
No liability for acts done in good faith.
Journalist has a reasonable excuse to keep confidential the identity of an informant.
106 After subsection 66(1)
There is a temporal overlap: The journalist's reasonable excuse overlaps with the time when giving information would reveal the identity of an informant.
Temporal overlap: The journalist's reasonable excuse overlaps with the time when giving information would reveal the identity of an informant.
There is a CogAI inference: The journalist's reasonable excuse can be inferred from the fact that they have a reasonable excuse.
CogAI inference: The journalist's reasonable excuse can be inferred from the fact that they have a reasonable excuse.
There is an obligation to keep confidential the identity of an informant.
Obligation to keep confidential the identity of an informant.
There is a diffusion: The journalist's reasonable excuse diffuses to all situations where giving information would tend to reveal the identity of an informant.
Diffusion: The journalist's reasonable excuse diffuses to all situations where giving information would tend to reveal the identity of an informant.
There is a temporal until: The journalist's reasonable excuse holds until the time when giving information would reveal the identity of an informant.
Temporal until: The journalist's reasonable excuse holds until the time when giving information would reveal the identity of an informant.
Making of a complaint under an approved privacy code and acceptance of a complaint under subsection 40(1B) are obligations.
107 After paragraph 67(a)
Insertion of 'in writing' after 'Commissioner'
108 Subsection 68(1)
Insertion of 'organisation' after 'agency'
109 Subsection 68(1)
Definition of contracted service provider for a government contract.
11 Subsection 6(1)
Definition of a term with normative implications
The Commissioner may authorise a person only while the person is a member of the staff assisting the Commissioner.
110 After subsection 68(1)
privacy-amendment-private-sector-act-2000.pdf, p.65
111 After subsection 68(3)
Authorised person must inform occupier or person in charge of potential refusal of consent.
111(3A) After subsection 68(3)
(3A) Before obtaining the consent, the authorised person must inform the occupier or person in charge that he or she may refuse to consent.
Must inform occupier or person in charge.
Consent must be voluntary for an entry to be lawful.
111(3B) After subsection 68(3)
Authorized person cannot enter premises without identity card
111(3C) After subsection 68(3)
Authorized person enters premises without identity card
Authorised person must leave premises if occupier or person in charge asks.
111(3D) After subsection 68(3)
The temporal interval of the authorised person's presence overlaps with the temporal interval of the occupier's or person in charge's request.
(3D) If an authorised person is on premises...
The cognitive system of the occupier or person in charge recognises the obligation to leave the premises.
The authorised person must leave the premises.
The diffusion of the obligation to leave the premises occurs when the occupier or person in charge requests it.
The temporal interval of the occupier's or person in charge's request occurs before the temporal interval of the authorised person's presence.
112 After section 68
Definition of complaint under Schedule 1
113 Subsection 69(9) (definition of complaint)
Substitutes a new definition for complaint
privacy-amendment-private-sector-act-2000.pdf, p.66
114 At the end of Division 5 of Part V
privacy-amendment-private-sector-act-2000.pdf, p.67
Repeal heading and substitute with new text.
115 Part VI (heading)
116 Before section 71
117 Section 72
118 At the end of section 72
Commissioner may make a written determination if public interest outweighs adherence to approved code or Principle.
118(2) At the end of section 72
Exemption from contravention of section 16A
118(3) At the end of section 72
Exemption applies during determination period
(3) The organisation is taken not to contravene section 16A if the organisation does the act, or engages in the practice, while the determination is in force under subsection (2).
Exempts organisation from contravention of section 16A
Permits organisation to engage in practice during determination period
Commissioner's written determination that an organisation does not contravene section 16A
118(4) At the end of section 72
Determinations have effect according to their terms.
118(5) At the end of section 72
privacy-amendment-private-sector-act-2000.pdf, p.68
119 Subsection 73(1)
privacy-amendment-private-sector-act-2000.pdf, p.11
12 Subsection 6(1)
The employee's hours of employment occur during the period of employment
The employee's hours of employment are a temporal interval
employee record is a record of personal information relating to the employment of an employee
120 At the end of subsection 73(1)
121 Subsection 73(2)
122 Subsection 75(2)
Agency must notify Commissioner within specified period
122(2) Subsection 75(2)
Commissioner must send written invitation to organisation and issue corresponding invitations.
122(2A) Subsection 75(2)
Commissioner must send written invitation.
privacy-amendment-private-sector-act-2000.pdf, p.69
Insertion of subsection (2A) after subsection (2)
123 Subsection 75(3)
Application and saving provisions for amendments to section 75 of the Privacy Act 1988.
124 Application and saving
125 Subsection 76(1)
Insertion of 'or organisation' after 'agency'
126 Subsection 76(4)
privacy-amendment-private-sector-act-2000.pdf, p.70
127 Subsection 77(1)
Omit “or any person”, substitute ‘, organisation or any other person’.
128 Subsection 79(2)
129 At the end of Part VI
privacy-amendment-private-sector-act-2000.pdf, p.33
12B Severability: additional effect of Act in relation to organisations
Act has effect in relation to organisations as provided by subsections of this section.
12B(1) Severability: additional effect of Act in relation to organisations
Act has effect on International Covenant on Civil and Political Rights
12B(2) Severability: additional effect of Act in relation to organisations
12B(3) Severability: additional effect of Act in relation to organisations
Act has effect if operation in relation to organisations were expressly confined.
12B(4) Severability: additional effect of Act in relation to organisations
Act has effect if operation in relation to organisations is expressly confined to acts or practices taking place in trade or commerce.
12B(5) Severability: additional effect of Act in relation to organisations
Temporal interval for conditional commencement
Operation in relation to organisations is expressly confined to acts or practices taking place in trade or commerce.
Additional effect of Act on organisations
12B(6) Severability: additional effect of Act in relation to organisations
Severability: additional effect of Act in relation to organisations
12B(7) Severability: additional effect of Act in relation to organisations
12B(8) Severability: additional effect of Act in relation to organisations
13 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.72
Section applies in relation to an application made by or on behalf of an agency under section 73 of the Privacy Act 1988.
130 Application
Section applies to agency applications under section 73 of the Privacy Act 1988.
131 After section 95
privacy-amendment-private-sector-act-2000.pdf, p.75
132 Subsection 97(2)
Details about complaints made under codes, their nature and outcome.
Report must include statement about approved privacy codes and their operation.
133 After subsection 97(2)
134 Subsections 98(1) and (2)
135 Subsections 99A(1) and (2)
136 Paragraph 99A(3)(a)
137 Paragraph 99A(3)(b)
Substitute employee for servant in Schedule 1
138 Subsection 99A(4)
Imposes a duty on the State to make the substitution
privacy-amendment-private-sector-act-2000.pdf, p.76
Minister must be satisfied that agency agrees to identifier use.
138A At the end of section 100
139 At the end of the Act
privacy-amendment-private-sector-act-2000.pdf, p.35
13A Interferences with privacy by organisations
Interference with privacy by organisations is prohibited.
13A(1) Interferences with privacy by organisations
Prohibition of interference with privacy
Organisations must not interfere with privacy.
13A(2) Interferences with privacy by organisations
Prohibition on interference with privacy
privacy-amendment-private-sector-act-2000.pdf, p.36
13B Related bodies corporate
Sharing personal information between related bodies corporate is permitted.
13B(1) Related bodies corporate
Exempt disclosure of personal information from related body corporate
13B(1A) Related bodies corporate
Organisation's act or practice may interfere with individual's privacy.
13B(2) Related bodies corporate
privacy-amendment-private-sector-act-2000.pdf, p.37
13C Change in partnership because of change in partners
Personal information can be passed on from an old to a new partnership.
13C(1) Change in partnership because of change in partners
Holds personal information about an individual.
The new partnership must comply with National Privacy Principles.
Note: Subsection (1) lets personal information be passed on from an old to a new partnership.
The new partnership's use of personal information may breach National Privacy Principle 2.
For example, the new partnership’s use of Schedule 1 Amendment of the Privacy Act 1988 personal information collected from the old partnership may constitute an interference with privacy if it breaches National Privacy Principle 2 or a corresponding provision in a binding approved privacy code.
The new partnership's use of personal information may constitute an interference with privacy.
(d) the new partnership holds, immediately after its formation, personal information about an individual that the old partnership held immediately before its dissolution;
The new partnership's use of personal information may interfere with the privacy of the individual.
Section 13C(2) has effect despite section 13A.
13C(2) Change in partnership because of change in partners
privacy-amendment-private-sector-act-2000.pdf, p.38
13D Overseas act required by foreign law
An act or practice outside Australia and an external Territory is not an interference with the privacy of an individual if required by a foreign country's law.
13D(1) Overseas act required by foreign law
Section 13D(2) has effect despite section 13A.
13D(2) Overseas act required by foreign law
Organisations are not prevented from interfering with individual privacy under section 13.
13E Effect on section 13 of sections 13B, 13C and 13D
Organisations' actions may overlap with individual privacy rights.
Section 13B, C and D do not prevent interference with privacy.
Organisations can infer from section 13 that they have an obligation to respect individual privacy.
Section 13 defines the concept of privacy.
Organisations have an obligation to respect individual privacy.
Organisations' actions diffuse individual privacy rights.
Organisations' actions may recurrently interfere with individual privacy rights.
No interference with privacy for acts not covered by section 13 or 13A
13F Act or practice not covered by section 13 or section 13A is not
Section 13 or 13A applies to this act/practice
privacy-amendment-private-sector-act-2000.pdf, p.12
Insertion of '(however published)' after 'other publication'
14 Subsection 6(1) (definition of generally available
15 Subsection 6(1)
16 Subsection 6(1)
Personal information includes health information
Inclusive relation between health information and personal information
Health information is a subset of personal information
Health information is a subclass of personal information
Class hierarchy for personal information
privacy-amendment-private-sector-act-2000.pdf, p.39
16A Organisations to comply with approved privacy codes or
Organisation must not breach approved privacy code
16A(1) Organisations to comply with approved privacy codes or
Prohibition applies during organisation's operation
(1) An organisation must not do an act, or engage in a practice, that breaches an approved privacy code that binds the organisation.
Prohibition of breaching approved privacy code through argumentation
Prohibition of breaching approved privacy code through CogAI
Prohibition of breaching approved privacy code
Prohibition of breaching approved privacy code through diffusion
Organisation must comply with approved privacy codes or face consequences.
16A(2) Organisations to comply with approved privacy codes or
Comply with approved privacy codes or National Privacy Principles
16A(3) Organisations to comply with approved privacy codes or
16B Personal information in records
Organisation must collect personal information only for inclusion in a record or publication.
16B(1) Personal information in records
For inclusion in a record or publication
Organisation collects personal information
Personal information must be held in a record for the Act to apply.
16B(2) Personal information in records
Must hold personal information in a record.
privacy-amendment-private-sector-act-2000.pdf, p.40
16C Application of National Privacy Principles
National Privacy Principles apply only to collection of personal information after commencement.
16C(1) Application of National Privacy Principles
(1) National Privacy Principles apply only in relation to the collection of personal information after the commencement of this section.
National Privacy Principle 2 applies only in relation to personal information collected after the commencement of this section.
16C(1A) Application of National Privacy Principles
The principle applies to personal information collected after a specific point in time.
(1A) National Privacy Principle 2 applies only in relation to personal information collected after the commencement of this section.
The principle is applied through a cognitive artificial intelligence system.
The principle applies to personal information collected after the commencement of this section.
The principle is applied through a process of diffusion.
The principle applies to a specific point in time.
National Privacy Principles apply to personal information held by organisations.
16C(2) Application of National Privacy Principles
Imposes a duty on states to apply National Privacy Principles.
National Privacy Principle 6 applies to personal information collected after commencement.
16C(3) Application of National Privacy Principles
Personal information subject to Principle
Principle applies to personal information
National Privacy Principle 8 applies only to transactions entered into after the commencement of this section.
16C(4) Application of National Privacy Principles
Restricts applicability to transactions after commencement.
(4) National Privacy Principle 8 applies only to transactions entered into after the commencement of this section.
16D Delayed application of National Privacy Principles to small
Delayed application of National Privacy Principles to small businesses
16D(1) Delayed application of National Privacy Principles to small
National Privacy Principles apply only to collection of personal information after delayed application period.
16D(2) Delayed application of National Privacy Principles to small
...only in relation to the collection of personal information after the delayed application period.
Applying principles only when specified conditions met.
(2) National Privacy Principles apply...
National Privacy Principles apply to organisation after delayed application period.
16D(3) Delayed application of National Privacy Principles to small
Principles relate to personal information
National Privacy Principles apply only to personal information collected after a delayed application period.
16D(4) Delayed application of National Privacy Principles to small
National Privacy Principle 8 applies only to transactions entered into with the organisation after a delayed application period.
16D(5) Delayed application of National Privacy Principles to small
The principle applies during the delayed application period.
(5) National Privacy Principle 8 applies only to transactions entered into with the organisation after the delayed application period.
The principle is applied by the organisation.
The principle applies to transactions entered into after the delayed application period.
The principle is diffused during the delayed application period.
The principle is true during the delayed application period.
Defines delayed application period for small organisations.
16D(6) Delayed application of National Privacy Principles to small
privacy-amendment-private-sector-act-2000.pdf, p.41
Exemptions from National Privacy Principles for personal, family or household affairs
16E Personal, family or household affairs
...for the purposes of, or in connection with, his or her personal,...
Nothing in the National Privacy Principles applies to...
privacy-amendment-private-sector-act-2000.pdf, p.42
16F Information under Commonwealth contract not to be used for
Limitation on use and disclosure of personal information for meeting Commonwealth contract obligations.
16F(1) Information under Commonwealth contract not to be used for
This section limits the use and disclosure of personal information collected:
Restricts use and disclosure of personal information.
(1) This section limits the use and disclosure of personal information collected:
Establishes duty to limit use and disclosure of personal information.
(a) for the purpose of meeting (directly or indirectly) an obligation under a Commonwealth contract;
Establishes duty to limit use and disclosure of personal information by contracted service providers.
(b) by an organisation that is a contracted service provider for the contract.
Prohibition on using personal information for direct marketing unless necessary to meet an obligation under the contract
16F(2) Information under Commonwealth contract not to be used for
for direct marketing, unless the use or disclosure is necessary to meet (directly or indirectly) an obligation under the contract.
(2) An organisation that is a contracted service provider for the contract must not use or disclose the personal information
Organisation must comply with approved privacy code and National Privacy Principles despite subsection (2) effect.
16F(3) Information under Commonwealth contract not to be used for
Subsection (2) effect starts after approved privacy code and National Privacy Principles take effect.
Temporal interval of subsection (2) effect starts after approved privacy code and National Privacy Principles take effect.
Approved privacy code and National Privacy Principles apply.
Organisation must comply with approved privacy code and National Privacy Principles.
Organisation must not use information under Commonwealth contract for specified purposes.
Subsection (2) effect is conditional on approved privacy code and National Privacy Principles taking effect.
Temporal interval of subsection (2) effect is conditional on approved privacy code and National Privacy Principles taking effect.
privacy-amendment-private-sector-act-2000.pdf, p.13
17 Subsection 6(1)
Defines a class hierarchy for health services
privacy-amendment-private-sector-act-2000.pdf, p.43
Application for approval of privacy code
18BA Application for approval of privacy code
18BB Commissioner may approve privacy code
Commissioner must consult person before approving privacy code
18BB(1) Commissioner may approve privacy code
Commissioner decides to approve privacy code
Commissioner must approve privacy code if certain conditions met
18BB(2) Commissioner may approve privacy code
The Commissioner may approve a privacy code if...
the organisation must consent to be bound
Organisations must consent to be bound by the code
(c) that only organisations that consent to be bound by the code are, or will be, bound by the code
the code must set out a procedure for cessation
Code must set out procedure for cessation of binding
(d) that the code sets out a procedure by which an organisation may cease to be bound by the code and when the cessation takes effect
Commissioner must be satisfied with code's compliance with standards and guidelines.
18BB(3) Commissioner may approve privacy code
Code must meet standards and guidelines.
privacy-amendment-private-sector-act-2000.pdf, p.46
18BC When approval takes effect
Approval takes effect on a specified day.
18BC(1) When approval takes effect
Approval must be given on or after the specified day.
18BC(2) When approval takes effect
The specified day contains the day of approval.
(2) The day specified must not be before the day on which the approval is given.
The approval must be given on or after the specified day.
Must provide approval on or after the specified day.
18BD Varying an approved privacy code
Organisation may apply for approval of a variation to an approved privacy code.
18BD(1) Varying an approved privacy code
The Commissioner must approve in writing the variation.
18BD(2) Varying an approved privacy code
Consider all matters when deciding to approve a variation.
18BD(3) Varying an approved privacy code
The Commissioner considers all matters within the applicable timeframe.
The Commissioner considers all matters within a certain timeframe.
The Commissioner must consider all matters.
Commissioner may consult on draft variation without public comment if deemed minor.
18BD(4) Varying an approved privacy code
Consultation overlaps with public comment period.
Commissioner's consultation overlaps with public comment period.
Commissioner consults on draft variation.
Commissioner may consult on draft variation.
Commissioner has permission to consult on draft variation.
The approval of the variation takes effect on the day specified in the approval.
18BD(5) Varying an approved privacy code
The day specified must not be before the day on which the approval is given.
18BD(6) Varying an approved privacy code
(6) The day specified must not be before the day on which the approval is given.
18BE Revoking the approval of an approved privacy code
Revoking approval of an approved privacy code
18BE(1) Revoking the approval of an approved privacy code
Prohibits revoking approval of an approved privacy code
(1) The Commissioner may revoke his or her approval...
Commissioner must consult certain persons before revoking approval of a code or variation.
18BE(2) Revoking the approval of an approved privacy code
18BE(3) Revoking the approval of an approved privacy code
Revocation of approved privacy code approval
18BE(4) Revoking the approval of an approved privacy code
The day specified must not be before the day on which the revocation is made.
18BE(5) Revoking the approval of an approved privacy code
(5) The day specified must not be before the day on which the revocation is made.
privacy-amendment-private-sector-act-2000.pdf, p.47
18BF Guidelines about privacy codes
Commissioner must make written guidelines about privacy codes.
18BF(1) Guidelines about privacy codes
Commissioner must give everyone with a real and substantial interest an opportunity to comment on proposed guidelines.
18BF(1A) Guidelines about privacy codes
Everyone with a real and substantial interest must be informed
Commissioner may publish guidelines in any way considered appropriate.
18BF(2) Guidelines about privacy codes
18BG Register of approved privacy codes
The Commissioner must keep a register of approved privacy codes.
18BG(1) Register of approved privacy codes
Commissioner's discretion over register form and keeping
18BG(2) Register of approved privacy codes
The Commissioner must make the register available to the public.
18BG(3) Register of approved privacy codes
Commissioner may charge fees for making register available to public or providing copies of register.
18BG(4) Register of approved privacy codes
(4) The Commissioner may charge fees for making register available to public or providing copies of register.
privacy-amendment-private-sector-act-2000.pdf, p.48
18BH Review of operation of approved privacy code
The Commissioner may review the operation of an approved privacy code.
18BH(1) Review of operation of approved privacy code
Commissioner may review operation of approved privacy code
18BH(2) Review of operation of approved privacy code
18BI Review of adjudicator’s decision under approved privacy code
Right to review adjudicator's decision under approved privacy code
18BI(1) Review of adjudicator’s decision under approved privacy code
Has the right to review adjudicator's decision
Commissioner can investigate complaint despite subsection 36(1A) restriction
18BI(2) Review of adjudicator’s decision under approved privacy code
Adjudicator's determination is subject to review by the Commissioner.
18BI(3) Review of adjudicator’s decision under approved privacy code
Adjudicator's determination is subject to review.
19 Subsection 6(1)
activities are part of media organisation
media organisation includes activities such as news collection
media organisation is a type of organisation
Reference to other laws for handling personal information
2 At the end of section 3
privacy-amendment-private-sector-act-2000.pdf, p.14
20 Subsection 6(1)
National Privacy Principle means a clause of Schedule 3.
21 Subsection 6(1)
...would be an interference with the privacy of the complainant
Defines a class hierarchy for NPP complaints
Defines organisation as given by section 6C.
22 Subsection 6(1)
Defines principal executive for an agency
22A Subsection 6(1)
23 Subsection 6(1)
Add “or” at the end of paragraphs (a), (d), (e) and (f) of the definition of record.
24 Subsection 6(1) (at the end of paragraphs (a), (d), (e) and
Arrange for access to records with a person other than a Commonwealth institution.
25 Subsection 6(1) (after paragraph (f) of the definition of
privacy-amendment-private-sector-act-2000.pdf, p.15
26 Subsection 6(1)
Part XI of the Commonwealth Electoral Act 1918
27 Subsection 6(1)
28 Subsection 6(1)
29 Subsection 6(1)
3 At the end of Part I
privacy-amendment-private-sector-act-2000.pdf, p.16
30 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.44
30 June each year on the operation of the code during the
Commissioner may consider guidelines when deciding on privacy codes.
30(4) June each year on the operation of the code during the
30(5) June each year on the operation of the code during the
Commissioner may approve a privacy code under certain conditions.
30(6) June each year on the operation of the code during the
Commissioner may approve a privacy code for specified conditions.
30(7) June each year on the operation of the code during the
(a) all personal information or a specified type of personal information;
Contract period overlaps with service provision
Services are to be provided during the contract period
State contract is a subclass of contract
State contract is a contract to which a State or Territory authority is or was a party
Definition of State or Territory authority
31 Subsection 6(1)
Defines subcontractor for a government contract.
32 Subsection 6(1)
that is or was responsible under the subcontract for the provision of services to an agency or a State or Territory authority...
Identifies the organisation responsible under the subcontract.
subcontractor, for a government contract, means an organisation:
(a) that is or was a party to a contract...
Identifies the parties involved in the subcontract.
(i) with a contracted service provider for the government contract...
Identifies the contracted service provider.
(ii) with a subcontractor for the government contract...
Defines temporary public interest determination
33 Subsection 6(1)
Additions to Schedule 1 of the Privacy Act 1988
34 At the end of subsection 6(7)
privacy-amendment-private-sector-act-2000.pdf, p.17
35 Subsection 6(8)
Determines relationship between bodies corporate under Corporations Law
35(8) Subsection 6(8)
Services provided to an agency or State/territory authority include services to other persons.
35(9) Subsection 6(8)
Includes provision of services to other persons
36 After section 6
privacy-amendment-private-sector-act-2000.pdf, p.27
Prevents breach of National Privacy Principle or approved privacy code regardless of contract date.
37 Application
38 At the end of paragraph 7(1)(ed)
An organisation must not engage in a practice without an exempt act or exempt practice.
39 After paragraph 7(1)(ed)
privacy-amendment-private-sector-act-2000.pdf, p.9
4 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.28
Insert approved privacy code after Information Privacy Principles
40 Subsection 7(2)
privacy-amendment-private-sector-act-2000.pdf, p.54
40A Referring complaint about act under Commonwealth contract
Complaint about act under Commonwealth contract
40A(1) Referring complaint about act under Commonwealth contract
Adjudicator must stop investigating complaint and refer to Commissioner.
40A(2) Referring complaint about act under Commonwealth contract
Commissioner must investigate complaint as if made under section 36.
40A(3) Referring complaint about act under Commonwealth contract
Investigation within temporal interval of subsection 40(1B)
Temporal interval of investigation includes subsection 40(1B)
Acceptance of complaint implies investigation
Commissioner's investigation implies acceptance of complaint
Investigation as if complaint made under section 36
Complaint investigated as if made under section 36
41 Subsection 7(4)
42 After section 7
privacy-amendment-private-sector-act-2000.pdf, p.32
Insertion of 'organisation' after 'agency' in section 8 heading.
43 Paragraph 8(1)(a)
Insertion of 'organisation' after 'the agency'
44 Paragraph 8(1)(a)
Insert “or organisation” after “an agency”.
45 Paragraph 8(1)(b)
Insert 'or organisation' after 'the agency'
46 Paragraph 8(1)(b)
47 At the end of section 8
An act done by a partner is taken to have been done by the organisation.
47(3) At the end of section 8
The organisation's actions overlap with the acts of partners.
States that an act done by a partner overlaps with the organisation's actions.
The organisation's actions incorporate the acts of partners.
States that an act done by a partner incorporates into the organisation's actions.
Imposes a duty on the state to treat partners as if they were the organisation.
The state is required to treat partners as if they were the organisation.
The acts of partners diffuse to the organisation.
States that an act done by a partner diffuses to the organisation.
The acts of partners are recurrent in relation to the organisation.
States that an act done by a partner is recurrent in relation to the organisation.
An act done by a member of the committee is taken to have been done by the organisation.
47(4) At the end of section 8
The organisation and the member are during the same time.
An act done by a member is during the same time as an act done by the organisation.
An act done by a member implies that the organisation does the act.
An act done by a member is an act done by the organisation.
An act done by a trustee is attributed to the organisation.
47(5) At the end of section 8
The organisation's temporal interval contains the action's temporal interval.
The action's temporal interval is contained within the organisation's temporal interval.
The organisation's knowledge includes its trustees' actions.
The organisation is held responsible for the action.
The organisation receives information from the trustee.
Information flows from the trustee to the organisation.
A communication made to a trustee is attributed to the organisation.
48 At the end of Part II
privacy-amendment-private-sector-act-2000.pdf, p.34
Amendment of the Privacy Act 1988 Schedule 1
49 Before section 13
5 Subsection 6(1)
Approved privacy code means a privacy code approved by the Commissioner under section 18BB
Privacy code approved by the Commissioner under section 18BB
Approved privacy code means a privacy code approved by the Commissioner under section 18BB with variations approved by the Commissioner under section 18BD
Privacy code with variations approved by the Commissioner under section 18BD
50 Section 13
privacy-amendment-private-sector-act-2000.pdf, p.57
50A Substitution of respondent to complaint
Commissioner can substitute an agency for an organisation as respondent to a complaint under certain conditions.
50A(1) Substitution of respondent to complaint
Commissioner has the power to substitute an agency for an organisation.
Specify agency or principal executive as respondent to complaint
50A(2) Substitution of respondent to complaint
Agency must provide written submissions on proposed amendment.
50A(3) Substitution of respondent to complaint
Commissioner satisfies subsection 43(1A) if amends complaint during investigation.
50A(4) Substitution of respondent to complaint
51 Paragraphs 13(b) and (d)
52 After section 13
An act or practice of an organisation may be an interference with the privacy of an individual.
53 Application
privacy-amendment-private-sector-act-2000.pdf, p.58
53A Notice to be given to outsourcing agency
Commissioner must give notice to agencies
53A(1) Notice to be given to outsourcing agency
The Commissioner must consult with the agency before giving a recommendation.
53A(2) Notice to be given to outsourcing agency
The Commissioner must consult with the agency.
Agency must notify Commissioner of proposed action within 60 days.
53A(3) Notice to be given to outsourcing agency
privacy-amendment-private-sector-act-2000.pdf, p.59
53B Substituting respondent to determination
Complainant entitled to compensation if respondent ceases to exist or becomes bankrupt
53B(1) Substituting respondent to determination
Complainant had not been paid whole or part of amount referred to in subparagraph (b)(i) or (b)(ii)
Compensation due during bankruptcy or insolvency
Respondent becomes bankrupt or insolvent, commences to be wound up
Complainant entitled to specified amount by way of compensation
State has obligation to pay compensation
Respondent is contracted service provider for Commonwealth contract
State has permission to pay compensation after bankruptcy or insolvency
State has obligation to pay reimbursement after bankruptcy or insolvency
Compensation is a subclass of reimbursement
Declaration under subsection 52(3) that complainant is entitled to specified amount by way of reimbursement
Agency is respondent to determination under section 52.
53B(2) Substituting respondent to determination
Substituting respondent to determination
Notice stating proposal and reasons, opportunity to make submissions
Notice and opportunity to appear before the Commissioner
53B(3) Substituting respondent to determination
Obligation to provide notice and appear before the Commissioner
54 After section 16
55 After section 18
privacy-amendment-private-sector-act-2000.pdf, p.60
55 Obligations of respondent organisation
Must not repeat or continue covered conduct, and must perform covered act.
55(1) Obligations of respondent organisation
Temporal overlap between obligations and conduct
(1) An organisation that is the respondent to a determination made under section 52:
55(2) Obligations of respondent organisation
(2) An organisation that is the respondent to a determination made under an approved privacy code:
Prohibits repeating or continuing covered conduct.
privacy-amendment-private-sector-act-2000.pdf, p.61
55A Proceedings in the Federal Court or Federal Magistrates Court
Any of the following persons may commence proceedings in the Federal Court or the Federal Magistrates Court for an order to enforce a determination.
55A(1) Proceedings in the Federal Court or Federal Magistrates Court
Court may make orders if respondent has engaged in conduct that constitutes an interference with the privacy of the complainant.
55A(2) Proceedings in the Federal Court or Federal Magistrates Court
Grant interim injunction pending proceedings determination
55A(3) Proceedings in the Federal Court or Federal Magistrates Court
Court cannot require giving an undertaking as a condition of granting an interim injunction.
55A(4) Proceedings in the Federal Court or Federal Magistrates Court
Court cannot impose obligation on person
Court must deal with question of privacy interference de novo.
55A(5) Proceedings in the Federal Court or Federal Magistrates Court
Obligation to deal with question of privacy interference de novo.
Court may receive certain documents as evidence in proceedings about a determination made by the Commissioner.
55A(6) Proceedings in the Federal Court or Federal Magistrates Court
Court obligation to receive certain documents as evidence.
Court may receive certain documents as evidence in proceedings about a determination made by an adjudicator under an approved privacy code.
55A(7) Proceedings in the Federal Court or Federal Magistrates Court
Court may receive records of appearances before the adjudicator
Court may receive certain documents as evidence
Court must have due regard to matters required by paragraph 29(a)
55A(7A) Proceedings in the Federal Court or Federal Magistrates Court
Defines 'complainant' in relation to a representative complaint.
55A(8) Proceedings in the Federal Court or Federal Magistrates Court
privacy-amendment-private-sector-act-2000.pdf, p.62
55B Evidentiary certificate
Commissioner must issue written certificate on findings of fact
55B(1) Evidentiary certificate
Adjudicator must issue written certificate setting out findings of fact.
55B(2) Evidentiary certificate
Adjudicator has an obligation to issue a written certificate.
Certificate not prima facie evidence of specified agency or organisation breach
55B(3) Evidentiary certificate
Document purporting to be a certificate must be taken as a certificate unless proven otherwise.
55B(4) Evidentiary certificate
Obligation to take the document as a certificate
Inserts National Privacy Principles and Part IIIAA provisions
56 After paragraph 18A(3)(a)
Amendment of section 18A of the Privacy Act 1988 applies to preparation of Code of Conduct after commencement.
57 Application
Inserts Part IIIAA—Privacy codes after Part III
58 After Part III
privacy-amendment-private-sector-act-2000.pdf, p.49
Functions and powers of the Commissioner
59 After paragraph 27(1)(a)
5B Extra-territorial operation of Act
Extra-territorial operation of Act obligation
5B(1) Extra-territorial operation of Act
...if the act or practice is required by an applicable foreign law.
Requires compliance during the organisation's overseas act or practice
(b) the requirements of subsection (2) or (3) are met.
...and approved privacy codes extend to an act done, or practice engaged in...
Obliges the organisation to comply with the Act
Exempts from National Privacy Principle or approved privacy code if required by a foreign law
...or be an interference with the privacy of an individual if...
Requires compliance with the Act for an organisation's overseas act or practice
The organisation must be an Australian citizen or a person whose continued presence in Australia is not subject to a limitation as to time imposed by law.
5B(2) Extra-territorial operation of Act
The organisation must be present in Australia during the specified time period.
Conditions for extra-territorial operation of Act
5B(3) Extra-territorial operation of Act
If the personal information was collected or held during this period, it meets condition (c).
The personal information was collected or held by the organisation before or at the time of the act or practice.
It implies that the organisation must meet conditions (b) and (c).
If the organisation carries on business in Australia or an external Territory.
The organisation is described in subsection (2).
If the organisation does not meet these conditions, it is not entitled to operate extra-territorially.
The organisation must meet these conditions.
It implies that the organisation must meet these conditions if it wants to operate extra-territorially.
If the organisation meets these conditions, it is entitled to operate extra-territorially.
Commissioner has obligation to take action overseas for complaints and investigations.
5B(4) Extra-territorial operation of Act
The Commissioner's action must be taken because of subsection (1).
Subsection (1) is a condition for extra-territorial operation
Part V of this Act has extra-territorial operation because of subsection (1)
Commissioner must take action overseas for complaints and investigations.
Part V of this Act has extra-territorial operation
The Commissioner has permission to investigate complaints and practices.
Commissioner is allowed to take action overseas for complaints and investigations.
This lets the Commissioner take action overseas
The Commissioner's action must be taken within the context of extra-territorial operation.
Ancillary provisions of Part V operate in the context of extra-territorial operation
This lets the Commissioner take action overseas to investigate complaints and lets the ancillary provisions of Part V operate in that context.
Definition of breach an approved privacy code
6 Subsection 6(1)
Breach an approved privacy code has the meaning given by section 6B.
Insert “or organisation” after “agency”.
60 Paragraph 27(1)(b)
Add “and of the National Privacy Principles”.
61 At the end of paragraph 27(1)(d)
Insertion of 'or an organisation' after 'agency'
62 Paragraph 27(1)(e)
Insert guidelines for preparing and publishing privacy codes.
63 After paragraph 27(1)(e)
privacy-amendment-private-sector-act-2000.pdf, p.50
Provide advice on matters relevant to the operation of this Act.
64 Paragraph 27(1)(f)
65 Paragraphs 27(1)(n) and (o)
Add: (s) to do anything incidental or conducive to the performance of any of the Commissioner’s other functions.
66 At the end of subsection 27(1)
Commissioner not subject to Part V in performing functions and exercising powers.
67 After subsection 27(1)
Commissioner has an obligation not to be subject to Part V.
Commissioner may examine records of an organisation upon request.
68 At the end of section 27
68A Identity cards
Recent photograph of the authorised person
Commissioner must issue identity card to authorised person.
68A(1) Identity cards
Must return identity card to Commissioner upon ceasing authorization.
68A(2) Identity cards
Prohibition on contravening subsection (2)
68A(3) Identity cards
privacy-amendment-private-sector-act-2000.pdf, p.51
Insertion of '(through the media and otherwise)' after 'free flow of information'
69 Paragraph 29(a)
Insertion happens during the text's existence
6A Breach of a National Privacy Principle
Breach of a National Privacy Principle is defined as an act or practice contrary to or inconsistent with the relevant principle.
6A(1) Breach of a National Privacy Principle
Breach occurs during the relevant principle's applicability
(1) For the purposes of this Act, an act or practice breaches a National Privacy Principle if, and only if it is contrary to, or inconsistent with, that National Privacy Principle.
Contradicts a National Privacy Principle
Exemption for disclosure to the Archives
6A(2) Breach of a National Privacy Principle
No breach if disclosure for Archives' decision-making purposes
6A(3) Breach of a National Privacy Principle
Disclosure not a breach if for Archives' decision-making
Act or practice outside Australia and foreign country law is exempt from National Privacy Principle breach.
6A(4) Breach of a National Privacy Principle
Subsections (2), (3) and (4) have effect despite subsection (1).
6A(5) Breach of a National Privacy Principle
privacy-amendment-private-sector-act-2000.pdf, p.18
6B Breach of an approved privacy code
Act or practice breaches an approved privacy code if it is contrary to or inconsistent with the code.
6B(1) Breach of an approved privacy code
No breach if done for contract purposes or authorized by the contract.
6B(2) Breach of an approved privacy code
6B(3) Breach of an approved privacy code
Act or practice outside Australia and foreign country law is exempted.
6B(4) Breach of an approved privacy code
Exemption from breach of approved privacy code
6B(5) Breach of an approved privacy code
privacy-amendment-private-sector-act-2000.pdf, p.19
6C Organisations
6C(1) Organisations
A legal person can have multiple capacities, and in each capacity, they are considered a different organisation.
6C(2) Organisations
Describes the temporal relationship between capacities.
In each of those capacities, the person is taken to be a different organisation.
Identifies the subject of the obligation.
6C(3) Organisations
Minister must consult Commissioner before prescribing instrumentality for organisation purposes.
6C(4) Organisations
Definition of State excludes Australian Capital Territory and Northern Territory.
6C(5) Organisations
privacy-amendment-private-sector-act-2000.pdf, p.22
6D Small business and small business operators
Business must meet annual turnover threshold to be considered a small business.
6D(1) Small business and small business operators
The business's annual turnover for the previous financial year must be $3,000,000 or less.
Annual turnover threshold applies to a specific time period (previous financial year).
The test time is a financial year (the current year).
The business's annual turnover for the previous financial year must be $3,000,000 or less to be classified as small.
Business classification uses artificial intelligence to determine eligibility.
The business is a small business at the test time if its annual turnover for the current year is $3,000,000 or less.
Business is obligated to meet the annual turnover threshold.
Annual turnover for the previous financial year is $3,000,000 or less.
The business's classification as a small business operator depends on meeting the annual turnover threshold.
Business classification affects its status as a small business operator.
A business is considered a small business operator if it meets the annual turnover threshold.
Business classification is based on a specific time period (previous financial year).
Business is a small business if annual turnover for the current year is $3,000,000 or less.
6D(2) Small business and small business operators
The business was carried on in the previous financial year if its annual turnover for the current year is $3,000,000 or less.
If there was no time in the previous financial year when the business was carried on, then the business is a small business at the test time only if its annual turnover for the current year is $3,000,000 or less.
The business is a small business operator if it meets the conditions.
6D(3) Small business and small business operators
Exempts certain individuals and entities from being considered small business operators.
6D(4) Small business and small business operators
Defines a temporal interval for exemption
Financial year ended after the later of the start date or section commencement
Carries on a business with annual turnover over $3,000,000
Exempts individuals from being small business operators under certain conditions.
6D(5) Small business and small business operators
Small business operators are exempt from disclosure requirements.
6D(6) Small business and small business operators
Disclosure of personal information is permitted with consent or under legislation.
6D(7) Small business and small business operators
An individual can be a small business operator despite collecting personal information with consent or authorization.
6D(8) Small business and small business operators
A body corporate is not a small business operator if it is related to another body corporate carrying on a non-small business.
6D(9) Small business and small business operators
privacy-amendment-private-sector-act-2000.pdf, p.24
6DA What is the annual turnover of a business?
Defines annual turnover of a business for tax purposes.
6DA(1) What is the annual turnover of a business?
States the definition of annual turnover
Business must calculate annual turnover using a formula for partial financial years.
6DA(2) What is the annual turnover of a business?
6E Small business operator treated as organisation
Small business operator treated as organisation
6E(1) Small business operator treated as organisation
Temporal interval for regulation modification
Mandatory treatment of small business operators
6E(2) Small business operator treated as organisation
Applicability of the Act to small business operators
6E(3) Small business operator treated as organisation
modifications includes additions, omissions and substitutions.
Minister must consult Commissioner before regulating small business operator under Act.
6E(4) Small business operator treated as organisation
Consultation must occur before regulation.
Minister must take action before regulation.
privacy-amendment-private-sector-act-2000.pdf, p.26
6EA Small business operators choosing to be treated as
Must register choice to be treated as an organisation
6EA(1) Small business operators choosing to be treated as
6EA(2) Small business operators choosing to be treated as
Can choose to be treated as an organisation
Must enter operator's name and ABN in a register.
6EA(3) Small business operators choosing to be treated as
Removal of material from register upon revocation of choice to be treated as an organisation.
6EA(4) Small business operators choosing to be treated as
Commissioner's discretion to decide register form and keeping method
6EA(5) Small business operators choosing to be treated as
Must make register available to public in specified way, but not beyond subsection (3)
6EA(6) Small business operators choosing to be treated as
6F State instrumentalities etc. treated as organisations
State instrumentalities treated as organisations
6F(1) State instrumentalities etc. treated as organisations
States that the Act applies to State or Territory authorities and instrumentalities
6F(2) State instrumentalities etc. treated as organisations
Treats state instrumentalities as organisations
Includes modifications to treat instrumentality etc. as organisation
Minister must consult Commissioner before prescribing State authority or instrumentality.
6F(3) State instrumentalities etc. treated as organisations
Minister knows about Commissioner's desirability.
Breach of an Information Privacy Principle has a meaning affected by subsection 6(2).
7 Subsection 6(1)
Ensure consistency of directions and guidelines with relevant privacy principles.
70 Paragraph 29(d)
70A Application of Part to organisations that are not legal persons
Imposes obligation on partners instead of organisation, dischargeable by any partner
70A(1) Application of Part to organisations that are not legal persons
Imposes obligation on members of committee of management
70A(2) Application of Part to organisations that are not legal persons
on each member of the committee of management
Imposes obligation on trustees instead of organisation
70A(3) Application of Part to organisations that are not legal persons
This Part operates in relation to an act or practice of the organisation (while it was an organisation); and the individual, body corporate, partnership, unincorporated association or trust; as if he, she or it were still (and had been at all relevant times) an organisation.
70B Application of this Part to former organisations
The provision imposes a duty on the State.
71 At the end of section 30
72 Subsection 31(2)
Substitution of words in subsection (1A)
73 Subsection 36(1)
74 After subsection 36(1)
Exemption for organisations bound by approved privacy code
74(1A) After subsection 36(1)
Individuals can make complaints under an approved privacy code to the adjudicator for the code.
74(1B) After subsection 36(1)
An individual can complain about an act done by an organisation meeting a Commonwealth contract obligation.
74(1C) After subsection 36(1)
The organisation's action meets the Commonwealth contract obligation.
Temporal relationship between obligations
Subsection (1A) does not prevent an individual from complaining under this Part to the Commissioner about an act done, or practice engaged in, by an organisation.
An individual can complain about an act done by an organisation.
Subsection (1A) does not prevent an individual from complaining under this Part.
The adjudicator must refer the complaint.
Requirement for an adjudicator to refer a complaint
Section 40A requires an adjudicator for an approved privacy code to refer a code complaint to the Commissioner if the complaint is about an act or practice of a contracted service provider for a Commonwealth contract.
The individual can complain about an act done by an organisation.
(1C) Subsection (1A) does not prevent an individual from complaining under this Part to the Commissioner about an act done, or practice engaged in, by an organisation.
privacy-amendment-private-sector-act-2000.pdf, p.52
75 Subsection 36(7)
Organisation is respondent in case of complaint about an act or practice.
75(7) Subsection 36(7)
Section 70A contains further rules about how this Part operates in relation to respondent organisations that are not legal persons.
The respondent to a complaint is the person who engaged in the act or practice.
75(8) Subsection 36(7)
The person who engaged in the act or practice is the respondent.
Identifies the respondent as an obligation.
Application of subsection 36(8) of the Privacy Act 1988 to complaints made after commencement.
76 Application
76A Section 37
77 Subsection 38(1)
privacy-amendment-private-sector-act-2000.pdf, p.53
78 Subsection 38(2)
79 Subsection 40(1)
7A Acts of certain agencies treated as acts of organisation
Acts of certain agencies treated as acts of organisation
7A(1) Acts of certain agencies treated as acts of organisation
...with the prescribed modifications (if any), in relation to an act or practice described in subsection (2) or (3)
The provision relates to a temporal interval
...as if the act were an act done, or practice engaged in, by an organisation.
The provision implies a conclusion about agency and organisation
If an act is done by an agency, it is treated as if done by an organisation
The provision spreads to related concepts of agency and organisation
Acts of certain agencies are prohibited unless specified in Part I of Schedule 2 to the Freedom of Information Act 1982.
7A(2) Acts of certain agencies treated as acts of organisation
The agency must be specified within the temporal interval defined by Part I of Schedule 2 to the Freedom of Information Act 1982.
Temporal interval for agency specification
(2) Subsection (1) applies to acts done, and practices engaged in, by a prescribed agency.
The agency must be classified using the CogAI system within the temporal interval defined by Part I of Schedule 2 to the Freedom of Information Act 1982.
The information about the agency must be diffused within the temporal interval defined by Part I of Schedule 2 to the Freedom of Information Act 1982.
Diffusion of information about agency specification
Agency's commercial activities are subject to the Freedom of Information Act.
7A(3) Acts of certain agencies treated as acts of organisation
Agency is obligated to comply with the Freedom of Information Act.
Section has effect despite certain subsections.
7A(4) Acts of certain agencies treated as acts of organisation
7A(5) Acts of certain agencies treated as acts of organisation
privacy-amendment-private-sector-act-2000.pdf, p.29
7B Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations
7B(1) Exempt acts and exempt practices of organisations
7B(2) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations related to employment relationships and employee records.
7B(3) Exempt acts and exempt practices of organisations
The act occurs during the exempt period.
Defines a temporal relationship between exempt acts and practices.
An act is exempt if it overlaps with the defined interval.
The organisation can apply the exemption rules.
Defines a knowledge graph for exempt acts and practices.
An organisation has knowledge of the exempt acts and practices.
The organisation must take action to exempt the act or practice.
Imposes a duty on organisations to exempt certain acts and practices.
An organisation is required to exempt an act or practice if it meets the conditions.
The act recurs during the exempt period.
Defines a recurring relationship between exempt acts and practices.
An act is exempt if it recurs within the defined interval.
The act conforms to the exemption rules.
Defines a validation rule for exempt acts and practices.
An act is valid if it meets the defined rule.
Media organisation must observe privacy standards when engaging in journalism or certain practices.
7B(4) Exempt acts and exempt practices of organisations
Media organisation must observe privacy standards during journalism or certain practices.
Media organisation must observe privacy standards.
Exempt acts and exempt practices of organisations classified by media organisation's commitment to privacy standards.
Exempt acts and practices of organisations for meeting contract obligations
7B(5) Exempt acts and exempt practices of organisations
...if: (a) the organisation is a contracted service provider for a State contract...
Exemption applies during contract period
(5) An act done, or practice engaged in, by an organisation is exempt for the purposes of paragraph 7(1)(ee)
Exemption implies meeting contract obligations
if: (a) the organisation is a contracted service provider for a State contract...
Exemption applies to meeting contract obligations
privacy-amendment-private-sector-act-2000.pdf, p.30
7C Political acts and practices are exempt
Political acts and practices are exempt for certain purposes.
7C(1) Political acts and practices are exempt
Exemptions for political acts and practices
7C(2) Political acts and practices are exempt
Exempts political acts and practices for meeting obligations under a contract.
7C(3) Political acts and practices are exempt
(3) An act done, or practice engaged in...
Exempts political acts and practices for certain purposes.
7C(4) Political acts and practices are exempt
Agents or principals are exempt from the operation of the Act.
7C(5) Political acts and practices are exempt
The excerpt refers to a temporal relation between two intervals.
(5) Subsection (4) does not otherwise affect the operation of the Act in relation to agents or principals.
The excerpt implies that agents or principals are exempt from the operation of the Act.
The excerpt represents knowledge about exemption for agents or principals.
The excerpt propagates a rule about exemption for agents or principals.
Electoral law and Parliament definitions
7C(6) Political acts and practices are exempt
Parliament means: (a) the Parliament of the Commonwealth; or (b) a State Parliament; or (c) the legislature of a Territory.
Class hierarchy for electoral law and Parliament
electoral law means a law of the Commonwealth, or a law of a State or Territory, relating to elections to a Parliament or to a local government authority.
(a) the Parliament of the Commonwealth; or (b) a State Parliament; or (c) the legislature of a Territory.
Note on exemption for political representatives
To avoid doubt, this section does not make exempt for the purposes of paragraph 7(1)(ee) an act or practice of the political representative, contractor, subcontractor or volunteer for a registered political party involving the use or disclosure (by way of sale or otherwise) of personal information in a way not covered by subsection (1), (2), (3) or (4) (as appropriate).
Definition of breach of National Privacy Principle
8 Subsection 6(1)
80 After subsection 40(1)
Commissioner must not investigate complaint if complainant did not complain to respondent first.
80(1A) After subsection 40(1)
Commissioner must not investigate complaint
The Commissioner must investigate a complaint about an act or practice that may be an interference with the privacy of an individual.
80(1B) After subsection 40(1)
The Commissioner must investigate a complaint.
(1B) The Commissioner must investigate under this Part a complaint...
Commissioner must deal with accepted complaint as if it were a complaint under section 36.
80(1C) After subsection 40(1)
Deal with complaint as if it were a complaint under section 36.
80A Temporary public interest determinations
Commissioner must determine if agency or organisation breaches privacy principles.
80A(1) Temporary public interest determinations
...the public interest in adhering to that Principle or code;
Commissioner must act within a timeframe.
(c) the application raises issues that require an urgent decision.
Commissioner must consider agency or organisation's actions.
(b) the public interest in the agency or organisation doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Principle or code;
...the public interest in adhering to that Principle or code; and (b) the public interest in the agency or organisation doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Principle or code;
Agency or organisation must comply with privacy principles.
(a) the act or practice of an agency or organisation that is the subject of an application under section 73 for a determination under section 72 breaches, or may breach: ...
Commissioner must consider public interest in agency or organisation's actions.
The Commissioner may make a written temporary public interest determination.
80A(2) Temporary public interest determinations
Commissioner must specify a period and reasons for temporary public interest determination.
80A(3) Temporary public interest determinations
privacy-amendment-private-sector-act-2000.pdf, p.71
80B Effect of temporary public interest determination
Agency not in breach if act or practice subject to temporary public interest determination.
80B(1) Effect of temporary public interest determination
...the agency does the act, or engages in the practice,...
Temporal interval during which agency's action is excused
(1) If an act or practice of an agency is the subject of a temporary public interest determination...
...the agency is taken not to breach section 16 if the agency does the act, or engages in the practice,...
Exemption from contravening section 16A while temporary public interest determination is in force.
80B(2) Effect of temporary public interest determination
Organisation not contravening section 16A
During temporary public interest determination
Act or practice of organisation subject to temporary public interest determination
Temporary public interest determination in force
Organisation not contravening section 16A if act is subject to temporary public interest determination
80B(3) Effect of temporary public interest determination
No organisation is taken to contravene section 16A
Effect of temporary public interest determination
80B(4) Effect of temporary public interest determination
Disallowable instrument for section 46A of the Acts Interpretation Act 1901.
80C Determinations disallowable
80D Commissioner may continue to consider application
Commissioner may continue to consider application despite previous determination.
80D(1) Commissioner may continue to consider application
Commissioner may continue to consider application
Commissioner's determination does not prevent continuation of application
Determination ceases to be in effect when another determination comes into effect or the application is dismissed.
80D(2) Commissioner may continue to consider application
(2) A determination under this Division about an act or practice ceases to be in effect when: (a) a determination made under subsection 72(1) or (2) (as appropriate) about the act or practice comes into effect;
(2) A determination under this Division about an act or practice ceases to be in effect when:
Subject to another determination coming into effect
(2) A determination under this Division about an act or practice ceases to be in effect when: (b) a determination is made under paragraph 78(b) to dismiss the application.
80E Register of determinations
The Commissioner must keep a register of determinations.
80E(1) Register of determinations
80E(2) Register of determinations
80E(3) Register of determinations
The register is accessible to the public during its registration process
(3) The Commissioner must make the register available to the public in the way that the Commissioner determines.
The availability of the register implies its accessibility to the public
Public access implies availability of information
The AI system recognizes the accessibility of the register to the public
The diffusion of information implies its accessibility to the public through the register
80E(4) Register of determinations
Commissioner may charge fees for making register available to public and providing copies of register
81 At the end of section 40
82 After section 40
83 Subsection 41(1)
84 Paragraph 41(1)(b)
Repeal certain paragraphs and substitute with new provisions regarding the Privacy Act 1988.
85 Paragraphs 41(1)(e) and (f)
The act or practice is not the subject of an application under this law.
Prohibits dealing with complaints under another law if it has been adequately dealt with.
Another Commonwealth law or State/Territory law provides a more appropriate remedy.
The subject-matter of the complaint has been, or is being, dealt with adequately under that law.
The act or practice is not subject to this law.
Implies that if another law provides a more appropriate remedy, then the act or practice is not subject to this law.
Another Commonwealth law, or a State or Territory law, provides a more appropriate remedy for the act or practice.
Implies that if the subject-matter of the complaint has been, or is being, dealt with adequately under another law, then the act or practice is not subject to this law.
privacy-amendment-private-sector-act-2000.pdf, p.55
86 Subsections 41(2) and 41(3)
Commissioner must not investigate unless interference with privacy of Australian citizens or permanent residents.
87 Subsection 41(4)
...the Commissioner must not investigate the act or practice except to the extent that it is an interference with the privacy of one or more individuals each of whom is...
Interference with privacy must occur within a specified time frame.
(4) If an act or practice may be an interference with the privacy of an individual solely because it may breach...
No investigation unless interference with privacy of Australian citizens or permanent residents.
Insertion of a phrase after 'Commissioner'
88 Section 42
Inform agency of investigation into act or practice by contracted service provider.
89 After subsection 43(1)
9 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.56
Insert “, organisation” after “agency” twice.
90 Subsection 43(6)
The Commissioner is not allowed to discuss a matter relevant to an investigation of a breach of an approved privacy code or the National Privacy Principles with a Minister, unless certain conditions are met.
91 After subsection 43(8)
Insertion of exception for NPP complaints and code complaints
92 Subsection 46(1)
Commissioner must inform agency of decision not to investigate contracted service provider.
93 At the end of section 48
Commissioner has a duty to inform the agency.
94 After section 50
95 Subsection 52(3A)
Commissioner may include an order in a determination concerning breach of certain privacy principles.
95(3A) Subsection 52(3A)
Order to make correction, deletion, or addition to a record or credit report.
95(3B) Subsection 52(3A)
95A Guidelines for National Privacy Principles about health
Commissioner approves guidelines for use and disclosure
95A(1) Guidelines for National Privacy Principles about health
Allows Commissioner to approve guidelines
Commissioner may approve guidelines for research or statistics
95A(2) Guidelines for National Privacy Principles about health
Approval required for guidelines on health information disclosure.
95A(3) Guidelines for National Privacy Principles about health
Commissioner may approve guidelines for health information collection
95A(4) Guidelines for National Privacy Principles about health
Commissioner has the power to approve guidelines
Approval must be given only if public interest in health information collection substantially outweighs privacy protection.
95A(5) Guidelines for National Privacy Principles about health
Public interest in health information collection
Commissioner may revoke guidelines by notice in the Gazette.
95A(6) Guidelines for National Privacy Principles about health
Commissioner has power to revoke guidelines
Right to appeal a decision of the Commissioner
95A(7) Guidelines for National Privacy Principles about health
privacy-amendment-private-sector-act-2000.pdf, p.74
95B Requirements for Commonwealth contracts
Agency must ensure contracted service provider does not breach Information Privacy Principle.
95B(1) Requirements for Commonwealth contracts
Agency must ensure contract does not authorise contracted service provider to engage in certain acts or practices.
95B(2) Requirements for Commonwealth contracts
The provision is prohibited within the specified time frame.
Prohibition of engaging in certain acts or practices within a specific time frame.
(2) The agency must ensure that the Commonwealth contract does not authorise a contracted service provider for the contract to do or engage in such an act or practice.
CogAI's prohibition of engaging in certain acts or practices.
The agency must ensure that the contract does not authorise the provision to engage in certain acts or practices.
Prohibition of engaging in certain acts or practices.
The provision is prohibited and diffused through contractual services.
Diffusion of prohibition through contractual services.
Agency must ensure Commonwealth contract provisions prevent unauthorized subcontracting.
95B(3) Requirements for Commonwealth contracts
Temporal interval for ensuring Commonwealth contract compliance with requirements.
(3) The agency must also ensure that the Commonwealth contract contains provisions to ensure that such an act or practice is not authorized by a subcontract.
Provisions for ensuring Commonwealth contract compliance with requirements.
Obligation to ensure Commonwealth contract provisions prevent unauthorized subcontracting.
Subcontract is a contract under which a contracted service provider provides services to another contracted service provider or an agency.
95B(4) Requirements for Commonwealth contracts
Classification of subcontract as a type of contract
Agency must comply with section requirements regardless of its role in the contract.
95B(5) Requirements for Commonwealth contracts
Agency must comply with section requirements.
Party must inform person of inconsistent contract provisions.
95C Disclosure of certain provisions of Commonwealth contracts
96 At the end of Division 2 of Part V
97 Division 3 of Part V (heading)
Judicial review of privacy code determinations is subject to the Administrative Decisions (Judicial Review) Act 1977.
98 After subsection 54(1)
Temporal overlap between judicial review and privacy code determinations
The making of a determination by the Commissioner under this Act or by an adjudicator under an approved privacy code is subject to judicial review under the Administrative Decisions (Judicial Review) Act 1977.
The making of a determination by the Commissioner under this Act or by an adjudicator under an approved privacy code is subject to judicial review.
Prohibition on making determinations without judicial review
Recurring application of judicial review
Repeal section and substitute with new content.
99 Section 55
privacy-amendment-private-sector-act-2000.pdf, p.90
Prevents removal of industry code from the Register under section 122A.
10 At the end of subsection 120(1)
Removal from Register and removal under section 122A overlap
Removal from Register overlaps with removal under section 122A
Removal of industry code implies removal under section 122A is not allowed
Removal of industry code prevents removal under section 122A
Removal from Register is valid according to section 10
Removal from Register is validated by section 10
Obligation to maintain industry code in Register
Removal of industry code propagates to removal under section 122A
Removal from Register propagates to removal under section 122A
Consult Privacy Commissioner before giving direction if contravention relates to National Privacy Principles or approved privacy code.
11 After subsection 121(1)
Consult Privacy Commissioner before giving direction
Obligation to consult Privacy Commissioner
Contravention relates to National Privacy Principles or approved privacy code
privacy-amendment-private-sector-act-2000.pdf, p.89
Industry codes and standards do not affect Privacy Act 1988 requirements.
116A Industry codes and standards do not affect Privacy Act 1988
Consult Privacy Commissioner before issuing warning if contravention relates to National Privacy Principles or approved privacy code.
12 At the end of section 122
privacy-amendment-private-sector-act-2000.pdf, p.91
122A De-registering industry codes and provisions of industry codes
The ACA may remove industry codes from the Register.
122A(1) De-registering industry codes and provisions of industry codes
Industry code ceases to be registered when removed from the Register.
122A(2) De-registering industry codes and provisions of industry codes
An industry code ceases to be registered.
(2) An industry code ceases to be registered...
Conditional effect of removal of provision from industry code
122A(3) De-registering industry codes and provisions of industry codes
13 At the end of Division 4 of Part 6
Allowing variation of industry standards under certain conditions.
14 At the end of subsection 130(1)
Repeal subsection, substitute with new obligations regarding industry standards related to privacy.
15 Subsection 134(1)
16 After subsection 136(1)
privacy-amendment-private-sector-act-2000.pdf, p.92
17 At the end of Division 4 of Part 13
Insert clause after Division 4 of Part 13
18 After Division 4 of Part 13
privacy-amendment-private-sector-act-2000.pdf, p.93
Inserts 'and the National Privacy Principles' after 'Privacy Act 1988'
19 Subclause 15(2) of Schedule 2
Inserts National Privacy Principle 2 and approved privacy codes into the law.
20 After subparagraph 147(2)(l)(i)
privacy-amendment-private-sector-act-2000.pdf, p.88
3 After section 273GAA
Disclosure of personal information to an officer for travel purposes.
3(1) After section 273GAA
No requirement to disclose information to an officer.
3(2) After section 273GAA
Nothing in this Division limits the generality of anything else in it.
303A Generality of Division not limited
303B Acts taken to be authorised by law for purposes of Privacy Act
Disclosure or use of information is authorized by law for Privacy Act purposes.
303B(1) Acts taken to be authorised by law for purposes of Privacy Act
Authorizes disclosure or use of information.
Disclosure or use of information is authorized for Privacy Act purposes.
303B(2) Acts taken to be authorised by law for purposes of Privacy Act
303C Prosecution of an offence against this Part does not affect
No effect on civil proceedings or administrative action under Privacy Act 1988
303C(1) Prosecution of an offence against this Part does not affect
No effect on civil proceedings or administrative action
(1) The prosecution of an offence against Division 2 or 4 of this Part for disclosure or use of information or a document does not prevent civil proceedings or administrative action from being taken under the Privacy Act 1988 or an approved privacy code (as defined in that Act) in relation to the disclosure or use.
Prosecution of an offence against this Part does not affect the outcome.
303C(2) Prosecution of an offence against this Part does not affect
The prosecution and outcome are overlapping intervals.
If prosecution affects outcome, then it is not an offence.
Does not affect the operation of section 49 of the Privacy Act 1988.
303C(3) Prosecution of an offence against this Part does not affect
4 At the end of Division 3 of Part 6
5 Paragraph 117(1)(j)
The ACA must consult with the Privacy Commissioner about a code.
6 At the end of subsection 117(1)
An industry code ceases to be registered when it is removed from the Register of industry codes under section 122A.
7 At the end of subsection 117(4)
8 At the end of subsection 118(1)
The ACA must consult the Privacy Commissioner before making a request for the development of an industry code.
9 After subsection 118(4)
The consultation request can only be made after the effective date of subsection (4A)
Temporal interval for consultation request
The consultation request must be made after subsection (4A) comes into effect
The industry code is a specific concept in this context
An industry code is a set of rules for the telecommunications industry
The request must be made with consultation
Obligation to consult the Privacy Commissioner
The ACA is required to consult the Privacy Commissioner
The industry code can only be developed within a certain timeframe
Temporal interval for industry code development
The industry code must be developed before the end of the specified period
The industry code is valid if it meets the requirements set by the Privacy Commissioner
The industry code must be validated by the Privacy Commissioner
1 Collection
Organisation must not collect personal information unless necessary for its functions or activities.
1 Section 1
Prohibition of collecting personal information
Organisation must collect personal information lawfully and fairly.
Organisation must collect personal information.
Organisation must inform individual of personal information collection details.
privacy-amendment-private-sector-act-2000.pdf, p.77
Organisation must collect personal information from individual if reasonable and practicable.
Must collect personal information from individual.
awareness of matters listed in subclause 1.3
Organisation must inform individual about personal info collection
Organisation's obligation to inform individual
privacy-amendment-private-sector-act-2000.pdf, p.94
1 Section 93A
privacy-amendment-private-sector-act-2000.pdf, p.85
10 Sensitive information
Organisation must not collect sensitive information about an individual unless certain conditions are met.
10 Section 10
...unless the information is collected in the course of non-profit activities.
Temporal overlap with lawful requirement
Prohibits collection of sensitive information
privacy-amendment-private-sector-act-2000.pdf, p.86
Organisation may collect health information under certain conditions.
Organisation may collect health information
Organisation may collect health information under specified conditions.
privacy-amendment-private-sector-act-2000.pdf, p.87
Organisation must de-identify health information before disclosure.
2 Use and disclosure
Organisation must not use or disclose personal information for a purpose other than the primary purpose of collection unless certain conditions are met.
2 Section 2
Organisation must not use or disclose personal information for a purpose other than the primary purpose of collection.
The organisation's business address and telephone number must be provided in direct marketing communications.
privacy-amendment-private-sector-act-2000.pdf, p.79
Must make a written note of use or disclosure under paragraph 2.1(h)
Organisation's primary purpose of collection of information
privacy-amendment-private-sector-act-2000.pdf, p.80
Disclosure of health information under certain circumstances.
...the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (b).
Temporal overlap between disclosure and care provision.
The disclosure is not contrary to any wish expressed by the individual before the individual became unable to give or communicate consent.
...the disclosure is necessary to provide appropriate care or treatment of the individual.
Permission to disclose health information under certain circumstances.
The organisation may disclose health information about the individual if...
...disclose health information about the individual if...
Allowance of disclosure under certain conditions.
Despite subclause 2.1, an organisation that provides a health service to an individual may...
...the disclosure is made for compassionate reasons.
Limitation of disclosure under certain conditions.
The disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (b).
...the disclosure is not contrary to any wish expressed by the individual before the individual became unable to give or communicate consent.
Restriction of disclosure under certain conditions.
Defines family relationships for the purpose of the Privacy Act 1988
Exempts certain acts from Privacy Act 1988
2 Saving
privacy-amendment-private-sector-act-2000.pdf, p.81
Ensure personal information is accurate, complete and up-to-date.
3 Data quality
Exempts disclosure of personal information to certain agencies.
3 After subsection 7(1)
Prohibits disclosure of personal information.
Ensure accuracy, completeness and timeliness.
4 Data security
Organisation must protect personal information
4 Section 4
Organisation must take reasonable steps to destroy or de-identify personal information.
Amendment of Privacy Act 1988 applies to determining operation in relation to acts or practices regardless of time.
4 Application
Imposes a duty on the state to determine operation in relation to acts or practices.
5 Openness
Organisation must set out policies on personal information management.
5 Section 5
Organisation must provide personal information to a person on request.
privacy-amendment-private-sector-act-2000.pdf, p.82
6 Access and correction
Organisation must not provide access to personal information under certain conditions.
6 Section 6
Organisation is prohibited from providing access to personal information under certain conditions.
privacy-amendment-private-sector-act-2000.pdf, p.83
Organisation must provide explanation for commercially sensitive decision.
Organisation must provide individual with access to information if required.
Consider mutually agreed intermediaries to meet access needs.
Organisation's charges for access to personal information must not be excessive and cannot apply to lodging a request.
Organisation's charges must not be excessive.
Charges cannot apply to lodging a request.
Organisation must correct inaccurate personal information upon request.
Organisation must take reasonable steps to associate with inaccurate information a statement claiming it is not accurate.
Time period during which organisation must take action.
Statement claiming inaccuracy must be associated with information.
Must provide reasons for denial of access or refusal to correct personal information.
privacy-amendment-private-sector-act-2000.pdf, p.84
7 Identifiers
Cannot adopt an identifier assigned by an agency, agent, or contracted service provider.
7 Section 7
Prohibition of adopting an identifier assigned by an agency, agent, or contracted service provider.
Exemption from subclause 7.1 for prescribed organisation adoption of identifier in circumstances.
Organisation must not use or disclose an identifier assigned to an individual without permission.
Prohibition of using or disclosing identifiers.
An individual's name or ABN is not an identifier.
Individuals must have the option of not identifying themselves when entering transactions with an organisation.
8 Anonymity
Transfer of personal information for specified purposes
9 Transborder data flows
Permits transfer of personal information under specified conditions
The organisation may transfer personal information to a foreign country if...
privacy-amendment-private-sector-act-2000.pdf, p.6
1 Short title
2 Commencement
2(1) Commencement
2(2) Commencement
Establishing a national scheme for collecting, holding, and using personal information
3 Objects
privacy-amendment-private-sector-act-2000.pdf, p.7
Amendment and repeal of Acts specified in Schedules
4 Schedule(s)
An Act to amend the law relating to privacy, and for related purposes
Privacy Amendment (Private Sector) Act 2000