privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.9
Omit certain words from disclosure or transfer
1 Section 3
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.32
Management of personal information is an obligation.
1 Australian Privacy Principle 1—open and transparent
Obligation to manage personal information
Ensure open and transparent management of personal information
1 Section 1
Duty to comply with Australian Privacy Principles
Must implement practices, procedures and systems to comply with Australian Privacy Principles.
to comply with Australian Privacy Principles.
Obligation to implement practices, procedures and systems.
APP entity must take such steps as are reasonable in the circumstances.
Entity must have a clearly expressed and up-to-date policy about personal information management.
Entity must have a clearly expressed and up-to-date policy.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.33
Entity must provide specific information in its APP privacy policy.
Entity must provide specific information.
An APP entity must make its APP privacy policy available.
Must provide a copy of the APP privacy policy in a particular form upon request.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.10
Entity must collect personal information for inclusion in a record or generally available publication.
10 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.20
10 Agencies that are taken to hold a record
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.46
10 Australian Privacy Principle 10—quality of personal information
Ensure personal information is accurate, up-to-date and complete.
10 Section 10
Ensure personal information is accurate, up-to-date, complete and relevant.
Duty to ensure accuracy of personal information
Entity must collect personal information.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.29
Substitute 'Australian' for 'Information'
100 Subsection 95B(1)
Substitute 'an Australian' for 'a National'
101 Section 95C
102 Subsections 100(2) to (4)
The Minister must be satisfied that the principal executive has agreed to the adoption, use or disclosure of the identifier.
102(2) Subsections 100(2) to (4)
the relevant agency or State or Territory authority has a principal executive
Consultation required before making regulations for certain purposes.
102(3) Subsections 100(2) to (4)
before the regulations are made, the Minister consults the Commissioner about the proposed regulations;
the circumstances of the use or disclosure of the identifier relate to the provision by...
the identifier is a kind commonly used in the processing of pay, or deductions from pay, of Commonwealth officers, or a class of Commonwealth officers;
Subsection (2) does not apply to the making of regulations for the purposes of Australian Privacy Principle 9.3 that relate to...
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.30
103 Part X
Repeal of Schedules and substitution with new Schedule
104 Schedules 1 and 3
Classifies the legislative provision as a descriptive clause
11 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.47
11 Australian Privacy Principle 11—security of personal
Must provide security for personal information
Protect personal information from misuse, interference, loss, unauthorized access, modification or disclosure.
11 Section 11
Destroy personal information if no longer needed
Destroy the information or de-identify it
The entity must take such steps as are reasonable in the circumstances
12 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.49
Entity must not charge excessive fee for access to personal information.
12 Section 12
written notice with reasons for refusal, mechanisms for complaint, and other prescribed matters
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.50
Entity must provide written notice to individual if access to personal information is refused
Entity has a duty to provide written notice
Must provide explanation for refusal of access to personal information
12 Australian Privacy Principle 12—access to personal information
Entity must provide access to personal information on request.
Entity may refuse access to personal information under certain conditions.
Entity's refusal overlaps with its authority.
Entity's refusal overlaps with the entity's authority to refuse access.
Entity is required or authorised to refuse access.
CogAI recognises the entity's refusal as a legitimate reason for not providing access.
Entity is an agency or required/authorised to refuse access.
Entity may refuse access to personal information.
Prohibits entity from giving access to personal information.
Entity is required or authorised to refuse to give access.
Personal information is diffused from entity's refusal.
Entity's refusal diffuses to the individual's personal information.
Entity refuses access to personal information.
Entity's refusal is a recurring trace of its authority.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.48
Entity not required to give individual access under certain conditions.
Entity is prohibited from giving access under certain conditions.
Access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.
Respond to request for access to personal information within a specified timeframe.
Entity must provide access in a way that meets the needs of the entity and the individual if refused.
Entity has an obligation to provide access.
Access may be given through a mutually agreed intermediary.
No charging for request or access to personal information
Defines the scope of court/tribunal orders
Applies to explicit class/type/subclass hierarchies
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.11
13 Subsection 6(1)
13 Australian Privacy Principle 13—correction of personal
Correct inaccurate or incomplete personal information upon request.
13 Section 13
Obligation to correct personal information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.51
Entity must notify other APP entity of correction upon request.
Entity must take steps to give notification.
Entity must provide written notice to individual upon refusal to correct personal information.
Correcting inaccurate personal information
Entity must correct inaccurate personal information upon request.
Entity must correct inaccurate personal information.
Must respond to request within specified timeframe and not charge individual for making the request.
De-identified personal information is obligation to be handled in a certain way.
14 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.21
14 Australian Privacy Principles
References to the Australian Privacy Principles in Schedule 1.
14(1) Australian Privacy Principles
Reference to Australian Privacy Principle with a specific number is an obligation.
14(2) Australian Privacy Principles
Repeal definition of eligible case manager
15 Subsection 6(1) (definition of eligible case manager)
Must not breach Australian Privacy Principle
15 APP entities must comply with Australian Privacy Principles
16 Subsection 6(1) (after paragraph (b) of the definition of
Exemptions from Australian Privacy Principles for personal, family or household affairs
16 Personal, family or household affairs
...his or her personal, family or household affairs.
for the purposes of, or in connection with...
...for the purposes of, or in connection with, his or her personal,...
Nothing in the Australian Privacy Principles applies to...
16A Permitted general situations in relation to the collection, use or
Permitted general situations for collection, use or disclosure of personal information
16A(1) Permitted general situations in relation to the collection, use or
the information or identifier falls within the permitted general situation
the entity is an entity of a kind specified in an item in column 1 of the table
Commissioner may make rules relating to collection, use or disclosure of personal information.
16A(2) Permitted general situations in relation to the collection, use or
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.24
16B Permitted health situations in relation to the collection, use or
Permitted health situations for collection of health information
16B(1) Permitted health situations in relation to the collection, use or
Describes the temporal relationship between the collection and the provision of a health service
(1) A permitted health situation exists in relation to the collection by an organisation of health information about an individual...
Describes the role of artificial intelligence in the collection and analysis of health information
Allows the collection of health information under certain conditions
Describes the mechanism by which health information is disseminated
Describes the temporal relationship between the collection and the expiration of a permit
16B(2) Permitted health situations in relation to the collection, use or
(2) A permitted health situation exists...
Permitted health situations for use or disclosure of health information
16B(3) Permitted health situations in relation to the collection, use or
(a) the use or disclosure is necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety;
(b) it is impracticable for the organisation to obtain the individual’s consent to the use or disclosure;
(c) the use or disclosure is conducted in accordance with guidelines approved under section 95A for the purposes of this paragraph;
Reasonable belief about recipient’s actions
(d) in the case of disclosure—the organisation reasonably believes that the recipient of the information will not disclose the information, or personal information derived from that information.
Permitted health situations for the use or disclosure of genetic information.
16B(4) Permitted health situations in relation to the collection, use or
The use or disclosure of genetic information must occur before a certain date.
Temporal interval for the use or disclosure of genetic information
The use or disclosure of genetic information is permitted if it occurs within a certain time frame.
Permitted health situations for disclosure of health information
16B(5) Permitted health situations in relation to the collection, use or
the disclosure is permitted if the conditions are met
Defines conditions under which disclosure is permitted
(5) A permitted health situation exists in relation to the disclosure by an organisation of health information about an individual if...
the disclosure must be limited to what is reasonable and necessary
(f) the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (d)
the disclosure must not contradict the individual's wishes
Defines exceptions to permitted disclosure
(e) the disclosure is not contrary to any wish expressed by the individual before the individual became unable to give or communicate consent
the disclosure must not contradict wishes known to the carer
(e) of which the carer is aware, or of which the carer could reasonably be expected to be aware
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.26
16C Acts and practices of overseas recipients of personal
Disclosing personal information to an overseas recipient is prohibited if certain conditions are met.
16C(1) Acts and practices of overseas recipients of personal
(a) an APP entity discloses personal information about an individual to an overseas recipient;
The act done by the overseas recipient is taken to be a breach of Australian Privacy Principles.
16C(2) Acts and practices of overseas recipients of personal
The act is taken to be a breach of Australian Privacy Principles.
(2) The act done, or the practice engaged in, by the overseas recipient is taken, for the purposes of this Act:
The act is a breach of Australian Privacy Principles.
(2) The act done, or the practice engaged in, by the overseas recipient is taken, for the purposes of this Act: (a) to have been done, or engaged in, by the APP entity; and (b) to be a breach of those Australian Privacy Principles by the APP entity.
The act is taken to be done or engaged in by the APP entity.
17 Subsection 6(1) (after paragraph (c) of the definition of
Establishment of a similar body for enforcement
18 Subsection 6(1) (after paragraph (e) of the definition of
Establishes an obligation to establish a similar body
Inserts the Corruption and Crime Commission of Western Australia as an enforcement body.
19 Subsection 6(1) (after paragraph (l) of the definition of
2 Section 3 (note)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.27
Substitute 'a responsible person for the individual'
2 Section 2
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.34
Australian Privacy Principle 2—anonymity and pseudonymity
2 Australian Privacy Principle 2—anonymity and pseudonymity
Must provide option to not identify themselves or use pseudonym when dealing with APP entity.
Exemption from Subclause 2.1 for APP entities dealing with individuals who have identified themselves or used a pseudonym.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.12
20 Subsection 6(1)
Includes various activities as enforcement-related
Subclassifies activities into enforcement-related
Insert: enforcement related activity means...
21 Subsection 6(1)
Classifies entities into agency, organisation, and small business operator
Definition of generally available publication
22 Subsection 6(1) (definition of generally available
Defines the term 'generally available publication'
Applies to publications that are generally available to members of the public
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.13
Defines government-related identifier of an individual
23 Subsection 6(1)
Contract period is relevant for identifier assignment
Identifier assigned by agency or authority during contract period
Entity holds personal information if it has possession or control of a record containing the information.
24 Subsection 6(1)
Entity holds personal information for that period
Temporal relation between entity and record
Entity has possession or control of a record at some point in time.
Entity's possession or control relation to the record
Entity has possession or control of a record containing the information.
25 Subsection 6(1)
but does not include the individual’s name
or a combination of any or all of those things
identifier is a number, letter or symbol
26 Subsection 6(1)
...the Minister administering the Migration Act 1958.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.14
Repeal definition of Information Privacy Principle
27 Subsection 6(1) (definition of Information Privacy
28 Subsection 6(1) (definition of IPP complaint)
29 Subsection 6(1)
3 Section 5
Collection of solicited personal information is an obligation.
3 Australian Privacy Principle 3—collection of solicited personal
Obligation to collect solicited personal information.
No personal information can be collected unless necessary for functions or activities.
3 Section 3
No personal information can be collected.
Organisations must not collect personal information unless necessary for their functions.
Entity must not collect personal information
Prohibition on collecting personal information
An APP entity must not collect sensitive information about an individual unless certain conditions are met.
Prohibition of collecting sensitive information
APP entity must not collect sensitive information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.35
Sensitive information about an individual can be collected under certain circumstances.
Collection overlaps with enforcement-related activities.
Collection is necessary for certain purposes.
Sensitive information is related to permitted health situations.
Sensitive information relates to specific situations.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.36
Must collect personal information only by lawful and fair means.
Obligation to collect personal information
Class hierarchy: Obligations -> APP entity obligations
Must collect personal information from individual unless certain conditions apply.
This principle applies to the collection of personal information solicited by an APP entity.
The APP entity must comply with this principle
Obligation to protect personal information
The APP entity is responsible for protecting personal information
Repeal the definition of National Privacy Principle
30 Subsection 6(1) (definition of National Privacy Principle)
31 Subsection 6(1)
cultural, recreational, political, religious, philosophical, professional, trade or trade union purposes
32 Subsection 6(1) (definition of NPP complaint)
Definition of overseas recipient for personal information
33 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.15
34 Subsection 6(1)
35 Subsection 6(1)
36 Subsection 6(1) (definition of personal information)
Imposes a duty on the state to protect personal information
37 Subsection 6(1) (definition of record)
Repeal paragraphs (b) and (c) of the definition of record, substitute with an electronic or other device.
38 Subsection 6(1) (paragraphs (b) and (c) of the definition of
Prohibits the definition of record with paragraphs (b) and (c)
39 Subsection 6(1) (at the end of the definition of record)
4 Subsection 6(1) (paragraph (i) of the definition of agency)
Dealing with unsolicited personal information
4 Australian Privacy Principle 4—dealing with unsolicited personal
Reasonable period after receiving personal information
Determine whether the entity could have collected information under Australian Privacy Principle 3 if solicited.
4 Section 4
Use or disclose personal information for making determination under subclause 4.1.
Destroy personal information if it cannot be collected or is not in a Commonwealth record.
Mandatory destruction of personal information.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.37
Applying Australian Privacy Principles if subclause 4.3 does not apply
Application of principles occurs under this relation
Temporal relation between collection and application of principles
40 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.16
Omit 'preferences', substitute 'orientation'
41 Subsection 6(1) (subparagraph (a)(viii) of the definition of
Add biometric information for automated verification or identification
42 Subsection 6(1) (at the end of the definition of sensitive
Adds to the definition of sensitive information
43 Subsection 6(1) (definition of solicit)
Entity must solicit personal information from another entity.
44 Subsection 6(1)
Inserts solicitation of personal information.
45 Subsection 6(1) (definition of use)
46 Subsection 6(2)
47 Paragraph 6(7)(a)
48 Paragraph 6(7)(d)
49 Paragraph 6(7)(f)
5 Subsection 6(1)
Notification of collection of personal information
5 Australian Privacy Principle 5—notification of the collection of
Notify individual of personal information collected
5 Section 5
The APP entity must provide certain information to the individual about their personal data collection and use.
The APP entity must provide certain information.
APP complaint means a complaint about an act or practice...
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.17
Substitute 16 with 16 in subsection 6(10)
50 Subsection 6(10)
51 Paragraph 6(10)(a)
52 After section 6
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.18
Repeal heading and substitute with new text.
53 Section 6A (heading)
54 Subsection 6A(1) (heading)
55 Subsection 6A(1)
Substitute 'principle' for 'National Privacy Principle'
56 Subsection 6A(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.19
57 Subsection 6A(2)
Substitute 'principle' with 'the principle'
58 Paragraph 6A(2)(b)
59 Subsections 6A(3) and (4)
6 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.38
Use or disclosure of personal information is an obligation.
6 Australian Privacy Principle 6—use or disclosure of personal
Must not use or disclose personal information for a secondary purpose without consent.
6 Section 6
Prohibits use or disclosure of personal information for a secondary purpose.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.39
Use or disclose personal information for secondary purpose if individual expects it, or required by law or court order.
use or disclosure of information overlaps with enforcement related activities
the APP entity reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.
use or disclose personal information for secondary purpose
Duty to use or disclose personal information for secondary purpose
individual would reasonably expect the APP entity to use or disclose the information
Duty to use or disclose personal information for secondary purpose if individual expects it
the individual would reasonably expect the APP entity to use or disclose the information
Duty to use or disclose personal information for secondary purpose if required by law or court order
the use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order;
Disclosure of personal information about an individual by an APP entity is subject to certain conditions.
Obligation on APP entities to disclose personal information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.40
Entity must de-identify personal information before disclosure.
Entity must take steps to ensure de-identification before disclosure.
Temporal interval: APP entity's collection of personal information.
De-identification requirement implies duty to disclose de-identified information.
COGAI's knowledge graph includes de-identification requirement for APP entities.
Entity must take steps to ensure de-identification.
Duty to de-identify personal information.
Diffusion of personal information requires de-identification.
Must make a written note of use or disclosure if in accordance with paragraph 6.2(e)
If an APP entity is a body corporate and collects personal information from a related body corporate, the principle applies.
Exemptions from data protection for direct marketing and government-related identifiers.
Personal information for direct marketing
60 Subparagraphs 6C(4)(b)(ii) and (iii)
61 Subsection 6EA(1)
Omit specific phrase from disclosure and transfer clause.
62 Paragraph 6F(3)(b)
63 Paragraph 7(1)(a)
64 Paragraph 7(1)(cb)
65 Paragraphs 7(1)(d) and (e)
66 Paragraphs 7(1)(ea) and (eb)
Substitute 'Australian' for 'Information Privacy Principles, the National'
67 Subsection 7(2)
Substitute section numbers in Schedule 1
68 Subsection 7B(1) (note)
Imposes a duty on the legislative body to make the substitution
69 Subsections 7B(1) and (2) (notes)
Imposes a duty on the State to substitute 'Australian' for 'National'
Breach of an Australian Privacy Principle
6A Breach of an Australian Privacy Principle
6AA Meaning of responsible person
Defines a responsible person for an individual.
6AA(1) Meaning of responsible person
The individual's guardian has a temporal relationship with...
Temporal relationship between an individual and their guardian
(f) a person exercising an enduring power of attorney granted by the individual that is exercisable in relation to decisions about the individual’s health;
Having an intimate personal relationship implies being a...
Relationship between being a responsible person and having an intimate personal relationship
(g) a person who has an intimate personal relationship with the individual;
Relationship between an individual and their relative
(d) a relative of the individual if the relative is: (i) at least 18 years old; and (ii) a member of the individual’s household;
(1) A responsible person for an individual is:
The individual's de facto partner is a...
Relationship between an individual and their de facto partner
(c) a spouse or de facto partner of the individual;
Defines a child for the purposes of subsection (1)
6AA(2) Meaning of responsible person
7 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.43
7 Section 7
Temporal interval during which exemptions apply
The exemptions apply during the period in which the Do Not Call Register Act 2006 and the Spam Act 2003 are in force.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.41
7 Australian Privacy Principle 7—direct marketing
Organisation must not use or disclose personal information for direct marketing.
Prohibition of using or disclosing personal information for direct marketing.
Organisation may use or disclose personal information for direct marketing under certain conditions.
Permission to use or disclose personal information for direct marketing
Use of personal information for direct marketing under certain conditions.
Direct marketing is permitted within this temporal interval.
Temporal interval within which direct marketing is permitted.
either: (i) the individual has consented to the use or disclosure of the information for that purpose; or (ii) it is impracticable to obtain that consent
Use of personal information for direct marketing is permitted under these conditions.
Permission granted under certain conditions.
the organisation collected the information from: (i) the individual and the individual would not reasonably expect the organisation to use or disclose the information for that purpose; or (ii) someone other than the individual
Consent is required from the individual before using their personal information.
Requirements for obtaining consent before using personal information.
the individual has not made such a request to the organisation
The individual is classified as non-sensitive if they did not provide consent.
Classification of individuals into sensitive and non-sensitive categories.
Direct marketing communications must include a prominent statement about requesting opt-out.
Characterization of direct marketing communications.
in each direct marketing communication with the individual: (i) the organisation includes a prominent statement that the individual may make such a request; or (ii) the organisation otherwise draws the individual’s attention to the fact that the individual may make such a request
Direct marketing is not permitted after this temporal interval.
Temporal interval until which direct marketing is not permitted.
the organisation provides a simple means by which the individual may easily request not to receive direct marketing communications from the organisation
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.42
Use of sensitive information for direct marketing with consent.
Permission to use sensitive information.
Organisation is a contracted service provider
Individual has right to request not to receive direct marketing communications.
The individual may request not to receive direct marketing communications.
Organisation must not charge individual for making request and give effect to it within a reasonable period.
Organisation must not charge individual.
Organisation must give effect to request within a reasonable period.
Organisation must notify individual of source unless impracticable or unreasonable.
70 Paragraph 8(2)(b)
71 Subsection 8(2)
Omit ‘of the record-keeper in relation to’
72 Section 9
73 Section 10 (heading)
74 Subsections 10(1) to (3)
75 Subsections 10(4) and (5)
Prohibits agency from holding certain role
76 Section 12
77 Subsection 13B(1) (note)
78 Subsection 13B(1) (note)
79 Subsection 13B(1A) (note)
8 Subsection 6(1)
Australian Privacy Principle 8—cross-border disclosure of personal information
8 Australian Privacy Principle 8—cross-border disclosure of
Entity must ensure overseas recipient does not breach Australian Privacy Principles.
8 Section 8
Entity has an obligation to ensure overseas recipient does not breach Australian Privacy Principles.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.44
Disclosure of personal information is permitted under certain conditions.
there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme
Permission granted under specified conditions.
the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting the information
80 Subsection 13C(1) (note)
81 Subsection 13C(1) (note)
82 Divisions 2 and 3 of Part III
83 Section 37 (table items 6 and 7)
84 Subsections 54(2) and 57(2) (definition of agency)
Omit specific term and substitute another.
85 Paragraph 80H(2)(e)
Replace 'individual' with 'responsible person for the individual'
86 Subparagraph 80P(1)(c)(v)
87 Paragraph 80Q(1)(c)
88 Subsection 95(1)
89 Subsections 95(2) and (4)
9 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.45
Adoption of government related identifiers is an obligation.
9 Australian Privacy Principle 9—adoption, use or disclosure of
Obligation to adopt government related identifiers.
Organisation must not adopt government related identifier of individual unless required or authorised by law.
9 Section 9
Organisation must not use or disclose government-related identifier unless certain conditions are met.
Organisation is prohibited from using or disclosing government-related identifier.
Organisations must adopt, use or disclose government-related identifiers of individuals if prescribed by regulations.
The adoption, use or disclosure occurs in the circumstances prescribed by the regulations.
The adoption, use or disclosure must occur in the circumstances prescribed by the regulations.
The organisation is prescribed by the regulations.
Organisations are obliged to adopt, use or disclose government-related identifiers of individuals.
Organisations must adopt, use or disclose government-related identifiers of individuals.
The regulations prescribe the adoption, use or disclosure.
Organisations are included in a class of organisations prescribed by the regulations.
The identifier is prescribed by the regulations.
The regulation is a prerequisite for the adoption, use or disclosure.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.28
90 Section 95A (heading)
Substitute Australian Privacy Principles for National Privacy Principles.
91 Subsection 95A(1)
Substitute paragraph 16B(3)(c) for omitted text.
92 Subsection 95A(2)
Substitute Australian Privacy Principles (disregarding subsection 16B(3))
93 Subsection 95A(3)
Substitute paragraph 16B(2)(d)(iii) for paragraph 10.3(d)(iii)
94 Subsection 95A(4)
Substitute Australian Privacy Principles (disregarding subsection 16B(2))
95 Subsection 95A(5)
Guidelines for Australian Privacy Principles about health
95A Guidelines for Australian Privacy Principles about health
Guidelines for Australian Privacy Principles about genetic information
95AA Guidelines for Australian Privacy Principles about genetic
96 Section 95AA (heading)
97 Subsection 95AA(1)
Omit specific paragraph and substitute another.
98 Subsection 95AA(2)
Omit “(whether or not the threat is imminent)”.
99 Subsection 95AA(2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.53
1 Before section 6
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.110
Exempts provider from credit information obligations.
Exempts the provider from certain obligations.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.54
Consumer credit liability information must be provided by a credit provider.
Must provide consumer credit liability information.
Classifies consumer credit as a type of consumer credit.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.55
Assessing an application for consumer credit and collecting overdue payments are obligations of a credit provider.
The text explicitly states obligations of a credit provider.
The excerpt describes a subclass of 'purpose' related to consumer credit.
Must provide court proceedings information about an individual's judgement in Australian courts.
Inserts court proceedings information into the definition of 'court proceedings information'
Definition of CP derived information about an individual
CP derivation occurs during the period of credit reporting
Temporal relation between credit reporting and CP derivation
Credit reporting occurs before CP derivation
CP derived information is a specific type of personal information
CP derived information is a subclass of personal information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.56
Defines CRB derived information about an individual.
Imposes a duty on credit reporting bodies.
Defines the scope of CRB derived information.
15 Subsection 6(1) (definition of credit)
16 Subsection 6(1) (definition of credit card)
Credit reporting information about an individual means credit reporting information disclosed to a credit provider by a credit reporting body under Division 2 of Part IIIA or CP derived information about the individual.
17 Subsection 6(1)
Temporal interval for credit reporting information disclosure
Class hierarchy for credit eligibility information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.57
18 Subsection 6(1) (definition of credit enhancement)
Omit 'the loan', substitute 'the credit'
19 Subsection 6(1) (paragraphs (a) and (b) of the definition of
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.78
Rules for credit reporting bodies and providers regarding handling of information.
19 Guide to this Part
Division 7 provides for compensation orders, and other orders, to be made by the Federal Court or Federal Magistrates Court.
Rule for handling information regarding credit reporting.
In general, this Part deals with the privacy of information relating to credit reporting.
Cognitive process for handling information regarding credit reporting.
Obligation to handle information correctly.
This Part deals with the privacy of information relating to credit reporting.
Diffusion of obligations to handle information correctly.
2 Subsection 6(1)
Definition of credit guarantee purpose for an individual
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.79
Rules for credit reporting bodies regarding handling of specific information and assessments.
20 Guide to this Division
Applies to the handling of specific information and assessments.
20A Application of this Division and the Australian Privacy
This Division applies to a credit reporting body in relation to the specified types of information.
20A(1) Application of this Division and the Australian Privacy
...in relation to the specified types of information.
The Division applies to a credit reporting body.
Exemptions from Australian Privacy Principles for credit reporting bodies
20A(2) Application of this Division and the Australian Privacy
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.80
20B Open and transparent management of credit reporting
Ensure open and transparent management of credit reporting
20B(1) Open and transparent management of credit reporting
Obligation to ensure open and transparent management
Must implement practices, procedures and systems to comply with Division and registered CR code.
20B(2) Open and transparent management of credit reporting
Credit reporting bodies must have a clearly expressed and up-to-date policy about the management of credit reporting information.
20B(3) Open and transparent management of credit reporting
Must have a clearly expressed and up-to-date policy.
The credit reporting body must provide certain information to individuals.
20B(4) Open and transparent management of credit reporting
The credit reporting body must provide certain information.
Credit reporting bodies must make the policy available free of charge and in an appropriate form.
20B(5) Open and transparent management of credit reporting
Credit reporting body must provide a copy of its policy in a requested form.
20B(6) Open and transparent management of credit reporting
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.81
20C Collection of solicited credit information
Cannot collect credit information about an individual
20C(1) Collection of solicited credit information
Prohibition of collecting credit information
Exemption from subsection (1) for collection of credit information under Australian law or court order.
20C(2) Collection of solicited credit information
Exemption from subsection (1) for credit reporting bodies collecting information from a permitted provider or in the course of carrying on a business.
20C(3) Collection of solicited credit information
Exemption from subsection (1) for certain credit reporting bodies
20C(4) Collection of solicited credit information
The credit reporting must occur after the individual's 18th birthday
Temporal relationship between credit reporting and consumer credit
if the information relates to consumer credit or commercial credit—the credit is or has been provided, or applied for, in Australia;
The credit reporting body has a duty to collect the credit information
the credit reporting body collects the credit information about the individual from an entity (other than a credit provider)
The credit reporting body is permitted to collect the credit information from an entity (other than a credit provider) if the individual has reached the age of majority
Permission to collect credit information
The credit reporting must occur regularly
if the information is repayment history information about the individual—the body collects the information from another credit reporting body that has an Australian link;
Exempts identification information about the individual from Paragraph (4)(b) of Schedule 2.
20C(5) Collection of solicited credit information
Exempts identification information from a duty.
(5) Paragraph (4)(b) does not apply to identification information about the individual.
Consumer credit liability information can relate to credit entered before turning 18.
20C(6) Collection of solicited credit information
Relates to consumer credit liability information
Classifies as consumer credit liability information
Must collect credit information by lawful and fair means.
20C(7) Collection of solicited credit information
Obligation to collect credit information by lawful and fair means.
Classification of credit reporting bodies as obligated to collect credit information by lawful and fair means.
Duty to collect solicited credit information
20C(8) Collection of solicited credit information
Obligation to collect solicited credit information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.83
20D Dealing with unsolicited credit information
Credit reporting body must determine if it could have collected information under section 20C if solicited.
20D(1) Dealing with unsolicited credit information
Use or disclose credit information for making determination under subsection (1)
20D(2) Dealing with unsolicited credit information
The credit reporting body must use or disclose the credit information for making the determination under subsection (1)
Temporal interval between use and disclosure
(2) The credit reporting body may use or disclose the credit information
The credit reporting body must infer its obligation to use or disclose the credit information for making the determination under subsection (1)
Infer obligation from use and disclosure
The credit reporting body must diffuse its obligation to use or disclose the credit information for making the determination under subsection (1)
If credit reporting body determines it could have collected information, sections 20E to 20ZA apply.
20D(3) Dealing with unsolicited credit information
Credit reporting body determines it could have collected information.
Destroy unsolicited credit information if unable to collect.
20D(4) Dealing with unsolicited credit information
Obligation to destroy unsolicited credit information.
Credit reporting body must retain credit information under certain conditions.
20D(5) Dealing with unsolicited credit information
Retention period meets minimum requirement
Retention period must be greater than or equal to a certain threshold
Australian law or court order requires retention
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.84
20E Use or disclosure of credit reporting information
Prohibition on using or disclosing credit reporting information
20E(1) Use or disclosure of credit reporting information
Permitted disclosures of credit reporting information
20E(2) Use or disclosure of credit reporting information
Permitted CRB disclosure in relation to the individual
20E(3) Use or disclosure of credit reporting information
Prohibition on disclosure of credit reporting information
Credit reporting body must not disclose repayment history information unless recipient is a credit provider or mortgage insurer.
20E(4) Use or disclosure of credit reporting information
Recipient is a credit provider or mortgage insurer.
Credit reporting body must not disclose repayment history information.
20E(5) Use or disclosure of credit reporting information
Exemption from section 20E for direct marketing purposes
20E(6) Use or disclosure of credit reporting information
Section does not apply to direct marketing
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.85
20F Permitted CRB disclosures in relation to individuals
Disclosure of credit reporting information is permitted to specified entities under certain conditions.
20F(1) Permitted CRB disclosures in relation to individuals
Disclosure is permitted for purposes related to consumer credit or commercial credit.
Consent for disclosure of CRB information under certain conditions.
20F(2) Permitted CRB disclosures in relation to individuals
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.87
20G Use or disclosure of credit reporting information for the
Use or disclosure of credit reporting information for direct marketing is prohibited.
20G(1) Use or disclosure of credit reporting information for the
Prohibition of using or disclosing credit reporting information for direct marketing.
Permits use of credit information for direct marketing by a licensed provider in Australia, under certain conditions.
20G(2) Use or disclosure of credit reporting information for the
Expresses a prohibition or restriction on an action.
Credit provider must nominate eligibility requirements for credit reporting bodies.
20G(3) Use or disclosure of credit reporting information for the
Obligation to nominate eligibility requirements.
Prohibition on using credit reporting information for pre-screening
20G(4) Use or disclosure of credit reporting information for the
(4) An assessment under paragraph (2)(d) is not credit reporting information about the individual.
Request for non-use of credit reporting information
20G(5) Use or disclosure of credit reporting information for the
(5) An individual may request a credit reporting body that holds credit information about the individual not to use the information under subsection (2).
Representation of permission in knowledge base
a credit reporting body that holds credit information about the individual not to use the information under subsection (2).
No charge for making a request or giving effect to the request.
20G(6) Use or disclosure of credit reporting information for the
Must make a written note of use of credit information
20G(7) Use or disclosure of credit reporting information for the
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.88
20H Use or disclosure of pre-screening assessments
Prohibition on using or disclosing pre-screening assessments
20H(1) Use or disclosure of pre-screening assessments
Prohibits the use or disclosure of pre-screening assessments
Disclosure of pre-screening assessment for direct marketing purposes
20H(2) Use or disclosure of pre-screening assessments
Disclosure must occur within this temporal interval
Credit reporting body must make a written note of disclosure.
20H(3) Use or disclosure of pre-screening assessments
Recipient must not use or disclose pre-screening assessment.
20H(4) Use or disclosure of pre-screening assessments
Prohibition of using or disclosing pre-screening assessments.
Permits use of pre-screening assessments for direct marketing by or on behalf of the credit provider.
20H(5) Use or disclosure of pre-screening assessments
Defines a temporal interval for permitted use of pre-screening assessments.
(5) Subsection (4) does not apply if the recipient uses the pre-screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider.
Classifies use of pre-screening assessments as permitted by artificial intelligence.
Grants permission for use of pre-screening assessments.
Diffuses information about permitted use of pre-screening assessments.
Recipient must make a written note of use of pre-screening assessment.
20H(6) Use or disclosure of pre-screening assessments
Exemption from Australian Privacy Principles for APP entities
20H(7) Use or disclosure of pre-screening assessments
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.89
20J Destruction of pre-screening assessment
Destroy pre-screening assessment if no longer needed or required by law.
20J(1) Destruction of pre-screening assessment
Assessment is destroyed during a specific time period.
(1) If an entity has possession or control of a pre-screening assessment...
...the entity must destroy the assessment if:
Entity's destruction of assessment implies compliance with law.
Entity's destruction of assessment propagates to others.
Australian Privacy Principle 11.2 does not apply to the entity in relation to the pre-screening assessment.
20J(2) Destruction of pre-screening assessment
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.90
20K No use or disclosure of credit reporting information during a
No use or disclosure of credit reporting information during a ban period.
20K(1) No use or disclosure of credit reporting information during a
then, despite any other provision of this Division, the body must not use or disclose the information during the ban period for the information.
Specifies a temporal interval during which credit reporting bodies must not use or disclose information.
(c) the individual requests the body not to use or disclose the information under this Division;
Classifies credit reporting bodies as entities that must not use or disclose information during a ban period.
(a) a credit reporting body holds credit reporting information about an individual;
Prohibits use or disclosure of credit reporting information during a ban period.
Negates the diffusion of credit reporting information during a ban period.
Specifies a temporal interval until which credit reporting bodies must not use or disclose information.
(b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud);
Consent required for use or disclosure of credit reporting information
20K(2) No use or disclosure of credit reporting information during a
Permission to use or disclose credit reporting information
Ban on use or disclosure of credit reporting information during a specified period.
20K(3) No use or disclosure of credit reporting information during a
Extend ban period for credit reporting information if victim of fraud
20K(4) No use or disclosure of credit reporting information during a
Ban period >= individual's request for extension
Ban period must be extended before it ends
Ban period > individual's request for extension
State must extend ban period if individual is a victim of fraud
20K(5) No use or disclosure of credit reporting information during a
Imposes a prohibition on the use or disclosure of credit reporting information
No charging for request to credit reporting body
20K(6) No use or disclosure of credit reporting information during a
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.91
20L Adoption of government related identifiers
Cannot adopt government related identifier as its own identifier.
20L(1) Adoption of government related identifiers
the body must not adopt the government related identifier as its own identifier.
Prohibition of adopting government related identifier.
(a) a credit reporting body holds credit reporting information about an individual; and (b) the information is a government related identifier of the individual;
Exemption from subsection (1) for adoption required by law or court order
20L(2) Adoption of government related identifiers
...if the adoption of the government related identifier is required or authorised by or under an Australian law...
Temporal relationship between subsections
...required or authorised by or under an Australian law...
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.92
20M Use or disclosure of credit reporting information that is
Must not use or disclose de-identified credit reporting information
20M(1) Use or disclosure of credit reporting information that is
the body must not use or disclose the de-identified information.
Temporal interval for prohibition on use or disclosure of de-identified credit reporting information
(1) If: (a) a credit reporting body holds credit reporting information; and (b) the information (the de-identified information) is de-identified;
Implication of prohibition on use or disclosure of de-identified credit reporting information
(a) a credit reporting body holds credit reporting information;
Prohibition on use or disclosure of de-identified credit reporting information
Spread of prohibition on use or disclosure of de-identified credit reporting information
Recurring trace for prohibition on use or disclosure of de-identified credit reporting information
Permits use or disclosure of credit reporting information for research purposes under certain conditions.
20M(2) Use or disclosure of credit reporting information that is
The Commissioner may make rules relating to the use or disclosure of credit reporting information.
20M(3) Use or disclosure of credit reporting information that is
Rules for use or disclosure of credit reporting information
20M(4) Use or disclosure of credit reporting information that is
Temporal interval for conducting research
(c) the purposes of conducting the research
Prohibition on using or disclosing credit reporting information without rules
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.93
20N Quality of credit reporting information
Ensure accurate, up-to-date and complete credit information
20N(1) Quality of credit reporting information
Ensure accuracy, completeness, and relevance of credit reporting information.
20N(2) Quality of credit reporting information
Ensure accuracy, completeness, and relevance.
Ensure accuracy, completeness, and regular audits of credit information.
20N(3) Quality of credit reporting information
Ensure accuracy, completeness, and regular audits.
20P False or misleading credit reporting information
Using or disclosing false credit reporting information under this Division is prohibited.
20P(1) False or misleading credit reporting information
the information is false or misleading in a material particular.
Temporal interval for using or disclosing credit reporting information.
(a) the body uses or discloses credit reporting information under this Division (other than subsections 20D(2) and 20T(4));
Classification of credit reporting information as true or false using artificial intelligence.
(b) the information is false or misleading in a material particular.
Prohibition of using or disclosing false credit reporting information.
Diffusing the prohibition of using or disclosing false credit reporting information.
Recurring trace for using or disclosing credit reporting information.
Must not use or disclose false or misleading credit reporting information.
20P(2) False or misleading credit reporting information
Prohibition of false or misleading credit reporting information.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.94
20Q Security of credit reporting information
Protect credit reporting information from misuse, interference, loss, unauthorized access, modification or disclosure.
20Q(1) Security of credit reporting information
the body must take such steps as are reasonable in the circumstances...
Temporal interval for protecting credit reporting information
(1) If a credit reporting body holds credit reporting information...
Duty to protect credit reporting information
20Q(2) Security of credit reporting information
Must protect credit reporting information.
20R Access to credit reporting information
Must provide access to credit reporting information on request
20R(1) Access to credit reporting information
Deny access to credit reporting information under certain conditions.
20R(2) Access to credit reporting information
Credit reporting body must respond to request within a reasonable period.
20R(3) Access to credit reporting information
Must provide response within a reasonable period.
Classifies as part of the definition of credit reporting bodies.
Access to credit reporting information must be given in a specific manner.
20R(4) Access to credit reporting information
Duty to provide access in a specific manner.
No charge for making request or giving access to information if not made in previous 12 months.
20R(5) Access to credit reporting information
No excessive charge for access to credit reporting information
20R(6) Access to credit reporting information
Credit reporting body must provide written notice with reasons for refusal of access to information.
20R(7) Access to credit reporting information
Refusal of access may be appealed within a certain timeframe
States options for dispute resolution and complaint process
(b) states that, if the access seeker is not satisfied with the response to the request
Provides contact information for dispute resolution and complaint process
(ii) access a recognised external dispute resolution scheme of which the body is a member; or (iii) make a complaint to the Commissioner under Part V.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.96
20S Correction of credit reporting information
Correct inaccurate credit reporting information
20S(1) Correction of credit reporting information
Obligation to correct inaccurate credit reporting information
Body must provide written notice of correction within a reasonable period.
20S(2) Correction of credit reporting information
Exemption from notice under subsection (2) due to impracticability or legal requirement.
20S(3) Correction of credit reporting information
Exemption from notice under subsection (2)
Permission for exemption from notice under subsection (2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.97
20T Individual may request the correction of credit information etc.
20T(1) Individual may request the correction of credit information etc.
Temporal overlap between request and correction
(1) An individual may request a credit reporting body to correct personal information about the individual if:...
Personal information about the individual
(a) The personal information is: (i) credit information about the individual; or (ii) CRB derived information about the individual; or (iii) CP derived information about the individual.
Credit reporting body must correct inaccurate personal information within a specified period.
20T(2) Individual may request the correction of credit information etc.
...the body must take such steps (if any)... within: (a) the period of 30 days that starts on the day on which the request is made;
The period of correction starts on the day of request
(2) If the credit reporting body is satisfied that the personal information is inaccurate...
...the body must take such steps (if any)...
Request for correction is a type of input to credit reporting body
Obligation to correct inaccurate personal information
Request for correction implies a condition that leads to correction
...the body must take such steps (if any)... within: (b) such longer period as the individual has agreed to in writing.
The period of correction can be longer if agreed in writing
Credit reporting body must consult interested parties about individual's request.
20T(3) Individual may request the correction of credit information etc.
the body must consult that interested party, or those interested parties, about the individual’s request.
(3) If the credit reporting body considers...
Use or disclosure of personal information for consultation purposes is authorized.
20T(4) Individual may request the correction of credit information etc.
Personal information used for consultation purposes is within authorized scope.
(4) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.
Personal information recognized as authorized for consultation purposes.
Authorizes use or disclosure of personal information.
Personal information used for consultation purposes recurs in authorized scope.
Personal information validated as authorized for consultation purposes.
No charge for request or correction of credit information
20T(5) Individual may request the correction of credit information etc.
Prohibits charging individual for request or correction
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.98
20U Notice of correction etc. must be given
Individual must provide notice of correction to credit reporting body.
20U(1) Notice of correction etc. must be given
Credit reporting body must provide written notice of correction to individual and recipient.
20U(2) Notice of correction etc. must be given
Must provide written notice of correction.
Credit reporting body must correct personal information within a reasonable period and provide written notice with reasons.
20U(3) Notice of correction etc. must be given
Credit reporting body must give notice under paragraph (2)(c) if possible
20U(4) Notice of correction etc. must be given
Notice must be given within a certain timeframe
(4) Paragraph (2)(c) does not apply if it is impracticable for the credit reporting body to give the notice under that paragraph.
No notice must be given if required by law or court order.
20U(5) Notice of correction etc. must be given
(5) Subsection (2) or (3) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order,
Subdivision G—Dealing with credit reporting information after the retention period ends etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.99
20V Destruction etc. of credit reporting information after the
Destruction of credit information after retention period ends.
20V(1) Destruction etc. of credit reporting information after the
Destruction of credit information within the retention period
(b) the retention period for the information ends.
Obligation to destroy credit information
Destroy credit information within 1 month after retention period ends.
20V(2) Destruction etc. of credit reporting information after the
Cannot destroy credit information if pending correction or dispute
20V(3) Destruction etc. of credit reporting information after the
if immediately before the retention period ends:
Credit reporting body must retain credit information under certain circumstances.
20V(4) Destruction etc. of credit reporting information after the
Credit reporting body must destroy CRB derived information or de-identify it under certain conditions.
20V(5) Destruction etc. of credit reporting information after the
Temporal interval for destruction of CRB derived information
(5) The credit reporting body must destroy any CRB derived information about the individual that was derived from the credit information...
Artificial intelligence application in this context
Obligation to destroy CRB derived information
Destroy CRB derived information if pending correction or dispute
20V(6) Destruction etc. of credit reporting information after the
...destroy the CRB derived information nor ensure that the information is de-identified, if immediately before the retention period ends:
Prohibition applies during retention period with pending correction or dispute
(6) Despite subsection (5), the credit reporting body must neither...
Prohibition can be inferred from related rules
...nor ensure that the information is de-identified
Prohibition of destroying CRB derived information
Prohibition spreads to all related information
Prohibition applies until correction or dispute is resolved
Credit reporting body not required to destroy CRB-derived information under certain circumstances.
20V(7) Destruction etc. of credit reporting information after the
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.100
Retention period for credit information—general
20W Retention period for credit information—general
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.102
20X Retention period for credit information—personal insolvency
Retention period for credit information—personal insolvency
20X(1) Retention period for credit information—personal insolvency
20X(2) Retention period for credit information—personal insolvency
20X(3) Retention period for credit information—personal insolvency
Requires a relation between identifiable temporal intervals
Retention period is dependent on the control of property
20X(4) Retention period for credit information—personal insolvency
Describes the type of obligation or prohibition
20X(5) Retention period for credit information—personal insolvency
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.103
20Y Destruction of credit reporting information in cases of fraud
Destruction of credit reporting information in cases of fraud
20Y(1) Destruction of credit reporting information in cases of fraud
Obligation to destroy credit reporting information in cases of fraud
Written notices to individual and credit provider.
Credit reporting body must destroy information and notify parties.
20Y(2) Destruction of credit reporting information in cases of fraud
Credit reporting bodies must notify third parties of destruction of credit reporting information in cases of fraud.
20Y(3) Destruction of credit reporting information in cases of fraud
Notify recipients of destruction of credit reporting information
20Y(4) Destruction of credit reporting information in cases of fraud
Notification is not required if mandated by law or court order.
20Y(5) Destruction of credit reporting information in cases of fraud
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.105
20Z Dealing with information if there is a pending correction
Notification of Commissioner required when credit reporting body holds information about an individual under certain conditions.
20Z(1) Dealing with information if there is a pending correction
(1) This section applies if a credit reporting body holds credit reporting information about an individual and either: (a) subsection 20V(3) applies in relation to the information; or (b) subsection 20V(6) applies in relation to the information.
Must provide notification to Commissioner
Notify Commissioner of pending correction information
20Z(2) Dealing with information if there is a pending correction
Prohibition on using or disclosing information under Subdivision D of this Division.
20Z(3) Dealing with information if there is a pending correction
There is a temporal relation between the prohibition and the use or disclosure of information.
Temporal relation between the prohibition and the use or disclosure of information
The credit reporting body must not use or disclose the information under Subdivision D of this Division during a certain period.
The credit reporting body is prohibited from using or disclosing the information in a way that is related to artificial intelligence.
Relating the prohibition to artificial intelligence
The credit reporting body must not use or disclose the information under Subdivision D of this Division.
The credit reporting body is prohibited from using or disclosing the information.
The prohibition is diffused to other entities that are related to the credit reporting body.
Spread of the prohibition to other entities
This provision asserts that the credit reporting body is prohibited from using or disclosing the information in a way that is related to other entities.
Validation of the prohibition against other entities
Use or disclose information for pending correction request or dispute, or under Australian law.
20Z(4) Dealing with information if there is a pending correction
Written note of use or disclosure of information
20Z(5) Dealing with information if there is a pending correction
Commissioner may direct credit reporting body to destroy or de-identify information by a specified day.
20Z(6) Dealing with information if there is a pending correction
Must comply with direction from Commissioner
20Z(7) Dealing with information if there is a pending correction
Section applies to credit reporting information de-identified by the credit reporting body.
20Z(8) Dealing with information if there is a pending correction
Section applies to specified information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.106
20ZA Dealing with information if an Australian law etc. requires it
Prohibition on destroying credit reporting information
20ZA(1) Dealing with information if an Australian law etc. requires it
Prohibits destruction of credit reporting information
20ZA(2) Dealing with information if an Australian law etc. requires it
The prohibition is during the use or disclosure of information under Subdivision D of this Division.
Temporal relationship between the prohibition and the use/disclosure of information
The credit reporting body must not use or disclose the information during Subdivision D of this Division
The prohibition is applied by artificial intelligence to all related concepts, including the use or disclosure of information under Subdivision D of this Division.
Artificial intelligence application of the prohibition
The credit reporting body must not use or disclose the information
The prohibition is spread to all related concepts, including the use or disclosure of information under Subdivision D of this Division.
Spread of the prohibition to related concepts
The prohibition is validated against all related data, including the use or disclosure of information under Subdivision D of this Division.
Validation of the prohibition against related data
Use or disclose information if required by law or court order
20ZA(3) Dealing with information if an Australian law etc. requires it
Australian law or court order during use or disclosure
Use or disclosure during Australian law or court order
Obligation to use or disclose information
Requires use or disclosure of information
Must make a written note of use or disclosure of information
20ZA(4) Dealing with information if an Australian law etc. requires it
No application of subdivision E applies to the use or disclosure of information.
20ZA(5) Dealing with information if an Australian law etc. requires it
Exemption from subdivision F of Division 2
20ZA(6) Dealing with information if an Australian law etc. requires it
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.107
Rules for credit providers' handling of credit information, eligibility information, and CRB-derived information.
21 Guide to this Division
Obligation to handle credit information correctly
21A Application of this Division to credit providers
Credit provider must comply with this Division's requirements.
21A(1) Application of this Division to credit providers
Permits credit providers to consider information privacy under this Division instead of Australian Privacy Principles.
21A(2) Application of this Division to credit providers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.108
21B Open and transparent management of credit information etc.
Ensure open and transparent management of credit information
21B(1) Open and transparent management of credit information etc.
(1) The object of this section is to ensure that credit providers manage...
A credit provider must implement practices, procedures and systems to comply with this Division and the registered CR code.
21B(2) Open and transparent management of credit information etc.
Obligation to comply with Division and CR code
Credit provider must have a clearly expressed and up-to-date policy about credit information management.
21B(3) Open and transparent management of credit information etc.
Credit provider must provide certain information to individuals about their credit eligibility.
21B(4) Open and transparent management of credit information etc.
Must provide certain information to individuals.
Credit provider must make policy available free of charge and in an appropriate form.
21B(5) Open and transparent management of credit information etc.
Must provide a copy of credit policy in a particular form upon request.
21B(6) Open and transparent management of credit information etc.
Australian Privacy Principles must be applied to APP entities.
21B(7) Open and transparent management of credit information etc.
Obligation to apply Australian Privacy Principles.
21C Additional notification requirements for the collection of
Credit provider must notify individual of personal info disclosure to credit reporting body.
21C(1) Additional notification requirements for the collection of
Notification occurs at or before collection of personal info
(1) At or before the time a credit provider collects personal information about an individual that the provider is likely to disclose to a credit reporting body, the provider must:
Notification implies awareness of disclosure matters
Notification diffuses awareness of disclosure matters
Credit provider must comply with Australian Privacy Principle 5.
21C(2) Additional notification requirements for the collection of
Subsection (1) applies to the credit provider at all times it is an APP entity.
Temporal applicability of subsection (1)
(2) If a credit provider is an APP entity, subsection (1) applies to the provider in relation to personal information in addition to Australian Privacy Principle 5.
The credit provider must comply with Australian Privacy Principle 5.
The credit provider has an obligation to comply with Australian Privacy Principle 5.
The credit provider must notify other parties of its status as an APP entity.
Credit provider must notify about credit reporting policy and procedures.
21C(3) Additional notification requirements for the collection of
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.111
21D Disclosure of credit information to a credit reporting body
Disclose credit information to a credit reporting body
21D(1) Disclosure of credit information to a credit reporting body
(1) A credit provider must not disclose...
Disclosure of credit information to a credit reporting body is permitted under certain conditions.
21D(2) Disclosure of credit information to a credit reporting body
Credit information must be disclosed to a credit reporting body under certain conditions.
21D(3) Disclosure of credit information to a credit reporting body
Exemption from disclosure of identification information about the individual.
21D(4) Disclosure of credit information to a credit reporting body
Consumer credit liability information about the individual may relate to consumer credit entered into before the individual turned 18.
21D(5) Disclosure of credit information to a credit reporting body
Credit provider must make a written note of disclosure.
21D(6) Disclosure of credit information to a credit reporting body
21D(7) Disclosure of credit information to a credit reporting body
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.113
Credit provider must disclose payment information after overdue payment is made.
21E Payment information must be disclosed to a credit reporting
21F Limitation on the disclosure of credit information during a ban
Credit reporting body must not disclose credit information during a ban period.
21F(1) Limitation on the disclosure of credit information during a ban
Temporal relationship between ban period and consumer credit provision
(c) the body is not permitted to disclose the information because there is a ban period for the information; (d) during the ban period, the provider provides the consumer credit...
Analysis of credit reporting body's actions during a ban period
(a) a credit reporting body holds credit reporting information about an individual; (b) a credit provider requests the body to disclose the information...
(1) This section applies if: ... and (d) during the ban period, the provider provides the consumer credit...
Restriction of credit reporting body's actions during a ban period
Validation of credit reporting body's actions during a ban period
Credit provider must not disclose credit information to a credit reporting body.
21F(2) Limitation on the disclosure of credit information during a ban
Credit provider must verify identity of individual before disclosing credit information.
21F(3) Limitation on the disclosure of credit information during a ban
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.114
21G Use or disclosure of credit eligibility information
Use or disclosure of credit eligibility information is prohibited.
21G(1) Use or disclosure of credit eligibility information
Permitted disclosures of credit eligibility information
21G(2) Use or disclosure of credit eligibility information
Disclosure of credit eligibility information is permitted under certain conditions.
21G(3) Use or disclosure of credit eligibility information
Credit provider must not disclose repayment history information under subsection (3).
21G(4) Use or disclosure of credit eligibility information
Exemption from subsection (4) for certain recipients and disclosures
21G(5) Use or disclosure of credit eligibility information
Temporal interval for disclosure under paragraph (3)(d)
Credit provider must make written note of use or disclosure of credit eligibility information.
21G(6) Use or disclosure of credit eligibility information
Exempts APP entities from Australian Privacy Principles 6, 7 and 8 regarding credit eligibility information.
21G(7) Use or disclosure of credit eligibility information
Exemption from Australian Privacy Principles 6, 7 and 8
Temporarily exempts credit providers that are APP entities from Australian Privacy Principles 6, 7 and 8.
Exempts credit providers that are APP entities from the application of knowledge-based rules regarding Australian Privacy Principles 6, 7 and 8.
Prohibits the application of Australian Privacy Principles 6, 7 and 8 to APP entities.
Exempts credit providers that are APP entities from the diffusion of Australian Privacy Principles 6, 7 and 8.
Exemption from Australian Privacy Principle 9.2 for APP entities with government-related identifiers.
21G(8) Use or disclosure of credit eligibility information
No Australian Privacy Principle 9.2 applies during this period.
Exempts credit providers from Australian Privacy Principle 9.2 for a specific duration.
Knowledge represented in a structured format.
Represents knowledge about exempt credit providers in a structured format.
No Australian Privacy Principle 9.2 applies.
Prohibits the application of Australian Privacy Principle 9.2.
Relevant parties informed of exempt status.
Diffuses information about exempt credit providers to relevant parties.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.116
Permitted CP uses in relation to individuals
21H Permitted CP uses in relation to individuals
of the table in subsection 20F(1) for a particular securitisation related purpose of the provider in relation to the individual.
Between permitted CP uses in relation to individuals and the use of credit eligibility information
the internal management purposes of the provider that are directly related to the provision or management of consumer credit by the provider.
of the table for the purpose (if any) specified in that column.
Permits credit provider use of credit eligibility information
The relevant credit reporting information was disclosed to the provider under a provision specified in column 1...
of the table in subsection 20F(1) for the purpose of assisting the individual to avoid defaulting on his or her obligations...
Permits credit provider use of credit eligibility information for internal management purposes
item 2 of the table in subsection 20F(1) for a particular commercial credit related purpose of the provider in relation to the individual.
of the table in subsection 20F(1) for a credit guarantee purpose of the provider in relation to the individual.
Recurring trace of permitted CP uses in relation to individuals and the use of credit eligibility information
the internal management purposes of the provider that are directly related to the provision or management of commercial credit by the provider.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.118
21J Permitted CP disclosures between credit providers
Permitted CP disclosures between credit providers
21J(1) Permitted CP disclosures between credit providers
Permits disclosure of credit eligibility information
(1) A disclosure by a credit provider...
Consent must be given in writing for certain disclosures.
21J(2) Permitted CP disclosures between credit providers
21J(3) Permitted CP disclosures between credit providers
21J(4) Permitted CP disclosures between credit providers
21J(5) Permitted CP disclosures between credit providers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.120
21K Permitted CP disclosures relating to guarantees etc.
Disclosure of credit eligibility information is permitted for certain purposes.
21K(1) Permitted CP disclosures relating to guarantees etc.
Permission to disclose credit eligibility information.
Consent in writing is not required under certain circumstances.
21K(2) Permitted CP disclosures relating to guarantees etc.
Disclosure of credit eligibility information is permitted to certain individuals under specific conditions.
21K(3) Permitted CP disclosures relating to guarantees etc.
Individual must provide written consent for credit application
21K(4) Permitted CP disclosures relating to guarantees etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.121
Permitted CP disclosures to mortgage insurers
21L Permitted CP disclosures to mortgage insurers
21M Permitted CP disclosures to debt collectors
Permitted CP disclosures to debt collectors
21M(1) Permitted CP disclosures to debt collectors
Debt collectors may disclose certain information about individuals.
21M(2) Permitted CP disclosures to debt collectors
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.122
21N Permitted CP disclosures to other recipients
Permitted CP disclosures to other recipients
21N(1) Permitted CP disclosures to other recipients
21N(2) Permitted CP disclosures to other recipients
21N(3) Permitted CP disclosures to other recipients
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.123
21NA Disclosures to certain persons and bodies that do not have an
Credit provider must ensure disclosure does not breach certain provisions.
21NA(1) Disclosures to certain persons and bodies that do not have an
Debt collectors must comply with the provisions of this Act.
21NA(2) Disclosures to certain persons and bodies that do not have an
The provisions of this Act apply to debt collectors.
Credit provider must ensure disclosure does not breach Australian Privacy Principles.
21NA(3) Disclosures to certain persons and bodies that do not have an
Credit provider must disclose credit eligibility information to certain persons and bodies.
21NA(4) Disclosures to certain persons and bodies that do not have an
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.125
21P Notification of a refusal of an application for consumer credit
Credit provider must not refuse an application for consumer credit based on certain information.
21P(1) Notification of a refusal of an application for consumer credit
...for the purposes of assessing the application.
Temporal interval for disclosure of credit reporting information.
(c) a credit reporting body disclosed the relevant credit reporting...
Knowledge representation for credit eligibility information.
(b) the refusal is based wholly or partly on credit eligibility...
...the refusal is based wholly or partly on credit eligibility information about one or more of the following:
Prohibition of refusal based on credit eligibility information.
(a) a credit provider refuses an application for consumer credit...
Information flow for disclosure of credit reporting information.
Recurring trace for disclosure of credit reporting information.
Credit provider must notify individual of refusal with specific details.
21P(2) Notification of a refusal of an application for consumer credit
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.126
21Q Quality of credit eligibility information
Ensure accurate, up-to-date and complete credit eligibility information.
21Q(1) Quality of credit eligibility information
Ensure accurate, up-to-date, complete and relevant credit eligibility information.
21Q(2) Quality of credit eligibility information
Obligation to ensure accurate credit eligibility information.
Australian Privacy Principle 10 does not apply to APP entities in relation to credit eligibility information.
21Q(3) Quality of credit eligibility information
Prevents Australian Privacy Principle 10 from applying to APP entities.
21R False or misleading credit information or credit eligibility
Disclosing false or misleading credit information is an offence.
21R(1) False or misleading credit information or credit eligibility
A credit provider commits an offence if...
Prohibits the action of disclosing false or misleading credit information.
(a) the provider discloses credit information under section 21D;
Justifies the prohibition on disclosing false or misleading credit information.
Implies that disclosing false or misleading credit information is an offence.
Using or disclosing false credit eligibility information is prohibited.
21R(2) False or misleading credit information or credit eligibility
...the information is false or misleading in a material particular.
Temporal interval for the prohibition of using or disclosing false credit eligibility information.
(2) A credit provider commits an offence if...
Classification of credit eligibility information as false or misleading by CogAI.
Prohibition of using or disclosing false credit eligibility information.
Diffusion of the prohibition of using or disclosing false credit eligibility information.
Recurring trace for the prohibition of using or disclosing false credit eligibility information.
Disclose false or misleading credit information under section 21D.
21R(3) False or misleading credit information or credit eligibility
Prohibition of false or misleading credit information.
Prohibition on using or disclosing false or misleading credit eligibility information.
21R(4) False or misleading credit information or credit eligibility
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.127
21S Security of credit eligibility information
Credit provider must protect credit eligibility information
21S(1) Security of credit eligibility information
Duty to protect credit eligibility information
Credit provider must destroy or de-identify credit eligibility information
21S(2) Security of credit eligibility information
Australian Privacy Principle 11 does not apply to credit providers in relation to credit eligibility information.
21S(3) Security of credit eligibility information
Prevents Australian Privacy Principle 11 from applying to credit providers.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.128
21T Access to credit eligibility information
Must provide access to credit eligibility information on request
21T(1) Access to credit eligibility information
Denying access is required or authorised by law.
21T(2) Access to credit eligibility information
Prohibits giving access to credit eligibility information.
Credit provider must respond to request within a reasonable period.
21T(3) Access to credit eligibility information
A response is a communication that answers the request.
Access to credit eligibility information must be provided in a specific manner.
21T(4) Access to credit eligibility information
Must provide access to credit eligibility information.
Credit provider must not charge for making request or giving access to information.
21T(5) Access to credit eligibility information
Prohibition of charging for request or access.
No excessive charge for access to credit information
21T(6) Access to credit eligibility information
Provider must give written notice if refusing access to credit eligibility information
21T(7) Access to credit eligibility information
Prohibits refusal of access to credit eligibility information
Australian Privacy Principle 12 does not apply to credit providers in relation to credit eligibility information.
21T(8) Access to credit eligibility information
Prohibits the application of Australian Privacy Principle 12 to credit providers.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.129
21U Correction of credit information or credit eligibility
Credit provider must correct inaccurate credit information.
21U(1) Correction of credit information or credit eligibility
Obligation to correct inaccurate credit information.
Provider must give written notice of correction within a reasonable period.
21U(2) Correction of credit information or credit eligibility
Credit provider must give notice under subsection (2) if able to do so.
21U(3) Correction of credit information or credit eligibility
Australian Privacy Principle 13 applies to credit providers in relation to identification information.
21U(4) Correction of credit information or credit eligibility
Australian Privacy Principle 13 applies to credit providers
Class hierarchy: APP entity -> Australian Privacy Principle 13
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.130
21V Individual may request the correction of credit information etc.
Request to correct personal information about an individual.
21V(1) Individual may request the correction of credit information etc.
Temporal relation between correction request and personal information update.
(1) An individual may request a credit provider to correct personal information about the individual if:
Implication of correction request on credit provider's action.
Knowledge graph representation of correction request and personal information.
Classification of personal information types.
(i) credit information about the individual; or (ii) CRB derived information about the individual; or (iii) CP derived information about the individual.
Propagated effect of correction request on credit information.
Credit provider must correct inaccurate personal information within a specified period.
21V(2) Individual may request the correction of credit information etc.
Credit provider must consult interested party about individual's request.
21V(3) Individual may request the correction of credit information etc.
The provider must consult that interested party, or those interested parties, about the individual’s request.
(3) If the credit provider considers that the provider cannot be satisfied...
Use of personal information for consultation purposes is authorized.
21V(4) Individual may request the correction of credit information etc.
Credit provider must not charge for request or correction of credit information.
21V(5) Individual may request the correction of credit information etc.
Prohibits charging for request or correction.
Credit provider must comply with Australian Privacy Principle 13 for personal information referred to in paragraph (1)(a) that is identification information.
21V(6) Individual may request the correction of credit information etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.132
21W Notice of correction etc. must be given
Individuals must provide notice of correction for personal information.
21W(1) Notice of correction etc. must be given
Credit provider must give written notice of correction to individual and recipients.
21W(2) Notice of correction etc. must be given
Correction must be made within a reasonable period
Written notice with reasons for non-correction
Correct personal information within a reasonable period
21W(3) Notice of correction etc. must be given
No notice is required if impracticable to provide
21W(4) Notice of correction etc. must be given
No notice required under subsections (2) or (3) if mandated by law or court order.
21W(5) Notice of correction etc. must be given
Repeal definition of credit information file
22 Subsection 6(1) (definition of credit information file)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.133
Rules for handling regulated information apply to affected recipients.
22 Guide to this Division
22A Open and transparent management of regulated information
Ensure open and transparent management of regulated information
22A(1) Open and transparent management of regulated information
Recipient must implement practices, procedures and systems to comply with Division and registered CR code.
22A(2) Open and transparent management of regulated information
Recipient must implement practices, procedures and systems.
Recipient must have a clearly expressed policy about management of regulated information.
22A(3) Open and transparent management of regulated information
Recipient must have a clearly expressed policy.
Recipient must provide information about regulated data collection and use.
22A(4) Open and transparent management of regulated information
An affected information recipient must make the policy available.
22A(5) Open and transparent management of regulated information
Recipient must provide a copy of requested policy in a particular form.
22A(6) Open and transparent management of regulated information
Recipient must provide within reasonable circumstances
(6) If a person or body requests a copy, in a particular form, of the policy of an affected information recipient
Recipient should take reasonable steps to provide the requested policy
Recipient must provide to the requesting party
22A(7) Open and transparent management of regulated information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.135
Recipient must provide information about access and complaint procedures
22B Additional notification requirements for affected information
22C Use or disclosure of information by mortgage insurers or trade
Use or disclosure of personal information by mortgage insurers or trades is prohibited.
22C(1) Use or disclosure of information by mortgage insurers or trade
the prohibition applies until the information is deleted or updated.
(a) a mortgage insurer or trade insurer holds or held personal information about an individual; and (b) the information was disclosed to the insurer by a credit reporting body or credit provider under Division 2 or 3 of this Part;
the knowledge representation includes the prohibition on use or disclosure.
Knowledge representation for prohibition.
the insurer must not use or disclose the information, or any personal information about the individual derived from that information.
the diffusion of the prohibition applies to all parties with access to the information.
the prohibition is recurring and applies until the information is deleted or updated.
Permitted disclosure of information under certain conditions.
22C(2) Use or disclosure of information by mortgage insurers or trade
Indicates that disclosure is permitted under specific conditions.
Disclosure of information is permitted if required or authorised by Australian law or court/tribunal order.
22C(3) Use or disclosure of information by mortgage insurers or trade
22C(4) Use or disclosure of information by mortgage insurers or trade
Prohibition on using or disclosing government-related identifiers without Australian Privacy Principle 9.2
22C(5) Use or disclosure of information by mortgage insurers or trade
(5) If: (a) the mortgage insurer or trade insurer is an APP entity; and ComLaw Authoritative Act C2015C00053 Credit reporting Schedule 2 Privacy Amendment (Enhancing Privacy Protection) Act 2012
Australian Privacy Principle 9.2 does not apply to the insurer in relation to the information.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.137
22D Use or disclosure of information by a related body corporate
Body corporate must not use or disclose credit eligibility information about an individual.
22D(1) Use or disclosure of information by a related body corporate
the body must not use or disclose the information in the future.
Restricts use of information to past tense.
(b) the information was disclosed to the body by a credit provider under paragraph 21G(3)(b);
the body must not use or disclose the information.
Implication of disclosure on body corporate's actions.
(a) a body corporate holds or held credit eligibility information about an individual;
the information is classified as confidential.
Classification of sensitive information as confidential.
Prohibition of using or disclosing credit eligibility information.
the information must not be shared with others.
Restricts diffusion of sensitive information.
Permits use or disclosure of information by a related body corporate under certain conditions.
22D(2) Use or disclosure of information by a related body corporate
Permits use or disclosure of information by a related body corporate
22D(3) Use or disclosure of information by a related body corporate
Australian Privacy Principles do not apply to APP entities.
22D(4) Use or disclosure of information by a related body corporate
Applying Australian Privacy Principles is obligatory for APP entities.
Prohibition on applying Australian Privacy Principle 9.2 to APP entities with government-related identifiers.
22D(5) Use or disclosure of information by a related body corporate
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.138
22E Use or disclosure of information by credit managers etc.
Prohibition on using or disclosing credit information without consent.
22E(1) Use or disclosure of information by credit managers etc.
(1) If: a person holds or held credit eligibility information about an individual; and the information was disclosed to the person by a credit provider under paragraph 21G(3)(c); the person must not use or disclose the information, or any personal information about the individual derived from that information.
Prohibition of using or disclosing credit information.
22E(2) Use or disclosure of information by credit managers etc.
Disclosure of information to credit provider or under Australian law is permitted.
22E(3) Use or disclosure of information by credit managers etc.
Temporal interval for permitted disclosure
(a) the disclosure is to the credit provider; or (b) the disclosure is required or authorised by or under an Australian law or a court/tribunal order.
Knowledge representation for permitted disclosure
Recurring trace for permitted disclosure
Schema validation for permitted disclosure
22E(4) Use or disclosure of information by credit managers etc.
Exempts APP entities from Australian Privacy Principles
22E(5) Use or disclosure of information by credit managers etc.
Australian Privacy Principle 9.2 does not apply
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.139
22F Use or disclosure of information by advisers etc.
Recipient must not use or disclose credit information.
22F(1) Use or disclosure of information by advisers etc.
Recipient must not use or disclose the information.
Recipient holds credit eligibility information.
22F(2) Use or disclosure of information by advisers etc.
Disclosure of information is permitted if required or authorised by Australian law or a court/tribunal order.
22F(3) Use or disclosure of information by advisers etc.
22F(4) Use or disclosure of information by advisers etc.
22F(5) Use or disclosure of information by advisers etc.
Substitute sections 6G to 6K for section 11B.
23 Subsection 6(1) (definition of credit provider)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.140
Individuals may complain to credit reporting bodies or credit providers about acts or practices that may be a breach of certain provisions.
23 Guide to this Division
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.141
23A Individual may complain about a breach of a provision of this
23A(1) Individual may complain about a breach of a provision of this
Complain about a breach of provisions related to the individual
23A(2) Individual may complain about a breach of a provision of this
Individual has a right to complain about a breach of provisions
Must specify the nature of the complaint upon making a complaint.
23A(3) Individual may complain about a breach of a provision of this
Must specify the nature of the complaint.
Obligation to specify the nature of the complaint.
No charge for complaint about personal information destruction or de-identification.
23A(4) Individual may complain about a breach of a provision of this
Obligation to provide no charge for complaint.
Credit provider cannot charge individual for complaint or dealing with complaint.
23A(5) Individual may complain about a breach of a provision of this
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.142
23B Dealing with complaints
Respondent must acknowledge complaint and investigate within 7 days.
23B(1) Dealing with complaints
Must provide written notice and investigate complaint
Respondent must consult credit reporting body or provider about complaint.
23B(2) Dealing with complaints
23B(3) Dealing with complaints
Respondent must make a decision and give written notice to individual within specified period.
23B(4) Dealing with complaints
23B(5) Dealing with complaints
Holds the state responsible for complaints
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.143
23C Notification requirements relating to correction complaints
Notification requirements for correction complaints
23C(1) Notification requirements relating to correction complaints
Respondent must notify provider of complaint and decision.
23C(2) Notification requirements relating to correction complaints
Respondent must notify body or provider of complaint making and decision making.
23C(3) Notification requirements relating to correction complaints
Credit reporting body must notify recipient of complaint upon disclosure.
23C(4) Notification requirements relating to correction complaints
Credit provider must notify recipient of complaint if personal information is disclosed under Division 3 or Australian Privacy Principles.
23C(5) Notification requirements relating to correction complaints
Exemption from notification requirements under certain circumstances
23C(6) Notification requirements relating to correction complaints
Temporal overlap with notification requirements
Granting permission to exempt from notification requirements
(6) Subsection (2), (3), (4) or (5) does not apply if:
24 Subsection 6(1) (definition of credit report)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.144
24 Obtaining credit reporting information from a credit reporting
Obtaining credit reporting information from a credit reporting body without permission is an offence.
24(1) Obtaining credit reporting information from a credit reporting
Temporal interval for obtaining credit reporting information.
(1) An entity obtains credit reporting information.
Prohibition of obtaining credit reporting information without permission.
Entity obtains credit reporting information from a credit reporting body.
Obtaining credit reporting information by false pretence is prohibited.
24(2) Obtaining credit reporting information from a credit reporting
Prohibition of obtaining credit reporting information by false pretence.
(2) An entity commits an offence if: (a) the entity obtains credit reporting information; and (b) the information is obtained from a credit reporting body; and (c) the information is obtained by false pretence.
Tracing obtaining credit reporting information as an offence.
Entity must not obtain credit reporting information from a credit reporting body without permission.
24(3) Obtaining credit reporting information from a credit reporting
(3) An entity must not obtain credit reporting information from a credit reporting body if the entity is not: (a) an entity to which the body is permitted to disclose the information under Division 2 of this Part; or (b) an access seeker for the information.
Entity must not obtain credit reporting information during certain periods
Entity must not obtain credit reporting information if certain conditions are met
Prohibition of obtaining credit reporting information
Entity must not obtain credit reporting information until certain conditions are met
24(4) Obtaining credit reporting information from a credit reporting
Entity must not obtain credit reporting information by false pretence.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.145
24A Obtaining credit eligibility information from a credit provider
Obtaining credit eligibility information from a credit provider without permission is an offence.
24A(1) Obtaining credit eligibility information from a credit provider
Provision applies to entities that obtain credit eligibility information from a credit provider.
Provision specifies conditions for obtaining credit eligibility information.
Classification of the entity as an offender.
Entity obtains credit eligibility information from a credit provider.
Prohibition of obtaining credit eligibility information without permission.
Obtaining credit eligibility information by false pretence is an offence.
24A(2) Obtaining credit eligibility information from a credit provider
Prohibition of obtaining credit eligibility information by false pretence.
Entity obtains credit eligibility information by false pretence.
Cannot obtain credit eligibility information from a credit provider without permission.
24A(3) Obtaining credit eligibility information from a credit provider
Temporal interval of when obtaining credit eligibility information is prohibited
Prohibition of obtaining credit eligibility information
Cannot obtain credit eligibility information by false pretence
24A(4) Obtaining credit eligibility information from a credit provider
Repeal definition of credit reporting agency
25 Subsection 6(1) (definition of credit reporting agency)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.146
25 Compensation orders
Compensation order for loss or damage suffered due to contravention of civil penalty provision.
25(1) Compensation orders
Obligation to compensate for loss or damage
Court may make compensation order within 6 years of cause of action.
25(2) Compensation orders
25(3) Compensation orders
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.147
25A Other orders to compensate loss or damage
Loss or damage compensation for contravention of civil penalty provisions or commission of an offence.
25A(1) Other orders to compensate loss or damage
(1) This section applies if: (a) either: (i) a civil penalty order has been made against an entity for a contravention of a civil penalty provision (other than section 13G); or (ii) an entity is found guilty of an offence against this Part; and (b) a person has suffered, or is likely to suffer, loss or damage (including injury to the person’s feelings or humiliation) as a result of the contravention or commission of the offence.
This section applies during the time period when an entity has suffered loss or damage.
If an entity has suffered loss or damage, then this section applies.
Obligation to compensate loss or damage.
Compensate loss or damage suffered by a person.
25A(2) Other orders to compensate loss or damage
Order to perform reasonable act or course of conduct
25A(3) Other orders to compensate loss or damage
...an order directing the entity to perform any reasonable act, or carry out any reasonable course of conduct...
Temporal relation between orders and contravention/commission of offence
(3) Without limiting subsection (2), examples of orders the court may make include:
...to reimburse the person for expenses reasonably incurred by the person in connection with the contravention or commission of the offence;
Inference from orders and expenses incurred by person
(b) an order directing the entity to pay the person a specified amount...
The court may make an order directing the entity to perform any reasonable act...
Mandatory duty to perform reasonable act or course of conduct
...an order directing the defendant to pay to the person the amount of loss or damage...
Diffusion of responsibility between entity and person
Recurring trace between orders and expenses incurred by person
Court may make order to compensate loss or damage within 6 years of the cause of action.
25A(4) Other orders to compensate loss or damage
Application must be made for order to be considered
Entity must pay amount to person as debt.
25A(5) Other orders to compensate loss or damage
a period of time during which the organisation or agency provides credit reporting services
Temporal interval for credit reporting business
that carries on a credit reporting business
an organisation or agency prescribed by the regulations
an organisation or agency that carries on a credit reporting business
credit reporting body means an organisation or agency prescribed by the regulations
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.58
Repeal and redefine credit reporting business definition.
27 Subsection 6(1) (definition of credit reporting business)
Existing credit reporting business definition
Defines credit reporting information about an individual.
28 Subsection 6(1)
credit reporting information about an individual is credit information or CRB derived information.
Establishes a class hierarchy for credit reporting information.
3 Subsection 6(1)
Repeal definition of current credit provider
30 Subsection 6(1) (definition of current credit provider)
Default information has the meaning given by section 6Q
Repeal definition of eligible communications service
32 Subsection 6(1) (definition of eligible communications
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.59
Definition of guarantee includes indemnity against default in payment.
33 Subsection 6(1) (definition of guarantee)
Guarantee definition implies obligation.
Identification information about an individual must be provided.
Must provide identification information.
Classification of individual's identity information.
Defines 'interested party' for subsections 20T(3) and 21V(3)
36 Subsection 6(1)
Establishes an obligation to use the defined term correctly
37 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.60
38 Subsection 6(1) (definition of loan)
Managing credit does not include collecting overdue payments.
39 Subsection 6(1)
4 Subsection 6(1)
Defines mortgage credit as consumer credit related to real property acquisition, maintenance, renovation or improvement.
40 Subsection 6(1) (definition of mortgage credit)
Substitutes a new definition for an existing one.
Assess risk of providing insurance to credit provider or individual
41 Subsection 6(1)
42 Subsection 6(1) (definition of mortgage insurer)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.61
Defines National Personal Insolvency Index
43 Subsection 6(1)
45 Subsection 6(1)
46 Subsection 6(1)
Request for credit information or CRB derived information must be made to a credit reporting body and not given notice under subsection 21W(2) or (3).
47 Subsection 6(1)
Obligation to make a request for credit information or CRB derived information.
Request for credit information or CRB derived information is a specific type of request.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.62
Definition of 'pending dispute in relation to credit information or CRB derived information'
48 Subsection 6(1)
49 Subsection 6(1)
Bankruptcy Act is defined as the 1966 Act.
Bankruptcy Act means the Bankruptcy Act 1966.
50 Subsection 6(1)
51 Subsection 6(1)
Definition of personal insolvency information
52 Subsection 6(1)
Personal insolvency information has the meaning given by section 6U
Section 6U defines personal insolvency information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.63
53 Subsection 6(1)
54 Subsection 6(1)
Defines a subclass relationship for 'purchase'
Defines regulated information for affected recipients.
55 Subsection 6(1)
Definition of repayment history information
56 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.64
57 Subsection 6(1)
National Consumer Credit Protection Act 2009
Defines who is the respondent for a complaint under section 23A.
58 Subsection 6(1)
59 Subsection 6(1)
Repeal and substitute subparagraphs with new definitions.
60 Subsection 6(1) (subparagraphs (a)(i) and (ii) of the
61 Subsection 6(1) (paragraph (b) of the definition of
Assessing risk in purchasing credit or undertaking credit enhancement
62 Subsection 6(1)
Assessing risk in purchasing credit or undertaking credit enhancement is an obligation.
The text classifies the purpose of a credit provider as assessing risk in purchasing credit or undertaking credit enhancement.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.65
Definition of serious credit infringement
63 Subsection 6(1) (definition of serious credit infringement)
Defines the term "serious credit infringement"
Subclassifies serious credit infringement as a type of obligation
Duty to assess risk of default on commercial credit
64 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.66
65 Subsection 6(1) (definition of trade insurer)
Substitutes a new definition for trade insurer
66 Subsections 6(5A) to (5D)
Substitute 'consumer credit' for 'credit'
67 Subsection 6(10)
Imposes a duty on the state to substitute 'consumer credit' for 'credit'
68 At the end of subsection 6D(4)
69 After section 6F
6G Meaning of credit provider
6G(1) Meaning of credit provider
Supplier is a credit provider if it provides credit in connection with the sale of goods or services and repayment is deferred for at least 7 days.
6G(2) Meaning of credit provider
Lessor is a credit provider if conditions are met.
6G(3) Meaning of credit provider
The credit must be in force for at least 7 days.
Credit must be in force for at least 7 days.
(3) If an organisation or small business operator (the lessor) carries on a business or undertaking...
The lessor provides credit in connection with the hiring, leasing or renting of goods.
The lessor is not a credit provider under subsection (1).
Lessor is not a credit provider under subsection (1).
No amount, or an amount less than the value of the goods, is paid as a deposit.
6G(4) Meaning of credit provider
An organisation or small business operator is a credit provider
(4) An organisation or small business operator is a credit provider if subsection 6H(1), 6J(1) or 6K(1) provides that the organisation or operator is a credit provider.
An organisation or small business operator is not a credit provider while acting in certain capacities.
6G(5) Meaning of credit provider
The organisation or small business operator is a credit provider.
An organisation or small business operator is not a credit provider if it is included in a class of organisations or operators prescribed by the regulations.
6G(6) Meaning of credit provider
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.68
6H Agents of credit providers
An agent acting on behalf of a principal is considered a credit provider.
6H(1) Agents of credit providers
...then, while the agent is so acting, the agent is a credit provider.
Agent's action occurs during principal's task
(1) If an organisation or small business operator (the agent) is acting as an agent of a credit provider...
Agent's action is not independent of principal's task
Agent's action and being a credit provider are related
Agent's action implies being a credit provider
6H(2) Agents of credit providers
Credit provider must provide credit with agent's involvement.
6H(3) Agents of credit providers
Obligation to provide credit with agent's involvement.
Application to principal is taken as made to both principal and agent for purposes of this Act.
6H(4) Agents of credit providers
Application to principal is taken as made to both principal and agent.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.69
6J Securitisation arrangements etc.
Securitisation entity is a credit provider while performing certain tasks.
6J(1) Securitisation arrangements etc.
(securitisation entity is a credit provider)
(task is for purchasing or managing credit)
Task is reasonably necessary for purchasing or managing credit
Exemption for small business operators from subsection (1)
6J(2) Securitisation arrangements etc.
Original credit provider is an organisation or small business operator
Credit is taken to have been provided by both original credit provider and securitisation entity.
6J(3) Securitisation arrangements etc.
Application to credit provider is taken as application to securitisation entity.
6J(4) Securitisation arrangements etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.70
6K Acquisition of the rights of a credit provider
Acquirer becomes a credit provider in relation to the credit.
6K(1) Acquisition of the rights of a credit provider
(acquirer is a credit provider in relation to the credit)
Acquirer becomes a credit provider during the assignment/subrogation
(acquirer acquires rights of original credit provider)
Acquirer's assignment/subrogation implies it becomes a credit provider
Acquirer asserts its status as a credit provider
Acquirer's assignment/subrogation diffuses its rights as a credit provider
Credit is taken to have been provided by the acquirer for the purposes of this Act.
6K(2) Acquisition of the rights of a credit provider
Credit is taken to have been provided by the acquirer.
Application to original credit provider is taken as made to acquirer.
6K(3) Acquisition of the rights of a credit provider
Application to acquirer is taken as made to original credit provider
6L Meaning of access seeker
Defines an access seeker for credit reporting information and eligibility information.
6L(1) Meaning of access seeker
the individual during the time they are being assisted
Describes the temporal relationship between the individual and the person assisting them.
(i) who is assisting the individual to deal with a credit reporting body or credit provider
the individual is assisted by the person during the time they are being assisted
Describes the relationship between the individual and the person assisting them.
the individual; or a person who is assisting the individual to deal with a credit reporting body or credit provider
Identifies the subject of an obligation.
(1) An access seeker in relation to credit reporting information, or credit eligibility information, about an individual is:
An individual must not authorise a person under subsection (1)(b)(ii) if the person is a credit provider, mortgage insurer, trade insurer, or prevented from being a credit provider by subsection 6G(5) or (6).
6L(2) Meaning of access seeker
Exempts certain persons from the application of a rule.
6L(3) Meaning of access seeker
Defines a temporal interval during which the exemption applies.
(3) Subparagraph (1)(b)(ii) does not apply to a person who provides the National Relay Service or a person prescribed by the regulations.
Identifies the exemption as a rule of law.
Spreads the exemption to related persons.
Defines a recurring pattern of exemption.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.71
6M Meaning of credit and amount of credit
Definition of credit and amount of credit
6M(1) Meaning of credit and amount of credit
Defines the amount of credit as the deferred debt, excluding fees and charges.
6M(2) Meaning of credit and amount of credit
6M(3) Meaning of credit and amount of credit
Defines personal information about an individual for credit reporting purposes.
6N Meaning of credit information
States what constitutes personal information.
Defines a class hierarchy for credit reporting information.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.72
6P Meaning of credit reporting business
6P(1) Meaning of credit reporting business
Information about credit worthiness must be provided for assessing consumer credit applications.
6P(2) Meaning of credit reporting business
Must provide information about credit worthiness.
Disregard provision of information about credit worthiness to a related body corporate.
6P(3) Meaning of credit reporting business
Business or undertaking not a credit reporting business if included in prescribed class
6P(4) Meaning of credit reporting business
Business or undertaking included in prescribed class
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.73
6Q Meaning of default information
Default information about an individual is required to be provided by a credit provider.
6Q(1) Meaning of default information
The provision requires the credit provider to provide default information.
6Q(2) Meaning of default information
The provision requires a specific action.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.74
6R Meaning of information request
Credit provider must provide information about individual upon request.
6R(1) Meaning of information request
Mortgage insurer must provide information to an individual upon request.
6R(2) Meaning of information request
Trade insurer must provide information to an individual upon request.
6R(3) Meaning of information request
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.75
6S Meaning of new arrangement information
Credit provider must disclose new arrangement information about an individual when certain conditions are met.
6S(1) Meaning of new arrangement information
new arrangement information must be disclosed when individual is overdue in making payment for original consumer credit
individual is overdue in making payment for original consumer credit
new arrangement information must be provided
Obligation to disclose new arrangement information
Credit provider has disclosed default information about an individual to a credit reporting body
new arrangement information must be provided about an individual
Credit provider must provide new arrangement information about an individual when certain conditions are met
individual has been provided with new consumer credit
Disclosure of opinion to credit reporting body
Credit provider must disclose opinion to credit reporting body if serious credit infringement suspected.
6S(2) Meaning of new arrangement information
Temporal interval for variation in terms or conditions contains temporal interval for new arrangement information
(ii) the individual is provided with other consumer credit (the new consumer credit) by a credit provider that relates, wholly or in part, to that amount of credit;
Variation in terms or conditions implies new arrangement information
(ii) the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied;
Credit provider believes individual has committed serious credit infringement
(a) a credit provider is of the opinion that an individual has committed a serious credit infringement in relation to consumer credit (the original consumer credit) provided by the provider to the individual;
Recurring variation of terms or conditions of original consumer credit
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.76
Payment information is a statement that the amount of overdue payment has been paid.
6T Meaning of payment information
payment information about the individual is a statement that the amount of the overdue payment has been paid on that day.
(a) a credit provider has disclosed default information about an individual to a credit reporting body; and (b) on a day after the default information was disclosed, the amount of the overdue payment to which the information relates is paid;
6U Meaning of personal insolvency information
Personal insolvency information about an individual is defined as certain types of data.
6U(1) Meaning of personal insolvency information
Personal insolvency information cannot relate to a creditor's petition or administration under Part XI of the Bankruptcy Act.
6U(2) Meaning of personal insolvency information
personal insolvency information about an individual must not relate to:
Restricts personal insolvency information to a specific time period.
Restricts personal insolvency information from relating to certain matters.
personal insolvency information must not relate to:
Prohibits personal insolvency information from relating to certain matters.
Definition of expression used in Bankruptcy Act
6U(3) Meaning of personal insolvency information
has the same meaning as it has in that Act
(3) An expression used in paragraph (1)(b) or (2)(a)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.77
6V Meaning of repayment history information
Repayment history information must include whether the individual has met an obligation to make a monthly payment.
6V(1) Meaning of repayment history information
the monthly payment is due during a specific time interval
The monthly payment is due on a specific day.
(b) the day on which the monthly payment is due and payable;
the individual has met an obligation to make a monthly payment
(a) whether or not the individual has met an obligation to make a monthly payment that is due and payable in relation to the consumer credit;
the individual does not have met an obligation to make a monthly payment
the credit provider must provide repayment history information
(1) If a credit provider provides consumer credit to an individual, the following information about the consumer credit is repayment history information about the individual:
the individual makes the monthly payment every time it is due
The individual makes the monthly payment after the due date.
(c) if the individual makes the monthly payment after the day on which the payment is due and payable—the day on which the individual makes that payment;
Defines what constitutes a monthly payment in relation to consumer credit.
6V(2) Meaning of repayment history information
whether or not an individual has met an obligation to make a monthly payment that is due and payable in relation to consumer credit.
Establishes the temporal scope of the regulation's application.
(2) The regulations may make provision in relation to:
Applies the regulation to all relevant data.
Determines the existence of an obligation.
Applies the regulation to all relevant entities.
Applies the regulation to all relevant situations.
7 Subsection 6(1) (definition of commercial credit)
Omit 'credit reporting agency' and substitute 'credit reporting body'.
70 Paragraphs 7(1)(a) and 8(1)(a)
Prohibits the use of 'credit reporting agency'
71 Sections 11A and 11B
Repeal Part and substitute with new provision.
72 Part IIIA
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.148
73 Subsections 30(3) and (4)
74 Subsection 49(4) (paragraph (a) of the definition of credit
Omit 'credit reporting agency', substitute 'credit reporting body'.
75 Subsection 68(1)
Defines 'commercial credit related purpose' for a credit provider.
Defines the meaning of 'commercial credit related purpose'
Classifies the definition into a logical hierarchy
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.149
1 Subsection 6(1)
APP code means the meaning given by section 26C.
APP code has the meaning given by section 26C.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.150
Omit 'the Code of Conduct', substitute 'the registered CR code'.
10 Subsection 6(1) (paragraph (a) of the definition of credit
Prohibition of using outdated terminology.
Repeal definition of credit reporting infringement
11 Subsection 6(1) (definition of credit reporting
12 Subsection 6(1) (definition of privacy code)
15 Subsection 6(3A)
16 At the end of subsection 6(7)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.151
17 Section 6B (heading)
Substitute approved privacy code with registered APP code.
18 Subsections 6B(1), (2), (3) and (4)
19 After section 6B
Omit 'an approved privacy code' and substitute 'a registered APP code'.
20 Subsection 7(2)
Replace 'or a binding approved privacy code' with 'or a registered APP code that binds the organisation'.
21 Subsection 7B(2) (note)
Granting permission for a registered APP code that binds them.
22 Subsection 13B(1) (note)
23 Subsection 13B(1) (paragraph (b) of the note)
Omit 'a binding approved privacy code' and substitute with a registered APP code that binds the body.
24 Subsection 13B(1A) (note)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.152
Substitute APP code for approved privacy code
25 Subsection 13C(1) (note)
Omit specified phrase from approved privacy code
26 Subsection 13C(1) (note)
An APP entity must not breach a registered APP code.
26 Guide to this Part
APP code developers or the Commissioner may develop APP codes.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.153
26A APP entities to comply with binding registered APP codes
26B What is a registered APP code
A registered APP code is an APP code included on the Codes Register and in force.
26B(1) What is a registered APP code
During the compilation period, the APP code is registered.
Temporal relationship between registration and commencement
An APP code included on the Codes Register and in force.
(1) A registered APP code is an APP code:
A registered APP code is a legislative instrument.
26B(2) What is a registered APP code
26B(3) What is a registered APP code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.154
26C What is an APP code
An APP code is a written code of practice about information privacy.
26C(1) What is an APP code
Must specify how APP principles are applied and which entities are bound
26C(2) What is an APP code
set out the period during which the code is in force (which must not start before the day the code is registered under section 26H);
(b) specify the APP entities that are bound by the code, or a way of determining the APP entities that are bound by the code;
Imposes additional requirements on APP codes
26C(3) What is an APP code
Obligation to comply with additional requirements
(3) An APP code may do one or more of the following:
An APP code may apply to personal information, activities, industry sectors, or professions.
26C(4) What is an APP code
Personal information, activities, sectors, or professions
An APP code is not a legislative instrument.
26C(5) What is an APP code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.155
This Act applies in relation to the code as if that act or practice were not exempt.
26D Extension of Act to exempt acts or practices covered by
If a registered APP code covers an act or practice that is exempt, this Act applies.
A registered APP code covers an act or practice that is exempt.
26E Development of APP codes by APP code developers
An APP code developer may develop an APP code at the Commissioner's request.
26E(1) Development of APP codes by APP code developers
Commissioner may request APP code developer to develop an APP code.
26E(2) Development of APP codes by APP code developers
request must specify period and set out effect
Specify period for compliance and effect of section 26A
26E(3) Development of APP codes by APP code developers
The period must run for at least 120 days from the date the request is made.
26E(4) Development of APP codes by APP code developers
(4) The period must run for at least 120 days from the date the request is made;
(4) The period may be extended by the Commissioner;
Specify matters and entities bound by the APP code
26E(5) Development of APP codes by APP code developers
Commissioner cannot require APP code to cover exempt act or practice.
26E(6) Development of APP codes by APP code developers
Publicly available copy of request must be made by the Commissioner.
26E(7) Development of APP codes by APP code developers
Duty to make publicly available copy of request.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.156
26F Application for registration of APP codes
Developer may apply for registration of APP code.
26F(1) Application for registration of APP codes
Must make draft publicly available, invite public submissions, and consider submissions.
26F(2) Application for registration of APP codes
Information as specified by the Commissioner.
Application must be made in specified form and manner.
26F(3) Application for registration of APP codes
Commissioner's consent required for varying APP code
26F(4) Application for registration of APP codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.157
26G Development of APP codes by the Commissioner
The Commissioner must register the APP code developed as requested if a request was made under subsection 26E(2) and it has not been complied with.
26G(1) Development of APP codes by the Commissioner
The Commissioner must register the APP code.
A request was made under subsection 26E(2).
The Commissioner does not need to register the APP code if a request was made under subsection 26E(2) and it has been complied with.
Commissioner must develop APP code if in public interest, with exemptions
26G(2) Development of APP codes by the Commissioner
Commissioner must make draft of APP code publicly available and invite public to submit comments.
26G(3) Development of APP codes by the Commissioner
Commissioner must make draft of APP code publicly available.
Commissioner should give consideration to these submissions.
Commissioner should consider submissions made by the public.
Commissioner has received submissions from the public.
26H Commissioner may register APP codes
26H(1) Commissioner may register APP codes
Commissioner may consult and consider matters when deciding to register APP code.
26H(2) Commissioner may register APP codes
Permission to consult and consider matters.
Commissioner must give written notice of decision to developer.
26H(3) Commissioner may register APP codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.158
26J Variation of registered APP codes
Commissioner may approve variation of registered APP code
26J(1) Variation of registered APP codes
Commissioner has permission to approve variation
Information specified by the Commissioner
26J(2) Variation of registered APP codes
Variation of registered APP codes must not deal with exempt acts or practices.
26J(3) Variation of registered APP codes
Prohibits variation of registered APP codes with exempt acts or practices.
Draft of the variation and opportunity for public comment
Commissioner must consult and consider public comments before approving a variation.
26J(4) Variation of registered APP codes
Duty to consult and consider public comments
Consider matters specified in relevant guidelines when deciding to approve a variation.
26J(5) Variation of registered APP codes
Obligation to consider relevant guidelines
Commissioner must remove original code and register varied APP code
26J(6) Variation of registered APP codes
Duty to remove original code and register varied APP code
Variation of registered APP codes comes into effect on a specified day after approval.
26J(7) Variation of registered APP codes
An approval is not a legislative instrument.
26J(8) Variation of registered APP codes
Temporal relation between inclusion and registration
An approval is not a legislative instrument. Note: The APP code, as varied, is a legislative instrument once it is included on the Codes Register: see section 26B.
Implication from definition to conclusion
The APP code, as varied, is a legislative instrument once it is included on the Codes Register: see section 26B.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.159
26K Removal of registered APP codes
Commissioner may remove APP code from Codes Register.
26K(1) Removal of registered APP codes
26K(2) Removal of registered APP codes
Consultation and public comment requirement before removing registered APP code
26K(3) Removal of registered APP codes
Duty to consult and consider public comment
Consider relevant guidelines when removing registered APP codes
26K(4) Removal of registered APP codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.160
26L Entities to comply with the registered CR code if bound by the
26M What is the registered CR code
The registered CR code is the CR code that is included on the Codes Register.
26M(1) What is the registered CR code
The registered CR code is a legislative instrument.
26M(2) What is the registered CR code
Conditional commencement of registered CR code
26M(3) What is the registered CR code
26N What is a CR code
A written code of practice about credit reporting is required.
26N(1) What is a CR code
A CR code must set out how to apply Part IIIA provisions and make provision for matters required or permitted by the code.
26N(2) What is a CR code
Must provide a CR code that sets out how to apply Part IIIA provisions.
(2) A CR code must: (a) set out how one or more of the provisions of Part IIIA are to be applied or complied with;
Must make provision for matters required or permitted by the code.
(2) A CR code must: (b) make provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code;
(2) A CR code must: (c) bind all credit reporting bodies;
Must specify the credit providers that are bound by the code.
(2) A CR code must: (d) specify the credit providers that are bound by the code, or a way of determining which credit providers are bound;
Must specify any other entities subject to Part IIIA that are bound by the code.
(2) A CR code must: (e) specify any other entities subject to Part IIIA that are bound by the code, or a way of determining which of those entities are bound.
Imposes additional requirements on CR codes
26N(3) What is a CR code
(3) A CR code may do one or more of the following:
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.161
26P Development of CR code by CR code developers
Commissioner may request CR code developer to develop a CR code.
26P(1) Development of CR code by CR code developers
Specify period for compliance and effect of section 26L
26P(2) Development of CR code by CR code developers
Extension of request period by Commissioner
26P(3) Development of CR code by CR code developers
Granting permission to extend the request period
Specify matters, credit providers, and entities bound by the code.
26P(4) Development of CR code by CR code developers
26P(5) Development of CR code by CR code developers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.162
26Q Application for registration of CR code
Developer may apply for registration of CR code
26Q(1) Application for registration of CR code
26Q(2) Application for registration of CR code
26Q(3) Application for registration of CR code
Consent required from Commissioner to vary CR code
26Q(4) Application for registration of CR code
26R Development of CR code by the Commissioner
Commissioner may develop CR code under certain conditions.
26R(1) Development of CR code by the Commissioner
Commissioner must make draft publicly available and invite public submissions.
26R(2) Development of CR code by the Commissioner
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.163
26S Commissioner may register CR code
26S(1) Commissioner may register CR code
Commissioner must consult and consider guidelines when deciding to register CR code
26S(2) Commissioner may register CR code
Commissioner must consult and consider guidelines
Commissioner must give written notice to developer if not registering CR code
26S(3) Commissioner may register CR code
Ensure one and only registered CR code at all times after commencement.
26S(4) Commissioner may register CR code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.164
26T Variation of the registered CR code
Commissioner may approve variation of registered CR code
26T(1) Variation of the registered CR code
26T(2) Variation of the registered CR code
(a) draft of the variation, (b) consultation results
Duty to consult and consider public comment on variation
26T(3) Variation of the registered CR code
Consider relevant guidelines when deciding to approve a variation.
26T(4) Variation of the registered CR code
Commissioner must remove original code and register varied CR code
26T(5) Variation of the registered CR code
Duty to remove original code and register varied CR code
Variation of the registered CR code comes into effect on a specified day after approval.
26T(6) Variation of the registered CR code
26T(7) Variation of the registered CR code
Temporal relation between CR code variation and legislative instrument status
An approval is not a legislative instrument. Note: The CR code, as varied, is a legislative instrument once it is included on the Codes Register: see section 26M.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.165
26U Codes Register
The Commissioner must keep a Codes Register.
26U(1) Codes Register
The Commissioner is not required to include certain codes on the Codes Register.
26U(2) Codes Register
The Commissioner must make the Codes Register available on the website.
26U(3) Codes Register
Commissioner may charge fees for providing copies or extracts from the Codes Register.
26U(4) Codes Register
26V Guidelines relating to codes
Commissioner must make written guidelines to assist with APP code development and application.
26V(1) Guidelines relating to codes
Commissioner may make written guidelines about matters in deciding certain actions.
26V(2) Guidelines relating to codes
Commissioner may publish guidelines on website
26V(3) Guidelines relating to codes
Guidelines are not a legislative instrument.
26V(4) Guidelines relating to codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.166
26W Review of operation of registered codes
Commissioner may review operation of registered APP code.
26W(1) Review of operation of registered codes
Commissioner may review operation of registered CR code.
26W(2) Review of operation of registered codes
Commissioner has an obligation to review operation of registered CR code.
27 Division 5 of Part III
28 Part IIIAA
29 Before Part IV
Repeal definition of approved privacy code
3 Subsection 6(1) (definition of approved privacy code)
Replace specific phrase with alternative phrase.
30 Subsection 36(1)
31 Subsections 36(1A), (1B) and (1C)
32 Subsections 54(1A), 55A(7) and 55B(2)
33 Subsection 55B(3)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.167
34 Subsection 55B(3)
35 Subsection 55B(4)
36 Subsection 64(1)
37 Subsection 64(2)
Substitute 'a registered APP code' for 'an approved privacy code'
38 Section 95C
Replaces approved privacy code with registered APP code
Substitute registered APP code for approved privacy code
4 Subsection 6(1) (definition of code complaint)
5 Subsection 6(1) (definition of Code of Conduct)
6B Breach of a registered APP code
Act or practice breaches CR code if it is contrary to the code.
6BA Breach of the registered CR code
Breach of CR code occurs during the act or practice's execution.
Temporal relation: Act or practice breaches CR code during its execution.
Breach of CR code implies act or practice.
Act or practice implies breach of CR code if it is contrary to the code.
Breach of CR code is recognized by CogAI in act or practice.
CogAI recognizes breach of CR code in act or practice if it is contrary to the code.
Act or practice is contrary to the code.
All acts or practices that are contrary to the code diffuse breach of CR code.
Breach of CR code diffuses to all acts or practices that are contrary to the code.
9 Subsection 6(1) (definition of credit provider)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.168
1 After section 2
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.170
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.194
100 Subsection 50(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.195
Add to a recognised external dispute resolution scheme
101 At the end of paragraph 50(2)(a)
102 Subsection 50(2)
Prohibits the use of specified entities.
103 Paragraphs 50(2)(c) and (e)
Add to recognised external dispute resolution scheme
104 At the end of paragraph 50(3)(a)
The Commissioner may determine under section 53B that the determination applies in relation to an agency if the organisation has not complied with the determination.
105 Subsection 50A(2) (note 2)
106 Subparagraph 52(1)(b)(i)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.196
Mandatory steps for respondent to prevent repeated conduct
107 After subparagraph 52(1)(b)(i)
108 Subparagraph 52(1)(b)(ii)
Commissioner may make a determination that includes one or more of the following declarations.
109 Subsection 52(1A)
Commissioner has an obligation to make a determination.
The Commissioner's determination includes one or more of the following declarations.
Repeal definitions, substitute new meanings for breach
11 Subsection 6(1) (all the definitions of breach)
Replace existing breach definitions with new ones
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.197
Insertion of subsection (1A) after subsection (1)
110 Subsection 52(1B)
Commissioner may consider necessary or appropriate orders in a determination.
111 Subsections 52(3A) and (3B)
Commissioner has an obligation to consider necessary or appropriate orders.
Omit specific phrase from contract provision
112 Subsection 53A(1)
113 Section 53B (heading)
Repeal paragraph, substitute with new obligation under section 52 for contracted service providers.
114 Paragraph 53B(1)(a)
Replace existing paragraph with new obligation.
Declaration under paragraph 52(1A)(d) that one or more individuals are entitled to a specified amount by way of compensation.
115 After subparagraph 53B(1)(b)(i)
Omit 'respondent', substitute 'provider'.
116 Paragraph 53B(1)(c)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.198
Insert “or individuals” after “complainant”.
117 Paragraph 53B(1)(d)
Modify paragraph (b) of section 53B(1)(d)
118 Paragraph 53B(1)(d)
Insertion of phrase after 'writing that'
119 Subsection 53B(2)
120 Subsection 53B(2)
121 Subsection 53B(2) (at the end of the note)
Modify 'respondent' to 'determination applies in relation to'
122 Subsection 54(1)
Repeal section and substitute with new content.
123 Section 55
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.199
124 Subsection 55A(1)
Imposes a duty on others to substitute 'The' for 'Any of the'
Repeal paragraphs and substitute with new provisions
125 Paragraphs 55A(1)(a) to (c)
Omit 'respondent', substitute 'person or entity in relation to which the determination applies'.
126 Subsection 55A(2)
Replace 'the complainant' with 'an individual'
127 Subsection 55A(2)
Imposes a duty on the legislative body to replace 'the complainant' with 'an individual'
128 Subsection 55A(5)
129 Subsection 55A(5)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.173
Severability—additional effect of this Act
12B Severability—additional effect of this Act
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.174
13 Interferences with privacy
Interference with privacy defined as breach of APP principle or code
13(1) Interferences with privacy
Interference with privacy defined as breach of Part IIIA or registered CR code.
13(2) Interferences with privacy
Interference with privacy is prohibited if it breaches an Australian Privacy Principle or a registered APP code.
13(3) Interferences with privacy
...the act or practice does not breach: (i) an Australian Privacy Principle;
Temporal relation between interference with privacy and breach of Australian Privacy Principle
(3) An act or practice of an organisation is an interference with the privacy of an individual if: (a) the act or practice relates to personal information about the individual; and...
...the act or practice does not breach: (i) an Australian Privacy Principle; or (ii) a registered APP code...
Prohibition of interference with privacy
(3) An act or practice of an organisation is an interference with the privacy of an individual...
...the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract);
Obligation to prevent interference with privacy
...the act or practice does not breach: (ii) a registered APP code;
Recurring trace of interference with privacy and breach of registered APP code
Interference with tax file number information is prohibited.
13(4) Interferences with privacy
Prohibits interference with tax file number information.
Interference with privacy defined as breach of specific Acts or rules.
13(5) Interferences with privacy
Omit 'appearance', substitute 'hearing'.
130 Paragraph 55A(6)(c)
131 Paragraph 55A(6)(c)
132 Subsection 55A(7A)
Prohibits the Commissioner from having due regard to specific matters.
Omit ‘matters that paragraph 29(a) requires the Commissioner to have due regard to’
Repeal paragraphs and substitute with conditions for breach of Australian Privacy Principle or APP code
133 Paragraphs 55B(1)(a) and (b) and (3)(a) and (b)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.200
134 Subsection 57(1)
The new phrase applies from the start of the agency's operation to its closure
Defines temporal interval for substitution
The substitution occurs at the specified time
The alternative text is used when the specified phrase is omitted
Establishes implication between omitted phrase and alternative text
Omitting the phrase implies the use of an alternative text
Agencies and executives must adapt to the new text
Draws inference about agency or executive behavior
The substitution implies a change in agency or executive behavior
All related agencies and principal executives must use the alternative text
Propagates substitution to related agencies or executives
The substitution applies to all agencies and principal executives
Repeal section and substitute with new provision
135 Section 58
Omit specific phrase from agency executive determination
136 Section 59
Prohibits the principal executive of an agency from being the respondent to a determination
137 Paragraph 59(b)
138 After paragraph 59(b)
Obligation to take steps within specified period
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.201
Add 'or paragraph 52(1A)(c)' to the end of paragraph 59(c)
139 At the end of paragraph 59(c)
The new clause extends the temporal interval of the provision
Extending a temporal interval by adding a new clause
The text adds 'or paragraph 52(1A)(c)' to the end of paragraph 59(c)
The new clause is added to the provision using cognitive AI
Adding a new clause to an existing provision through cognitive AI
A new obligation is imposed on the state
Adding a clause to an existing provision
The text adds a new clause to paragraph 59(c)
The new clause is diffused into the provision
Adding a new clause to an existing provision through diffusion
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.177
Organisations may still interfere with individual privacy despite sections 13B, 13C and 13D.
13E Effect of sections 13B, 13C and 13D
An act or practice not covered by section 13 is not an interference with the privacy of an individual.
13F Act or practice not covered by section 13 is not an interference
Serious and repeated interferences with privacy are prohibited.
13G Serious and repeated interferences with privacy
Prohibits serious and repeated interferences with privacy.
14 Subsection 6(1) (definition of code complaint)
An individual is replaced by the complainant
Replacing 'the complainant' with 'an individual'
140 Subsection 60(1)
Insertion of 'or individual' after 'complainant'
141 Subsection 60(1)
142 Subsection 60(2)
143 Subsection 60(2)
144 Section 61
Application may be made by complainant or Commissioner
145 Subsection 62(3)
Omit 'respondent', substitute 'agency or principal executive'
146 Subsection 62(4)
147 Paragraph 62(5)(a)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.202
Defines complainant for a representative complaint.
148 At the end of section 62
149 Subsection 63(2A)
Definition of committee of management of an unincorporated association.
15 Subsection 6(1)
150 Paragraphs 67(aa) and (ab)
151 Sections 69 and 70A
152 Subsection 72(1)
153 Subsection 72(2) (heading)
Prohibits breach of Australian Privacy Principle or registered APP code
154 Paragraph 72(2)(a)
155 Paragraph 72(2)(b)
156 Paragraph 72(2)(b)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.203
Omit 'make a written', substitute ', by legislative instrument, make a'
157 Subsection 72(2)
158 Subsection 72(3)
159 Subsection 72(4)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.171
16 Subsection 6(1) (definition of credit reporting complaint)
160 Subsection 72(4)
Omit “organisation does”, substitute ‘APP entity does’.
161 Subsection 72(4)
162 Subsection 72(4)
163 Section 73 (heading)
Substitute 'An APP entity' for 'An agency or organisation'
164 Subsection 73(1)
Substitute “the entity” for “the agency or organisation”.
165 Subsection 73(1)
166 After subsection 73(1)
Prohibits Commissioner from dismissing frivolous applications
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.204
167 Section 74 (heading)
Omit all words after 'notice' and substitute with specific phrases.
168 Subsection 74(1)
Prohibit omission of words after 'notice'
Add “unless the Commissioner dismisses the application under subsection 73(1A)”.
169 At the end of subsection 75(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.178
The Commissioner must issue rules concerning tax file number information.
17 Rules relating to tax file number information
Defence Department means the Department of State that deals with defence and that is administered by the Minister administering section 1 of the Defence Act 1903.
170 Subsection 79(3)
171 Section 80
Substitute 'APP entity' for 'agency or organisation'
172 Paragraph 80A(1)(a)
Repeal subparagraphs and substitute with an Australian Privacy Principle or a registered APP code.
173 Subparagraphs 80A(1)(a)(i) and (ii)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.205
Replace 'agency or organisation' with 'entity'
174 Paragraph 80A(1)(b)
175 Paragraph 80A(1)(b)
Substitute legislative instrument for 'make a written temporary public interest'
176 Subsection 80A(2)
Omit 'agency or organisation', substitute 'APP entity'.
177 Paragraph 80A(2)(a)
Specify a period of up to 12 months for the determination to be in force.
178 Subsection 80A(3)
Entity not breaching section 15 or 26A if act/practice subject to temporary public interest determination.
179 Subsections 80B(1) and (2)
Entity does act/practice without breaching section 15 or 26A
Temporary public interest determination in force
18 Subsection 6(1) (definition of file number complaint)
File number recipients to comply with rules
18 File number recipients to comply with rules
180 Subsection 80B(3)
Omit 'organisation is taken to contravene section 16A', substitute 'APP entity is taken to contravene section 15 or 26A'
181 Subsection 80B(3)
APP entity is taken to contravene section 15 or 26A
Replaces organisation with APP entity in the context of temporal intervals
Omit 'organisation is taken to contravene section 16A'
Prohibits organisation from contravening section 16A
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.206
182 Subsection 80B(3)
183 Subsection 80B(3)
184 Section 80C
185 Paragraph 80D(2)(a)
Prohibits omitting specified subsection references
186 Paragraph 80P(1)(a)
No breach of Australian Privacy Principle or APP code for authorized collection, use, or disclosure of personal information.
187 Subsections 80P(4) and (5)
Authorized collection, use, or disclosure of personal information
Grant permission for disclosure under Australian Privacy Principle or registered APP code
188 Paragraphs 80Q(2)(a) and (b)
Compilation and registration of amendments
189 After Part VIA
19 Subsection 6(1) (paragraph (a) of the definition of file
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.211
Inserts the Privacy Commissioner within the meaning of the Australian Information Commissioner Act 2010.
190 After paragraph 82(2)(a)
191 Paragraph 82(2)(b)
Insert 'and Privacy Commissioner' after 'Commissioner'
192 Subsection 82(3)
At least one person must have specific experience in industry, public administration, or health privacy.
193 Paragraph 82(7)(a)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.212
194 Paragraph 82(7)(b)
195 At the end of paragraph 82(7)(b)
Requires at least one person with extensive experience in information and communication technologies.
196 Paragraph 82(7)(c)
Requires a specific condition to be met.
197 Paragraphs 82(7)(d) and (e)
Omit 'guidelines', substitute 'rules or guidelines'.
198 Paragraph 83(b)
199 Subsections 95(5), 95A(7) and 95AA(3)
2 Subsections 5B(1) and (1A)
2(1) Subsections 5B(1) and (1A)
Australian Privacy Principle not breached if required by foreign law
2(1A) Subsections 5B(1) and (1A)
200 After section 95C
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.213
201 After section 98
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.215
Insertion of 'or for a civil penalty order'
202 Subsection 99A(1)
Insert 'or proceedings for a civil penalty order' after 'this Act'
203 Subsection 99A(2)
204 Subsection 99A(3)
205 Subsection 99A(4)
206 Subsection 99A(9)
Repeal definition of individual concerned
21 Subsection 6(1) (definition of individual concerned)
22 Subsection 6(1)
Definition of monitoring related functions
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.172
Offences against this Act are also offences against other Acts.
Subclass relationship between the Act and other Acts.
Definition of recognised external dispute resolution scheme
Omit ‘(including information forming part of a database’) from the definition.
26 Subsection 6(1) (definition of tax file number information)
Prohibits omitting ‘(including information forming part of a database’) from the definition.
27 Subsection 6(3)
27 Functions of the Commissioner
The Commissioner has various functions under the Act.
27(1) Functions of the Commissioner
Commissioner has power to perform functions
27(2) Functions of the Commissioner
The Commissioner's power to perform functions is exercised during the performance of its duties.
Power is exercised during function performance
The Commissioner's power to perform functions implies that it is able to perform its duties.
The Commissioner's power to perform functions is exercised through its own agency.
The Commissioner has the power to perform its functions.
Commissioner's power to perform functions
The Commissioner's power to perform functions diffuses through the performance of its duties.
Power diffuses through function performance
Commissioner may establish a panel to assist in performing functions.
27(3) Functions of the Commissioner
Section 38 of the Healthcare Identifiers Act 2010 applies in relation to an investigation.
27(4) Functions of the Commissioner
Omit 'Department of Defence', substitute 'Defence Department'.
28 Subsection 6(6)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.179
28 Guidance related functions of the Commissioner
Commissioner's guidance related functions
28(1) Guidance related functions of the Commissioner
Commissioner may publish guidelines in an appropriate manner.
28(2) Guidance related functions of the Commissioner
The Commissioner may undertake educational programs
28(3) Guidance related functions of the Commissioner
Permission to undertake educational programs
Legislative instruments are not guidelines.
28(4) Guidance related functions of the Commissioner
Guidelines are not legislative instruments.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.180
28A Monitoring related functions of the Commissioner
The Commissioner must monitor and ensure compliance with certain rules.
28A(1) Monitoring related functions of the Commissioner
The Commissioner must examine proposed enactments and proposals for data matching or linkage to ensure they do not have adverse effects on privacy.
28A(2) Monitoring related functions of the Commissioner
The Commissioner must perform the specified actions.
Commissioner may perform functions on request or initiative
28A(3) Monitoring related functions of the Commissioner
Instrument is not a legislative instrument if reporting is done in writing.
28A(4) Monitoring related functions of the Commissioner
Instrument is not a legislative instrument.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.181
28B Advice related functions of the Commissioner
The Commissioner must provide advice on matters relevant to the operation of the Act.
28B(1) Advice related functions of the Commissioner
Functions may be performed by Commissioner on request or initiative.
28B(2) Advice related functions of the Commissioner
The Commissioner may perform a function whenever necessary.
28B(3) Advice related functions of the Commissioner
Instrument is not a legislative instrument if Minister is informed in writing or report is provided in writing.
28B(4) Advice related functions of the Commissioner
Minister informed in writing or report provided in writing
29 Paragraphs 7(1)(ca) and (g) and (1A)(c)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.182
Commissioner must have due regard to the objects of the Act
29 Commissioner must have due regard to the objects of the Act
Promote protection of individual privacy and balance with entity interests.
2A Objects of this Act
Promote protection of individual privacy.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.169
Repeal heading and substitute with 'Australian link'
3 Subsection 5B(2) (heading)
Substitute “in relation to the principles and such a code” for “under section 27”.
30 Subsection 7(2)
31 Paragraph 7(2)(b)
32 Subsection 7(3A)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.183
The Commissioner must report to the Minister if certain activities are monitored.
32 Commissioner may report to the Minister if the Commissioner
The Commissioner must report to the Minister.
The Commissioner has monitored certain activities.
Modify certain paragraphs in section 28 and 28A.
33 Subsection 7(4)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.184
33C Commissioner may conduct an assessment relating to the
Commissioner must conduct an assessment of certain matters.
33C(1) Commissioner may conduct an assessment relating to the
Commissioner may conduct assessment in manner considered fit.
33C(2) Commissioner may conduct an assessment relating to the
33D Commissioner may direct an agency to give a privacy impact
Commissioner may direct an agency to give a privacy impact assessment.
33D(1) Commissioner may direct an agency to give a privacy impact
33D(2) Commissioner may direct an agency to give a privacy impact
Must provide a privacy impact assessment.
Agency must conduct a privacy impact assessment
33D(3) Commissioner may direct an agency to give a privacy impact
33D(4) Commissioner may direct an agency to give a privacy impact
Failure to comply with a direction is prohibited.
33D(5) Commissioner may direct an agency to give a privacy impact
A privacy impact assessment is not a legislative instrument.
Agency must comply with direction from Commissioner regarding privacy impact.
33D(6) Commissioner may direct an agency to give a privacy impact
Commissioner may direct an agency to give a privacy impact review after five years.
33D(7) Commissioner may direct an agency to give a privacy impact
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.185
33E Commissioner may accept undertakings
Commissioner may accept undertakings for specified actions or refraining from taking action.
33E(1) Commissioner may accept undertakings
Obligation to take specified actions or refrain from taking action.
33E(2) Commissioner may accept undertakings
Commissioner must consent to withdraw or vary undertaking.
33E(3) Commissioner may accept undertakings
33E(4) Commissioner may accept undertakings
Commissioner may publish undertaking on website
33E(5) Commissioner may accept undertakings
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.186
33F Enforcement of undertakings
Commissioner may apply for order if entity breaches undertaking.
33F(1) Enforcement of undertakings
(c) the Commissioner considers that the entity has breached the undertaking;
Court may order entity to comply with undertaking or compensate for breach.
33F(2) Enforcement of undertakings
Entity has a duty to comply with the undertaking.
34 Section 12B (heading)
35 Subsections 12B(1) and (2)
Regulated entities subject to the Act's effect
35(1) Subsections 12B(1) and (2)
The Act has no effect in relation to these entities
The Act has the effect of giving effect to specific articles of international human rights covenants.
35(2) Subsections 12B(1) and (2)
The operation overlaps with a specific time period.
The operation is confined to a specific time period.
(2) This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to an operation to give effect to the following:
The Act has knowledge of specific human rights.
The Act has the effect it would have if its operation in relation to regulated entities were expressly confined to an operation to give effect to the following:
The Act has the effect of giving effect to specific articles.
The operation diffuses into a specific entity.
The operation occurs before a specific event.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.187
35A Commissioner may recognise external dispute resolution
Commissioner may recognise external dispute resolution scheme.
35A(1) Commissioner may recognise external dispute resolution
Classifies entities or classes of entities.
Commissioner must consider certain factors when recognising an external dispute resolution scheme.
35A(2) Commissioner may recognise external dispute resolution
Commissioner must consider factors that occur after scheme recognition.
(2) In considering whether to recognise an external dispute resolution scheme, the Commissioner...
Commissioner must consider certain factors.
Commissioner may specify period for recognition of external dispute resolution scheme and subject it to conditions.
35A(3) Commissioner may recognise external dispute resolution
Notice under subsection (1) is not a legislative instrument.
35A(4) Commissioner may recognise external dispute resolution
Omit “to organisations”, substitute ‘to regulated entities’.
36 Subsection 12B(3)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.188
Individuals have a right to complain about privacy interference and the Commissioner must investigate.
36A Guide to this Part
Individuals have a duty to complain about privacy interference.
An individual may complain to the Commissioner...
Entities have a duty to comply with determination declarations.
Entities must comply with determination declarations.
An entity to which a determination relates must comply with certain declarations...
The Commissioner has a duty to investigate complaints.
The Commissioner must investigate complaints.
If a complaint is made, the Commissioner is required to investigate...
Determination is a basis for court proceedings.
Court proceedings can be commenced to enforce a determination.
After an investigation, the Commissioner may make a determination...
37 Subsection 12B(3)
38 Subsection 12B(3)
Omit 'organisations' and substitute 'regulated entities'.
39 Subsections 12B(4) and (5)
Granting permission for an organisation or small business operator to have an Australian link.
4 Subsection 5B(2)
Regulated entities must comply with banking and insurance regulations.
40 After subsection 12B(5)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.190
40A Conciliation of complaints
Commissioner must attempt to conciliate a complaint if reasonably possible.
40A(1) Conciliation of complaints
Commissioner's decision not to investigate is a condition for subsection (1) not applying.
40A(2) Conciliation of complaints
Commissioner's decision affects the applicability of subsection (1)
Commissioner's decision overlaps with investigation decisions
Commissioner's decision is a temporal subset of investigation decisions
Commissioner must notify complainant and respondent if conciliation is not possible.
40A(3) Conciliation of complaints
Temporal relationship between notification and conciliation process
(3) If the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner must, in writing, notify the complainant and respondent of that matter.
Implication of notification on conciliation process
Assertion of notification by Commissioner
Spread of information about notification
Commissioner may decide not to investigate or further investigate a complaint.
40A(4) Conciliation of complaints
Commissioner has the power to decide not to investigate.
Complainant and respondent must agree for evidence to be admissible.
40A(5) Conciliation of complaints
Evidence is admissible unless they disagree.
Obligation on the state to provide admissible evidence.
The complainant and respondent must agree.
41 Subsections 12B(6) to (8)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.191
Commissioner must decide not to investigate in certain circumstances.
41 Commissioner may or must decide not to investigate etc. in
Repeal sections and substitute with new ones.
42 Sections 13 and 13A
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.176
Substitute subsection 13(1) for omitted paragraphs.
43 Subsection 13B(1)
43A Interested party may request a hearing
Request for hearing before Commissioner's determination
43A(1) Interested party may request a hearing
Commissioner must notify and give opportunity to make submission about request.
43A(2) Interested party may request a hearing
Must provide notification and opportunity for submission.
Defines 'interested party' for investigation purposes.
43A(3) Interested party may request a hearing
Substitute 'of an individual' with itself.
44 Subsection 13B(1)
Does not prevent an act or practice from being an interference with the privacy of an individual under subsection 13(3).
45 Subsection 13B(2)
Substitute “of the individual” with “of the individual”.
46 Subsection 13C(1)
Subsection (1) has effect despite subsections 13(1) and (3).
47 Subsection 13C(2)
(2) Subsection (1) has effect despite subsections 13(1) and (3).
48 Subsection 13D(1)
49 Subsection 13D(2)
Overrides effects of subsections 13(1) and (3)
5 Subsection 5B(3) (heading)
50 Sections 13E and 13F
Repeal section and substitute with new text.
51 Section 17
52 Section 18 (heading)
53 Section 18
53B Substituting an agency for a contracted service provider
Repeal sections and substitute with new provisions.
54 Sections 27 to 29
Repeal and substitute a provision regarding conciliation.
55 Subparagraph 30(1)(b)(ii)
Must not repeat or continue conduct covered by a declaration included in the determination.
55 Obligations of organisations and small business operators
56 Subsection 30(3)
Prohibits omitting specified paragraph references.
Interference with individual privacy is prohibited.
57 Subsection 30(3)
Prohibits interference with individual privacy.
58 Subsection 30(6)
Agency must not repeat or continue conduct covered by a declaration included in the determination.
58 Obligations of agencies
Agency must not repeat or continue conduct.
Substitute paragraph 28A(2)(a) for paragraph 27(1)(b)
59 Subsection 31(1)
Replaces a condition with an alternative requirement for an Australian link.
6 Subsection 5B(3)
Replaces a condition with an alternative requirement.
Substitute “entity” for “agency or organisation”.
60 Subsection 31(2)
61 Section 32 (heading)
The Commissioner must report to the Minister about an activity or assessment if directed.
62 Subsection 32(1)
63 Subsection 32(2)
Inserts amendments of the Privacy Act 1988
64 After section 33B
Substitute Commissioner's functions for 'functions referred to in section 27'
65 Subsections 34(1) and (2)
66 At the end of Part IV
67 Part V (heading)
68 Before Division 1 of Part V
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.189
69 Subsection 36(7) (note)
Insert “or operator” after “organisation”.
7 Paragraphs 5B(3)(a), (b) and (c)
Omit specific text and substitute with alternative text.
70 Subsection 36(8)
71 Subsection 36(8)
72 Subsection 38(1)
73 Paragraph 38(1)(a)
73 Application by APP entity
74 Subsection 38(2)
74 Publication of application etc.
Omit all words after 'representative' and substitute with specific clause.
75 Subsection 38B(2)
Prohibits omitting words after 'representative'
Member may make complaint under section 36 if withdrawn from representative complaint.
76 Add at the end of subsection 38B(2)
Repeal subsections and substitute with new provisions
77 Subsections 40(1B) and (1C)
Insertion of initiative clause after 'Commissioner may'
78 Subsection 40(2)
Insertion of 'or a breach of Australian Privacy Principle 1' after 'individual'
79 Paragraph 40(2)(a)
8 Subsection 5B(4)
80 Section 40A
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.207
80U Civil penalty provisions
80V Ancillary contravention of civil penalty provisions
Prohibition on aiding, abetting, or inducing contravention of civil penalty provisions.
80V(1) Ancillary contravention of civil penalty provisions
Prohibition on aiding, abetting, or inducing contravention.
Entity taken to have contravened civil penalty provision if it contravenes subsection (1) in relation to a civil penalty provision.
80V(2) Ancillary contravention of civil penalty provisions
T1 overlaps with T2 where T2 is the temporal interval during which Entity A contravenes civil penalty provision.
Temporal interval during which entity contravenes subsection (1) overlaps with temporal interval during which it contravenes civil penalty provision.
Entity A starts contravening subsection (1) at time T1 and ends at time T2.
CogAI recognizes Entity A as Entity B where Entity B contravenes civil penalty provision.
CogAI recognizes entity that contravenes subsection (1) as entity that contravenes civil penalty provision.
Entity A starts contravening subsection (1).
Entity A contravenes civil penalty provision.
If entity contravenes subsection (1), then it contravenes civil penalty provision.
Entity A diffuses to Entity B where Entity B contravenes civil penalty provision.
Entity that contravenes subsection (1) diffuses to entity that contravenes civil penalty provision.
Entity A stops contravening civil penalty provision until Entity B stops contravening subsection (1).
Entity that contravenes subsection (1) until it stops contravening civil penalty provision.
80W Civil penalty orders
Entity must pay pecuniary penalty if alleged to have contravened a civil penalty provision.
80W(1) Civil penalty orders
Entity has an obligation to pay pecuniary penalty.
The Commissioner must make the application within 6 years of the alleged contravention.
80W(2) Civil penalty orders
Entity must pay pecuniary penalty to the Commonwealth if found contravening civil penalty provision.
80W(3) Civil penalty orders
Entity has a duty to pay pecuniary penalty.
80W(4) Civil penalty orders
State has obligation to determine pecuniary penalty
80W(5) Civil penalty orders
Court must consider specific factors when determining pecuniary penalty.
80W(6) Civil penalty orders
Circumstances of contravention are considered.
(c) the circumstances in which the contravention took place;
(d) whether the entity has previously been found by a court...
(6) In determining the pecuniary penalty, the court...
(b) the nature and extent of any loss or damage suffered because of the contravention;
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.208
80X Civil enforcement of penalty
A pecuniary penalty is a debt payable to the Commonwealth.
80X(1) Civil enforcement of penalty
The Commonwealth may enforce a civil penalty order as if it were an order made in civil proceedings.
80X(2) Civil enforcement of penalty
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.209
80Y Conduct contravening more than one civil penalty provision
Entity must comply with multiple civil penalty provisions.
80Y(1) Conduct contravening more than one civil penalty provision
Entity is not liable to more than one pecuniary penalty under this Division in relation to the same conduct.
80Y(2) Conduct contravening more than one civil penalty provision
Entity not liable to more than one pecuniary penalty.
Entity's liability is limited by this provision.
Entity liable to pecuniary penalty under Division.
80Z Multiple contraventions
Entity may be subject to a single civil penalty order for multiple contraventions of the same or similar character.
80Z(1) Multiple contraventions
The entity must provide evidence of the contraventions.
Contraventions occur within the same temporal interval.
(b) the contraventions form, or are part of, a series of contraventions...
The entity must provide a civil penalty order.
Entity is subject to a civil penalty order.
(1) The Federal Court or Federal Magistrates Court may make a single civil penalty order...
Entity is subject to multiple contraventions of the same or similar character.
Entity is subject to a civil penalty order for multiple contraventions.
Contraventions occur in a recurring pattern.
Pecuniary penalty must not exceed the sum of maximum pecuniary penalties for each contravention.
80Z(2) Multiple contraventions
Pecuniary penalty = Maximum pecuniary penalties for each contravention
Temporal interval for determining pecuniary penalty
(2) However, the pecuniary penalty must not exceed the sum of the maximum pecuniary penalties that could be ordered if a separate civil penalty order were made for each of the contraventions.
Pecuniary penalty ≤ Maximum pecuniary penalties for each contravention
The pecuniary penalty must not exceed the sum of the maximum pecuniary penalties that could be ordered if a separate civil penalty order were made for each of the contraventions.
Federal Court or Federal Magistrates Court may direct that proceedings for civil penalty orders are to be heard together.
80ZA Proceedings may be heard together
Federal Court or Federal Magistrates Court must apply rules of evidence and procedure for civil matters when hearing proceedings for a civil penalty order.
80ZB Civil evidence and procedure rules for civil penalty orders
Obligation to apply rules of evidence and procedure
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.210
A contravention of a civil penalty provision is not an offence.
80ZC Contravening a civil penalty provision is not an offence
It is not an offence to contravene a civil penalty provision.
It is not the case that it is an offence to contravene a civil penalty provision.
Federal Court cannot make a civil penalty order against an entity convicted of the same or substantially similar conduct.
80ZD Civil proceedings after criminal proceedings
Prohibition on making a civil penalty order
80ZE Criminal proceedings during civil proceedings
Stay of civil penalty proceedings during criminal proceedings for the same or substantially similar conduct.
80ZE(1) Criminal proceedings during civil proceedings
The excerpt describes an overlap between temporal intervals of criminal proceedings and civil penalty proceedings.
(a) Criminal proceedings are commenced or have already been commenced against the entity for an offence; and (b) the offence is constituted by conduct that is the same, or substantially the same, as the conduct alleged to constitute the contravention.
The excerpt describes an inferential relationship between criminal proceedings and civil penalty proceedings.
Prevents civil penalty proceedings during criminal proceedings for the same or substantially similar conduct.
The excerpt describes a diffusion of obligations from criminal proceedings to civil penalty proceedings.
The excerpt describes a recurring relationship between criminal proceedings and civil penalty proceedings.
Proceedings dismissed if entity is not convicted of the offence.
80ZE(2) Criminal proceedings during civil proceedings
Otherwise: (a) the proceedings are dismissed;
(2) The proceedings for the civil penalty order may be resumed...
Classifies dismissal as a consequence of non-conviction.
Prohibits dismissal if entity is not convicted.
Criminal proceedings may be commenced against an entity for conduct that is the same, or substantially the same, as conduct that would constitute a contravention of a civil penalty provision.
80ZF Criminal proceedings after civil proceedings
Prohibits conduct that would constitute a contravention of a civil penalty provision.
80ZG Evidence given in proceedings for civil penalty order not
Prevents admissibility of evidence in criminal proceedings if previously given or produced in civil penalty order proceedings for the same conduct.
80ZG(1) Evidence given in proceedings for civil penalty order not
No admissibility in criminal proceedings
Previous civil penalty order proceedings for the same conduct
Exemption from subsection (1) for criminal proceedings.
80ZG(2) Evidence given in proceedings for civil penalty order not
81 Section 41 (heading)
82 Subsection 41(1)
Prohibits Commissioner from accepting certain phrases.
Add “or” at the end of paragraphs 41(1)(a) and (c)
83 At the end of paragraphs 41(1)(a) and (c)
84 Paragraph 41(1)(d)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.192
Investigation not warranted due to circumstances, complainant non-response, external dispute resolution scheme, or effective alternative
85 After paragraph 41(1)(d)
Cannot investigate complaint if complainant has withdrawn it.
86 After subsection 41(1)
87 Subsections 41(2) and (3)
88 Section 42
Omit specified phrase from subsection 40(1B)
89 Section 42
Substitute 'respondent or any other person' for 'respondent'
90 Section 42
The Commissioner may make inquiries of any person for the purpose of determining whether to investigate an act or practice under subsection 40(2).
91 At the end of section 42
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.193
Commissioner must inform person or entity before investigating an act or practice.
92 After subsection 43(1)
93 Subsection 43(2)
Commissioner may make a determination without holding a hearing under certain conditions.
94 Subsections 43(4), (5) and (6)
Commissioner may make a determination without holding a hearing.
Omit provision allowing appearance before Commissioner and submissions.
95 Subsection 43(7)
Prohibits omission of provision allowing appearance before Commissioner and submissions.
Omit reference to approved privacy code or National Privacy Principles.
96 Subsection 43(8A)
96 Review by the Administrative Appeals Tribunal
Application for review of certain decisions by the Administrative Appeals Tribunal.
96(1) Review by the Administrative Appeals Tribunal
Application must be made by the APP code developer
96(2) Review by the Administrative Appeals Tribunal
The APP code developer that developed the APP code must make an application.
Application must be made by the CR code developer.
96(3) Review by the Administrative Appeals Tribunal
97 After section 43
Substitute 'section' for 'sections 69 and'
98 Subsection 44(4)
98A Treatment of partnerships
If the Act would impose an obligation on a partnership, it is instead imposed on each partner.
98A(1) Treatment of partnerships
If the Act would impose an obligation on a partnership
Each partner in a partnership commits an offence if the partnership would otherwise commit one.
98A(2) Treatment of partnerships
Each partner has an obligation to comply.
Each partner is liable for the contravention if the partnership would have violated a civil penalty provision.
98A(3) Treatment of partnerships
Each partner is liable for the contravention.
Partnership would have violated a civil penalty provision.
A partner does not commit an offence if they do not know of the circumstances or take reasonable steps to correct them.
98A(4) Treatment of partnerships
The partner does not know of the circumstances
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.214
98B Treatment of unincorporated associations
Imposes obligation on association members
98B(1) Treatment of unincorporated associations
Each member of an unincorporated association's committee of management is liable for an offence committed by the association.
98B(2) Treatment of unincorporated associations
Each member of the association's committee of management is liable for contravention if the association would have violated a civil penalty provision.
98B(3) Treatment of unincorporated associations
Association would have violated a civil penalty provision
Member of unincorporated association's committee of management has an obligation to correct contravention as soon as possible after becoming aware.
98B(4) Treatment of unincorporated associations
Member takes all reasonable steps to correct contravention
Trace of reasonable steps taken to correct contravention
98C Treatment of trusts
Imposes obligation on trustee, dischargeable by any trustee
98C(1) Treatment of trusts
Offence against the Act is transferred to each trustee of a trust.
98C(2) Treatment of trusts
Each trustee is held liable for the offence.
Trustees are liable for the actions of the trust.
Each trustee of a trust is liable for contravention of civil penalty provisions.
98C(3) Treatment of trusts
Liability for contravention of civil penalty provisions.
State is responsible for enforcing civil penalty provisions.
Trustee has an obligation to correct contravention as soon as possible after becoming aware of the circumstances.
98C(4) Treatment of trusts
Trustee must take all reasonable steps to correct the contravention.
Trustee has an obligation to correct contravention.
Trustee knows of circumstances that constitute contravention.
Omit specific phrase from subsection 46(1)
99 Subsection 46(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.216
Australian Privacy Principle has the same meaning as in the Privacy Act 1988.
1 Section 2B
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.217
Replace Privacy Act 1988 with Australian Privacy Principles
10 Subsection 126(3)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.231
Substitute 'An APP entity that holds' for 'A record keeper who has possession or control of'
100 Subsection 38AA(1)
Substitute Australian Privacy Principles with authorization from this Act.
101 Subsection 38AA(2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.232
Substitute “body” for “agency” in the definition of assessment.
102 Section 5 (definition of assessment)
Repeal the definition of credit information file.
103 Section 5 (definition of credit information file)
Repeal the definition of credit reporting agency.
104 Section 5 (definition of credit reporting agency)
105 Section 5
credit reporting body has the same meaning as in the Privacy Act 1988.
106 Section 35A (heading)
107 Paragraph 35A(1)(a)
108 Paragraph 35A(1)(b)
Omit specific phrase from credit reporting agency
109 Paragraph 35A(1)(b)
11 Subsections 13(1) and (2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.233
110 Subparagraph 35A(2)(a)(ii)
111 Subparagraph 35A(2)(a)(iii)
Omit specific phrase from credit information file
112 Subparagraph 35A(2)(a)(iii)
113 Subparagraph 35A(2)(a)(iv)
114 Subparagraph 35A(2)(a)(v)
Omit specific information from credit files.
115 Subparagraph 35A(2)(a)(v)
Prohibits the disclosure of personal information.
116 Section 35B (heading)
117 Subsection 35B(1)
118 Paragraph 35B(1)(a)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.234
Omit specific information from credit reporting bodies.
119 Paragraph 35B(1)(b)
12 Subsection 16(2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.240
12 Rules relating to privacy
120 Paragraph 35B(2)(a)
121 Subsection 35B(3)
Substitute 'this Act' for 'law' in paragraph 20E(3)(e)
122 Subsection 35B(3)
123 Paragraph 35C(2)(b)
124 Section 35D
Repeal heading and substitute with new title.
125 Section 35E (heading)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.235
126 Sections 35E, 35F and 35G
127 Section 35L
128 Paragraph 29A(7)(b)
129 Paragraph 77A(9)(c)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.218
Substitute Australian Privacy Principle 6 for Information Privacy Principle 11 in section 14 of the Privacy Act 1988.
13 Subsection 43(1A) (note 2)
130 Paragraph 91(9)(c)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.236
Credit reporting bodies may collect and hold default information under the Privacy Act 1988.
131 Paragraph 88(3)(i) of the National Credit Code
Repeal paragraph and substitute with new provision
132 Paragraph 179D(2)(h) of the National Credit Code
Prohibits collection and holding of default information
133 Section 355-200 in Schedule 1 (example)
Omit specific requirement from credit information file.
134 Section 355-200 in Schedule 1 (example)
Prohibits omitting specific requirement.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.237
Repeal paragraph, substitute with new statement about APP code procedures.
135 Paragraph 32(1)(b)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.241
135AA Privacy rules
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.242
135AB Breaches of the privacy rules
136 Section 116A
137 Subparagraph 117(1)(k)(iii)
Substitute “the registered APP code” for “the approved privacy code”.
138 Subparagraph 117(1)(k)(iv)
Omit approved privacy code, substitute registered APP code.
139 Subsection 118(1) (note)
Substitute Australian Privacy Principle 6 for the purposes of this Act.
14 Subsection 40(2)
140 Paragraph 118(4A)(c)
Omit 'the approved privacy code' and substitute 'the registered APP code'.
141 Paragraph 118(4A)(d)
142 Subsections 121(1A) and 122(3)
Prohibits the use of approved privacy codes.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.238
143 Subsection 130(1) (note)
144 Paragraphs 134(1)(c) and (d)
145 Subsections 303B(1), 303B(2) and 303C(1)
Prohibits the use of 'an approved privacy code'
Omit 'approved privacy code', substitute 'registered APP code'.
146 Subparagraph 147(2)(l)(ib)
Prohibits the use of 'approved privacy code'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.239
Omit certain words from a provision related to the Privacy Act 1988.
147 Paragraph 20(4A)(b)
148 Subsection 9(2) (table item 3, column headed
Repeal paragraphs and substitute with new functions and powers.
149 Paragraphs 12(4)(a) and (b)
Replace existing paragraphs with new ones.
15 Subsection 40(3)
Repeal guidelines under Privacy Act 1988
150 Paragraph 12(4)(c)
Prohibits making guidelines under Privacy Act 1988
Repeal and substitute rules under specific acts.
151 Paragraph 12(4)(d)
Prohibits the issue, variation or revocation of rules under specific acts.
Omit paragraph 27(1)(r), substitute paragraph 28B(1)(c)
152 Paragraph 12(4)(e)
153 Paragraph 12(4)(f)
154 Paragraph 25(k)
Substitute section 17 and paragraph 28A(1)(d) for omitted paragraphs.
155 Paragraph 32(1)(a)
Replaces omitted provisions with new ones.
156 Subsection 85ZZG(1)
157 Subsection 5(2)
158 Section 12 (heading)
Omit 'guidelines' and substitute 'rules'.
159 Section 12
Replace Australian Privacy Principle 11 with Australian Privacy Principle 6.
16 Subsection 40(3) (note)
Omit 'guidelines in the Schedule', substitute 'rules issued under section 12'.
160 Subsection 13(2)
Prohibition of 'guidelines in the Schedule'
161 Subsections 13(3) and (4)
Omit “Part 5 and section 99”, substitute ‘Part V’.
162 Subsection 13(7)
163 Subsection 14(1)
164 Subsection 29(3)
165 Section 135AA (heading)
Repeal heading, substitute 'Issuing rules'
166 Subsection 135AA(3) (heading)
167 Subsections 135AA(3) and (3A)
168 Subsection 135AA(4) (heading)
169 Subsection 135AA(4)
Repeal paragraphs and substitute with new text
17 Paragraphs 42(3)(a) and (b)
Repeal heading and substitute with new content
170 Subsection 135AA(5) (heading)
171 Subsections 135AA(5) and (5A)
172 Subsection 135AA(5AA)
173 Subsections 135AA(5B) and (6)
174 Subsection 135AA(8) (heading)
175 Subsection 135AA(8)
176 Section 135AB (heading)
177 Subsections 135AB(1) and (2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.243
178 Subsection 137A(3) (note 2)
179 Section 147
Omit “or authorised by law”, substitute ‘or authorised by this Act’.
18 Subsection 42(3)
Replaces a temporal interval with another one
Prohibits the use of 'or authorised by law'
180 Subsection 299LA(3) (note 2)
Omit section 14 of the Privacy Act 1988 and substitute Australian Privacy Principles.
19 Section 46 (note)
Omit certain privacy principles and substitute with new ones.
2 Subsection 91-2(3)
Prohibits the use of certain privacy principles.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.219
Replace section 14 of the Privacy Act 1988 with Australian Privacy Principles
20 Subsection 47(1) (note)
Substitute Australian Privacy Principle 6 reference
21 Subsection 56(12)
22 Subsection 7A(1C)
Omit paragraph (1)(c) of Information Privacy Principle 10 in section 14 of the Privacy Act 1988, substitute paragraph 6.2(b) of Australian Privacy Principle 6.
23 Subsection 7A(1C) (note)
24 Paragraph 7A(1D)(a)
25 Subsection 7A(1D) (note)
Replace 'Information Privacy Principles' with 'Australian Privacy Principles'
26 Paragraph 85ZZ(2)(e)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.220
27 Subsection 37ZB(1)
28 Subsection 72Q(3)
Omit and substitute a provision in the Privacy Act 1988.
29 Subsection 72Q(3) (note)
3 Subsection 92-7(4)
Prohibits the use of outdated privacy principles
Replace 'authorised by law' with 'authorised by this Act'
30 Subsection 36A(4)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.230
Acts taken to be authorised by this Act for purposes of Privacy
303B Acts taken to be authorised by this Act for purposes of Privacy
Substitute 'to be authorised by this Act' for 'authorised by law'
31 Subsection 79(4)
Replace 'to be authorised by law' with 'authorised by this Act'
Omit 'to be authorised by law', substitute 'to be authorised by this Act'.
32 Subsection 45C(4)
Remove the phrase 'to be authorised by law'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.221
33 Subsection 50D(1) (note 1)
34 Subsection 54A(1)
35 Subsection 65(7)
Reporting entities may disclose personal information to credit reporting bodies.
35A Reporting entities may disclose certain personal information to
Use and disclose personal information for identity verification purposes
35B Credit reporting bodies may use and disclose certain personal
Credit reporting bodies must not collect or hold personal information about an individual related to a verification request.
35D Verification information not to be collected or held by a credit
Prohibition of collecting or holding personal information.
35E Retention of verification information—credit reporting bodies
Interference with privacy constitutes a breach of requirement.
35L Breach of requirement is an interference with privacy
The breach overlaps with the requirement in relation to the individual.
Temporal overlap between breach and requirement
Breach of a requirement in relation to an individual
The breach is recognized as an act or practice involving an interference with the privacy of the individual.
Recognition of breach as interference with privacy
Breach of requirement constitutes an act or practice involving an interference with the privacy of the individual.
The breach diffuses to the requirement in relation to the individual.
The interference is recurring and involves an act or practice.
Substitute definition of personal information from Privacy Act 1988 and Healthcare Identifiers Act 2010.
36 Subsection 4(1) (definition of personal information)
Repeal previous definition of personal information
37 Section 5 (definition of National Privacy Principle)
Repeal subsection, substitute with new definition of healthcare identifier.
38 Subsection 9(6)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.222
39 Section 18
4 Subsection 93-1(5)
40 Paragraph 23(b)
41 Paragraph 26(2)(c)
Substitute Australian Privacy Principles for information privacy principles.
42 Subsection 19-60(1)
Repeal of paragraph and substitution with new definition for personal information
43 Section 179-5 (paragraph (a) of the definition of personal
44 Subclause 23(1) of Schedule 1A
Repeal and substitute paragraph (a) of the definition of VET personal information with new conditions.
45 Clause 72 of Schedule 1A (paragraph (a) of the definition
Prohibits the collection of personal information without consent.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.223
Substitute Australian Privacy Principle 6
46 Subsection 36(2) (note 2)
Omit National Privacy Principle 2 in Schedule 3 to the Privacy Act 1988
47 Subsection 35(4) (note)
Prohibits omitting National Privacy Principle 2 in Schedule 3 to the Privacy Act 1988
Omit or substitute a provision in the Privacy Act 1988
48 Subsection 36(3) (note)
Omit specified paragraph from Privacy Act 1988
49 Subsection 37(5) (note)
Repeal and substitute definition of personal information with the Privacy Act 1988.
5 Clause 1 of Schedule 1 (definition of personal information)
Replace existing definition with new one.
50 Subsection 71(2) (note)
Omit a provision from the Privacy Act 1988
51 Subsection 76(2) (note)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.224
52 Paragraphs 140ZI(2)(a) and (b)
53 Subsection 140ZI(2)
Disclosure of personal information is authorized if certain conditions are met.
54 Subsection 336FD(1)
Authorizes disclosure of personal information
55 Subsection 503A(7)
Substitute Australian Privacy Principles in section 14 of the Privacy Act 1988 with principles authorized by this Act.
56 Subsection 409(4)
Australian Privacy Principles, to be authorised by this Act.
Replace existing information with new information.
Omit ‘Information Privacy Principles set out in section 14 of the Privacy Act 1988’.
Specify that principles are authorized by this Act.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.225
57 Subsection 43D(1)
58 Subsection 9BA(5)
59 Subsection 9BA(6)
6 Paragraphs 219GA(7)(a) and (b)
Authorization required for certain actions
Action cannot be taken without authorization
Definition of personal information substituted from Privacy Act 1988.
60 Subsection 9BA(7) (definition of personal information)
61 Subsection 135AB(3)
Substitute 'this Act' for the purposes of subparagraph 16B(1)(b)(i) of National Health Reform Act 2011
62 Subsection 135AC(1)
63 Subsection 127(3)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.226
Omit certain paragraph from Privacy Act 1988
64 Sections 19, 20, 47, 52, 85, 86, 87, 88 and 89 (notes)
65 Paragraphs 210(2)(a) and (b)
66 Subsection 210(2)
Omit certain principles in the Privacy Act 1988 and substitute others.
67 Subsection 57(3) (note)
68 Subsections 7A(1D) and 8(2D)
Omit section 14 of the Privacy Act 1988, substitute Australian Privacy Principles.
69 Subsection 128(1) (note)
Obligation to omit section 14 of the Privacy Act 1988.
Substitute 'authorised by this Act' for 'authorised by law'
7 Subsection 219GA(7)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.227
70 Subsection 207(7)
71 Paragraph 73(1)(b)
72 Subsection 250-10(2)
New obligation to be authorised by this Act
Replace an obligation with another obligation
Obligation to be authorised by law is replaced with Obligation to be authorised by this Act
Replace an obligation with another obligation using a linear logic rule
Repeal definition, substitute with Privacy Act 1988
73 Clause 1 of Schedule 1 (definition of personal information)
Omit paragraph (1)(d) of Information Privacy Principle 11 in section 14 of the Privacy Act 1988, substitute paragraph 6.2(b) of Australian Privacy Principle 6.
74 Subsection 60(1) (note 1)
75 Section 66AZD
76 Section 66AZD (note)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.228
Omit specific subclauses from National Privacy Principle 7
77 Subsection 137A(3)
Omit Subclause 7.1, substitute Australian Privacy Principle 9.
78 Subsection 137A(3) (note 1)
Substitute Australian Privacy Principles for section 14 of the Privacy Act 1988
79 Subsection 202(8) (note)
Imposes a duty on the legislative body to substitute
8 Section 219PA
80 Subsection 105(2)
81 Subsection 299LA(3)
82 Subsection 299LA(3) (note 1)
Substitute Australian Privacy Principles
83 Paragraph 12(3)(b)
Imposes a duty on the State to substitute Australian Privacy Principles
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.229
Replace National Privacy Principles with Australian Privacy Principles.
84 Subparagraph 117(1)(k)(i)
Imposes a duty to replace National Privacy Principles with Australian Privacy Principles.
85 Subparagraph 117(1)(k)(ii)
Substitute ‘the Privacy Act 1988 that relate to those principles’
Omit ‘that Act that relate to those Principles’
86 Subsection 118(1) (note)
87 Paragraph 118(4A)(a)
88 Paragraph 118(4A)(b)
89 Subsection 121(1A)
Substitute Australian Privacy Principle 6 for the purposes of paragraph 6.2(b) of the Act.
9 Subsection 35A(3)
90 Subsection 122(3)
91 Subsection 130(1) (note)
92 Paragraph 134(1)(a)
93 Paragraph 134(1)(b)
94 Section 303B (heading)
95 Subsections 303B(1) and (2)
Replace outdated privacy principles with Australian Privacy Principles.
96 Subclause 15(2) of Schedule 2
Repeal subparagraphs and substitute with Australian Privacy Principle 6.
97 Subparagraphs 147(2)(l)(i) and (ia)
Imposes an obligation to repeal subparagraphs.
98 Subsections 61(4B) and (5B)
Omit and substitute certain principles in the Privacy Act 1988
99 Subsection 143(1) (note 2)
Imposes an obligation on the legislative body to omit and substitute certain principles
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.7
1 Short title
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.244
Defines terms for Schedule 1 to this Act
1 Definitions
The day this Act receives the Royal Assent.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.249
Amendment applies in relation to representative complaints lodged after commencement time.
10 Application—amendment made by item 75 of Schedule 4
Conditional commencement of Schedule 5 items 157 to 161
Paragraph 41(1)(db) of the Privacy Act applies in relation to a request made after commencement time.
11 Application—paragraph 41(1)(db) of the Privacy Act
Temporal interval '15 months beginning on the day this Act receives the Royal Assent'
12 December
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.8
12 March 2014
12 Saving—public interest determinations
Defines a temporal interval for the determination's effect after commencement time.
(2) The determination has effect, after the commencement time, as if it had been made under that section, as amended by Schedule 4 to this Act.
Defines a duty for the Commissioner to vary the determination after commencement time.
(3) The Commissioner may, by legislative instrument, vary the determination after the commencement time to take account of the amendments of the Privacy Act made by this Act.
Defines a duty for the Commissioner to consult any person or entity when varying the determination.
(4) In deciding whether to vary the determination, the Commissioner may: (a) consult any person or entity; and (b) take into account any matter that the Commissioner considers relevant.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.256
Remains in force until 12 Dec 2012 (s 2(1) items 1, 10, 12, 16, 18)
12 Dec
Overlaps with commencement of Statute Law Revision Act (No. 1) 2015
The section remains in force until 12 Dec 2012
Implies that the section remains in force until 12 Dec 2012
Commencement information for Privacy Amendment (Enhancing Privacy Protection) Act 2012
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.250
Application of subsection 73(1A) of the Privacy Act after commencement time
13 Application—subsection 73(1A) of the Privacy Act
Applicability of Privacy Act provisions to decisions made after commencement time.
14 Application—review by the Administrative Appeals
The provisions apply during the commencement interval.
Applicability of Privacy Act provisions to decisions made during commencement interval.
Tribunal Paragraphs 96(1)(c), (e), (f) and (g) of the Privacy Act, as inserted by Schedule 4 to this Act, apply in relation to a decision made after the commencement time.
Applicability of Privacy Act provisions.
The provisions diffuse during the commencement interval.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.251
Saving—guidelines issued under other Acts
15 Saving—guidelines issued under other Acts
16 Section 16
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.252
Complaints about acts or practices made before commencement time can be dealt with under the Privacy Act after commencement.
16 Pre-commencement complaints
Temporal relation between commencement time and complaints.
(a) before the commencement time, a complaint about an act or practice was made to the Commissioner...
Obligation to investigate complaints before commencement time.
17 Section 17
Commissioner may continue investigation under Privacy Act after commencement time.
17 Pre-commencement own initiative investigations
18 Section 18
An act or practice done before commencement time may be an interference with individual privacy.
18 Pre-commencement acts and practices
Obligation to respect individual privacy.
Act or practice done before commencement time.
19 Section 19
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.253
Governor-General may make regulations dealing with transitional, application or saving nature relating to the amendments made by this Act.
19 Regulations may deal with transitional etc. matters
2 Commencement
Schedules 1 to The day after the end of the period of 15 months beginning on the day this Act receives the Royal Assent.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.245
Definition of court/tribunal order applies to existing orders
2 Application—court/tribunal orders
25 Feb
Schedule 5 items 1 to 155 commence on the day after the end of a 15-month period beginning from the Act's Royal Assent.
Each Act specified in a Schedule is amended or repealed according to its terms.
3 Schedule(s)
Guidelines issued under certain subsections of the Privacy Act have effect after commencement as if they had been issued or approved under those subsections, as amended.
3 Saving—guidelines relating to medical research etc.
Guidelines have effect after commencement.
a 15-month period beginning from the Act's Royal Assent.
Defines temporal interval for commencement
the day after the end of the period of 15 months beginning on the day this Act receives the Royal Assent.
Analyzes legislative provision for argument structure
Analyzes legislative provision for cognitive properties
Classifies legislative provision as an undertaking
Analyzes legislative provision for diffusion properties
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.246
Applicability of amendments to credit reporting
4 Application—credit reporting
The amendments apply to existing credit reports.
Amendments apply to existing credit reports
Schedule 2 amendments apply in relation to credit applied for, or provided, before or after the commencement time.
The definition of serious credit infringement applies to acts done before or after the commencement time.
Definition of serious credit infringement applies to acts done before or after the commencement time
The definition of serious credit infringement in subsection 6(1) of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to an act done before or after the commencement time.
The paragraph applies to activities done before or after the commencement time.
Paragraph 6N(k) of the Privacy Act applies to activities done before or after the commencement time
Paragraph 6N(k) of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to activities done before or after the commencement time.
The section applies to information requests made before or after the commencement time.
Section 6R of the Privacy Act applies to information requests made before or after the commencement time
Section 6R of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to an information request made before or after the commencement time.
The section applies to monthly payments due and payable on or after the day this Act receives the Royal Assent.
Section 6V of the Privacy Act applies to monthly payments due and payable on or after the day this Act receives the Royal Assent
Section 6V of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to a monthly payment that is due and payable on or after the day this Act receives the Royal Assent.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.247
Function or power may be performed or exercised during the transition period as if the Privacy Act was in force.
5 Privacy codes may be developed etc. during the transition
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.248
6 Application—section 13G of the Privacy Act
Guidelines have effect after commencement time as if they had been rules issued under section 17 of the Privacy Act.
7 Saving—guidelines relating to tax file number information
Guidelines have effect during the period after commencement time.
Guidelines have effect after commencement time.
Guidelines prepared under Privacy Act have effect after commencement time.
8 Saving—guidelines prepared and published under the
The Commissioner may continue an audit after the commencement time.
9 Audits by the Commissioner
The Commissioner has a duty to continue the audit.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.1
Includes amendments up to Act No. 5, 2015
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.2
Compilation information and notes on amendments.
12 March 2014 (the compilation date).
Compilation of Privacy Amendment (Enhancing Privacy Protection) Act 2012
6 March 2015
Privacy Amendment (Enhancing Privacy Protection) Act 2012