Privacy Amendment (Private Sector) Act 2000
An Act to amend the law relating to privacy, and for related purposes
1 Short title
privacy-amendment-private-sector-act-2000.pdf, p.6
2 Commencement
2(1) Commencement
2(2) Commencement
3 Objects
Establishing a national scheme for collecting, holding, and using personal information
4 Schedule(s)
Amendment and repeal of Acts specified in Schedules
privacy-amendment-private-sector-act-2000.pdf, p.7
1 Section 3
Omit 'interferences with the privacy of persons' and substitute 'the collection, holding, use, correction, disclosure or transfer of personal information'.
privacy-amendment-private-sector-act-2000.pdf, p.8
Omit 'interferences with the privacy of persons'
Substitute 'the collection, holding, use, correction, disclosure or transfer of personal information'
2 At the end of section 3
Reference to other laws for handling personal information
3 At the end of Part I
5B Extra-territorial operation of Act
5B(1) Extra-territorial operation of Act
Extra-territorial operation of Act obligation
Obliges the organisation to comply with the Act
...and approved privacy codes extend to an act done, or practice engaged in...
Requires compliance during the organisation's overseas act or practice
(b) the requirements of subsection (2) or (3) are met.
...if the act or practice is required by an applicable foreign law.
Exempts from National Privacy Principle or approved privacy code if required by a foreign law
...or be an interference with the privacy of an individual if...
Requires compliance with the Act for an organisation's overseas act or practice
5B(2) Extra-territorial operation of Act
The organisation must be an Australian citizen or a person whose continued presence in Australia is not subject to a limitation as to time imposed by law.
The organisation must be present in Australia during the specified time period.
5B(3) Extra-territorial operation of Act
Conditions for extra-territorial operation of Act
The organisation must meet these conditions.
If the organisation does not meet these conditions, it is not entitled to operate extra-territorially.
The personal information was collected or held by the organisation before or at the time of the act or practice.
If the personal information was collected or held during this period, it meets condition (c).
If the organisation carries on business in Australia or an external Territory.
It implies that the organisation must meet conditions (b) and (c).
If the organisation meets these conditions, it is entitled to operate extra-territorially.
It implies that the organisation must meet these conditions if it wants to operate extra-territorially.
The organisation is described in subsection (2).
5B(4) Extra-territorial operation of Act
Commissioner has obligation to take action overseas for complaints and investigations.
Part V of this Act has extra-territorial operation
Commissioner must take action overseas for complaints and investigations.
Subsection (1) is a condition for extra-territorial operation
Part V of this Act has extra-territorial operation because of subsection (1)
The Commissioner's action must be taken because of subsection (1).
Commissioner is allowed to take action overseas for complaints and investigations.
This lets the Commissioner take action overseas
The Commissioner has permission to investigate complaints and practices.
Ancillary provisions of Part V operate in the context of extra-territorial operation
This lets the Commissioner take action overseas to investigate complaints and lets the ancillary provisions of Part V operate in that context.
The Commissioner's action must be taken within the context of extra-territorial operation.
4 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.9
5 Subsection 6(1)
Privacy code approved by the Commissioner under section 18BB
Approved privacy code means a privacy code approved by the Commissioner under section 18BB
Privacy code with variations approved by the Commissioner under section 18BD
Approved privacy code means a privacy code approved by the Commissioner under section 18BB with variations approved by the Commissioner under section 18BD
6 Subsection 6(1)
Definition of breach an approved privacy code
privacy-amendment-private-sector-act-2000.pdf, p.10
Breach an approved privacy code has the meaning given by section 6B.
7 Subsection 6(1)
Breach of an Information Privacy Principle has a meaning affected by subsection 6(2).
8 Subsection 6(1)
Definition of breach of National Privacy Principle
9 Subsection 6(1)
10 Subsection 6(1)
11 Subsection 6(1)
Definition of contracted service provider for a government contract.
Definition of a term with normative implications
12 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.11
employee record is a record of personal information relating to the employment of an employee
The employee's hours of employment are a temporal interval
The employee's hours of employment occur during the period of employment
13 Subsection 6(1)
14 Subsection 6(1) (definition of generally available
Insertion of '(however published)' after 'other publication'
privacy-amendment-private-sector-act-2000.pdf, p.12
15 Subsection 6(1)
16 Subsection 6(1)
Class hierarchy for personal information
Personal information includes health information
Health information is a subclass of personal information
Inclusive relation between health information and personal information
Health information is a subset of personal information
17 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.13
Defines a class hierarchy for health services
19 Subsection 6(1)
media organisation is a type of organisation
media organisation includes activities such as news collection
activities are part of media organisation
20 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.14
National Privacy Principle means a clause of Schedule 3.
21 Subsection 6(1)
...would be an interference with the privacy of the complainant
Defines a class hierarchy for NPP complaints
22 Subsection 6(1)
Defines organisation as given by section 6C.
22A Subsection 6(1)
Defines principal executive for an agency
23 Subsection 6(1)
24 Subsection 6(1) (at the end of paragraphs (a), (d), (e) and
Add “or” at the end of paragraphs (a), (d), (e) and (f) of the definition of record.
25 Subsection 6(1) (after paragraph (f) of the definition of
Arrange for access to records with a person other than a Commonwealth institution.
26 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.15
Part XI of the Commonwealth Electoral Act 1918
27 Subsection 6(1)
28 Subsection 6(1)
29 Subsection 6(1)
30 Subsection 6(1)
privacy-amendment-private-sector-act-2000.pdf, p.16
State contract is a contract to which a State or Territory authority is or was a party
State contract is a subclass of contract
Services are to be provided during the contract period
Contract period overlaps with service provision
31 Subsection 6(1)
Definition of State or Territory authority
32 Subsection 6(1)
Defines subcontractor for a government contract.
Identifies the organisation responsible under the subcontract.
subcontractor, for a government contract, means an organisation:
that is or was responsible under the subcontract for the provision of services to an agency or a State or Territory authority...
Identifies the parties involved in the subcontract.
(a) that is or was a party to a contract...
Identifies the contracted service provider.
(i) with a contracted service provider for the government contract...
(ii) with a subcontractor for the government contract...
33 Subsection 6(1)
Defines temporary public interest determination
34 At the end of subsection 6(7)
Additions to Schedule 1 of the Privacy Act 1988
35 Subsection 6(8)
privacy-amendment-private-sector-act-2000.pdf, p.17
35(8) Subsection 6(8)
Determines relationship between bodies corporate under Corporations Law
35(9) Subsection 6(8)
Services provided to an agency or State/territory authority include services to other persons.
Includes provision of services to other persons
36 After section 6
6A Breach of a National Privacy Principle
6A(1) Breach of a National Privacy Principle
Breach of a National Privacy Principle is defined as an act or practice contrary to or inconsistent with the relevant principle.
Contradicts a National Privacy Principle
(1) For the purposes of this Act, an act or practice breaches a National Privacy Principle if, and only if it is contrary to, or inconsistent with, that National Privacy Principle.
Breach occurs during the relevant principle's applicability
6A(2) Breach of a National Privacy Principle
Exemption for disclosure to the Archives
6A(3) Breach of a National Privacy Principle
No breach if disclosure for Archives' decision-making purposes
Disclosure not a breach if for Archives' decision-making
6A(4) Breach of a National Privacy Principle
Act or practice outside Australia and foreign country law is exempt from National Privacy Principle breach.
6A(5) Breach of a National Privacy Principle
Subsections (2), (3) and (4) have effect despite subsection (1).
6B Breach of an approved privacy code
privacy-amendment-private-sector-act-2000.pdf, p.18
6B(1) Breach of an approved privacy code
Act or practice breaches an approved privacy code if it is contrary to or inconsistent with the code.
6B(2) Breach of an approved privacy code
No breach if done for contract purposes or authorized by the contract.
6B(3) Breach of an approved privacy code
6B(4) Breach of an approved privacy code
Act or practice outside Australia and foreign country law is exempted.
Exemption from breach of approved privacy code
6B(5) Breach of an approved privacy code
6C Organisations
privacy-amendment-private-sector-act-2000.pdf, p.19
6C(1) Organisations
6C(2) Organisations
A legal person can have multiple capacities, and in each capacity, they are considered a different organisation.
Identifies the subject of the obligation.
Describes the temporal relationship between capacities.
In each of those capacities, the person is taken to be a different organisation.
6C(3) Organisations
6C(4) Organisations
Minister must consult Commissioner before prescribing instrumentality for organisation purposes.
6C(5) Organisations
Definition of State excludes Australian Capital Territory and Northern Territory.
6D Small business and small business operators
privacy-amendment-private-sector-act-2000.pdf, p.22
6D(1) Small business and small business operators
Business must meet annual turnover threshold to be considered a small business.
Business is obligated to meet the annual turnover threshold.
Annual turnover for the previous financial year is $3,000,000 or less.
The business is a small business at the test time if its annual turnover for the current year is $3,000,000 or less.
Annual turnover threshold applies to a specific time period (previous financial year).
The test time is a financial year (the current year).
The business's annual turnover for the previous financial year must be $3,000,000 or less.
Business classification is based on a specific time period (previous financial year).
Business classification affects its status as a small business operator.
A business is considered a small business operator if it meets the annual turnover threshold.
The business's classification as a small business operator depends on meeting the annual turnover threshold.
Business classification uses artificial intelligence to determine eligibility.
The business's annual turnover for the previous financial year must be $3,000,000 or less to be classified as small.
6D(2) Small business and small business operators
Business is a small business if annual turnover for the current year is $3,000,000 or less.
If there was no time in the previous financial year when the business was carried on, then the business is a small business at the test time only if its annual turnover for the current year is $3,000,000 or less.
The business was carried on in the previous financial year if its annual turnover for the current year is $3,000,000 or less.
The business is a small business operator if it meets the conditions.
6D(3) Small business and small business operators
6D(4) Small business and small business operators
Exempts certain individuals and entities from being considered small business operators.
Carries on a business with annual turnover over $3,000,000
Defines a temporal interval for exemption
Financial year ended after the later of the start date or section commencement
6D(5) Small business and small business operators
Exempts individuals from being small business operators under certain conditions.
6D(6) Small business and small business operators
Small business operators are exempt from disclosure requirements.
6D(7) Small business and small business operators
Disclosure of personal information is permitted with consent or under legislation.
6D(8) Small business and small business operators
An individual can be a small business operator despite collecting personal information with consent or authorization.
6D(9) Small business and small business operators
A body corporate is not a small business operator if it is related to another body corporate carrying on a non-small business.
6DA What is the annual turnover of a business?
privacy-amendment-private-sector-act-2000.pdf, p.24
6DA(1) What is the annual turnover of a business?
Defines annual turnover of a business for tax purposes.
States the definition of annual turnover
6DA(2) What is the annual turnover of a business?
Business must calculate annual turnover using a formula for partial financial years.
6E Small business operator treated as organisation
6E(1) Small business operator treated as organisation
Small business operator treated as organisation
Mandatory treatment of small business operators
Temporal interval for regulation modification
6E(2) Small business operator treated as organisation
Applicability of the Act to small business operators
6E(3) Small business operator treated as organisation
modifications includes additions, omissions and substitutions.
6E(4) Small business operator treated as organisation
Minister must consult Commissioner before regulating small business operator under Act.
Minister must take action before regulation.
Consultation must occur before regulation.
6EA Small business operators choosing to be treated as
privacy-amendment-private-sector-act-2000.pdf, p.26
6EA(1) Small business operators choosing to be treated as
Must register choice to be treated as an organisation
6EA(2) Small business operators choosing to be treated as
Can choose to be treated as an organisation
6EA(3) Small business operators choosing to be treated as
Must enter operator's name and ABN in a register.
6EA(4) Small business operators choosing to be treated as
Removal of material from register upon revocation of choice to be treated as an organisation.
6EA(5) Small business operators choosing to be treated as
Commissioner's discretion to decide register form and keeping method
6EA(6) Small business operators choosing to be treated as
Must make register available to public in specified way, but not beyond subsection (3)
6F State instrumentalities etc. treated as organisations
6F(1) State instrumentalities etc. treated as organisations
State instrumentalities treated as organisations
States that the Act applies to State or Territory authorities and instrumentalities
6F(2) State instrumentalities etc. treated as organisations
Treats state instrumentalities as organisations
Includes modifications to treat instrumentality etc. as organisation
6F(3) State instrumentalities etc. treated as organisations
Minister must consult Commissioner before prescribing State authority or instrumentality.
Minister knows about Commissioner's desirability.
37 Application
Prevents breach of National Privacy Principle or approved privacy code regardless of contract date.
privacy-amendment-private-sector-act-2000.pdf, p.27
38 At the end of paragraph 7(1)(ed)
39 After paragraph 7(1)(ed)
An organisation must not engage in a practice without an exempt act or exempt practice.
40 Subsection 7(2)
Insert approved privacy code after Information Privacy Principles
privacy-amendment-private-sector-act-2000.pdf, p.28
41 Subsection 7(4)
42 After section 7
7A Acts of certain agencies treated as acts of organisation
7A(1) Acts of certain agencies treated as acts of organisation
Acts of certain agencies treated as acts of organisation
If an act is done by an agency, it is treated as if done by an organisation
...as if the act were an act done, or practice engaged in, by an organisation.
The provision relates to a temporal interval
...with the prescribed modifications (if any), in relation to an act or practice described in subsection (2) or (3)
The provision implies a conclusion about agency and organisation
The provision spreads to related concepts of agency and organisation
7A(2) Acts of certain agencies treated as acts of organisation
Acts of certain agencies are prohibited unless specified in Part I of Schedule 2 to the Freedom of Information Act 1982.
(2) Subsection (1) applies to acts done, and practices engaged in, by a prescribed agency.
Temporal interval for agency specification
The agency must be specified within the temporal interval defined by Part I of Schedule 2 to the Freedom of Information Act 1982.
Diffusion of information about agency specification
The information about the agency must be diffused within the temporal interval defined by Part I of Schedule 2 to the Freedom of Information Act 1982.
The agency must be classified using the CogAI system within the temporal interval defined by Part I of Schedule 2 to the Freedom of Information Act 1982.
7A(3) Acts of certain agencies treated as acts of organisation
Agency's commercial activities are subject to the Freedom of Information Act.
Agency is obligated to comply with the Freedom of Information Act.
7A(4) Acts of certain agencies treated as acts of organisation
Section has effect despite certain subsections.
7A(5) Acts of certain agencies treated as acts of organisation
Amendment of the Privacy Act 1988 Schedule 1
7B Exempt acts and exempt practices of organisations
privacy-amendment-private-sector-act-2000.pdf, p.29
7B(1) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations
7B(2) Exempt acts and exempt practices of organisations
7B(3) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations related to employment relationships and employee records.
Imposes a duty on organisations to exempt certain acts and practices.
An organisation is required to exempt an act or practice if it meets the conditions.
The organisation must take action to exempt the act or practice.
Defines a temporal relationship between exempt acts and practices.
An act is exempt if it overlaps with the defined interval.
The act occurs during the exempt period.
Defines a recurring relationship between exempt acts and practices.
An act is exempt if it recurs within the defined interval.
The act recurs during the exempt period.
Defines a knowledge graph for exempt acts and practices.
An organisation has knowledge of the exempt acts and practices.
The organisation can apply the exemption rules.
Defines a validation rule for exempt acts and practices.
An act is valid if it meets the defined rule.
The act conforms to the exemption rules.
7B(4) Exempt acts and exempt practices of organisations
Media organisation must observe privacy standards when engaging in journalism or certain practices.
Media organisation must observe privacy standards.
Exempt acts and exempt practices of organisations classified by media organisation's commitment to privacy standards.
Media organisation must observe privacy standards during journalism or certain practices.
7B(5) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations for meeting contract obligations
(5) An act done, or practice engaged in, by an organisation is exempt for the purposes of paragraph 7(1)(ee)
if: (a) the organisation is a contracted service provider for a State contract...
Exemption applies during contract period
...if: (a) the organisation is a contracted service provider for a State contract...
Exemption applies to meeting contract obligations
Exemption implies meeting contract obligations
7C Political acts and practices are exempt
privacy-amendment-private-sector-act-2000.pdf, p.30
7C(1) Political acts and practices are exempt
Political acts and practices are exempt for certain purposes.
7C(2) Political acts and practices are exempt
Exemptions for political acts and practices
7C(3) Political acts and practices are exempt
Exempts political acts and practices for meeting obligations under a contract.
(3) An act done, or practice engaged in...
7C(4) Political acts and practices are exempt
Exempts political acts and practices for certain purposes.
7C(5) Political acts and practices are exempt
Agents or principals are exempt from the operation of the Act.
(5) Subsection (4) does not otherwise affect the operation of the Act in relation to agents or principals.
The excerpt refers to a temporal relation between two intervals.
The excerpt implies that agents or principals are exempt from the operation of the Act.
The excerpt propagates a rule about exemption for agents or principals.
The excerpt represents knowledge about exemption for agents or principals.
7C(6) Political acts and practices are exempt
Electoral law and Parliament definitions
Class hierarchy for electoral law and Parliament
electoral law means a law of the Commonwealth, or a law of a State or Territory, relating to elections to a Parliament or to a local government authority.
Parliament means: (a) the Parliament of the Commonwealth; or (b) a State Parliament; or (c) the legislature of a Territory.
(a) the Parliament of the Commonwealth; or (b) a State Parliament; or (c) the legislature of a Territory.
Note on exemption for political representatives
To avoid doubt, this section does not make exempt for the purposes of paragraph 7(1)(ee) an act or practice of the political representative, contractor, subcontractor or volunteer for a registered political party involving the use or disclosure (by way of sale or otherwise) of personal information in a way not covered by subsection (1), (2), (3) or (4) (as appropriate).
43 Paragraph 8(1)(a)
Insertion of 'organisation' after 'agency' in section 8 heading.
privacy-amendment-private-sector-act-2000.pdf, p.32
44 Paragraph 8(1)(a)
Insertion of 'organisation' after 'the agency'
45 Paragraph 8(1)(b)
Insert “or organisation” after “an agency”.
46 Paragraph 8(1)(b)
Insert 'or organisation' after 'the agency'
47 At the end of section 8
privacy-amendment-private-sector-act-2000.pdf, p.33
47(3) At the end of section 8
An act done by a partner is taken to have been done by the organisation.
Imposes a duty on the state to treat partners as if they were the organisation.
The state is required to treat partners as if they were the organisation.
States that an act done by a partner overlaps with the organisation's actions.
The organisation's actions overlap with the acts of partners.
States that an act done by a partner is recurrent in relation to the organisation.
The acts of partners are recurrent in relation to the organisation.
States that an act done by a partner diffuses to the organisation.
The acts of partners diffuse to the organisation.
States that an act done by a partner incorporates into the organisation's actions.
The organisation's actions incorporate the acts of partners.
47(4) At the end of section 8
An act done by a member of the committee is taken to have been done by the organisation.
An act done by a member is an act done by the organisation.
An act done by a member is during the same time as an act done by the organisation.
The organisation and the member are during the same time.
An act done by a member implies that the organisation does the act.
47(5) At the end of section 8
An act done by a trustee is attributed to the organisation.
The organisation is held responsible for the action.
The action's temporal interval is contained within the organisation's temporal interval.
The organisation's temporal interval contains the action's temporal interval.
Information flows from the trustee to the organisation.
A communication made to a trustee is attributed to the organisation.
The organisation receives information from the trustee.
The organisation's knowledge includes its trustees' actions.
48 At the end of Part II
12B Severability: additional effect of Act in relation to organisations
12B(1) Severability: additional effect of Act in relation to organisations
Act has effect in relation to organisations as provided by subsections of this section.
12B(2) Severability: additional effect of Act in relation to organisations
Act has effect on International Covenant on Civil and Political Rights
12B(3) Severability: additional effect of Act in relation to organisations
12B(4) Severability: additional effect of Act in relation to organisations
Act has effect if operation in relation to organisations were expressly confined.
12B(5) Severability: additional effect of Act in relation to organisations
Act has effect if operation in relation to organisations is expressly confined to acts or practices taking place in trade or commerce.
Operation in relation to organisations is expressly confined to acts or practices taking place in trade or commerce.
Temporal interval for conditional commencement
12B(6) Severability: additional effect of Act in relation to organisations
Additional effect of Act on organisations
12B(7) Severability: additional effect of Act in relation to organisations
Severability: additional effect of Act in relation to organisations
12B(8) Severability: additional effect of Act in relation to organisations
49 Before section 13
privacy-amendment-private-sector-act-2000.pdf, p.34
50 Section 13
privacy-amendment-private-sector-act-2000.pdf, p.35
51 Paragraphs 13(b) and (d)
52 After section 13
13A Interferences with privacy by organisations
13A(1) Interferences with privacy by organisations
Interference with privacy by organisations is prohibited.
Prohibition of interference with privacy
13A(2) Interferences with privacy by organisations
Organisations must not interfere with privacy.
Prohibition on interference with privacy
13B Related bodies corporate
privacy-amendment-private-sector-act-2000.pdf, p.36
13B(1) Related bodies corporate
Sharing personal information between related bodies corporate is permitted.
13B(1A) Related bodies corporate
Exempt disclosure of personal information from related body corporate
13B(2) Related bodies corporate
Organisation's act or practice may interfere with individual's privacy.
13C Change in partnership because of change in partners
privacy-amendment-private-sector-act-2000.pdf, p.37
13C(1) Change in partnership because of change in partners
Personal information can be passed on from an old to a new partnership.
Holds personal information about an individual.
The new partnership must comply with National Privacy Principles.
Note: Subsection (1) lets personal information be passed on from an old to a new partnership.
The new partnership's use of personal information may breach National Privacy Principle 2.
For example, the new partnership’s use of Schedule 1 Amendment of the Privacy Act 1988 personal information collected from the old partnership may constitute an interference with privacy if it breaches National Privacy Principle 2 or a corresponding provision in a binding approved privacy code.
The new partnership's use of personal information may constitute an interference with privacy.
(d) the new partnership holds, immediately after its formation, personal information about an individual that the old partnership held immediately before its dissolution;
The new partnership's use of personal information may interfere with the privacy of the individual.
13C(2) Change in partnership because of change in partners
Section 13C(2) has effect despite section 13A.
13D Overseas act required by foreign law
privacy-amendment-private-sector-act-2000.pdf, p.38
13D(1) Overseas act required by foreign law
An act or practice outside Australia and an external Territory is not an interference with the privacy of an individual if required by a foreign country's law.
13D(2) Overseas act required by foreign law
Section 13D(2) has effect despite section 13A.
13E Effect on section 13 of sections 13B, 13C and 13D
Organisations are not prevented from interfering with individual privacy under section 13.
Organisations have an obligation to respect individual privacy.
Section 13B, C and D do not prevent interference with privacy.
Organisations' actions may overlap with individual privacy rights.
Organisations' actions may recurrently interfere with individual privacy rights.
Organisations' actions diffuse individual privacy rights.
Organisations can infer from section 13 that they have an obligation to respect individual privacy.
Section 13 defines the concept of privacy.
13F Act or practice not covered by section 13 or section 13A is not
No interference with privacy for acts not covered by section 13 or 13A
Section 13 or 13A applies to this act/practice
53 Application
An act or practice of an organisation may be an interference with the privacy of an individual.
54 After section 16
16A Organisations to comply with approved privacy codes or
privacy-amendment-private-sector-act-2000.pdf, p.39
16A(1) Organisations to comply with approved privacy codes or
Organisation must not breach approved privacy code
Prohibition of breaching approved privacy code
(1) An organisation must not do an act, or engage in a practice, that breaches an approved privacy code that binds the organisation.
Prohibition applies during organisation's operation
Prohibition of breaching approved privacy code through argumentation
Prohibition of breaching approved privacy code through diffusion
Prohibition of breaching approved privacy code through CogAI
16A(2) Organisations to comply with approved privacy codes or
Organisation must comply with approved privacy codes or face consequences.
16A(3) Organisations to comply with approved privacy codes or
Comply with approved privacy codes or National Privacy Principles
16B Personal information in records
16B(1) Personal information in records
Organisation must collect personal information only for inclusion in a record or publication.
Organisation collects personal information
For inclusion in a record or publication
16B(2) Personal information in records
Personal information must be held in a record for the Act to apply.
Must hold personal information in a record.
16C Application of National Privacy Principles
privacy-amendment-private-sector-act-2000.pdf, p.40
16C(1) Application of National Privacy Principles
National Privacy Principles apply only to collection of personal information after commencement.
(1) National Privacy Principles apply only in relation to the collection of personal information after the commencement of this section.
16C(1A) Application of National Privacy Principles
National Privacy Principle 2 applies only in relation to personal information collected after the commencement of this section.
The principle applies to personal information collected after the commencement of this section.
(1A) National Privacy Principle 2 applies only in relation to personal information collected after the commencement of this section.
The principle applies to personal information collected after a specific point in time.
The principle applies to a specific point in time.
The principle is applied through a process of diffusion.
The principle is applied through a cognitive artificial intelligence system.
16C(2) Application of National Privacy Principles
National Privacy Principles apply to personal information held by organisations.
Imposes a duty on states to apply National Privacy Principles.
16C(3) Application of National Privacy Principles
National Privacy Principle 6 applies to personal information collected after commencement.
Principle applies to personal information
Personal information subject to Principle
16C(4) Application of National Privacy Principles
National Privacy Principle 8 applies only to transactions entered into after the commencement of this section.
Restricts applicability to transactions after commencement.
(4) National Privacy Principle 8 applies only to transactions entered into after the commencement of this section.
16D Delayed application of National Privacy Principles to small
16D(1) Delayed application of National Privacy Principles to small
Delayed application of National Privacy Principles to small businesses
16D(2) Delayed application of National Privacy Principles to small
National Privacy Principles apply only to collection of personal information after delayed application period.
Applying principles only when specified conditions met.
(2) National Privacy Principles apply...
...only in relation to the collection of personal information after the delayed application period.
16D(3) Delayed application of National Privacy Principles to small
National Privacy Principles apply to organisation after delayed application period.
Principles relate to personal information
16D(4) Delayed application of National Privacy Principles to small
National Privacy Principles apply only to personal information collected after a delayed application period.
16D(5) Delayed application of National Privacy Principles to small
National Privacy Principle 8 applies only to transactions entered into with the organisation after a delayed application period.
The principle applies to transactions entered into after the delayed application period.
(5) National Privacy Principle 8 applies only to transactions entered into with the organisation after the delayed application period.
The principle applies during the delayed application period.
The principle is true during the delayed application period.
The principle is diffused during the delayed application period.
The principle is applied by the organisation.
16D(6) Delayed application of National Privacy Principles to small
Defines delayed application period for small organisations.
16E Personal, family or household affairs
Exemptions from National Privacy Principles for personal, family or household affairs
privacy-amendment-private-sector-act-2000.pdf, p.41
Nothing in the National Privacy Principles applies to...
...for the purposes of, or in connection with, his or her personal,...
16F Information under Commonwealth contract not to be used for
privacy-amendment-private-sector-act-2000.pdf, p.42
16F(1) Information under Commonwealth contract not to be used for
Limitation on use and disclosure of personal information for meeting Commonwealth contract obligations.
Restricts use and disclosure of personal information.
(1) This section limits the use and disclosure of personal information collected:
Establishes duty to limit use and disclosure of personal information.
(a) for the purpose of meeting (directly or indirectly) an obligation under a Commonwealth contract;
Establishes duty to limit use and disclosure of personal information by contracted service providers.
(b) by an organisation that is a contracted service provider for the contract.
This section limits the use and disclosure of personal information collected:
16F(2) Information under Commonwealth contract not to be used for
Prohibition on using personal information for direct marketing unless necessary to meet an obligation under the contract
(2) An organisation that is a contracted service provider for the contract must not use or disclose the personal information
for direct marketing, unless the use or disclosure is necessary to meet (directly or indirectly) an obligation under the contract.
16F(3) Information under Commonwealth contract not to be used for
Organisation must comply with approved privacy code and National Privacy Principles despite subsection (2) effect.
Approved privacy code and National Privacy Principles apply.
Temporal interval of subsection (2) effect starts after approved privacy code and National Privacy Principles take effect.
Subsection (2) effect starts after approved privacy code and National Privacy Principles take effect.
Temporal interval of subsection (2) effect is conditional on approved privacy code and National Privacy Principles taking effect.
Subsection (2) effect is conditional on approved privacy code and National Privacy Principles taking effect.
Organisation must comply with approved privacy code and National Privacy Principles.
Organisation must not use information under Commonwealth contract for specified purposes.
55 After section 18
56 After paragraph 18A(3)(a)
Inserts National Privacy Principles and Part IIIAA provisions
57 Application
Amendment of section 18A of the Privacy Act 1988 applies to preparation of Code of Conduct after commencement.
58 After Part III
Inserts Part IIIAA—Privacy codes after Part III
privacy-amendment-private-sector-act-2000.pdf, p.43
18BA Application for approval of privacy code
Application for approval of privacy code
18BB Commissioner may approve privacy code
18BB(1) Commissioner may approve privacy code
Commissioner must consult person before approving privacy code
Commissioner decides to approve privacy code
18BB(2) Commissioner may approve privacy code
Commissioner must approve privacy code if certain conditions met
The Commissioner may approve a privacy code if...
Organisations must consent to be bound by the code
(c) that only organisations that consent to be bound by the code are, or will be, bound by the code
the organisation must consent to be bound
Code must set out procedure for cessation of binding
(d) that the code sets out a procedure by which an organisation may cease to be bound by the code and when the cessation takes effect
the code must set out a procedure for cessation
18BB(3) Commissioner may approve privacy code
Commissioner must be satisfied with code's compliance with standards and guidelines.
Code must meet standards and guidelines.
30 June each year on the operation of the code during the
privacy-amendment-private-sector-act-2000.pdf, p.44
30(4) June each year on the operation of the code during the
Commissioner may consider guidelines when deciding on privacy codes.
30(5) June each year on the operation of the code during the
30(6) June each year on the operation of the code during the
Commissioner may approve a privacy code under certain conditions.
30(7) June each year on the operation of the code during the
Commissioner may approve a privacy code for specified conditions.
(a) all personal information or a specified type of personal information;
18BC When approval takes effect
privacy-amendment-private-sector-act-2000.pdf, p.46
18BC(1) When approval takes effect
Approval takes effect on a specified day.
18BC(2) When approval takes effect
Approval must be given on or after the specified day.
Must provide approval on or after the specified day.
(2) The day specified must not be before the day on which the approval is given.
The approval must be given on or after the specified day.
The specified day contains the day of approval.
18BD Varying an approved privacy code
18BD(1) Varying an approved privacy code
Organisation may apply for approval of a variation to an approved privacy code.
18BD(2) Varying an approved privacy code
The Commissioner must approve in writing the variation.
18BD(3) Varying an approved privacy code
Consider all matters when deciding to approve a variation.
The Commissioner must consider all matters.
The Commissioner considers all matters within a certain timeframe.
The Commissioner considers all matters within the applicable timeframe.
18BD(4) Varying an approved privacy code
Commissioner may consult on draft variation without public comment if deemed minor.
Commissioner has permission to consult on draft variation.
Commissioner may consult on draft variation.
Commissioner's consultation overlaps with public comment period.
Commissioner consults on draft variation.
Consultation overlaps with public comment period.
18BD(5) Varying an approved privacy code
The approval of the variation takes effect on the day specified in the approval.
18BD(6) Varying an approved privacy code
The day specified must not be before the day on which the approval is given.
(6) The day specified must not be before the day on which the approval is given.
18BE Revoking the approval of an approved privacy code
18BE(1) Revoking the approval of an approved privacy code
Revoking approval of an approved privacy code
Prohibits revoking approval of an approved privacy code
(1) The Commissioner may revoke his or her approval...
18BE(2) Revoking the approval of an approved privacy code
Commissioner must consult certain persons before revoking approval of a code or variation.
18BE(3) Revoking the approval of an approved privacy code
18BE(4) Revoking the approval of an approved privacy code
Revocation of approved privacy code approval
18BE(5) Revoking the approval of an approved privacy code
The day specified must not be before the day on which the revocation is made.
(5) The day specified must not be before the day on which the revocation is made.
18BF Guidelines about privacy codes
privacy-amendment-private-sector-act-2000.pdf, p.47
18BF(1) Guidelines about privacy codes
Commissioner must make written guidelines about privacy codes.
18BF(1A) Guidelines about privacy codes
Commissioner must give everyone with a real and substantial interest an opportunity to comment on proposed guidelines.
Everyone with a real and substantial interest must be informed
18BF(2) Guidelines about privacy codes
Commissioner may publish guidelines in any way considered appropriate.
18BG Register of approved privacy codes
18BG(1) Register of approved privacy codes
The Commissioner must keep a register of approved privacy codes.
18BG(2) Register of approved privacy codes
Commissioner's discretion over register form and keeping
18BG(3) Register of approved privacy codes
The Commissioner must make the register available to the public.
18BG(4) Register of approved privacy codes
Commissioner may charge fees for making register available to public or providing copies of register.
(4) The Commissioner may charge fees for making register available to public or providing copies of register.
18BH Review of operation of approved privacy code
privacy-amendment-private-sector-act-2000.pdf, p.48
18BH(1) Review of operation of approved privacy code
The Commissioner may review the operation of an approved privacy code.
18BH(2) Review of operation of approved privacy code
Commissioner may review operation of approved privacy code
18BI Review of adjudicator’s decision under approved privacy code
18BI(1) Review of adjudicator’s decision under approved privacy code
Right to review adjudicator's decision under approved privacy code
Has the right to review adjudicator's decision
18BI(2) Review of adjudicator’s decision under approved privacy code
Commissioner can investigate complaint despite subsection 36(1A) restriction
18BI(3) Review of adjudicator’s decision under approved privacy code
Adjudicator's determination is subject to review by the Commissioner.
Adjudicator's determination is subject to review.
59 After paragraph 27(1)(a)
Functions and powers of the Commissioner
privacy-amendment-private-sector-act-2000.pdf, p.49
60 Paragraph 27(1)(b)
Insert “or organisation” after “agency”.
61 At the end of paragraph 27(1)(d)
Add “and of the National Privacy Principles”.
62 Paragraph 27(1)(e)
Insertion of 'or an organisation' after 'agency'
63 After paragraph 27(1)(e)
Insert guidelines for preparing and publishing privacy codes.
64 Paragraph 27(1)(f)
Provide advice on matters relevant to the operation of this Act.
privacy-amendment-private-sector-act-2000.pdf, p.50
65 Paragraphs 27(1)(n) and (o)
66 At the end of subsection 27(1)
Add: (s) to do anything incidental or conducive to the performance of any of the Commissioner’s other functions.
67 After subsection 27(1)
Commissioner not subject to Part V in performing functions and exercising powers.
Commissioner has an obligation not to be subject to Part V.
68 At the end of section 27
Commissioner may examine records of an organisation upon request.
69 Paragraph 29(a)
Insertion of '(through the media and otherwise)' after 'free flow of information'
privacy-amendment-private-sector-act-2000.pdf, p.51
Insertion happens during the text's existence
70 Paragraph 29(d)
Ensure consistency of directions and guidelines with relevant privacy principles.
71 At the end of section 30
72 Subsection 31(2)
73 Subsection 36(1)
Substitution of words in subsection (1A)
74 After subsection 36(1)
74(1A) After subsection 36(1)
Exemption for organisations bound by approved privacy code
74(1B) After subsection 36(1)
Individuals can make complaints under an approved privacy code to the adjudicator for the code.
74(1C) After subsection 36(1)
An individual can complain about an act done by an organisation meeting a Commonwealth contract obligation.
Subsection (1A) does not prevent an individual from complaining under this Part.
An individual can complain about an act done by an organisation.
Temporal relationship between obligations
Subsection (1A) does not prevent an individual from complaining under this Part to the Commissioner about an act done, or practice engaged in, by an organisation.
The organisation's action meets the Commonwealth contract obligation.
Requirement for an adjudicator to refer a complaint
Section 40A requires an adjudicator for an approved privacy code to refer a code complaint to the Commissioner if the complaint is about an act or practice of a contracted service provider for a Commonwealth contract.
The adjudicator must refer the complaint.
(1C) Subsection (1A) does not prevent an individual from complaining under this Part to the Commissioner about an act done, or practice engaged in, by an organisation.
The individual can complain about an act done by an organisation.
75 Subsection 36(7)
privacy-amendment-private-sector-act-2000.pdf, p.52
75(7) Subsection 36(7)
Organisation is respondent in case of complaint about an act or practice.
Section 70A contains further rules about how this Part operates in relation to respondent organisations that are not legal persons.
75(8) Subsection 36(7)
The respondent to a complaint is the person who engaged in the act or practice.
Identifies the respondent as an obligation.
The person who engaged in the act or practice is the respondent.
76 Application
Application of subsection 36(8) of the Privacy Act 1988 to complaints made after commencement.
76A Section 37
77 Subsection 38(1)
78 Subsection 38(2)
privacy-amendment-private-sector-act-2000.pdf, p.53
79 Subsection 40(1)
80 After subsection 40(1)
80(1A) After subsection 40(1)
Commissioner must not investigate complaint if complainant did not complain to respondent first.
Commissioner must not investigate complaint
80(1B) After subsection 40(1)
The Commissioner must investigate a complaint about an act or practice that may be an interference with the privacy of an individual.
The Commissioner must investigate a complaint.
(1B) The Commissioner must investigate under this Part a complaint...
80(1C) After subsection 40(1)
Commissioner must deal with accepted complaint as if it were a complaint under section 36.
Deal with complaint as if it were a complaint under section 36.
81 At the end of section 40
82 After section 40
privacy-amendment-private-sector-act-2000.pdf, p.54
40A Referring complaint about act under Commonwealth contract
40A(1) Referring complaint about act under Commonwealth contract
Complaint about act under Commonwealth contract
40A(2) Referring complaint about act under Commonwealth contract
Adjudicator must stop investigating complaint and refer to Commissioner.
40A(3) Referring complaint about act under Commonwealth contract
Commissioner must investigate complaint as if made under section 36.
Complaint investigated as if made under section 36
Investigation as if complaint made under section 36
Temporal interval of investigation includes subsection 40(1B)
Investigation within temporal interval of subsection 40(1B)
Commissioner's investigation implies acceptance of complaint
Acceptance of complaint implies investigation
83 Subsection 41(1)
84 Paragraph 41(1)(b)
85 Paragraphs 41(1)(e) and (f)
Repeal certain paragraphs and substitute with new provisions regarding the Privacy Act 1988.
Prohibits dealing with complaints under another law if it has been adequately dealt with.
Another Commonwealth law or State/Territory law provides a more appropriate remedy.
The act or practice is not the subject of an application under this law.
The subject-matter of the complaint has been, or is being, dealt with adequately under that law.
Implies that if another law provides a more appropriate remedy, then the act or practice is not subject to this law.
Another Commonwealth law, or a State or Territory law, provides a more appropriate remedy for the act or practice.
The act or practice is not subject to this law.
Implies that if the subject-matter of the complaint has been, or is being, dealt with adequately under another law, then the act or practice is not subject to this law.
86 Subsections 41(2) and 41(3)
privacy-amendment-private-sector-act-2000.pdf, p.55
87 Subsection 41(4)
Commissioner must not investigate unless interference with privacy of Australian citizens or permanent residents.
No investigation unless interference with privacy of Australian citizens or permanent residents.
Interference with privacy must occur within a specified time frame.
(4) If an act or practice may be an interference with the privacy of an individual solely because it may breach...
...the Commissioner must not investigate the act or practice except to the extent that it is an interference with the privacy of one or more individuals each of whom is...
88 Section 42
Insertion of a phrase after 'Commissioner'
89 After subsection 43(1)
Inform agency of investigation into act or practice by contracted service provider.
90 Subsection 43(6)
Insert “, organisation” after “agency” twice.
privacy-amendment-private-sector-act-2000.pdf, p.56
91 After subsection 43(8)
The Commissioner is not allowed to discuss a matter relevant to an investigation of a breach of an approved privacy code or the National Privacy Principles with a Minister, unless certain conditions are met.
92 Subsection 46(1)
Insertion of exception for NPP complaints and code complaints
93 At the end of section 48
Commissioner must inform agency of decision not to investigate contracted service provider.
Commissioner has a duty to inform the agency.
94 After section 50
50A Substitution of respondent to complaint
privacy-amendment-private-sector-act-2000.pdf, p.57
50A(1) Substitution of respondent to complaint
Commissioner can substitute an agency for an organisation as respondent to a complaint under certain conditions.
Commissioner has the power to substitute an agency for an organisation.
50A(2) Substitution of respondent to complaint
Specify agency or principal executive as respondent to complaint
50A(3) Substitution of respondent to complaint
Agency must provide written submissions on proposed amendment.
50A(4) Substitution of respondent to complaint
Commissioner satisfies subsection 43(1A) if amends complaint during investigation.
95 Subsection 52(3A)
95(3A) Subsection 52(3A)
Commissioner may include an order in a determination concerning breach of certain privacy principles.
95(3B) Subsection 52(3A)
Order to make correction, deletion, or addition to a record or credit report.
96 At the end of Division 2 of Part V
privacy-amendment-private-sector-act-2000.pdf, p.58
53A Notice to be given to outsourcing agency
53A(1) Notice to be given to outsourcing agency
Commissioner must give notice to agencies
53A(2) Notice to be given to outsourcing agency
The Commissioner must consult with the agency before giving a recommendation.
The Commissioner must consult with the agency.
53A(3) Notice to be given to outsourcing agency
Agency must notify Commissioner of proposed action within 60 days.
53B Substituting respondent to determination
privacy-amendment-private-sector-act-2000.pdf, p.59
53B(1) Substituting respondent to determination
Complainant entitled to compensation if respondent ceases to exist or becomes bankrupt
State has obligation to pay compensation
Respondent is contracted service provider for Commonwealth contract
Complainant entitled to specified amount by way of compensation
Compensation is a subclass of reimbursement
Declaration under subsection 52(3) that complainant is entitled to specified amount by way of reimbursement
Compensation due during bankruptcy or insolvency
Respondent becomes bankrupt or insolvent, commences to be wound up
Complainant had not been paid whole or part of amount referred to in subparagraph (b)(i) or (b)(ii)
State has permission to pay compensation after bankruptcy or insolvency
State has obligation to pay reimbursement after bankruptcy or insolvency
53B(2) Substituting respondent to determination
Agency is respondent to determination under section 52.
Substituting respondent to determination
53B(3) Substituting respondent to determination
Notice and opportunity to appear before the Commissioner
Notice stating proposal and reasons, opportunity to make submissions
Obligation to provide notice and appear before the Commissioner
97 Division 3 of Part V (heading)
Repeal heading and substitute with new text.
privacy-amendment-private-sector-act-2000.pdf, p.60
98 After subsection 54(1)
Judicial review of privacy code determinations is subject to the Administrative Decisions (Judicial Review) Act 1977.
The making of a determination by the Commissioner under this Act or by an adjudicator under an approved privacy code is subject to judicial review.
Temporal overlap between judicial review and privacy code determinations
The making of a determination by the Commissioner under this Act or by an adjudicator under an approved privacy code is subject to judicial review under the Administrative Decisions (Judicial Review) Act 1977.
Recurring application of judicial review
Prohibition on making determinations without judicial review
99 Section 55
Repeal section and substitute with new content.
55 Obligations of respondent organisation
55(1) Obligations of respondent organisation
Must not repeat or continue covered conduct, and must perform covered act.
(1) An organisation that is the respondent to a determination made under section 52:
Temporal overlap between obligations and conduct
55(2) Obligations of respondent organisation
Prohibits repeating or continuing covered conduct.
(2) An organisation that is the respondent to a determination made under an approved privacy code:
55A Proceedings in the Federal Court or Federal Magistrates Court
privacy-amendment-private-sector-act-2000.pdf, p.61
55A(1) Proceedings in the Federal Court or Federal Magistrates Court
Any of the following persons may commence proceedings in the Federal Court or the Federal Magistrates Court for an order to enforce a determination.
55A(2) Proceedings in the Federal Court or Federal Magistrates Court
Court may make orders if respondent has engaged in conduct that constitutes an interference with the privacy of the complainant.
55A(3) Proceedings in the Federal Court or Federal Magistrates Court
Grant interim injunction pending proceedings determination
55A(4) Proceedings in the Federal Court or Federal Magistrates Court
Court cannot require giving an undertaking as a condition of granting an interim injunction.
Court cannot impose obligation on person
55A(5) Proceedings in the Federal Court or Federal Magistrates Court
Court must deal with question of privacy interference de novo.
Obligation to deal with question of privacy interference de novo.
55A(6) Proceedings in the Federal Court or Federal Magistrates Court
Court may receive certain documents as evidence in proceedings about a determination made by the Commissioner.
Court obligation to receive certain documents as evidence.
55A(7) Proceedings in the Federal Court or Federal Magistrates Court
Court may receive certain documents as evidence in proceedings about a determination made by an adjudicator under an approved privacy code.
Court may receive certain documents as evidence
Court may receive records of appearances before the adjudicator
55A(7A) Proceedings in the Federal Court or Federal Magistrates Court
Court must have due regard to matters required by paragraph 29(a)
55A(8) Proceedings in the Federal Court or Federal Magistrates Court
Defines 'complainant' in relation to a representative complaint.
55B Evidentiary certificate
privacy-amendment-private-sector-act-2000.pdf, p.62
55B(1) Evidentiary certificate
Commissioner must issue written certificate on findings of fact
55B(2) Evidentiary certificate
Adjudicator must issue written certificate setting out findings of fact.
Adjudicator has an obligation to issue a written certificate.
55B(3) Evidentiary certificate
Certificate not prima facie evidence of specified agency or organisation breach
55B(4) Evidentiary certificate
Document purporting to be a certificate must be taken as a certificate unless proven otherwise.
Obligation to take the document as a certificate
100 Application
Enforcement of determinations and evidentiary certificates
privacy-amendment-private-sector-act-2000.pdf, p.63
Obligation applies to determinations and evidentiary certificates
Temporal intervals apply to determinations and evidentiary certificates.
101 Subsections 62(1) and (2)
Insert 'or the Federal Magistrates Court' after 'Federal Court'
Federal Court or Federal Magistrates Court
102 Subsection 62(4)
Omit 'Federal Court', substitute 'court'.
103 Paragraphs 63(2)(a) and (b)
104 After subsection 63(2)
No application can enforce a determination relating to a code complaint or an NPP complaint.
Subsection (2) does not permit an application relating to proceedings under section 55A.
105 At the end of section 64
No liability for acts done in good faith under the Act or code.
privacy-amendment-private-sector-act-2000.pdf, p.64
No liability implies a duty to act in good faith.
No liability for acts done in good faith.
106 After subsection 66(1)
Journalist has a reasonable excuse to keep confidential the identity of an informant.
Obligation to keep confidential the identity of an informant.
There is an obligation to keep confidential the identity of an informant.
Temporal overlap: The journalist's reasonable excuse overlaps with the time when giving information would reveal the identity of an informant.
There is a temporal overlap: The journalist's reasonable excuse overlaps with the time when giving information would reveal the identity of an informant.
Temporal until: The journalist's reasonable excuse holds until the time when giving information would reveal the identity of an informant.
There is a temporal until: The journalist's reasonable excuse holds until the time when giving information would reveal the identity of an informant.
Diffusion: The journalist's reasonable excuse diffuses to all situations where giving information would tend to reveal the identity of an informant.
There is a diffusion: The journalist's reasonable excuse diffuses to all situations where giving information would tend to reveal the identity of an informant.
CogAI inference: The journalist's reasonable excuse can be inferred from the fact that they have a reasonable excuse.
There is a CogAI inference: The journalist's reasonable excuse can be inferred from the fact that they have a reasonable excuse.
107 After paragraph 67(a)
Making of a complaint under an approved privacy code and acceptance of a complaint under subsection 40(1B) are obligations.
108 Subsection 68(1)
Insertion of 'in writing' after 'Commissioner'
109 Subsection 68(1)
Insertion of 'organisation' after 'agency'
110 After subsection 68(1)
The Commissioner may authorise a person only while the person is a member of the staff assisting the Commissioner.
111 After subsection 68(3)
privacy-amendment-private-sector-act-2000.pdf, p.65
111(3A) After subsection 68(3)
Authorised person must inform occupier or person in charge of potential refusal of consent.
Must inform occupier or person in charge.
(3A) Before obtaining the consent, the authorised person must inform the occupier or person in charge that he or she may refuse to consent.
111(3B) After subsection 68(3)
Consent must be voluntary for an entry to be lawful.
111(3C) After subsection 68(3)
Authorized person cannot enter premises without identity card
Authorized person enters premises without identity card
111(3D) After subsection 68(3)
Authorised person must leave premises if occupier or person in charge asks.
(3D) If an authorised person is on premises...
The authorised person must leave the premises.
The temporal interval of the authorised person's presence overlaps with the temporal interval of the occupier's or person in charge's request.
The temporal interval of the occupier's or person in charge's request occurs before the temporal interval of the authorised person's presence.
The diffusion of the obligation to leave the premises occurs when the occupier or person in charge requests it.
The cognitive system of the occupier or person in charge recognises the obligation to leave the premises.
112 After section 68
68A Identity cards
68A(1) Identity cards
Commissioner must issue identity card to authorised person.
Recent photograph of the authorised person
68A(2) Identity cards
Must return identity card to Commissioner upon ceasing authorization.
68A(3) Identity cards
Prohibition on contravening subsection (2)
113 Subsection 69(9) (definition of complaint)
Definition of complaint under Schedule 1
Substitutes a new definition for complaint
114 At the end of Division 5 of Part V
privacy-amendment-private-sector-act-2000.pdf, p.66
70A Application of Part to organisations that are not legal persons
70A(1) Application of Part to organisations that are not legal persons
Imposes obligation on partners instead of organisation, dischargeable by any partner
70A(2) Application of Part to organisations that are not legal persons
Imposes obligation on members of committee of management
on each member of the committee of management
70A(3) Application of Part to organisations that are not legal persons
Imposes obligation on trustees instead of organisation
70B Application of this Part to former organisations
This Part operates in relation to an act or practice of the organisation (while it was an organisation); and the individual, body corporate, partnership, unincorporated association or trust; as if he, she or it were still (and had been at all relevant times) an organisation.
The provision imposes a duty on the State.
115 Part VI (heading)
privacy-amendment-private-sector-act-2000.pdf, p.67
116 Before section 71
117 Section 72
118 At the end of section 72
118(2) At the end of section 72
Commissioner may make a written determination if public interest outweighs adherence to approved code or Principle.
118(3) At the end of section 72
Exemption from contravention of section 16A
Exempts organisation from contravention of section 16A
(3) The organisation is taken not to contravene section 16A if the organisation does the act, or engages in the practice, while the determination is in force under subsection (2).
Exemption applies during determination period
Permits organisation to engage in practice during determination period
118(4) At the end of section 72
Commissioner's written determination that an organisation does not contravene section 16A
118(5) At the end of section 72
Determinations have effect according to their terms.
119 Subsection 73(1)
privacy-amendment-private-sector-act-2000.pdf, p.68
120 At the end of subsection 73(1)
121 Subsection 73(2)
122 Subsection 75(2)
122(2) Subsection 75(2)
Agency must notify Commissioner within specified period
122(2A) Subsection 75(2)
Commissioner must send written invitation to organisation and issue corresponding invitations.
Commissioner must send written invitation.
123 Subsection 75(3)
Insertion of subsection (2A) after subsection (2)
privacy-amendment-private-sector-act-2000.pdf, p.69
124 Application and saving
Application and saving provisions for amendments to section 75 of the Privacy Act 1988.
125 Subsection 76(1)
126 Subsection 76(4)
Insertion of 'or organisation' after 'agency'
127 Subsection 77(1)
privacy-amendment-private-sector-act-2000.pdf, p.70
128 Subsection 79(2)
Omit “or any person”, substitute ‘, organisation or any other person’.
129 At the end of Part VI
80A Temporary public interest determinations
80A(1) Temporary public interest determinations
Commissioner must determine if agency or organisation breaches privacy principles.
Agency or organisation must comply with privacy principles.
(a) the act or practice of an agency or organisation that is the subject of an application under section 73 for a determination under section 72 breaches, or may breach: ...
...the public interest in adhering to that Principle or code; and (b) the public interest in the agency or organisation doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Principle or code;
Commissioner must act within a timeframe.
(c) the application raises issues that require an urgent decision.
...the public interest in adhering to that Principle or code;
Commissioner must consider public interest in agency or organisation's actions.
(b) the public interest in the agency or organisation doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Principle or code;
Commissioner must consider agency or organisation's actions.
80A(2) Temporary public interest determinations
The Commissioner may make a written temporary public interest determination.
80A(3) Temporary public interest determinations
Commissioner must specify a period and reasons for temporary public interest determination.
80B Effect of temporary public interest determination
privacy-amendment-private-sector-act-2000.pdf, p.71
80B(1) Effect of temporary public interest determination
Agency not in breach if act or practice subject to temporary public interest determination.
(1) If an act or practice of an agency is the subject of a temporary public interest determination...
...the agency is taken not to breach section 16 if the agency does the act, or engages in the practice,...
Temporal interval during which agency's action is excused
...the agency does the act, or engages in the practice,...
80B(2) Effect of temporary public interest determination
Exemption from contravening section 16A while temporary public interest determination is in force.
Temporary public interest determination in force
Organisation not contravening section 16A
During temporary public interest determination
Act or practice of organisation subject to temporary public interest determination
80B(3) Effect of temporary public interest determination
Organisation not contravening section 16A if act is subject to temporary public interest determination
No organisation is taken to contravene section 16A
80B(4) Effect of temporary public interest determination
Effect of temporary public interest determination
80C Determinations disallowable
Disallowable instrument for section 46A of the Acts Interpretation Act 1901.
80D Commissioner may continue to consider application
80D(1) Commissioner may continue to consider application
Commissioner may continue to consider application despite previous determination.
Commissioner's determination does not prevent continuation of application
Commissioner may continue to consider application
80D(2) Commissioner may continue to consider application
Determination ceases to be in effect when another determination comes into effect or the application is dismissed.
(2) A determination under this Division about an act or practice ceases to be in effect when:
Subject to another determination coming into effect
(2) A determination under this Division about an act or practice ceases to be in effect when: (a) a determination made under subsection 72(1) or (2) (as appropriate) about the act or practice comes into effect;
(2) A determination under this Division about an act or practice ceases to be in effect when: (b) a determination is made under paragraph 78(b) to dismiss the application.
80E Register of determinations
privacy-amendment-private-sector-act-2000.pdf, p.72
80E(1) Register of determinations
The Commissioner must keep a register of determinations.
80E(2) Register of determinations
80E(3) Register of determinations
(3) The Commissioner must make the register available to the public in the way that the Commissioner determines.
The register is accessible to the public during its registration process
Public access implies availability of information
The availability of the register implies its accessibility to the public
The diffusion of information implies its accessibility to the public through the register
The AI system recognizes the accessibility of the register to the public
80E(4) Register of determinations
Commissioner may charge fees for making register available to public and providing copies of register
130 Application
Section applies in relation to an application made by or on behalf of an agency under section 73 of the Privacy Act 1988.
Section applies to agency applications under section 73 of the Privacy Act 1988.
131 After section 95
95A Guidelines for National Privacy Principles about health
95A(1) Guidelines for National Privacy Principles about health
Commissioner approves guidelines for use and disclosure
Allows Commissioner to approve guidelines
95A(2) Guidelines for National Privacy Principles about health
Commissioner may approve guidelines for research or statistics
95A(3) Guidelines for National Privacy Principles about health
Approval required for guidelines on health information disclosure.
95A(4) Guidelines for National Privacy Principles about health
Commissioner may approve guidelines for health information collection
Commissioner has the power to approve guidelines
95A(5) Guidelines for National Privacy Principles about health
Approval must be given only if public interest in health information collection substantially outweighs privacy protection.
Public interest in health information collection
95A(6) Guidelines for National Privacy Principles about health
Commissioner may revoke guidelines by notice in the Gazette.
Commissioner has power to revoke guidelines
95A(7) Guidelines for National Privacy Principles about health
Right to appeal a decision of the Commissioner
95B Requirements for Commonwealth contracts
privacy-amendment-private-sector-act-2000.pdf, p.74
95B(1) Requirements for Commonwealth contracts
Agency must ensure contracted service provider does not breach Information Privacy Principle.
95B(2) Requirements for Commonwealth contracts
Agency must ensure contract does not authorise contracted service provider to engage in certain acts or practices.
Prohibition of engaging in certain acts or practices.
(2) The agency must ensure that the Commonwealth contract does not authorise a contracted service provider for the contract to do or engage in such an act or practice.
The agency must ensure that the contract does not authorise the provision to engage in certain acts or practices.
Prohibition of engaging in certain acts or practices within a specific time frame.
The provision is prohibited within the specified time frame.
Diffusion of prohibition through contractual services.
The provision is prohibited and diffused through contractual services.
CogAI's prohibition of engaging in certain acts or practices.
95B(3) Requirements for Commonwealth contracts
Agency must ensure Commonwealth contract provisions prevent unauthorized subcontracting.
Obligation to ensure Commonwealth contract provisions prevent unauthorized subcontracting.
(3) The agency must also ensure that the Commonwealth contract contains provisions to ensure that such an act or practice is not authorized by a subcontract.
Temporal interval for ensuring Commonwealth contract compliance with requirements.
Provisions for ensuring Commonwealth contract compliance with requirements.
95B(4) Requirements for Commonwealth contracts
Subcontract is a contract under which a contracted service provider provides services to another contracted service provider or an agency.
Classification of subcontract as a type of contract
95B(5) Requirements for Commonwealth contracts
Agency must comply with section requirements regardless of its role in the contract.
Agency must comply with section requirements.
95C Disclosure of certain provisions of Commonwealth contracts
Party must inform person of inconsistent contract provisions.
privacy-amendment-private-sector-act-2000.pdf, p.75
132 Subsection 97(2)
133 After subsection 97(2)
Report must include statement about approved privacy codes and their operation.
Details about complaints made under codes, their nature and outcome.
134 Subsections 98(1) and (2)
135 Subsections 99A(1) and (2)
136 Paragraph 99A(3)(a)
137 Paragraph 99A(3)(b)
138 Subsection 99A(4)
Substitute employee for servant in Schedule 1
Imposes a duty on the State to make the substitution
138A At the end of section 100
Minister must be satisfied that agency agrees to identifier use.
privacy-amendment-private-sector-act-2000.pdf, p.76
139 At the end of the Act
1 Collection
1 Section 1
Organisation must not collect personal information unless necessary for its functions or activities.
Prohibition of collecting personal information
Organisation must collect personal information lawfully and fairly.
Organisation must collect personal information.
Organisation must inform individual of personal information collection details.
Organisation must collect personal information from individual if reasonable and practicable.
privacy-amendment-private-sector-act-2000.pdf, p.77
Must collect personal information from individual.
Organisation must inform individual about personal info collection
awareness of matters listed in subclause 1.3
Organisation's obligation to inform individual
2 Use and disclosure
2 Section 2
Organisation must not use or disclose personal information for a purpose other than the primary purpose of collection unless certain conditions are met.
Organisation must not use or disclose personal information for a purpose other than the primary purpose of collection.
The organisation's business address and telephone number must be provided in direct marketing communications.
Must make a written note of use or disclosure under paragraph 2.1(h)
privacy-amendment-private-sector-act-2000.pdf, p.79
Organisation's primary purpose of collection of information
Disclosure of health information under certain circumstances.
privacy-amendment-private-sector-act-2000.pdf, p.80
Permission to disclose health information under certain circumstances.
The organisation may disclose health information about the individual if...
...the disclosure is necessary to provide appropriate care or treatment of the individual.
Allowance of disclosure under certain conditions.
Despite subclause 2.1, an organisation that provides a health service to an individual may...
...disclose health information about the individual if...
Temporal overlap between disclosure and care provision.
The disclosure is not contrary to any wish expressed by the individual before the individual became unable to give or communicate consent.
...the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (b).
Limitation of disclosure under certain conditions.
The disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (b).
...the disclosure is made for compassionate reasons.
Restriction of disclosure under certain conditions.
...the disclosure is not contrary to any wish expressed by the individual before the individual became unable to give or communicate consent.
Defines family relationships for the purpose of the Privacy Act 1988
3 Data quality
Ensure personal information is accurate, complete and up-to-date.
privacy-amendment-private-sector-act-2000.pdf, p.81
Ensure accuracy, completeness and timeliness.
4 Data security
4 Section 4
Organisation must protect personal information
Organisation must take reasonable steps to destroy or de-identify personal information.
5 Openness
5 Section 5
Organisation must set out policies on personal information management.
Organisation must provide personal information to a person on request.
6 Access and correction
privacy-amendment-private-sector-act-2000.pdf, p.82
6 Section 6
Organisation must not provide access to personal information under certain conditions.
Organisation is prohibited from providing access to personal information under certain conditions.
Organisation must provide explanation for commercially sensitive decision.
privacy-amendment-private-sector-act-2000.pdf, p.83
Organisation must provide individual with access to information if required.
Consider mutually agreed intermediaries to meet access needs.
Organisation's charges for access to personal information must not be excessive and cannot apply to lodging a request.
Organisation's charges must not be excessive.
Charges cannot apply to lodging a request.
Organisation must correct inaccurate personal information upon request.
Organisation must take reasonable steps to associate with inaccurate information a statement claiming it is not accurate.
Statement claiming inaccuracy must be associated with information.
Time period during which organisation must take action.
Must provide reasons for denial of access or refusal to correct personal information.
7 Identifiers
privacy-amendment-private-sector-act-2000.pdf, p.84
7 Section 7
Cannot adopt an identifier assigned by an agency, agent, or contracted service provider.
Prohibition of adopting an identifier assigned by an agency, agent, or contracted service provider.
Exemption from subclause 7.1 for prescribed organisation adoption of identifier in circumstances.
Organisation must not use or disclose an identifier assigned to an individual without permission.
Prohibition of using or disclosing identifiers.
An individual's name or ABN is not an identifier.
8 Anonymity
Individuals must have the option of not identifying themselves when entering transactions with an organisation.
9 Transborder data flows
Transfer of personal information for specified purposes
privacy-amendment-private-sector-act-2000.pdf, p.85
Permits transfer of personal information under specified conditions
The organisation may transfer personal information to a foreign country if...
10 Sensitive information
10 Section 10
Organisation must not collect sensitive information about an individual unless certain conditions are met.
Prohibits collection of sensitive information
Temporal overlap with lawful requirement
...unless the information is collected in the course of non-profit activities.
Organisation may collect health information under certain conditions.
privacy-amendment-private-sector-act-2000.pdf, p.86
Organisation may collect health information
Organisation may collect health information under specified conditions.
Organisation must de-identify health information before disclosure.
privacy-amendment-private-sector-act-2000.pdf, p.87
3 After section 273GAA
privacy-amendment-private-sector-act-2000.pdf, p.88
3(1) After section 273GAA
Disclosure of personal information to an officer for travel purposes.
3(2) After section 273GAA
No requirement to disclose information to an officer.
4 At the end of Division 3 of Part 6
116A Industry codes and standards do not affect Privacy Act 1988
Industry codes and standards do not affect Privacy Act 1988 requirements.
privacy-amendment-private-sector-act-2000.pdf, p.89
5 Paragraph 117(1)(j)
6 At the end of subsection 117(1)
The ACA must consult with the Privacy Commissioner about a code.
7 At the end of subsection 117(4)
An industry code ceases to be registered when it is removed from the Register of industry codes under section 122A.
8 At the end of subsection 118(1)
9 After subsection 118(4)
The ACA must consult the Privacy Commissioner before making a request for the development of an industry code.
privacy-amendment-private-sector-act-2000.pdf, p.90
Obligation to consult the Privacy Commissioner
The ACA is required to consult the Privacy Commissioner
The request must be made with consultation
Temporal interval for consultation request
The consultation request must be made after subsection (4A) comes into effect
The consultation request can only be made after the effective date of subsection (4A)
Temporal interval for industry code development
The industry code must be developed before the end of the specified period
The industry code can only be developed within a certain timeframe
An industry code is a set of rules for the telecommunications industry
The industry code is a specific concept in this context
The industry code must be validated by the Privacy Commissioner
The industry code is valid if it meets the requirements set by the Privacy Commissioner
10 At the end of subsection 120(1)
Prevents removal of industry code from the Register under section 122A.
Obligation to maintain industry code in Register
Removal from Register overlaps with removal under section 122A
Removal from Register and removal under section 122A overlap
Removal of industry code prevents removal under section 122A
Removal of industry code implies removal under section 122A is not allowed
Removal from Register propagates to removal under section 122A
Removal of industry code propagates to removal under section 122A
Removal from Register is validated by section 10
Removal from Register is valid according to section 10
11 After subsection 121(1)
Consult Privacy Commissioner before giving direction if contravention relates to National Privacy Principles or approved privacy code.
Obligation to consult Privacy Commissioner
Contravention relates to National Privacy Principles or approved privacy code
Consult Privacy Commissioner before giving direction
12 At the end of section 122
Consult Privacy Commissioner before issuing warning if contravention relates to National Privacy Principles or approved privacy code.
13 At the end of Division 4 of Part 6
122A De-registering industry codes and provisions of industry codes
privacy-amendment-private-sector-act-2000.pdf, p.91
122A(1) De-registering industry codes and provisions of industry codes
The ACA may remove industry codes from the Register.
122A(2) De-registering industry codes and provisions of industry codes
Industry code ceases to be registered when removed from the Register.
(2) An industry code ceases to be registered...
An industry code ceases to be registered.
122A(3) De-registering industry codes and provisions of industry codes
Conditional effect of removal of provision from industry code
14 At the end of subsection 130(1)
Allowing variation of industry standards under certain conditions.
15 Subsection 134(1)
Repeal subsection, substitute with new obligations regarding industry standards related to privacy.
16 After subsection 136(1)
17 At the end of Division 4 of Part 13
privacy-amendment-private-sector-act-2000.pdf, p.92
303A Generality of Division not limited
Nothing in this Division limits the generality of anything else in it.
18 After Division 4 of Part 13
Insert clause after Division 4 of Part 13
303B Acts taken to be authorised by law for purposes of Privacy Act
303B(1) Acts taken to be authorised by law for purposes of Privacy Act
Disclosure or use of information is authorized by law for Privacy Act purposes.
Authorizes disclosure or use of information.
303B(2) Acts taken to be authorised by law for purposes of Privacy Act
Disclosure or use of information is authorized for Privacy Act purposes.
303C Prosecution of an offence against this Part does not affect
303C(1) Prosecution of an offence against this Part does not affect
No effect on civil proceedings or administrative action under Privacy Act 1988
No effect on civil proceedings or administrative action
(1) The prosecution of an offence against Division 2 or 4 of this Part for disclosure or use of information or a document does not prevent civil proceedings or administrative action from being taken under the Privacy Act 1988 or an approved privacy code (as defined in that Act) in relation to the disclosure or use.
303C(2) Prosecution of an offence against this Part does not affect
Prosecution of an offence against this Part does not affect the outcome.
If prosecution affects outcome, then it is not an offence.
The prosecution and outcome are overlapping intervals.
303C(3) Prosecution of an offence against this Part does not affect
Does not affect the operation of section 49 of the Privacy Act 1988.
19 Subclause 15(2) of Schedule 2
Inserts 'and the National Privacy Principles' after 'Privacy Act 1988'
privacy-amendment-private-sector-act-2000.pdf, p.93
20 After subparagraph 147(2)(l)(i)
Inserts National Privacy Principle 2 and approved privacy codes into the law.
1 Section 93A
privacy-amendment-private-sector-act-2000.pdf, p.94
2 Saving
Exempts certain acts from Privacy Act 1988
3 After subsection 7(1)
Exempts disclosure of personal information to certain agencies.
Prohibits disclosure of personal information.
4 Application
Amendment of Privacy Act 1988 applies to determining operation in relation to acts or practices regardless of time.
Imposes a duty on the state to determine operation in relation to acts or practices.