Privacy Amendment (Enhancing Privacy Protection) Act 2012
12 March 2014
Includes amendments up to Act No. 5, 2015
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.1
6 March 2015
Compilation of Privacy Amendment (Enhancing Privacy Protection) Act 2012
12 March 2014 (the compilation date).
Compilation information and notes on amendments.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.2
1 Short title
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.7
2 Commencement
1 Section 1
12 December
2 Section 2
Schedules 1 to The day after the end of the period of 15 months beginning on the day this Act receives the Royal Assent.
3 Section 3
Schedule 5 items 1 to 155 commence on the day after the end of a 15-month period beginning from the Act's Royal Assent.
Defines temporal interval for commencement
the day after the end of the period of 15 months beginning on the day this Act receives the Royal Assent.
a 15-month period beginning from the Act's Royal Assent.
Classifies legislative provision as an undertaking
Analyzes legislative provision for argument structure
Analyzes legislative provision for diffusion properties
Analyzes legislative provision for cognitive properties
10 Section 10
The day this Act receives the Royal Assent.
Requires a relation between identifiable temporal intervals
11 Section 11
Conditional commencement of Schedule 5 items 157 to 161
Temporal interval '15 months beginning on the day this Act receives the Royal Assent'
12 Section 12
13 Section 13
Commencement information for Privacy Amendment (Enhancing Privacy Protection) Act 2012
16 Section 16
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.8
17 Section 17
18 Section 18
19 Section 19
3 Schedule(s)
Each Act specified in a Schedule is amended or repealed according to its terms.
1 Section 3
Omit certain words from disclosure or transfer
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.9
2 Section 3 (note)
3 Section 5
4 Subsection 6(1) (paragraph (i) of the definition of agency)
5 Subsection 6(1)
APP complaint means a complaint about an act or practice...
6 Subsection 6(1)
7 Subsection 6(1)
8 Subsection 6(1)
9 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.10
10 Subsection 6(1)
Entity must collect personal information for inclusion in a record or generally available publication.
Entity must collect personal information.
11 Subsection 6(1)
12 Subsection 6(1)
Defines the scope of court/tribunal orders
Applies to explicit class/type/subclass hierarchies
13 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.11
14 Subsection 6(1)
De-identified personal information is obligation to be handled in a certain way.
15 Subsection 6(1) (definition of eligible case manager)
Repeal definition of eligible case manager
16 Subsection 6(1) (after paragraph (b) of the definition of
17 Subsection 6(1) (after paragraph (c) of the definition of
18 Subsection 6(1) (after paragraph (e) of the definition of
Establishment of a similar body for enforcement
Establishes an obligation to establish a similar body
19 Subsection 6(1) (after paragraph (l) of the definition of
Inserts the Corruption and Crime Commission of Western Australia as an enforcement body.
20 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.12
Includes various activities as enforcement-related
Subclassifies activities into enforcement-related
Insert: enforcement related activity means...
21 Subsection 6(1)
Classifies entities into agency, organisation, and small business operator
22 Subsection 6(1) (definition of generally available
Definition of generally available publication
Defines the term 'generally available publication'
Applies to publications that are generally available to members of the public
23 Subsection 6(1)
Defines government-related identifier of an individual
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.13
Identifier assigned by agency or authority during contract period
Contract period is relevant for identifier assignment
24 Subsection 6(1)
Entity holds personal information if it has possession or control of a record containing the information.
Temporal relation between entity and record
Entity has possession or control of a record at some point in time.
Entity holds personal information for that period
Entity's possession or control relation to the record
Entity has possession or control of a record containing the information.
25 Subsection 6(1)
identifier is a number, letter or symbol
or a combination of any or all of those things
but does not include the individual’s name
26 Subsection 6(1)
...the Minister administering the Migration Act 1958.
27 Subsection 6(1) (definition of Information Privacy
Repeal definition of Information Privacy Principle
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.14
28 Subsection 6(1) (definition of IPP complaint)
29 Subsection 6(1)
30 Subsection 6(1) (definition of National Privacy Principle)
Repeal the definition of National Privacy Principle
31 Subsection 6(1)
cultural, recreational, political, religious, philosophical, professional, trade or trade union purposes
32 Subsection 6(1) (definition of NPP complaint)
33 Subsection 6(1)
Definition of overseas recipient for personal information
34 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.15
35 Subsection 6(1)
36 Subsection 6(1) (definition of personal information)
Imposes a duty on the state to protect personal information
37 Subsection 6(1) (definition of record)
38 Subsection 6(1) (paragraphs (b) and (c) of the definition of
Repeal paragraphs (b) and (c) of the definition of record, substitute with an electronic or other device.
Prohibits the definition of record with paragraphs (b) and (c)
39 Subsection 6(1) (at the end of the definition of record)
40 Subsection 6(1)
41 Subsection 6(1) (subparagraph (a)(viii) of the definition of
Omit 'preferences', substitute 'orientation'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.16
42 Subsection 6(1) (at the end of the definition of sensitive
Add biometric information for automated verification or identification
Adds to the definition of sensitive information
43 Subsection 6(1) (definition of solicit)
44 Subsection 6(1)
Entity must solicit personal information from another entity.
Inserts solicitation of personal information.
45 Subsection 6(1) (definition of use)
46 Subsection 6(2)
47 Paragraph 6(7)(a)
48 Paragraph 6(7)(d)
49 Paragraph 6(7)(f)
50 Subsection 6(10)
Substitute 16 with 16 in subsection 6(10)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.17
51 Paragraph 6(10)(a)
52 After section 6
6AA Meaning of responsible person
6AA(1) Meaning of responsible person
Defines a responsible person for an individual.
(1) A responsible person for an individual is:
Temporal relationship between an individual and their guardian
(f) a person exercising an enduring power of attorney granted by the individual that is exercisable in relation to decisions about the individual’s health;
The individual's guardian has a temporal relationship with...
Relationship between being a responsible person and having an intimate personal relationship
(g) a person who has an intimate personal relationship with the individual;
Having an intimate personal relationship implies being a...
Relationship between an individual and their de facto partner
(c) a spouse or de facto partner of the individual;
The individual's de facto partner is a...
Relationship between an individual and their relative
(d) a relative of the individual if the relative is: (i) at least 18 years old; and (ii) a member of the individual’s household;
6AA(2) Meaning of responsible person
Defines a child for the purposes of subsection (1)
53 Section 6A (heading)
Repeal heading and substitute with new text.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.18
6A Breach of an Australian Privacy Principle
Breach of an Australian Privacy Principle
54 Subsection 6A(1) (heading)
55 Subsection 6A(1)
Substitute 'an Australian' for 'a National'
56 Subsection 6A(1)
Substitute 'principle' for 'National Privacy Principle'
57 Subsection 6A(2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.19
58 Paragraph 6A(2)(b)
Substitute 'principle' with 'the principle'
59 Subsections 6A(3) and (4)
60 Subparagraphs 6C(4)(b)(ii) and (iii)
61 Subsection 6EA(1)
62 Paragraph 6F(3)(b)
Omit specific phrase from disclosure and transfer clause.
63 Paragraph 7(1)(a)
64 Paragraph 7(1)(cb)
65 Paragraphs 7(1)(d) and (e)
66 Paragraphs 7(1)(ea) and (eb)
67 Subsection 7(2)
Substitute 'Australian' for 'Information Privacy Principles, the National'
68 Subsection 7B(1) (note)
Substitute section numbers in Schedule 1
Imposes a duty on the legislative body to make the substitution
69 Subsections 7B(1) and (2) (notes)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.20
Imposes a duty on the State to substitute 'Australian' for 'National'
70 Paragraph 8(2)(b)
71 Subsection 8(2)
Omit ‘of the record-keeper in relation to’
72 Section 9
73 Section 10 (heading)
10 Agencies that are taken to hold a record
74 Subsections 10(1) to (3)
75 Subsections 10(4) and (5)
Prohibits agency from holding certain role
76 Section 12
77 Subsection 13B(1) (note)
78 Subsection 13B(1) (note)
79 Subsection 13B(1A) (note)
80 Subsection 13C(1) (note)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.21
81 Subsection 13C(1) (note)
82 Divisions 2 and 3 of Part III
14 Australian Privacy Principles
14(1) Australian Privacy Principles
References to the Australian Privacy Principles in Schedule 1.
14(2) Australian Privacy Principles
Reference to Australian Privacy Principle with a specific number is an obligation.
15 APP entities must comply with Australian Privacy Principles
Must not breach Australian Privacy Principle
16 Personal, family or household affairs
Exemptions from Australian Privacy Principles for personal, family or household affairs
Nothing in the Australian Privacy Principles applies to...
...for the purposes of, or in connection with, his or her personal,...
for the purposes of, or in connection with...
...his or her personal, family or household affairs.
16A Permitted general situations in relation to the collection, use or
16A(1) Permitted general situations in relation to the collection, use or
Permitted general situations for collection, use or disclosure of personal information
the entity is an entity of a kind specified in an item in column 1 of the table
the information or identifier falls within the permitted general situation
16A(2) Permitted general situations in relation to the collection, use or
Commissioner may make rules relating to collection, use or disclosure of personal information.
16B Permitted health situations in relation to the collection, use or
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.24
16B(1) Permitted health situations in relation to the collection, use or
Permitted health situations for collection of health information
Allows the collection of health information under certain conditions
(1) A permitted health situation exists in relation to the collection by an organisation of health information about an individual...
Describes the temporal relationship between the collection and the provision of a health service
Describes the temporal relationship between the collection and the expiration of a permit
Describes the mechanism by which health information is disseminated
Describes the role of artificial intelligence in the collection and analysis of health information
16B(2) Permitted health situations in relation to the collection, use or
(2) A permitted health situation exists...
16B(3) Permitted health situations in relation to the collection, use or
Permitted health situations for use or disclosure of health information
(a) the use or disclosure is necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety;
(b) it is impracticable for the organisation to obtain the individual’s consent to the use or disclosure;
(c) the use or disclosure is conducted in accordance with guidelines approved under section 95A for the purposes of this paragraph;
Reasonable belief about recipient’s actions
(d) in the case of disclosure—the organisation reasonably believes that the recipient of the information will not disclose the information, or personal information derived from that information.
16B(4) Permitted health situations in relation to the collection, use or
Permitted health situations for the use or disclosure of genetic information.
Temporal interval for the use or disclosure of genetic information
The use or disclosure of genetic information is permitted if it occurs within a certain time frame.
The use or disclosure of genetic information must occur before a certain date.
16B(5) Permitted health situations in relation to the collection, use or
Permitted health situations for disclosure of health information
Defines conditions under which disclosure is permitted
(5) A permitted health situation exists in relation to the disclosure by an organisation of health information about an individual if...
the disclosure is permitted if the conditions are met
(f) the disclosure is limited to the extent reasonable and necessary for a purpose mentioned in paragraph (d)
the disclosure must be limited to what is reasonable and necessary
Defines exceptions to permitted disclosure
(e) the disclosure is not contrary to any wish expressed by the individual before the individual became unable to give or communicate consent
the disclosure must not contradict the individual's wishes
(e) of which the carer is aware, or of which the carer could reasonably be expected to be aware
the disclosure must not contradict wishes known to the carer
16C Acts and practices of overseas recipients of personal
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.26
16C(1) Acts and practices of overseas recipients of personal
Disclosing personal information to an overseas recipient is prohibited if certain conditions are met.
(a) an APP entity discloses personal information about an individual to an overseas recipient;
16C(2) Acts and practices of overseas recipients of personal
The act done by the overseas recipient is taken to be a breach of Australian Privacy Principles.
The act is taken to be a breach of Australian Privacy Principles.
(2) The act done, or the practice engaged in, by the overseas recipient is taken, for the purposes of this Act:
The act is a breach of Australian Privacy Principles.
(2) The act done, or the practice engaged in, by the overseas recipient is taken, for the purposes of this Act: (a) to have been done, or engaged in, by the APP entity; and (b) to be a breach of those Australian Privacy Principles by the APP entity.
The act is taken to be done or engaged in by the APP entity.
83 Section 37 (table items 6 and 7)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.27
84 Subsections 54(2) and 57(2) (definition of agency)
85 Paragraph 80H(2)(e)
Omit specific term and substitute another.
86 Subparagraph 80P(1)(c)(v)
Replace 'individual' with 'responsible person for the individual'
87 Paragraph 80Q(1)(c)
Substitute 'a responsible person for the individual'
88 Subsection 95(1)
89 Subsections 95(2) and (4)
Substitute 'Australian' for 'Information'
90 Section 95A (heading)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.28
95A Guidelines for Australian Privacy Principles about health
Guidelines for Australian Privacy Principles about health
91 Subsection 95A(1)
Substitute Australian Privacy Principles for National Privacy Principles.
92 Subsection 95A(2)
Substitute paragraph 16B(3)(c) for omitted text.
93 Subsection 95A(3)
Substitute Australian Privacy Principles (disregarding subsection 16B(3))
94 Subsection 95A(4)
Substitute paragraph 16B(2)(d)(iii) for paragraph 10.3(d)(iii)
95 Subsection 95A(5)
Substitute Australian Privacy Principles (disregarding subsection 16B(2))
96 Section 95AA (heading)
95AA Guidelines for Australian Privacy Principles about genetic
Guidelines for Australian Privacy Principles about genetic information
97 Subsection 95AA(1)
98 Subsection 95AA(2)
Omit specific paragraph and substitute another.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.29
99 Subsection 95AA(2)
Omit “(whether or not the threat is imminent)”.
100 Subsection 95B(1)
101 Section 95C
102 Subsections 100(2) to (4)
102(2) Subsections 100(2) to (4)
The Minister must be satisfied that the principal executive has agreed to the adoption, use or disclosure of the identifier.
the relevant agency or State or Territory authority has a principal executive
102(3) Subsections 100(2) to (4)
Consultation required before making regulations for certain purposes.
Subsection (2) does not apply to the making of regulations for the purposes of Australian Privacy Principle 9.3 that relate to...
the identifier is a kind commonly used in the processing of pay, or deductions from pay, of Commonwealth officers, or a class of Commonwealth officers;
the circumstances of the use or disclosure of the identifier relate to the provision by...
before the regulations are made, the Minister consults the Commissioner about the proposed regulations;
103 Part X
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.30
104 Schedules 1 and 3
Repeal of Schedules and substitution with new Schedule
Classifies the legislative provision as a descriptive clause
1 Australian Privacy Principle 1—open and transparent
Management of personal information is an obligation.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.32
Obligation to manage personal information
Ensure open and transparent management of personal information
Duty to comply with Australian Privacy Principles
Must implement practices, procedures and systems to comply with Australian Privacy Principles.
Obligation to implement practices, procedures and systems.
APP entity must take such steps as are reasonable in the circumstances.
to comply with Australian Privacy Principles.
Entity must have a clearly expressed and up-to-date policy about personal information management.
Entity must have a clearly expressed and up-to-date policy.
Entity must provide specific information in its APP privacy policy.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.33
Entity must provide specific information.
An APP entity must make its APP privacy policy available.
Must provide a copy of the APP privacy policy in a particular form upon request.
2 Australian Privacy Principle 2—anonymity and pseudonymity
Australian Privacy Principle 2—anonymity and pseudonymity
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.34
Must provide option to not identify themselves or use pseudonym when dealing with APP entity.
Exemption from Subclause 2.1 for APP entities dealing with individuals who have identified themselves or used a pseudonym.
3 Australian Privacy Principle 3—collection of solicited personal
Collection of solicited personal information is an obligation.
Obligation to collect solicited personal information.
No personal information can be collected unless necessary for functions or activities.
No personal information can be collected.
Organisations must not collect personal information unless necessary for their functions.
Prohibition on collecting personal information
Entity must not collect personal information
An APP entity must not collect sensitive information about an individual unless certain conditions are met.
Prohibition of collecting sensitive information
APP entity must not collect sensitive information
Sensitive information about an individual can be collected under certain circumstances.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.35
Collection is necessary for certain purposes.
Sensitive information relates to specific situations.
Sensitive information is related to permitted health situations.
Collection overlaps with enforcement-related activities.
Must collect personal information only by lawful and fair means.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.36
Obligation to collect personal information
Class hierarchy: Obligations -> APP entity obligations
Must collect personal information from individual unless certain conditions apply.
This principle applies to the collection of personal information solicited by an APP entity.
Obligation to protect personal information
The APP entity is responsible for protecting personal information
The APP entity must comply with this principle
4 Australian Privacy Principle 4—dealing with unsolicited personal
Dealing with unsolicited personal information
4 Section 4
Determine whether the entity could have collected information under Australian Privacy Principle 3 if solicited.
Reasonable period after receiving personal information
Use or disclose personal information for making determination under subclause 4.1.
Destroy personal information if it cannot be collected or is not in a Commonwealth record.
Mandatory destruction of personal information.
Applying Australian Privacy Principles if subclause 4.3 does not apply
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.37
Temporal relation between collection and application of principles
Application of principles occurs under this relation
5 Australian Privacy Principle 5—notification of the collection of
Notification of collection of personal information
5 Section 5
Notify individual of personal information collected
The APP entity must provide certain information to the individual about their personal data collection and use.
The APP entity must provide certain information.
6 Australian Privacy Principle 6—use or disclosure of personal
Use or disclosure of personal information is an obligation.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.38
6 Section 6
Must not use or disclose personal information for a secondary purpose without consent.
Prohibits use or disclosure of personal information for a secondary purpose.
Use or disclose personal information for secondary purpose if individual expects it, or required by law or court order.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.39
Duty to use or disclose personal information for secondary purpose
individual would reasonably expect the APP entity to use or disclose the information
use or disclose personal information for secondary purpose
Use or disclosure of information overlaps with enforcement related activities
the APP entity reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.
Duty to use or disclose personal information for secondary purpose if individual expects it
the individual would reasonably expect the APP entity to use or disclose the information
Duty to use or disclose personal information for secondary purpose if required by law or court order
the use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order;
Disclosure of personal information about an individual by an APP entity is subject to certain conditions.
Obligation on APP entities to disclose personal information
Entity must de-identify personal information before disclosure.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.40
Duty to de-identify personal information.
Entity must take steps to ensure de-identification.
Temporal interval: APP entity's collection of personal information.
Entity must take steps to ensure de-identification before disclosure.
De-identification requirement implies duty to disclose de-identified information.
Diffusion of personal information requires de-identification.
COGAI's knowledge graph includes de-identification requirement for APP entities.
Must make a written note of use or disclosure if in accordance with paragraph 6.2(e)
If an APP entity is a body corporate and collects personal information from a related body corporate, the principle applies.
Exemptions from data protection for direct marketing and government-related identifiers.
Personal information for direct marketing
7 Australian Privacy Principle 7—direct marketing
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.41
7 Section 7
Organisation must not use or disclose personal information for direct marketing.
Prohibition of using or disclosing personal information for direct marketing.
Organisation may use or disclose personal information for direct marketing under certain conditions.
Permission to use or disclose personal information for direct marketing
Use of personal information for direct marketing under certain conditions.
Permission granted under certain conditions.
the organisation collected the information from: (i) the individual and the individual would not reasonably expect the organisation to use or disclose the information for that purpose; or (ii) someone other than the individual
Use of personal information for direct marketing is permitted under these conditions.
Classification of individuals into sensitive and non-sensitive categories.
The individual is classified as non-sensitive if they did not provide consent.
Temporal interval within which direct marketing is permitted.
either: (i) the individual has consented to the use or disclosure of the information for that purpose; or (ii) it is impracticable to obtain that consent
Direct marketing is permitted within this temporal interval.
Temporal interval until which direct marketing is not permitted.
the organisation provides a simple means by which the individual may easily request not to receive direct marketing communications from the organisation
Direct marketing is not permitted after this temporal interval.
Requirements for obtaining consent before using personal information.
the individual has not made such a request to the organisation
Consent is required from the individual before using their personal information.
Characterization of direct marketing communications.
in each direct marketing communication with the individual: (i) the organisation includes a prominent statement that the individual may make such a request; or (ii) the organisation otherwise draws the individual’s attention to the fact that the individual may make such a request
Direct marketing communications must include a prominent statement about requesting opt-out.
Use of sensitive information for direct marketing with consent.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.42
Permission to use sensitive information.
Organisation is a contracted service provider
Individual has right to request not to receive direct marketing communications.
The individual may request not to receive direct marketing communications.
Organisation must not charge individual for making request and give effect to it within a reasonable period.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.43
Organisation must not charge individual.
Organisation must give effect to request within a reasonable period.
Organisation must notify individual of source unless impracticable or unreasonable.
Temporal interval during which exemptions apply
The exemptions apply during the period in which the Do Not Call Register Act 2006 and the Spam Act 2003 are in force.
8 Australian Privacy Principle 8—cross-border disclosure of
Australian Privacy Principle 8—cross-border disclosure of personal information
8 Section 8
Entity must ensure overseas recipient does not breach Australian Privacy Principles.
Entity has an obligation to ensure overseas recipient does not breach Australian Privacy Principles.
Disclosure of personal information is permitted under certain conditions.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.44
Permission granted under specified conditions.
the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting the information
there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme
9 Australian Privacy Principle 9—adoption, use or disclosure of
Adoption of government related identifiers is an obligation.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.45
Obligation to adopt government related identifiers.
9 Section 9
Organisation must not adopt government related identifier of individual unless required or authorised by law.
Organisation must not use or disclose government-related identifier unless certain conditions are met.
Organisation is prohibited from using or disclosing government-related identifier.
Organisations must adopt, use or disclose government-related identifiers of individuals if prescribed by regulations.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.46
Organisations must adopt, use or disclose government-related identifiers of individuals.
The regulations prescribe the adoption, use or disclosure.
Organisations are obliged to adopt, use or disclose government-related identifiers of individuals.
The regulation is a prerequisite for the adoption, use or disclosure.
The adoption, use or disclosure must occur in the circumstances prescribed by the regulations.
The organisation is prescribed by the regulations.
The adoption, use or disclosure occurs in the circumstances prescribed by the regulations.
Organisations are included in a class of organisations prescribed by the regulations.
The identifier is prescribed by the regulations.
10 Australian Privacy Principle 10—quality of personal information
Ensure personal information is accurate, up-to-date and complete.
Ensure personal information is accurate, up-to-date, complete and relevant.
Duty to ensure accuracy of personal information
11 Australian Privacy Principle 11—security of personal
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.47
Must provide security for personal information
Protect personal information from misuse, interference, loss, unauthorized access, modification or disclosure.
Destroy personal information if no longer needed
The entity must take such steps as are reasonable in the circumstances
Destroy the information or de-identify it
12 Australian Privacy Principle 12—access to personal information
Entity must provide access to personal information on request.
Entity may refuse access to personal information under certain conditions.
Prohibits entity from giving access to personal information.
Entity is required or authorised to refuse to give access.
Entity may refuse access to personal information.
Entity's refusal overlaps with the entity's authority to refuse access.
Entity is required or authorised to refuse access.
Entity's refusal overlaps with its authority.
Entity's refusal is a recurring trace of its authority.
Entity's refusal diffuses to the individual's personal information.
Entity refuses access to personal information.
Personal information is diffused from entity's refusal.
CogAI recognises the entity's refusal as a legitimate reason for not providing access.
Entity is an agency or required/authorised to refuse access.
Entity not required to give individual access under certain conditions.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.48
Entity is prohibited from giving access under certain conditions.
Respond to request for access to personal information within a specified timeframe.
Access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.49
Entity must provide access in a way that meets the needs of the entity and the individual if refused.
Entity has an obligation to provide access.
Access may be given through a mutually agreed intermediary.
No charging for request or access to personal information
Entity must not charge excessive fee for access to personal information.
Entity must provide written notice to individual if access to personal information is refused
written notice with reasons for refusal, mechanisms for complaint, and other prescribed matters
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.50
Entity has a duty to provide written notice
Must provide explanation for refusal of access to personal information
13 Australian Privacy Principle 13—correction of personal
Correct inaccurate or incomplete personal information upon request.
Obligation to correct personal information
Entity must notify other APP entity of correction upon request.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.51
Entity must take steps to give notification.
Entity must provide written notice to individual upon refusal to correct personal information.
Entity must correct inaccurate personal information upon request.
Correcting inaccurate personal information
Entity must correct inaccurate personal information.
Must respond to request within specified timeframe and not charge individual for making the request.
1 Before section 6
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.53
2 Subsection 6(1)
3 Subsection 6(1)
4 Subsection 6(1)
Bankruptcy Act means the Bankruptcy Act 1966.
Bankruptcy Act is defined as the 1966 Act.
7 Subsection 6(1) (definition of commercial credit)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.54
Defines 'commercial credit related purpose' for a credit provider.
Defines the meaning of 'commercial credit related purpose'
Classifies the definition into a logical hierarchy
Consumer credit liability information must be provided by a credit provider.
Must provide consumer credit liability information.
Classifies consumer credit as a type of consumer credit.
Assessing an application for consumer credit and collecting overdue payments are obligations of a credit provider.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.55
The text explicitly states obligations of a credit provider.
The excerpt describes a subclass of 'purpose' related to consumer credit.
Must provide court proceedings information about an individual's judgement in Australian courts.
Inserts court proceedings information into the definition of 'court proceedings information'
Definition of CP derived information about an individual
CP derived information is a subclass of personal information
CP derived information is a specific type of personal information
Temporal relation between credit reporting and CP derivation
Credit reporting occurs before CP derivation
CP derivation occurs during the period of credit reporting
Defines CRB derived information about an individual.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.56
Imposes a duty on credit reporting bodies.
Defines the scope of CRB derived information.
15 Subsection 6(1) (definition of credit)
16 Subsection 6(1) (definition of credit card)
17 Subsection 6(1)
Credit reporting information about an individual means credit reporting information disclosed to a credit provider by a credit reporting body under Division 2 of Part IIIA or CP derived information about the individual.
Class hierarchy for credit eligibility information
Temporal interval for credit reporting information disclosure
18 Subsection 6(1) (definition of credit enhancement)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.57
19 Subsection 6(1) (paragraphs (a) and (b) of the definition of
Omit 'the loan', substitute 'the credit'
Definition of credit guarantee purpose for an individual
22 Subsection 6(1) (definition of credit information file)
Repeal definition of credit information file
23 Subsection 6(1) (definition of credit provider)
Substitute sections 6G to 6K for section 11B.
24 Subsection 6(1) (definition of credit report)
25 Subsection 6(1) (definition of credit reporting agency)
Repeal definition of credit reporting agency
credit reporting body means an organisation or agency prescribed by the regulations
an organisation or agency that carries on a credit reporting business
Temporal interval for credit reporting business
that carries on a credit reporting business
a period of time during which the organisation or agency provides credit reporting services
an organisation or agency prescribed by the regulations
27 Subsection 6(1) (definition of credit reporting business)
Repeal and redefine credit reporting business definition.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.58
Existing credit reporting business definition
28 Subsection 6(1)
Defines credit reporting information about an individual.
credit reporting information about an individual is credit information or CRB derived information.
Establishes a class hierarchy for credit reporting information.
30 Subsection 6(1) (definition of current credit provider)
Repeal definition of current credit provider
Default information has the meaning given by section 6Q
32 Subsection 6(1) (definition of eligible communications
Repeal definition of eligible communications service
33 Subsection 6(1) (definition of guarantee)
Definition of guarantee includes indemnity against default in payment.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.59
Guarantee definition implies obligation.
Identification information about an individual must be provided.
Must provide identification information.
Classification of individual's identity information.
36 Subsection 6(1)
Defines 'interested party' for subsections 20T(3) and 21V(3)
Establishes an obligation to use the defined term correctly
37 Subsection 6(1)
38 Subsection 6(1) (definition of loan)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.60
39 Subsection 6(1)
Managing credit does not include collecting overdue payments.
40 Subsection 6(1) (definition of mortgage credit)
Defines mortgage credit as consumer credit related to real property acquisition, maintenance, renovation or improvement.
Substitutes a new definition for an existing one.
41 Subsection 6(1)
Assess risk of providing insurance to credit provider or individual
42 Subsection 6(1) (definition of mortgage insurer)
43 Subsection 6(1)
Defines National Personal Insolvency Index
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.61
45 Subsection 6(1)
46 Subsection 6(1)
47 Subsection 6(1)
Request for credit information or CRB derived information must be made to a credit reporting body and not given notice under subsection 21W(2) or (3).
Obligation to make a request for credit information or CRB derived information.
Request for credit information or CRB derived information is a specific type of request.
48 Subsection 6(1)
Definition of 'pending dispute in relation to credit information or CRB derived information'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.62
49 Subsection 6(1)
50 Subsection 6(1)
51 Subsection 6(1)
52 Subsection 6(1)
Definition of personal insolvency information
Section 6U defines personal insolvency information
Personal insolvency information has the meaning given by section 6U
53 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.63
54 Subsection 6(1)
Defines a subclass relationship for 'purchase'
55 Subsection 6(1)
Defines regulated information for affected recipients.
56 Subsection 6(1)
Definition of repayment history information
57 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.64
National Consumer Credit Protection Act 2009
58 Subsection 6(1)
Defines who is the respondent for a complaint under section 23A.
59 Subsection 6(1)
60 Subsection 6(1) (subparagraphs (a)(i) and (ii) of the
Repeal and substitute subparagraphs with new definitions.
61 Subsection 6(1) (paragraph (b) of the definition of
62 Subsection 6(1)
Assessing risk in purchasing credit or undertaking credit enhancement
Assessing risk in purchasing credit or undertaking credit enhancement is an obligation.
The text classifies the purpose of a credit provider as assessing risk in purchasing credit or undertaking credit enhancement.
63 Subsection 6(1) (definition of serious credit infringement)
Definition of serious credit infringement
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.65
Defines the term "serious credit infringement"
Subclassifies serious credit infringement as a type of obligation
64 Subsection 6(1)
Duty to assess risk of default on commercial credit
65 Subsection 6(1) (definition of trade insurer)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.66
Substitutes a new definition for trade insurer
66 Subsections 6(5A) to (5D)
67 Subsection 6(10)
Substitute 'consumer credit' for 'credit'
Imposes a duty on the state to substitute 'consumer credit' for 'credit'
68 At the end of subsection 6D(4)
69 After section 6F
6G Meaning of credit provider
6G(1) Meaning of credit provider
6G(2) Meaning of credit provider
Supplier is a credit provider if it provides credit in connection with the sale of goods or services and repayment is deferred for at least 7 days.
6G(3) Meaning of credit provider
Lessor is a credit provider if conditions are met.
The lessor provides credit in connection with the hiring, leasing or renting of goods.
Credit must be in force for at least 7 days.
(3) If an organisation or small business operator (the lessor) carries on a business or undertaking...
The credit must be in force for at least 7 days.
No amount, or an amount less than the value of the goods, is paid as a deposit.
Lessor is not a credit provider under subsection (1).
The lessor is not a credit provider under subsection (1).
6G(4) Meaning of credit provider
(4) An organisation or small business operator is a credit provider if subsection 6H(1), 6J(1) or 6K(1) provides that the organisation or operator is a credit provider.
An organisation or small business operator is a credit provider
6G(5) Meaning of credit provider
An organisation or small business operator is not a credit provider while acting in certain capacities.
The organisation or small business operator is a credit provider.
6G(6) Meaning of credit provider
An organisation or small business operator is not a credit provider if it is included in a class of organisations or operators prescribed by the regulations.
6H Agents of credit providers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.68
6H(1) Agents of credit providers
An agent acting on behalf of a principal is considered a credit provider.
(1) If an organisation or small business operator (the agent) is acting as an agent of a credit provider...
...then, while the agent is so acting, the agent is a credit provider.
Agent's action implies being a credit provider
Agent's action occurs during principal's task
Agent's action is not independent of principal's task
Agent's action and being a credit provider are related
6H(2) Agents of credit providers
6H(3) Agents of credit providers
Credit provider must provide credit with agent's involvement.
Obligation to provide credit with agent's involvement.
6H(4) Agents of credit providers
Application to principal is taken as made to both principal and agent for purposes of this Act.
Application to principal is taken as made to both principal and agent.
6J Securitisation arrangements etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.69
6J(1) Securitisation arrangements etc.
Securitisation entity is a credit provider while performing certain tasks.
(securitisation entity is a credit provider)
Task is reasonably necessary for purchasing or managing credit
(task is for purchasing or managing credit)
6J(2) Securitisation arrangements etc.
Exemption for small business operators from subsection (1)
Original credit provider is an organisation or small business operator
6J(3) Securitisation arrangements etc.
Credit is taken to have been provided by both original credit provider and securitisation entity.
6J(4) Securitisation arrangements etc.
Application to credit provider is taken as application to securitisation entity.
6K Acquisition of the rights of a credit provider
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.70
6K(1) Acquisition of the rights of a credit provider
Acquirer becomes a credit provider in relation to the credit.
(acquirer acquires rights of original credit provider)
(acquirer is a credit provider in relation to the credit)
Acquirer becomes a credit provider during the assignment/subrogation
Acquirer's assignment/subrogation implies it becomes a credit provider
Acquirer's assignment/subrogation diffuses its rights as a credit provider
Acquirer asserts its status as a credit provider
6K(2) Acquisition of the rights of a credit provider
Credit is taken to have been provided by the acquirer for the purposes of this Act.
Credit is taken to have been provided by the acquirer.
6K(3) Acquisition of the rights of a credit provider
Application to original credit provider is taken as made to acquirer.
Application to acquirer is taken as made to original credit provider
6L Meaning of access seeker
6L(1) Meaning of access seeker
Defines an access seeker for credit reporting information and eligibility information.
Identifies the subject of an obligation.
(1) An access seeker in relation to credit reporting information, or credit eligibility information, about an individual is:
the individual; or a person who is assisting the individual to deal with a credit reporting body or credit provider
Describes the temporal relationship between the individual and the person assisting them.
(i) who is assisting the individual to deal with a credit reporting body or credit provider
the individual during the time they are being assisted
Describes the relationship between the individual and the person assisting them.
the individual is assisted by the person during the time they are being assisted
6L(2) Meaning of access seeker
An individual must not authorise a person under subsection (1)(b)(ii) if the person is a credit provider, mortgage insurer, trade insurer, or prevented from being a credit provider by subsection 6G(5) or (6).
6L(3) Meaning of access seeker
Exempts certain persons from the application of a rule.
(3) Subparagraph (1)(b)(ii) does not apply to a person who provides the National Relay Service or a person prescribed by the regulations.
Defines a temporal interval during which the exemption applies.
Defines a recurring pattern of exemption.
Spreads the exemption to related persons.
Identifies the exemption as a rule of law.
6M Meaning of credit and amount of credit
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.71
6M(1) Meaning of credit and amount of credit
Definition of credit and amount of credit
6M(2) Meaning of credit and amount of credit
Defines the amount of credit as the deferred debt, excluding fees and charges.
6M(3) Meaning of credit and amount of credit
6N Meaning of credit information
Defines personal information about an individual for credit reporting purposes.
States what constitutes personal information.
Defines a class hierarchy for credit reporting information.
6P Meaning of credit reporting business
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.72
6P(1) Meaning of credit reporting business
6P(2) Meaning of credit reporting business
Information about credit worthiness must be provided for assessing consumer credit applications.
Must provide information about credit worthiness.
6P(3) Meaning of credit reporting business
Disregard provision of information about credit worthiness to a related body corporate.
6P(4) Meaning of credit reporting business
Business or undertaking not a credit reporting business if included in prescribed class
Business or undertaking included in prescribed class
6Q Meaning of default information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.73
6Q(1) Meaning of default information
Default information about an individual is required to be provided by a credit provider.
The provision requires the credit provider to provide default information.
6Q(2) Meaning of default information
The provision requires a specific action.
6R Meaning of information request
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.74
6R(1) Meaning of information request
Credit provider must provide information about individual upon request.
6R(2) Meaning of information request
Mortgage insurer must provide information to an individual upon request.
6R(3) Meaning of information request
Trade insurer must provide information to an individual upon request.
6S Meaning of new arrangement information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.75
6S(1) Meaning of new arrangement information
Credit provider must disclose new arrangement information about an individual when certain conditions are met.
Obligation to disclose new arrangement information
Credit provider has disclosed default information about an individual to a credit reporting body
new arrangement information must be provided
New arrangement information must be disclosed when individual is overdue in making payment for original consumer credit
individual is overdue in making payment for original consumer credit
Credit provider must provide new arrangement information about an individual when certain conditions are met
individual has been provided with new consumer credit
new arrangement information must be provided about an individual
6S(2) Meaning of new arrangement information
Credit provider must disclose opinion to credit reporting body if serious credit infringement suspected.
Disclosure of opinion to credit reporting body
Credit provider believes individual has committed serious credit infringement
(a) a credit provider is of the opinion that an individual has committed a serious credit infringement in relation to consumer credit (the original consumer credit) provided by the provider to the individual;
Recurring variation of terms or conditions of original consumer credit
(ii) the terms or conditions of the original consumer credit that relate to the repayment of the amount of credit are varied;
Variation in terms or conditions implies new arrangement information
Temporal interval for variation in terms or conditions contains temporal interval for new arrangement information
(ii) the individual is provided with other consumer credit (the new consumer credit) by a credit provider that relates, wholly or in part, to that amount of credit;
6T Meaning of payment information
Payment information is a statement that the amount of overdue payment has been paid.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.76
(a) a credit provider has disclosed default information about an individual to a credit reporting body; and (b) on a day after the default information was disclosed, the amount of the overdue payment to which the information relates is paid;
payment information about the individual is a statement that the amount of the overdue payment has been paid on that day.
6U Meaning of personal insolvency information
6U(1) Meaning of personal insolvency information
Personal insolvency information about an individual is defined as certain types of data.
6U(2) Meaning of personal insolvency information
Personal insolvency information cannot relate to a creditor's petition or administration under Part XI of the Bankruptcy Act.
Prohibits personal insolvency information from relating to certain matters.
personal insolvency information must not relate to:
Restricts personal insolvency information to a specific time period.
personal insolvency information about an individual must not relate to:
Restricts personal insolvency information from relating to certain matters.
6U(3) Meaning of personal insolvency information
Definition of expression used in Bankruptcy Act
(3) An expression used in paragraph (1)(b) or (2)(a)
has the same meaning as it has in that Act
6V Meaning of repayment history information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.77
6V(1) Meaning of repayment history information
Repayment history information must include whether the individual has met an obligation to make a monthly payment.
The individual has met an obligation to make a monthly payment.
(a) whether or not the individual has met an obligation to make a monthly payment that is due and payable in relation to the consumer credit;
The individual does not have met an obligation to make a monthly payment.
The monthly payment is due on a specific day.
(b) the day on which the monthly payment is due and payable;
the monthly payment is due during a specific time interval
The individual makes the monthly payment after the due date.
(c) if the individual makes the monthly payment after the day on which the payment is due and payable—the day on which the individual makes that payment;
the individual makes the monthly payment every time it is due
The credit provider must provide repayment history information.
(1) If a credit provider provides consumer credit to an individual, the following information about the consumer credit is repayment history information about the individual:
6V(2) Meaning of repayment history information
Defines what constitutes a monthly payment in relation to consumer credit.
Determines the existence of an obligation.
(2) The regulations may make provision in relation to:
whether or not an individual has met an obligation to make a monthly payment that is due and payable in relation to consumer credit.
Establishes the temporal scope of the regulation's application.
Applies the regulation to all relevant situations.
Applies the regulation to all relevant entities.
Applies the regulation to all relevant data.
70 Paragraphs 7(1)(a) and 8(1)(a)
Omit 'credit reporting agency' and substitute 'credit reporting body'.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.78
Prohibits the use of 'credit reporting agency'
71 Sections 11A and 11B
72 Part IIIA
Repeal Part and substitute with new provision.
19 Guide to this Part
Rules for credit reporting bodies and providers regarding handling of information.
Obligation to handle information correctly.
This Part deals with the privacy of information relating to credit reporting.
Division 7 provides for compensation orders, and other orders, to be made by the Federal Court or Federal Magistrates Court.
Rule for handling information regarding credit reporting.
In general, this Part deals with the privacy of information relating to credit reporting.
Diffusion of obligations to handle information correctly.
Cognitive process for handling information regarding credit reporting.
20 Guide to this Division
Rules for credit reporting bodies regarding handling of specific information and assessments.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.79
Applies to the handling of specific information and assessments.
20A Application of this Division and the Australian Privacy
20A(1) Application of this Division and the Australian Privacy
This Division applies to a credit reporting body in relation to the specified types of information.
The Division applies to a credit reporting body.
...in relation to the specified types of information.
20A(2) Application of this Division and the Australian Privacy
Exemptions from Australian Privacy Principles for credit reporting bodies
20B Open and transparent management of credit reporting
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.80
20B(1) Open and transparent management of credit reporting
Ensure open and transparent management of credit reporting
Obligation to ensure open and transparent management
20B(2) Open and transparent management of credit reporting
Must implement practices, procedures and systems to comply with Division and registered CR code.
20B(3) Open and transparent management of credit reporting
Credit reporting bodies must have a clearly expressed and up-to-date policy about the management of credit reporting information.
Must have a clearly expressed and up-to-date policy.
20B(4) Open and transparent management of credit reporting
The credit reporting body must provide certain information to individuals.
The credit reporting body must provide certain information.
20B(5) Open and transparent management of credit reporting
Credit reporting bodies must make the policy available free of charge and in an appropriate form.
20B(6) Open and transparent management of credit reporting
Credit reporting body must provide a copy of its policy in a requested form.
20C Collection of solicited credit information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.81
20C(1) Collection of solicited credit information
Cannot collect credit information about an individual
Prohibition of collecting credit information
20C(2) Collection of solicited credit information
Exemption from subsection (1) for collection of credit information under Australian law or court order.
20C(3) Collection of solicited credit information
Exemption from subsection (1) for credit reporting bodies collecting information from a permitted provider or in the course of carrying on a business.
20C(4) Collection of solicited credit information
Exemption from subsection (1) for certain credit reporting bodies
Temporal relationship between credit reporting and consumer credit
if the information relates to consumer credit or commercial credit—the credit is or has been provided, or applied for, in Australia;
The credit reporting must occur after the individual's 18th birthday
if the information is repayment history information about the individual—the body collects the information from another credit reporting body that has an Australian link;
The credit reporting must occur regularly
the credit reporting body collects the credit information about the individual from an entity (other than a credit provider)
The credit reporting body has a duty to collect the credit information
Permission to collect credit information
The credit reporting body is permitted to collect the credit information from an entity (other than a credit provider) if the individual has reached the age of majority
20C(5) Collection of solicited credit information
Exempts identification information about the individual from Paragraph (4)(b) of Schedule 2.
Exempts identification information from a duty.
(5) Paragraph (4)(b) does not apply to identification information about the individual.
20C(6) Collection of solicited credit information
Consumer credit liability information can relate to credit entered before turning 18.
Relates to consumer credit liability information
Classifies as consumer credit liability information
20C(7) Collection of solicited credit information
Must collect credit information by lawful and fair means.
Obligation to collect credit information by lawful and fair means.
Classification of credit reporting bodies as obligated to collect credit information by lawful and fair means.
20C(8) Collection of solicited credit information
Duty to collect solicited credit information
Obligation to collect solicited credit information
20D Dealing with unsolicited credit information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.83
20D(1) Dealing with unsolicited credit information
Credit reporting body must determine if it could have collected information under section 20C if solicited.
20D(2) Dealing with unsolicited credit information
Use or disclose credit information for making determination under subsection (1)
(2) The credit reporting body may use or disclose the credit information
The credit reporting body must use or disclose the credit information for making the determination under subsection (1)
Temporal interval between use and disclosure
The credit reporting body must diffuse its obligation to use or disclose the credit information for making the determination under subsection (1)
Infer obligation from use and disclosure
The credit reporting body must infer its obligation to use or disclose the credit information for making the determination under subsection (1)
20D(3) Dealing with unsolicited credit information
If credit reporting body determines it could have collected information, sections 20E to 20ZA apply.
Credit reporting body determines it could have collected information.
20D(4) Dealing with unsolicited credit information
Destroy unsolicited credit information if unable to collect.
Obligation to destroy unsolicited credit information.
20D(5) Dealing with unsolicited credit information
Credit reporting body must retain credit information under certain conditions.
Australian law or court order requires retention
Retention period must be greater than or equal to a certain threshold
Retention period meets minimum requirement
20E Use or disclosure of credit reporting information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.84
20E(1) Use or disclosure of credit reporting information
Prohibition on using or disclosing credit reporting information
20E(2) Use or disclosure of credit reporting information
Permitted disclosures of credit reporting information
20E(3) Use or disclosure of credit reporting information
Permitted CRB disclosure in relation to the individual
Prohibition on disclosure of credit reporting information
20E(4) Use or disclosure of credit reporting information
Credit reporting body must not disclose repayment history information unless recipient is a credit provider or mortgage insurer.
Credit reporting body must not disclose repayment history information.
Recipient is a credit provider or mortgage insurer.
20E(5) Use or disclosure of credit reporting information
20E(6) Use or disclosure of credit reporting information
Exemption from section 20E for direct marketing purposes
Section does not apply to direct marketing
20F Permitted CRB disclosures in relation to individuals
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.85
20F(1) Permitted CRB disclosures in relation to individuals
Disclosure of credit reporting information is permitted to specified entities under certain conditions.
Disclosure is permitted for purposes related to consumer credit or commercial credit.
20F(2) Permitted CRB disclosures in relation to individuals
Consent for disclosure of CRB information under certain conditions.
20G Use or disclosure of credit reporting information for the
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.87
20G(1) Use or disclosure of credit reporting information for the
Use or disclosure of credit reporting information for direct marketing is prohibited.
Prohibition of using or disclosing credit reporting information for direct marketing.
20G(2) Use or disclosure of credit reporting information for the
Permits use of credit information for direct marketing by a licensed provider in Australia, under certain conditions.
Expresses a prohibition or restriction on an action.
20G(3) Use or disclosure of credit reporting information for the
Credit provider must nominate eligibility requirements for credit reporting bodies.
Obligation to nominate eligibility requirements.
20G(4) Use or disclosure of credit reporting information for the
Prohibition on using credit reporting information for pre-screening
(4) An assessment under paragraph (2)(d) is not credit reporting information about the individual.
20G(5) Use or disclosure of credit reporting information for the
Request for non-use of credit reporting information
a credit reporting body that holds credit information about the individual not to use the information under subsection (2).
(5) An individual may request a credit reporting body that holds credit information about the individual not to use the information under subsection (2).
Representation of permission in knowledge base
20G(6) Use or disclosure of credit reporting information for the
No charge for making a request or giving effect to the request.
20G(7) Use or disclosure of credit reporting information for the
Must make a written note of use of credit information
20H Use or disclosure of pre-screening assessments
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.88
20H(1) Use or disclosure of pre-screening assessments
Prohibition on using or disclosing pre-screening assessments
Prohibits the use or disclosure of pre-screening assessments
20H(2) Use or disclosure of pre-screening assessments
Disclosure of pre-screening assessment for direct marketing purposes
Disclosure must occur within this temporal interval
20H(3) Use or disclosure of pre-screening assessments
Credit reporting body must make a written note of disclosure.
20H(4) Use or disclosure of pre-screening assessments
Recipient must not use or disclose pre-screening assessment.
Prohibition of using or disclosing pre-screening assessments.
20H(5) Use or disclosure of pre-screening assessments
Permits use of pre-screening assessments for direct marketing by or on behalf of the credit provider.
Grants permission for use of pre-screening assessments.
(5) Subsection (4) does not apply if the recipient uses the pre-screening assessment for the purposes of the direct marketing by, or on behalf of, the credit provider.
Defines a temporal interval for permitted use of pre-screening assessments.
Diffuses information about permitted use of pre-screening assessments.
Classifies use of pre-screening assessments as permitted by artificial intelligence.
20H(6) Use or disclosure of pre-screening assessments
Recipient must make a written note of use of pre-screening assessment.
20H(7) Use or disclosure of pre-screening assessments
Exemption from Australian Privacy Principles for APP entities
20J Destruction of pre-screening assessment
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.89
20J(1) Destruction of pre-screening assessment
Destroy pre-screening assessment if no longer needed or required by law.
(1) If an entity has possession or control of a pre-screening assessment...
...the entity must destroy the assessment if:
Assessment is destroyed during a specific time period.
Entity's destruction of assessment implies compliance with law.
Entity's destruction of assessment propagates to others.
20J(2) Destruction of pre-screening assessment
Australian Privacy Principle 11.2 does not apply to the entity in relation to the pre-screening assessment.
20K No use or disclosure of credit reporting information during a
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.90
20K(1) No use or disclosure of credit reporting information during a
No use or disclosure of credit reporting information during a ban period.
Prohibits use or disclosure of credit reporting information during a ban period.
then, despite any other provision of this Division, the body must not use or disclose the information during the ban period for the information.
Specifies a temporal interval during which credit reporting bodies must not use or disclose information.
(c) the individual requests the body not to use or disclose the information under this Division;
Specifies a temporal interval until which credit reporting bodies must not use or disclose information.
(b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud);
Negates the diffusion of credit reporting information during a ban period.
(a) a credit reporting body holds credit reporting information about an individual;
Classifies credit reporting bodies as entities that must not use or disclose information during a ban period.
20K(2) No use or disclosure of credit reporting information during a
Consent required for use or disclosure of credit reporting information
Permission to use or disclose credit reporting information
20K(3) No use or disclosure of credit reporting information during a
Ban on use or disclosure of credit reporting information during a specified period.
20K(4) No use or disclosure of credit reporting information during a
Extend ban period for credit reporting information if victim of fraud
State must extend ban period if individual is a victim of fraud
Ban period must be extended before it ends
Ban period > individual's request for extension
Ban period >= individual's request for extension
20K(5) No use or disclosure of credit reporting information during a
Imposes a prohibition on the use or disclosure of credit reporting information
20K(6) No use or disclosure of credit reporting information during a
No charging for request to credit reporting body
20L Adoption of government related identifiers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.91
20L(1) Adoption of government related identifiers
Cannot adopt government related identifier as its own identifier.
Prohibition of adopting government related identifier.
(a) a credit reporting body holds credit reporting information about an individual; and (b) the information is a government related identifier of the individual;
the body must not adopt the government related identifier as its own identifier.
20L(2) Adoption of government related identifiers
Exemption from subsection (1) for adoption required by law or court order
...required or authorised by or under an Australian law...
Temporal relationship between subsections
...if the adoption of the government related identifier is required or authorised by or under an Australian law...
20M Use or disclosure of credit reporting information that is
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.92
20M(1) Use or disclosure of credit reporting information that is
Must not use or disclose de-identified credit reporting information
Prohibition on use or disclosure of de-identified credit reporting information
(a) a credit reporting body holds credit reporting information;
(1) If: (a) a credit reporting body holds credit reporting information; and (b) the information (the de-identified information) is de-identified;
Temporal interval for prohibition on use or disclosure of de-identified credit reporting information
the body must not use or disclose the de-identified information.
Recurring trace for prohibition on use or disclosure of de-identified credit reporting information
Spread of prohibition on use or disclosure of de-identified credit reporting information
Implication of prohibition on use or disclosure of de-identified credit reporting information
20M(2) Use or disclosure of credit reporting information that is
Permits use or disclosure of credit reporting information for research purposes under certain conditions.
20M(3) Use or disclosure of credit reporting information that is
The Commissioner may make rules relating to the use or disclosure of credit reporting information.
20M(4) Use or disclosure of credit reporting information that is
Rules for use or disclosure of credit reporting information
Prohibition on using or disclosing credit reporting information without rules
Temporal interval for conducting research
(c) the purposes of conducting the research
20N Quality of credit reporting information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.93
20N(1) Quality of credit reporting information
Ensure accurate, up-to-date and complete credit information
20N(2) Quality of credit reporting information
Ensure accuracy, completeness, and relevance of credit reporting information.
Ensure accuracy, completeness, and relevance.
20N(3) Quality of credit reporting information
Ensure accuracy, completeness, and regular audits of credit information.
Ensure accuracy, completeness, and regular audits.
20P False or misleading credit reporting information
20P(1) False or misleading credit reporting information
Using or disclosing false credit reporting information under this Division is prohibited.
Prohibition of using or disclosing false credit reporting information.
(a) the body uses or discloses credit reporting information under this Division (other than subsections 20D(2) and 20T(4));
(b) the information is false or misleading in a material particular.
Temporal interval for using or disclosing credit reporting information.
the information is false or misleading in a material particular.
Recurring trace for using or disclosing credit reporting information.
Diffusing the prohibition of using or disclosing false credit reporting information.
Classification of credit reporting information as true or false using artificial intelligence.
20P(2) False or misleading credit reporting information
Must not use or disclose false or misleading credit reporting information.
Prohibition of false or misleading credit reporting information.
20Q Security of credit reporting information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.94
20Q(1) Security of credit reporting information
Protect credit reporting information from misuse, interference, loss, unauthorized access, modification or disclosure.
Duty to protect credit reporting information
(1) If a credit reporting body holds credit reporting information...
the body must take such steps as are reasonable in the circumstances...
Temporal interval for protecting credit reporting information
20Q(2) Security of credit reporting information
Must protect credit reporting information.
20R Access to credit reporting information
20R(1) Access to credit reporting information
Must provide access to credit reporting information on request
20R(2) Access to credit reporting information
Deny access to credit reporting information under certain conditions.
20R(3) Access to credit reporting information
Credit reporting body must respond to request within a reasonable period.
Must provide response within a reasonable period.
Classifies as part of the definition of credit reporting bodies.
20R(4) Access to credit reporting information
Access to credit reporting information must be given in a specific manner.
Duty to provide access in a specific manner.
20R(5) Access to credit reporting information
No charge for making request or giving access to information if not made in previous 12 months.
20R(6) Access to credit reporting information
No excessive charge for access to credit reporting information
20R(7) Access to credit reporting information
Credit reporting body must provide written notice with reasons for refusal of access to information.
States options for dispute resolution and complaint process
(b) states that, if the access seeker is not satisfied with the response to the request
Refusal of access may be appealed within a certain timeframe
Provides contact information for dispute resolution and complaint process
(ii) access a recognised external dispute resolution scheme of which the body is a member; or (iii) make a complaint to the Commissioner under Part V.
20S Correction of credit reporting information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.96
20S(1) Correction of credit reporting information
Correct inaccurate credit reporting information
Obligation to correct inaccurate credit reporting information
20S(2) Correction of credit reporting information
Body must provide written notice of correction within a reasonable period.
20S(3) Correction of credit reporting information
Exemption from notice under subsection (2) due to impracticability or legal requirement.
Exemption from notice under subsection (2)
Permission for exemption from notice under subsection (2)
20T Individual may request the correction of credit information etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.97
20T(1) Individual may request the correction of credit information etc.
Personal information about the individual
(a) The personal information is: (i) credit information about the individual; or (ii) CRB derived information about the individual; or (iii) CP derived information about the individual.
Temporal overlap between request and correction
(1) An individual may request a credit reporting body to correct personal information about the individual if:...
20T(2) Individual may request the correction of credit information etc.
Credit reporting body must correct inaccurate personal information within a specified period.
Obligation to correct inaccurate personal information
(2) If the credit reporting body is satisfied that the personal information is inaccurate...
...the body must take such steps (if any)...
The period of correction starts on the day of request
...the body must take such steps (if any)... within: (a) the period of 30 days that starts on the day on which the request is made;
The period of correction can be longer if agreed in writing
...the body must take such steps (if any)... within: (b) such longer period as the individual has agreed to in writing.
Request for correction implies a condition that leads to correction
Request for correction is a type of input to credit reporting body
20T(3) Individual may request the correction of credit information etc.
Credit reporting body must consult interested parties about individual's request.
(3) If the credit reporting body considers...
the body must consult that interested party, or those interested parties, about the individual’s request.
20T(4) Individual may request the correction of credit information etc.
Use or disclosure of personal information for consultation purposes is authorized.
Authorizes use or disclosure of personal information.
(4) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.
Personal information used for consultation purposes is within authorized scope.
Personal information used for consultation purposes recurs in authorized scope.
Personal information recognized as authorized for consultation purposes.
Personal information validated as authorized for consultation purposes.
20T(5) Individual may request the correction of credit information etc.
No charge for request or correction of credit information
Prohibits charging individual for request or correction
20U Notice of correction etc. must be given
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.98
20U(1) Notice of correction etc. must be given
Individual must provide notice of correction to credit reporting body.
20U(2) Notice of correction etc. must be given
Credit reporting body must provide written notice of correction to individual and recipient.
Must provide written notice of correction.
20U(3) Notice of correction etc. must be given
Credit reporting body must correct personal information within a reasonable period and provide written notice with reasons.
20U(4) Notice of correction etc. must be given
Credit reporting body must give notice under paragraph (2)(c) if possible
(4) Paragraph (2)(c) does not apply if it is impracticable for the credit reporting body to give the notice under that paragraph.
Notice must be given within a certain timeframe
20U(5) Notice of correction etc. must be given
No notice must be given if required by law or court order.
(5) Subsection (2) or (3) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order,
Subdivision G—Dealing with credit reporting information after the retention period ends etc.
20V Destruction etc. of credit reporting information after the
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.99
20V(1) Destruction etc. of credit reporting information after the
Destruction of credit information after retention period ends.
Obligation to destroy credit information
Destruction of credit information within the retention period
(b) the retention period for the information ends.
20V(2) Destruction etc. of credit reporting information after the
Destroy credit information within 1 month after retention period ends.
20V(3) Destruction etc. of credit reporting information after the
Cannot destroy credit information if pending correction or dispute
if immediately before the retention period ends:
20V(4) Destruction etc. of credit reporting information after the
Credit reporting body must retain credit information under certain circumstances.
20V(5) Destruction etc. of credit reporting information after the
Credit reporting body must destroy CRB derived information or de-identify it under certain conditions.
Obligation to destroy CRB derived information
Temporal interval for destruction of CRB derived information
(5) The credit reporting body must destroy any CRB derived information about the individual that was derived from the credit information...
Artificial intelligence application in this context
20V(6) Destruction etc. of credit reporting information after the
Destroy CRB derived information if pending correction or dispute
Prohibition of destroying CRB derived information
(6) Despite subsection (5), the credit reporting body must neither...
...nor ensure that the information is de-identified
Prohibition applies during retention period with pending correction or dispute
...destroy the CRB derived information nor ensure that the information is de-identified, if immediately before the retention period ends:
Prohibition applies until correction or dispute is resolved
Prohibition spreads to all related information
Prohibition can be inferred from related rules
20V(7) Destruction etc. of credit reporting information after the
Credit reporting body not required to destroy CRB-derived information under certain circumstances.
20W Retention period for credit information—general
Retention period for credit information—general
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.100
20X Retention period for credit information—personal insolvency
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.102
20X(1) Retention period for credit information—personal insolvency
Retention period for credit information—personal insolvency
20X(2) Retention period for credit information—personal insolvency
20X(3) Retention period for credit information—personal insolvency
Retention period is dependent on the control of property
20X(4) Retention period for credit information—personal insolvency
Describes the type of obligation or prohibition
20X(5) Retention period for credit information—personal insolvency
20Y Destruction of credit reporting information in cases of fraud
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.103
20Y(1) Destruction of credit reporting information in cases of fraud
Destruction of credit reporting information in cases of fraud
Obligation to destroy credit reporting information in cases of fraud
20Y(2) Destruction of credit reporting information in cases of fraud
Credit reporting body must destroy information and notify parties.
Written notices to individual and credit provider.
20Y(3) Destruction of credit reporting information in cases of fraud
Credit reporting bodies must notify third parties of destruction of credit reporting information in cases of fraud.
20Y(4) Destruction of credit reporting information in cases of fraud
Notify recipients of destruction of credit reporting information
20Y(5) Destruction of credit reporting information in cases of fraud
Notification is not required if mandated by law or court order.
20Z Dealing with information if there is a pending correction
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.105
20Z(1) Dealing with information if there is a pending correction
Notification of Commissioner required when credit reporting body holds information about an individual under certain conditions.
Must provide notification to Commissioner
(1) This section applies if a credit reporting body holds credit reporting information about an individual and either: (a) subsection 20V(3) applies in relation to the information; or (b) subsection 20V(6) applies in relation to the information.
20Z(2) Dealing with information if there is a pending correction
Notify Commissioner of pending correction information
20Z(3) Dealing with information if there is a pending correction
Prohibition on using or disclosing information under Subdivision D of this Division.
The credit reporting body must not use or disclose the information under Subdivision D of this Division.
The credit reporting body is prohibited from using or disclosing the information.
Temporal relation between the prohibition and the use or disclosure of information
The credit reporting body must not use or disclose the information under Subdivision D of this Division during a certain period.
There is a temporal relation between the prohibition and the use or disclosure of information.
Spread of the prohibition to other entities
The prohibition is diffused to other entities that are related to the credit reporting body.
Relating the prohibition to artificial intelligence
The credit reporting body is prohibited from using or disclosing the information in a way that is related to artificial intelligence.
Validation of the prohibition against other entities
This provision asserts that the credit reporting body is prohibited from using or disclosing the information in a way that is related to other entities.
20Z(4) Dealing with information if there is a pending correction
Use or disclose information for pending correction request or dispute, or under Australian law.
20Z(5) Dealing with information if there is a pending correction
Written note of use or disclosure of information
20Z(6) Dealing with information if there is a pending correction
Commissioner may direct credit reporting body to destroy or de-identify information by a specified day.
20Z(7) Dealing with information if there is a pending correction
Must comply with direction from Commissioner
20Z(8) Dealing with information if there is a pending correction
Section applies to credit reporting information de-identified by the credit reporting body.
Section applies to specified information
20ZA Dealing with information if an Australian law etc. requires it
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.106
20ZA(1) Dealing with information if an Australian law etc. requires it
Prohibition on destroying credit reporting information
Prohibits destruction of credit reporting information
20ZA(2) Dealing with information if an Australian law etc. requires it
The credit reporting body must not use or disclose the information
Temporal relationship between the prohibition and the use/disclosure of information
The credit reporting body must not use or disclose the information during Subdivision D of this Division
The prohibition is during the use or disclosure of information under Subdivision D of this Division.
Spread of the prohibition to related concepts
The prohibition is spread to all related concepts, including the use or disclosure of information under Subdivision D of this Division.
Artificial intelligence application of the prohibition
The prohibition is applied by artificial intelligence to all related concepts, including the use or disclosure of information under Subdivision D of this Division.
Validation of the prohibition against related data
The prohibition is validated against all related data, including the use or disclosure of information under Subdivision D of this Division.
20ZA(3) Dealing with information if an Australian law etc. requires it
Use or disclose information if required by law or court order
Requires use or disclosure of information
Obligation to use or disclose information
Use or disclosure during Australian law or court order
Australian law or court order during use or disclosure
20ZA(4) Dealing with information if an Australian law etc. requires it
Must make a written note of use or disclosure of information
20ZA(5) Dealing with information if an Australian law etc. requires it
No application of subdivision E applies to the use or disclosure of information.
20ZA(6) Dealing with information if an Australian law etc. requires it
Exemption from subdivision F of Division 2
21 Guide to this Division
Rules for credit providers' handling of credit information, eligibility information, and CRB-derived information.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.107
Obligation to handle credit information correctly
21A Application of this Division to credit providers
21A(1) Application of this Division to credit providers
Credit provider must comply with this Division's requirements.
21A(2) Application of this Division to credit providers
Permits credit providers to consider information privacy under this Division instead of Australian Privacy Principles.
21B Open and transparent management of credit information etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.108
21B(1) Open and transparent management of credit information etc.
Ensure open and transparent management of credit information
(1) The object of this section is to ensure that credit providers manage...
21B(2) Open and transparent management of credit information etc.
A credit provider must implement practices, procedures and systems to comply with this Division and the registered CR code.
Obligation to comply with Division and CR code
21B(3) Open and transparent management of credit information etc.
Credit provider must have a clearly expressed and up-to-date policy about credit information management.
21B(4) Open and transparent management of credit information etc.
Credit provider must provide certain information to individuals about their credit eligibility.
Must provide certain information to individuals.
21B(5) Open and transparent management of credit information etc.
Credit provider must make policy available free of charge and in an appropriate form.
21B(6) Open and transparent management of credit information etc.
Must provide a copy of credit policy in a particular form upon request.
21B(7) Open and transparent management of credit information etc.
Australian Privacy Principles must be applied to APP entities.
Obligation to apply Australian Privacy Principles.
Exempts provider from credit information obligations.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.110
Exempts the provider from certain obligations.
21C Additional notification requirements for the collection of
21C(1) Additional notification requirements for the collection of
Credit provider must notify individual of personal info disclosure to credit reporting body.
Notification occurs at or before collection of personal info
(1) At or before the time a credit provider collects personal information about an individual that the provider is likely to disclose to a credit reporting body, the provider must:
Notification implies awareness of disclosure matters
Notification diffuses awareness of disclosure matters
21C(2) Additional notification requirements for the collection of
Credit provider must comply with Australian Privacy Principle 5.
(2) If a credit provider is an APP entity, subsection (1) applies to the provider in relation to personal information in addition to Australian Privacy Principle 5.
The credit provider must comply with Australian Privacy Principle 5.
Temporal applicability of subsection (1)
Subsection (1) applies to the credit provider at all times it is an APP entity.
The credit provider has an obligation to comply with Australian Privacy Principle 5.
The credit provider must notify other parties of its status as an APP entity.
21C(3) Additional notification requirements for the collection of
Credit provider must notify about credit reporting policy and procedures.
21D Disclosure of credit information to a credit reporting body
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.111
21D(1) Disclosure of credit information to a credit reporting body
Disclose credit information to a credit reporting body
(1) A credit provider must not disclose...
21D(2) Disclosure of credit information to a credit reporting body
Disclosure of credit information to a credit reporting body is permitted under certain conditions.
21D(3) Disclosure of credit information to a credit reporting body
Credit information must be disclosed to a credit reporting body under certain conditions.
21D(4) Disclosure of credit information to a credit reporting body
Exemption from disclosure of identification information about the individual.
21D(5) Disclosure of credit information to a credit reporting body
Consumer credit liability information about the individual may relate to consumer credit entered into before the individual turned 18.
21D(6) Disclosure of credit information to a credit reporting body
Credit provider must make a written note of disclosure.
21D(7) Disclosure of credit information to a credit reporting body
21E Payment information must be disclosed to a credit reporting
Credit provider must disclose payment information after overdue payment is made.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.113
21F Limitation on the disclosure of credit information during a ban
21F(1) Limitation on the disclosure of credit information during a ban
Credit reporting body must not disclose credit information during a ban period.
(a) a credit reporting body holds credit reporting information about an individual; (b) a credit provider requests the body to disclose the information...
(1) This section applies if: ... and (d) during the ban period, the provider provides the consumer credit...
Temporal relationship between ban period and consumer credit provision
(c) the body is not permitted to disclose the information because there is a ban period for the information; (d) during the ban period, the provider provides the consumer credit...
Restriction of credit reporting body's actions during a ban period
Analysis of credit reporting body's actions during a ban period
Validation of credit reporting body's actions during a ban period
21F(2) Limitation on the disclosure of credit information during a ban
Credit provider must not disclose credit information to a credit reporting body.
21F(3) Limitation on the disclosure of credit information during a ban
Credit provider must verify identity of individual before disclosing credit information.
21G Use or disclosure of credit eligibility information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.114
21G(1) Use or disclosure of credit eligibility information
Use or disclosure of credit eligibility information is prohibited.
21G(2) Use or disclosure of credit eligibility information
Permitted disclosures of credit eligibility information
21G(3) Use or disclosure of credit eligibility information
Disclosure of credit eligibility information is permitted under certain conditions.
21G(4) Use or disclosure of credit eligibility information
Credit provider must not disclose repayment history information under subsection (3).
21G(5) Use or disclosure of credit eligibility information
Exemption from subsection (4) for certain recipients and disclosures
Temporal interval for disclosure under paragraph (3)(d)
21G(6) Use or disclosure of credit eligibility information
Credit provider must make written note of use or disclosure of credit eligibility information.
21G(7) Use or disclosure of credit eligibility information
Exempts APP entities from Australian Privacy Principles 6, 7 and 8 regarding credit eligibility information.
Prohibits the application of Australian Privacy Principles 6, 7 and 8 to APP entities.
Exemption from Australian Privacy Principles 6, 7 and 8
Temporarily exempts credit providers that are APP entities from Australian Privacy Principles 6, 7 and 8.
Exempts credit providers that are APP entities from the diffusion of Australian Privacy Principles 6, 7 and 8.
Exempts credit providers that are APP entities from the application of knowledge-based rules regarding Australian Privacy Principles 6, 7 and 8.
21G(8) Use or disclosure of credit eligibility information
Exemption from Australian Privacy Principle 9.2 for APP entities with government-related identifiers.
Prohibits the application of Australian Privacy Principle 9.2.
No Australian Privacy Principle 9.2 applies.
Exempts credit providers from Australian Privacy Principle 9.2 for a specific duration.
No Australian Privacy Principle 9.2 applies during this period.
Diffuses information about exempt credit providers to relevant parties.
Relevant parties informed of exempt status.
Represents knowledge about exempt credit providers in a structured format.
Knowledge represented in a structured format.
21H Permitted CP uses in relation to individuals
Permitted CP uses in relation to individuals
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.116
Permits credit provider use of credit eligibility information
The relevant credit reporting information was disclosed to the provider under a provision specified in column 1...
of the table for the purpose (if any) specified in that column.
Between permitted CP uses in relation to individuals and the use of credit eligibility information
the internal management purposes of the provider that are directly related to the provision or management of consumer credit by the provider.
of the table in subsection 20F(1) for a particular securitisation related purpose of the provider in relation to the individual.
Recurring trace of permitted CP uses in relation to individuals and the use of credit eligibility information
the internal management purposes of the provider that are directly related to the provision or management of commercial credit by the provider.
of the table in subsection 20F(1) for a credit guarantee purpose of the provider in relation to the individual.
Permits credit provider use of credit eligibility information for internal management purposes
item 2 of the table in subsection 20F(1) for a particular commercial credit related purpose of the provider in relation to the individual.
of the table in subsection 20F(1) for the purpose of assisting the individual to avoid defaulting on his or her obligations...
21J Permitted CP disclosures between credit providers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.118
21J(1) Permitted CP disclosures between credit providers
Permitted CP disclosures between credit providers
Permits disclosure of credit eligibility information
(1) A disclosure by a credit provider...
21J(2) Permitted CP disclosures between credit providers
Consent must be given in writing for certain disclosures.
21J(3) Permitted CP disclosures between credit providers
21J(4) Permitted CP disclosures between credit providers
21J(5) Permitted CP disclosures between credit providers
21K Permitted CP disclosures relating to guarantees etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.120
21K(1) Permitted CP disclosures relating to guarantees etc.
Disclosure of credit eligibility information is permitted for certain purposes.
Permission to disclose credit eligibility information.
21K(2) Permitted CP disclosures relating to guarantees etc.
Consent in writing is not required under certain circumstances.
21K(3) Permitted CP disclosures relating to guarantees etc.
Disclosure of credit eligibility information is permitted to certain individuals under specific conditions.
21K(4) Permitted CP disclosures relating to guarantees etc.
Individual must provide written consent for credit application
21L Permitted CP disclosures to mortgage insurers
Permitted CP disclosures to mortgage insurers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.121
21M Permitted CP disclosures to debt collectors
21M(1) Permitted CP disclosures to debt collectors
Permitted CP disclosures to debt collectors
21M(2) Permitted CP disclosures to debt collectors
Debt collectors may disclose certain information about individuals.
21N Permitted CP disclosures to other recipients
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.122
21N(1) Permitted CP disclosures to other recipients
Permitted CP disclosures to other recipients
21N(2) Permitted CP disclosures to other recipients
21N(3) Permitted CP disclosures to other recipients
21NA Disclosures to certain persons and bodies that do not have an
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.123
21NA(1) Disclosures to certain persons and bodies that do not have an
Credit provider must ensure disclosure does not breach certain provisions.
21NA(2) Disclosures to certain persons and bodies that do not have an
Debt collectors must comply with the provisions of this Act.
The provisions of this Act apply to debt collectors.
21NA(3) Disclosures to certain persons and bodies that do not have an
Credit provider must ensure disclosure does not breach Australian Privacy Principles.
21NA(4) Disclosures to certain persons and bodies that do not have an
Credit provider must disclose credit eligibility information to certain persons and bodies.
21P Notification of a refusal of an application for consumer credit
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.125
21P(1) Notification of a refusal of an application for consumer credit
Credit provider must not refuse an application for consumer credit based on certain information.
Prohibition of refusal based on credit eligibility information.
(a) a credit provider refuses an application for consumer credit...
...the refusal is based wholly or partly on credit eligibility information about one or more of the following:
Temporal interval for disclosure of credit reporting information.
(c) a credit reporting body disclosed the relevant credit reporting...
...for the purposes of assessing the application.
Recurring trace for disclosure of credit reporting information.
Information flow for disclosure of credit reporting information.
Knowledge representation for credit eligibility information.
(b) the refusal is based wholly or partly on credit eligibility...
21P(2) Notification of a refusal of an application for consumer credit
Credit provider must notify individual of refusal with specific details.
21Q Quality of credit eligibility information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.126
21Q(1) Quality of credit eligibility information
Ensure accurate, up-to-date and complete credit eligibility information.
21Q(2) Quality of credit eligibility information
Ensure accurate, up-to-date, complete and relevant credit eligibility information.
Obligation to ensure accurate credit eligibility information.
21Q(3) Quality of credit eligibility information
Australian Privacy Principle 10 does not apply to APP entities in relation to credit eligibility information.
Prevents Australian Privacy Principle 10 from applying to APP entities.
21R False or misleading credit information or credit eligibility
21R(1) False or misleading credit information or credit eligibility
Disclosing false or misleading credit information is an offence.
Prohibits the action of disclosing false or misleading credit information.
(a) the provider discloses credit information under section 21D;
A credit provider commits an offence if...
Implies that disclosing false or misleading credit information is an offence.
Justifies the prohibition on disclosing false or misleading credit information.
21R(2) False or misleading credit information or credit eligibility
Using or disclosing false credit eligibility information is prohibited.
Prohibition of using or disclosing false credit eligibility information.
(2) A credit provider commits an offence if...
...the information is false or misleading in a material particular.
Temporal interval for the prohibition of using or disclosing false credit eligibility information.
Recurring trace for the prohibition of using or disclosing false credit eligibility information.
Diffusion of the prohibition of using or disclosing false credit eligibility information.
Classification of credit eligibility information as false or misleading by CogAI.
21R(3) False or misleading credit information or credit eligibility
Disclose false or misleading credit information under section 21D.
Prohibition of false or misleading credit information.
21R(4) False or misleading credit information or credit eligibility
Prohibition on using or disclosing false or misleading credit eligibility information.
21S Security of credit eligibility information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.127
21S(1) Security of credit eligibility information
Credit provider must protect credit eligibility information
Duty to protect credit eligibility information
21S(2) Security of credit eligibility information
Credit provider must destroy or de-identify credit eligibility information
21S(3) Security of credit eligibility information
Australian Privacy Principle 11 does not apply to credit providers in relation to credit eligibility information.
Prevents Australian Privacy Principle 11 from applying to credit providers.
21T Access to credit eligibility information
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.128
21T(1) Access to credit eligibility information
Must provide access to credit eligibility information on request
21T(2) Access to credit eligibility information
Denying access is required or authorised by law.
Prohibits giving access to credit eligibility information.
21T(3) Access to credit eligibility information
Credit provider must respond to request within a reasonable period.
A response is a communication that answers the request.
21T(4) Access to credit eligibility information
Access to credit eligibility information must be provided in a specific manner.
Must provide access to credit eligibility information.
21T(5) Access to credit eligibility information
Credit provider must not charge for making request or giving access to information.
Prohibition of charging for request or access.
21T(6) Access to credit eligibility information
No excessive charge for access to credit information
21T(7) Access to credit eligibility information
Provider must give written notice if refusing access to credit eligibility information
Prohibits refusal of access to credit eligibility information
21T(8) Access to credit eligibility information
Australian Privacy Principle 12 does not apply to credit providers in relation to credit eligibility information.
Prohibits the application of Australian Privacy Principle 12 to credit providers.
21U Correction of credit information or credit eligibility
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.129
21U(1) Correction of credit information or credit eligibility
Credit provider must correct inaccurate credit information.
Obligation to correct inaccurate credit information.
21U(2) Correction of credit information or credit eligibility
Provider must give written notice of correction within a reasonable period.
21U(3) Correction of credit information or credit eligibility
Credit provider must give notice under subsection (2) if able to do so.
21U(4) Correction of credit information or credit eligibility
Australian Privacy Principle 13 applies to credit providers in relation to identification information.
Class hierarchy: APP entity -> Australian Privacy Principle 13
Australian Privacy Principle 13 applies to credit providers
21V Individual may request the correction of credit information etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.130
21V(1) Individual may request the correction of credit information etc.
Request to correct personal information about an individual.
Classification of personal information types.
(i) credit information about the individual; or (ii) CRB derived information about the individual; or (iii) CP derived information about the individual.
Temporal relation between correction request and personal information update.
(1) An individual may request a credit provider to correct personal information about the individual if:
Implication of correction request on credit provider's action.
Propagated effect of correction request on credit information.
Knowledge graph representation of correction request and personal information.
21V(2) Individual may request the correction of credit information etc.
Credit provider must correct inaccurate personal information within a specified period.
21V(3) Individual may request the correction of credit information etc.
Credit provider must consult interested party about individual's request.
(3) If the credit provider considers that the provider cannot be satisfied...
The provider must consult that interested party, or those interested parties, about the individual’s request.
21V(4) Individual may request the correction of credit information etc.
Use of personal information for consultation purposes is authorized.
21V(5) Individual may request the correction of credit information etc.
Credit provider must not charge for request or correction of credit information.
Prohibits charging for request or correction.
21V(6) Individual may request the correction of credit information etc.
Credit provider must comply with Australian Privacy Principle 13 for personal information referred to in paragraph (1)(a) that is identification information.
21W Notice of correction etc. must be given
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.132
21W(1) Notice of correction etc. must be given
Individuals must provide notice of correction for personal information.
21W(2) Notice of correction etc. must be given
Credit provider must give written notice of correction to individual and recipients.
Correction must be made within a reasonable period
21W(3) Notice of correction etc. must be given
Correct personal information within a reasonable period
Written notice with reasons for non-correction
21W(4) Notice of correction etc. must be given
No notice is required if impracticable to provide
21W(5) Notice of correction etc. must be given
No notice required under subsections (2) or (3) if mandated by law or court order.
22 Guide to this Division
Rules for handling regulated information apply to affected recipients.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.133
22A Open and transparent management of regulated information
22A(1) Open and transparent management of regulated information
Ensure open and transparent management of regulated information
22A(2) Open and transparent management of regulated information
Recipient must implement practices, procedures and systems to comply with Division and registered CR code.
Recipient must implement practices, procedures and systems.
22A(3) Open and transparent management of regulated information
Recipient must have a clearly expressed policy about management of regulated information.
Recipient must have a clearly expressed policy.
22A(4) Open and transparent management of regulated information
Recipient must provide information about regulated data collection and use.
22A(5) Open and transparent management of regulated information
An affected information recipient must make the policy available.
22A(6) Open and transparent management of regulated information
Recipient must provide a copy of requested policy in a particular form.
Recipient must provide within reasonable circumstances
(6) If a person or body requests a copy, in a particular form, of the policy of an affected information recipient
Recipient should take reasonable steps to provide the requested policy
Recipient must provide to the requesting party
22A(7) Open and transparent management of regulated information
22B Additional notification requirements for affected information
Recipient must provide information about access and complaint procedures
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.135
22C Use or disclosure of information by mortgage insurers or trade
22C(1) Use or disclosure of information by mortgage insurers or trade
Use or disclosure of personal information by mortgage insurers or trades is prohibited.
(a) a mortgage insurer or trade insurer holds or held personal information about an individual; and (b) the information was disclosed to the insurer by a credit reporting body or credit provider under Division 2 or 3 of this Part;
the insurer must not use or disclose the information, or any personal information about the individual derived from that information.
the prohibition applies until the information is deleted or updated.
the prohibition is recurring and applies until the information is deleted or updated.
the diffusion of the prohibition applies to all parties with access to the information.
Knowledge representation for prohibition.
the knowledge representation includes the prohibition on use or disclosure.
22C(2) Use or disclosure of information by mortgage insurers or trade
Permitted disclosure of information under certain conditions.
Indicates that disclosure is permitted under specific conditions.
22C(3) Use or disclosure of information by mortgage insurers or trade
Disclosure of information is permitted if required or authorised by Australian law or court/tribunal order.
22C(4) Use or disclosure of information by mortgage insurers or trade
22C(5) Use or disclosure of information by mortgage insurers or trade
Prohibition on using or disclosing government-related identifiers without Australian Privacy Principle 9.2
Australian Privacy Principle 9.2 does not apply to the insurer in relation to the information.
(5) If: (a) the mortgage insurer or trade insurer is an APP entity; and ComLaw Authoritative Act C2015C00053 Credit reporting Schedule 2 Privacy Amendment (Enhancing Privacy Protection) Act 2012
22D Use or disclosure of information by a related body corporate
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.137
22D(1) Use or disclosure of information by a related body corporate
Body corporate must not use or disclose credit eligibility information about an individual.
Prohibition of using or disclosing credit eligibility information.
the body must not use or disclose the information.
Restricts use of information to past tense.
(b) the information was disclosed to the body by a credit provider under paragraph 21G(3)(b);
the body must not use or disclose the information in the future.
Implication of disclosure on body corporate's actions.
(a) a body corporate holds or held credit eligibility information about an individual;
Restricts diffusion of sensitive information.
the information must not be shared with others.
Classification of sensitive information as confidential.
the information is classified as confidential.
22D(2) Use or disclosure of information by a related body corporate
Permits use or disclosure of information by a related body corporate under certain conditions.
22D(3) Use or disclosure of information by a related body corporate
Permits use or disclosure of information by a related body corporate
22D(4) Use or disclosure of information by a related body corporate
Australian Privacy Principles do not apply to APP entities.
Applying Australian Privacy Principles is obligatory for APP entities.
22D(5) Use or disclosure of information by a related body corporate
Prohibition on applying Australian Privacy Principle 9.2 to APP entities with government-related identifiers.
22E Use or disclosure of information by credit managers etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.138
22E(1) Use or disclosure of information by credit managers etc.
Prohibition on using or disclosing credit information without consent.
Prohibition of using or disclosing credit information.
(1) If: a person holds or held credit eligibility information about an individual; and the information was disclosed to the person by a credit provider under paragraph 21G(3)(c); the person must not use or disclose the information, or any personal information about the individual derived from that information.
22E(2) Use or disclosure of information by credit managers etc.
22E(3) Use or disclosure of information by credit managers etc.
Disclosure of information to credit provider or under Australian law is permitted.
Temporal interval for permitted disclosure
(a) the disclosure is to the credit provider; or (b) the disclosure is required or authorised by or under an Australian law or a court/tribunal order.
Recurring trace for permitted disclosure
Knowledge representation for permitted disclosure
Schema validation for permitted disclosure
22E(4) Use or disclosure of information by credit managers etc.
Exempts APP entities from Australian Privacy Principles
22E(5) Use or disclosure of information by credit managers etc.
Australian Privacy Principle 9.2 does not apply
22F Use or disclosure of information by advisers etc.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.139
22F(1) Use or disclosure of information by advisers etc.
Recipient must not use or disclose credit information.
Recipient holds credit eligibility information.
Recipient must not use or disclose the information.
22F(2) Use or disclosure of information by advisers etc.
22F(3) Use or disclosure of information by advisers etc.
Disclosure of information is permitted if required or authorised by Australian law or a court/tribunal order.
22F(4) Use or disclosure of information by advisers etc.
22F(5) Use or disclosure of information by advisers etc.
23 Guide to this Division
Individuals may complain to credit reporting bodies or credit providers about acts or practices that may be a breach of certain provisions.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.140
23A Individual may complain about a breach of a provision of this
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.141
23A(1) Individual may complain about a breach of a provision of this
23A(2) Individual may complain about a breach of a provision of this
Complain about a breach of provisions related to the individual
Individual has a right to complain about a breach of provisions
23A(3) Individual may complain about a breach of a provision of this
Must specify the nature of the complaint upon making a complaint.
Must specify the nature of the complaint.
Obligation to specify the nature of the complaint.
23A(4) Individual may complain about a breach of a provision of this
No charge for complaint about personal information destruction or de-identification.
Obligation to provide no charge for complaint.
23A(5) Individual may complain about a breach of a provision of this
Credit provider cannot charge individual for complaint or dealing with complaint.
23B Dealing with complaints
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.142
23B(1) Dealing with complaints
Respondent must acknowledge complaint and investigate within 7 days.
Must provide written notice and investigate complaint
23B(2) Dealing with complaints
Respondent must consult credit reporting body or provider about complaint.
23B(3) Dealing with complaints
23B(4) Dealing with complaints
Respondent must make a decision and give written notice to individual within specified period.
23B(5) Dealing with complaints
Holds the state responsible for complaints
23C Notification requirements relating to correction complaints
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.143
23C(1) Notification requirements relating to correction complaints
Notification requirements for correction complaints
23C(2) Notification requirements relating to correction complaints
Respondent must notify provider of complaint and decision.
23C(3) Notification requirements relating to correction complaints
Respondent must notify body or provider of complaint making and decision making.
23C(4) Notification requirements relating to correction complaints
Credit reporting body must notify recipient of complaint upon disclosure.
23C(5) Notification requirements relating to correction complaints
Credit provider must notify recipient of complaint if personal information is disclosed under Division 3 or Australian Privacy Principles.
23C(6) Notification requirements relating to correction complaints
Exemption from notification requirements under certain circumstances
Granting permission to exempt from notification requirements
(6) Subsection (2), (3), (4) or (5) does not apply if:
Temporal overlap with notification requirements
24 Obtaining credit reporting information from a credit reporting
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.144
24(1) Obtaining credit reporting information from a credit reporting
Obtaining credit reporting information from a credit reporting body without permission is an offence.
Prohibition of obtaining credit reporting information without permission.
Entity obtains credit reporting information from a credit reporting body.
Temporal interval for obtaining credit reporting information.
(1) An entity obtains credit reporting information.
24(2) Obtaining credit reporting information from a credit reporting
Obtaining credit reporting information by false pretence is prohibited.
Prohibition of obtaining credit reporting information by false pretence.
(2) An entity commits an offence if: (a) the entity obtains credit reporting information; and (b) the information is obtained from a credit reporting body; and (c) the information is obtained by false pretence.
Tracing obtaining credit reporting information as an offence.
24(3) Obtaining credit reporting information from a credit reporting
Entity must not obtain credit reporting information from a credit reporting body without permission.
Prohibition of obtaining credit reporting information
(3) An entity must not obtain credit reporting information from a credit reporting body if the entity is not: (a) an entity to which the body is permitted to disclose the information under Division 2 of this Part; or (b) an access seeker for the information.
Entity must not obtain credit reporting information during certain periods
Entity must not obtain credit reporting information until certain conditions are met
Entity must not obtain credit reporting information if certain conditions are met
24(4) Obtaining credit reporting information from a credit reporting
Entity must not obtain credit reporting information by false pretence.
24A Obtaining credit eligibility information from a credit provider
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.145
24A(1) Obtaining credit eligibility information from a credit provider
Obtaining credit eligibility information from a credit provider without permission is an offence.
Prohibition of obtaining credit eligibility information without permission.
Entity obtains credit eligibility information from a credit provider.
Provision specifies conditions for obtaining credit eligibility information.
Provision applies to entities that obtain credit eligibility information from a credit provider.
Classification of the entity as an offender.
24A(2) Obtaining credit eligibility information from a credit provider
Obtaining credit eligibility information by false pretence is an offence.
Prohibition of obtaining credit eligibility information by false pretence.
Entity obtains credit eligibility information by false pretence.
24A(3) Obtaining credit eligibility information from a credit provider
Cannot obtain credit eligibility information from a credit provider without permission.
Prohibition of obtaining credit eligibility information
Temporal interval of when obtaining credit eligibility information is prohibited
24A(4) Obtaining credit eligibility information from a credit provider
Cannot obtain credit eligibility information by false pretence
25 Compensation orders
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.146
25(1) Compensation orders
Compensation order for loss or damage suffered due to contravention of civil penalty provision.
Obligation to compensate for loss or damage
25(2) Compensation orders
Court may make compensation order within 6 years of cause of action.
25(3) Compensation orders
25A Other orders to compensate loss or damage
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.147
25A(1) Other orders to compensate loss or damage
Loss or damage compensation for contravention of civil penalty provisions or commission of an offence.
Obligation to compensate loss or damage.
(1) This section applies if: (a) either: (i) a civil penalty order has been made against an entity for a contravention of a civil penalty provision (other than section 13G); or (ii) an entity is found guilty of an offence against this Part; and (b) a person has suffered, or is likely to suffer, loss or damage (including injury to the person’s feelings or humiliation) as a result of the contravention or commission of the offence.
This section applies during the time period when an entity has suffered loss or damage.
If an entity has suffered loss or damage, then this section applies.
25A(2) Other orders to compensate loss or damage
Compensate loss or damage suffered by a person.
25A(3) Other orders to compensate loss or damage
Order to perform reasonable act or course of conduct
Mandatory duty to perform reasonable act or course of conduct
The court may make an order directing the entity to perform any reasonable act...
Temporal relation between orders and contravention/commission of offence
(3) Without limiting subsection (2), examples of orders the court may make include:
...an order directing the entity to perform any reasonable act, or carry out any reasonable course of conduct...
Recurring trace between orders and expenses incurred by person
(b) an order directing the entity to pay the person a specified amount...
...to reimburse the person for expenses reasonably incurred by the person in connection with the contravention or commission of the offence;
Diffusion of responsibility between entity and person
...an order directing the defendant to pay to the person the amount of loss or damage...
Inference from orders and expenses incurred by person
25A(4) Other orders to compensate loss or damage
Court may make order to compensate loss or damage within 6 years of the cause of action.
Application must be made for order to be considered
25A(5) Other orders to compensate loss or damage
Entity must pay amount to person as debt.
73 Subsections 30(3) and (4)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.148
74 Subsection 49(4) (paragraph (a) of the definition of credit
75 Subsection 68(1)
Omit 'credit reporting agency', substitute 'credit reporting body'.
1 Subsection 6(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.149
APP code has the meaning given by section 26C.
APP code means the meaning given by section 26C.
3 Subsection 6(1) (definition of approved privacy code)
Repeal definition of approved privacy code
4 Subsection 6(1) (definition of code complaint)
Substitute registered APP code for approved privacy code
5 Subsection 6(1) (definition of Code of Conduct)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.150
9 Subsection 6(1) (definition of credit provider)
10 Subsection 6(1) (paragraph (a) of the definition of credit
Omit 'the Code of Conduct', substitute 'the registered CR code'.
Prohibition of using outdated terminology.
11 Subsection 6(1) (definition of credit reporting
Repeal definition of credit reporting infringement
12 Subsection 6(1) (definition of privacy code)
15 Subsection 6(3A)
16 At the end of subsection 6(7)
17 Section 6B (heading)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.151
6B Breach of a registered APP code
18 Subsections 6B(1), (2), (3) and (4)
Substitute approved privacy code with registered APP code.
19 After section 6B
6BA Breach of the registered CR code
Act or practice breaches CR code if it is contrary to the code.
Act or practice is contrary to the code.
Temporal relation: Act or practice breaches CR code during its execution.
Breach of CR code occurs during the act or practice's execution.
Act or practice implies breach of CR code if it is contrary to the code.
Breach of CR code implies act or practice.
Breach of CR code diffuses to all acts or practices that are contrary to the code.
All acts or practices that are contrary to the code diffuse breach of CR code.
CogAI recognizes breach of CR code in act or practice if it is contrary to the code.
Breach of CR code is recognized by CogAI in act or practice.
20 Subsection 7(2)
Omit 'an approved privacy code' and substitute 'a registered APP code'.
21 Subsection 7B(2) (note)
Replace 'or a binding approved privacy code' with 'or a registered APP code that binds the organisation'.
22 Subsection 13B(1) (note)
Granting permission for a registered APP code that binds them.
23 Subsection 13B(1) (paragraph (b) of the note)
24 Subsection 13B(1A) (note)
Omit 'a binding approved privacy code' and substitute with a registered APP code that binds the body.
25 Subsection 13C(1) (note)
Substitute APP code for approved privacy code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.152
26 Subsection 13C(1) (note)
Omit specified phrase from approved privacy code
27 Division 5 of Part III
28 Part IIIAA
29 Before Part IV
26 Guide to this Part
An APP entity must not breach a registered APP code.
APP code developers or the Commissioner may develop APP codes.
26A APP entities to comply with binding registered APP codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.153
26B What is a registered APP code
26B(1) What is a registered APP code
A registered APP code is an APP code included on the Codes Register and in force.
(1) A registered APP code is an APP code:
An APP code included on the Codes Register and in force.
Temporal relationship between registration and commencement
During the compilation period, the APP code is registered.
26B(2) What is a registered APP code
A registered APP code is a legislative instrument.
26B(3) What is a registered APP code
26C What is an APP code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.154
26C(1) What is an APP code
An APP code is a written code of practice about information privacy.
26C(2) What is an APP code
Must specify how APP principles are applied and which entities are bound
set out the period during which the code is in force (which must not start before the day the code is registered under section 26H);
(b) specify the APP entities that are bound by the code, or a way of determining the APP entities that are bound by the code;
26C(3) What is an APP code
Imposes additional requirements on APP codes
Obligation to comply with additional requirements
(3) An APP code may do one or more of the following:
26C(4) What is an APP code
An APP code may apply to personal information, activities, industry sectors, or professions.
Personal information, activities, sectors, or professions
26C(5) What is an APP code
An APP code is not a legislative instrument.
26D Extension of Act to exempt acts or practices covered by
This Act applies in relation to the code as if that act or practice were not exempt.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.155
If a registered APP code covers an act or practice that is exempt, this Act applies.
A registered APP code covers an act or practice that is exempt.
26E Development of APP codes by APP code developers
26E(1) Development of APP codes by APP code developers
An APP code developer may develop an APP code at the Commissioner's request.
26E(2) Development of APP codes by APP code developers
Commissioner may request APP code developer to develop an APP code.
26E(3) Development of APP codes by APP code developers
Specify period for compliance and effect of section 26A
request must specify period and set out effect
26E(4) Development of APP codes by APP code developers
The period must run for at least 120 days from the date the request is made.
(4) The period must run for at least 120 days from the date the request is made;
(4) The period may be extended by the Commissioner;
26E(5) Development of APP codes by APP code developers
Specify matters and entities bound by the APP code
26E(6) Development of APP codes by APP code developers
Commissioner cannot require APP code to cover exempt act or practice.
26E(7) Development of APP codes by APP code developers
Publicly available copy of request must be made by the Commissioner.
Duty to make publicly available copy of request.
26F Application for registration of APP codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.156
26F(1) Application for registration of APP codes
Developer may apply for registration of APP code.
26F(2) Application for registration of APP codes
Must make draft publicly available, invite public submissions, and consider submissions.
26F(3) Application for registration of APP codes
Application must be made in specified form and manner.
Information as specified by the Commissioner.
26F(4) Application for registration of APP codes
Commissioner's consent required for varying APP code
26G Development of APP codes by the Commissioner
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.157
26G(1) Development of APP codes by the Commissioner
The Commissioner must register the APP code developed as requested if a request was made under subsection 26E(2) and it has not been complied with.
The Commissioner must register the APP code.
A request was made under subsection 26E(2).
The Commissioner does not need to register the APP code if a request was made under subsection 26E(2) and it has been complied with.
26G(2) Development of APP codes by the Commissioner
Commissioner must develop APP code if in public interest, with exemptions
26G(3) Development of APP codes by the Commissioner
Commissioner must make draft of APP code publicly available and invite public to submit comments.
Commissioner must make draft of APP code publicly available.
Commissioner should consider submissions made by the public.
Commissioner has received submissions from the public.
Commissioner should give consideration to these submissions.
26H Commissioner may register APP codes
26H(1) Commissioner may register APP codes
26H(2) Commissioner may register APP codes
Commissioner may consult and consider matters when deciding to register APP code.
Permission to consult and consider matters.
26H(3) Commissioner may register APP codes
Commissioner must give written notice of decision to developer.
26J Variation of registered APP codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.158
26J(1) Variation of registered APP codes
Commissioner may approve variation of registered APP code
Commissioner has permission to approve variation
26J(2) Variation of registered APP codes
Information specified by the Commissioner
26J(3) Variation of registered APP codes
Variation of registered APP codes must not deal with exempt acts or practices.
Prohibits variation of registered APP codes with exempt acts or practices.
26J(4) Variation of registered APP codes
Commissioner must consult and consider public comments before approving a variation.
Draft of the variation and opportunity for public comment
Duty to consult and consider public comments
26J(5) Variation of registered APP codes
Consider matters specified in relevant guidelines when deciding to approve a variation.
Obligation to consider relevant guidelines
26J(6) Variation of registered APP codes
Commissioner must remove original code and register varied APP code
Duty to remove original code and register varied APP code
26J(7) Variation of registered APP codes
Variation of registered APP codes comes into effect on a specified day after approval.
26J(8) Variation of registered APP codes
An approval is not a legislative instrument.
Temporal relation between inclusion and registration
An approval is not a legislative instrument. Note: The APP code, as varied, is a legislative instrument once it is included on the Codes Register: see section 26B.
Implication from definition to conclusion
The APP code, as varied, is a legislative instrument once it is included on the Codes Register: see section 26B.
26K Removal of registered APP codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.159
26K(1) Removal of registered APP codes
Commissioner may remove APP code from Codes Register.
26K(2) Removal of registered APP codes
26K(3) Removal of registered APP codes
Consultation and public comment requirement before removing registered APP code
Duty to consult and consider public comment
26K(4) Removal of registered APP codes
Consider relevant guidelines when removing registered APP codes
26L Entities to comply with the registered CR code if bound by the
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.160
26M What is the registered CR code
26M(1) What is the registered CR code
The registered CR code is the CR code that is included on the Codes Register.
26M(2) What is the registered CR code
The registered CR code is a legislative instrument.
26M(3) What is the registered CR code
Conditional commencement of registered CR code
26N What is a CR code
26N(1) What is a CR code
A written code of practice about credit reporting is required.
26N(2) What is a CR code
A CR code must set out how to apply Part IIIA provisions and make provision for matters required or permitted by the code.
Must provide a CR code that sets out how to apply Part IIIA provisions.
(2) A CR code must: (a) set out how one or more of the provisions of Part IIIA are to be applied or complied with;
Must make provision for matters required or permitted by the code.
(2) A CR code must: (b) make provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code;
(2) A CR code must: (c) bind all credit reporting bodies;
Must specify the credit providers that are bound by the code.
(2) A CR code must: (d) specify the credit providers that are bound by the code, or a way of determining which credit providers are bound;
Must specify any other entities subject to Part IIIA that are bound by the code.
(2) A CR code must: (e) specify any other entities subject to Part IIIA that are bound by the code, or a way of determining which of those entities are bound.
26N(3) What is a CR code
Imposes additional requirements on CR codes
(3) A CR code may do one or more of the following:
26P Development of CR code by CR code developers
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.161
26P(1) Development of CR code by CR code developers
Commissioner may request CR code developer to develop a CR code.
26P(2) Development of CR code by CR code developers
Specify period for compliance and effect of section 26L
26P(3) Development of CR code by CR code developers
Extension of request period by Commissioner
Granting permission to extend the request period
26P(4) Development of CR code by CR code developers
Specify matters, credit providers, and entities bound by the code.
26P(5) Development of CR code by CR code developers
26Q Application for registration of CR code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.162
26Q(1) Application for registration of CR code
Developer may apply for registration of CR code
26Q(2) Application for registration of CR code
26Q(3) Application for registration of CR code
26Q(4) Application for registration of CR code
Consent required from Commissioner to vary CR code
26R Development of CR code by the Commissioner
26R(1) Development of CR code by the Commissioner
Commissioner may develop CR code under certain conditions.
26R(2) Development of CR code by the Commissioner
Commissioner must make draft publicly available and invite public submissions.
26S Commissioner may register CR code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.163
26S(1) Commissioner may register CR code
26S(2) Commissioner may register CR code
Commissioner must consult and consider guidelines when deciding to register CR code
Commissioner must consult and consider guidelines
26S(3) Commissioner may register CR code
Commissioner must give written notice to developer if not registering CR code
26S(4) Commissioner may register CR code
Ensure one and only registered CR code at all times after commencement.
26T Variation of the registered CR code
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.164
26T(1) Variation of the registered CR code
Commissioner may approve variation of registered CR code
26T(2) Variation of the registered CR code
26T(3) Variation of the registered CR code
Duty to consult and consider public comment on variation
(a) draft of the variation, (b) consultation results
26T(4) Variation of the registered CR code
Consider relevant guidelines when deciding to approve a variation.
26T(5) Variation of the registered CR code
Commissioner must remove original code and register varied CR code
Duty to remove original code and register varied CR code
26T(6) Variation of the registered CR code
Variation of the registered CR code comes into effect on a specified day after approval.
26T(7) Variation of the registered CR code
Temporal relation between CR code variation and legislative instrument status
An approval is not a legislative instrument. Note: The CR code, as varied, is a legislative instrument once it is included on the Codes Register: see section 26M.
26U Codes Register
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.165
26U(1) Codes Register
The Commissioner must keep a Codes Register.
26U(2) Codes Register
The Commissioner is not required to include certain codes on the Codes Register.
26U(3) Codes Register
The Commissioner must make the Codes Register available on the website.
26U(4) Codes Register
Commissioner may charge fees for providing copies or extracts from the Codes Register.
26V Guidelines relating to codes
26V(1) Guidelines relating to codes
Commissioner must make written guidelines to assist with APP code development and application.
26V(2) Guidelines relating to codes
Commissioner may make written guidelines about matters in deciding certain actions.
26V(3) Guidelines relating to codes
Commissioner may publish guidelines on website
26V(4) Guidelines relating to codes
Guidelines are not a legislative instrument.
26W Review of operation of registered codes
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.166
26W(1) Review of operation of registered codes
Commissioner may review operation of registered APP code.
26W(2) Review of operation of registered codes
Commissioner may review operation of registered CR code.
Commissioner has an obligation to review operation of registered CR code.
30 Subsection 36(1)
Replace specific phrase with alternative phrase.
31 Subsections 36(1A), (1B) and (1C)
32 Subsections 54(1A), 55A(7) and 55B(2)
33 Subsection 55B(3)
34 Subsection 55B(3)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.167
35 Subsection 55B(4)
36 Subsection 64(1)
37 Subsection 64(2)
38 Section 95C
Substitute 'a registered APP code' for 'an approved privacy code'
Replaces approved privacy code with registered APP code
1 After section 2
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.168
2A Objects of this Act
Promote protection of individual privacy and balance with entity interests.
Promote protection of individual privacy.
2 Subsections 5B(1) and (1A)
2(1) Subsections 5B(1) and (1A)
2(1A) Subsections 5B(1) and (1A)
Australian Privacy Principle not breached if required by foreign law
3 Subsection 5B(2) (heading)
Repeal heading and substitute with 'Australian link'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.169
4 Subsection 5B(2)
Granting permission for an organisation or small business operator to have an Australian link.
5 Subsection 5B(3) (heading)
6 Subsection 5B(3)
Replaces a condition with an alternative requirement for an Australian link.
Replaces a condition with an alternative requirement.
7 Paragraphs 5B(3)(a), (b) and (c)
Insert “or operator” after “organisation”.
8 Subsection 5B(4)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.170
11 Subsection 6(1) (all the definitions of breach)
Repeal definitions, substitute new meanings for breach
Replace existing breach definitions with new ones
14 Subsection 6(1) (definition of code complaint)
Replace 'the complainant' with 'an individual'
Replacing 'the complainant' with 'an individual'
An individual is replaced by the complainant
15 Subsection 6(1)
Definition of committee of management of an unincorporated association.
16 Subsection 6(1) (definition of credit reporting complaint)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.171
Defence Department means the Department of State that deals with defence and that is administered by the Minister administering section 1 of the Defence Act 1903.
18 Subsection 6(1) (definition of file number complaint)
19 Subsection 6(1) (paragraph (a) of the definition of file
21 Subsection 6(1) (definition of individual concerned)
Repeal definition of individual concerned
22 Subsection 6(1)
Definition of monitoring related functions
Offences against this Act are also offences against other Acts.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.172
Subclass relationship between the Act and other Acts.
Definition of recognised external dispute resolution scheme
26 Subsection 6(1) (definition of tax file number information)
Omit ‘(including information forming part of a database’) from the definition.
Prohibits omitting ‘(including information forming part of a database’) from the definition.
27 Subsection 6(3)
28 Subsection 6(6)
Omit 'Department of Defence', substitute 'Defence Department'.
29 Paragraphs 7(1)(ca) and (g) and (1A)(c)
30 Subsection 7(2)
Substitute “in relation to the principles and such a code” for “under section 27”.
31 Paragraph 7(2)(b)
32 Subsection 7(3A)
33 Subsection 7(4)
Modify certain paragraphs in section 28 and 28A.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.173
34 Section 12B (heading)
12B Severability—additional effect of this Act
Severability—additional effect of this Act
35 Subsections 12B(1) and (2)
35(1) Subsections 12B(1) and (2)
Regulated entities subject to the Act's effect
The Act has no effect in relation to these entities
35(2) Subsections 12B(1) and (2)
The Act has the effect of giving effect to specific articles of international human rights covenants.
The Act has the effect of giving effect to specific articles.
(2) This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to an operation to give effect to the following:
The Act has the effect it would have if its operation in relation to regulated entities were expressly confined to an operation to give effect to the following:
The operation is confined to a specific time period.
The operation overlaps with a specific time period.
The operation occurs before a specific event.
The operation diffuses into a specific entity.
The Act has knowledge of specific human rights.
36 Subsection 12B(3)
Omit “to organisations”, substitute ‘to regulated entities’.
37 Subsection 12B(3)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.174
38 Subsection 12B(3)
39 Subsections 12B(4) and (5)
Omit 'organisations' and substitute 'regulated entities'.
40 After subsection 12B(5)
Regulated entities must comply with banking and insurance regulations.
41 Subsections 12B(6) to (8)
42 Sections 13 and 13A
Repeal sections and substitute with new ones.
13 Interferences with privacy
13(1) Interferences with privacy
Interference with privacy defined as breach of APP principle or code
13(2) Interferences with privacy
Interference with privacy defined as breach of Part IIIA or registered CR code.
13(3) Interferences with privacy
Interference with privacy is prohibited if it breaches an Australian Privacy Principle or a registered APP code.
Prohibition of interference with privacy
(3) An act or practice of an organisation is an interference with the privacy of an individual...
...the act or practice does not breach: (i) an Australian Privacy Principle; or (ii) a registered APP code...
Temporal relation between interference with privacy and breach of Australian Privacy Principle
(3) An act or practice of an organisation is an interference with the privacy of an individual if: (a) the act or practice relates to personal information about the individual; and...
...the act or practice does not breach: (i) an Australian Privacy Principle;
Recurring trace of interference with privacy and breach of registered APP code
...the act or practice does not breach: (ii) a registered APP code;
Obligation to prevent interference with privacy
...the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract);
13(4) Interferences with privacy
Interference with tax file number information is prohibited.
Prohibits interference with tax file number information.
13(5) Interferences with privacy
Interference with privacy defined as breach of specific Acts or rules.
43 Subsection 13B(1)
Substitute subsection 13(1) for omitted paragraphs.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.176
44 Subsection 13B(1)
Substitute 'of an individual' with itself.
45 Subsection 13B(2)
Does not prevent an act or practice from being an interference with the privacy of an individual under subsection 13(3).
46 Subsection 13C(1)
Substitute “of the individual” with “of the individual”.
47 Subsection 13C(2)
Subsection (1) has effect despite subsections 13(1) and (3).
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.177
(2) Subsection (1) has effect despite subsections 13(1) and (3).
48 Subsection 13D(1)
49 Subsection 13D(2)
Overrides effects of subsections 13(1) and (3)
50 Sections 13E and 13F
13E Effect of sections 13B, 13C and 13D
Organisations may still interfere with individual privacy despite sections 13B, 13C and 13D.
13F Act or practice not covered by section 13 is not an interference
An act or practice not covered by section 13 is not an interference with the privacy of an individual.
13G Serious and repeated interferences with privacy
Serious and repeated interferences with privacy are prohibited.
Prohibits serious and repeated interferences with privacy.
51 Section 17
Repeal section and substitute with new text.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.178
17 Rules relating to tax file number information
The Commissioner must issue rules concerning tax file number information.
52 Section 18 (heading)
18 File number recipients to comply with rules
File number recipients to comply with rules
53 Section 18
54 Sections 27 to 29
Repeal sections and substitute with new provisions.
27 Functions of the Commissioner
27(1) Functions of the Commissioner
The Commissioner has various functions under the Act.
27(2) Functions of the Commissioner
Commissioner has power to perform functions
Commissioner's power to perform functions
The Commissioner has the power to perform its functions.
Power is exercised during function performance
The Commissioner's power to perform functions is exercised during the performance of its duties.
The Commissioner's power to perform functions implies that it is able to perform its duties.
Power diffuses through function performance
The Commissioner's power to perform functions diffuses through the performance of its duties.
The Commissioner's power to perform functions is exercised through its own agency.
27(3) Functions of the Commissioner
Commissioner may establish a panel to assist in performing functions.
27(4) Functions of the Commissioner
Section 38 of the Healthcare Identifiers Act 2010 applies in relation to an investigation.
28 Guidance related functions of the Commissioner
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.179
28(1) Guidance related functions of the Commissioner
Commissioner's guidance related functions
28(2) Guidance related functions of the Commissioner
Commissioner may publish guidelines in an appropriate manner.
28(3) Guidance related functions of the Commissioner
The Commissioner may undertake educational programs
Permission to undertake educational programs
28(4) Guidance related functions of the Commissioner
Legislative instruments are not guidelines.
Guidelines are not legislative instruments.
28A Monitoring related functions of the Commissioner
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.180
28A(1) Monitoring related functions of the Commissioner
The Commissioner must monitor and ensure compliance with certain rules.
28A(2) Monitoring related functions of the Commissioner
The Commissioner must examine proposed enactments and proposals for data matching or linkage to ensure they do not have adverse effects on privacy.
The Commissioner must perform the specified actions.
28A(3) Monitoring related functions of the Commissioner
Commissioner may perform functions on request or initiative
28A(4) Monitoring related functions of the Commissioner
Instrument is not a legislative instrument if reporting is done in writing.
Instrument is not a legislative instrument.
28B Advice related functions of the Commissioner
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.181
28B(1) Advice related functions of the Commissioner
The Commissioner must provide advice on matters relevant to the operation of the Act.
28B(2) Advice related functions of the Commissioner
Functions may be performed by Commissioner on request or initiative.
28B(3) Advice related functions of the Commissioner
The Commissioner may perform a function whenever necessary.
28B(4) Advice related functions of the Commissioner
Instrument is not a legislative instrument if Minister is informed in writing or report is provided in writing.
Minister informed in writing or report provided in writing
29 Commissioner must have due regard to the objects of the Act
Commissioner must have due regard to the objects of the Act
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.182
55 Subparagraph 30(1)(b)(ii)
Repeal and substitute a provision regarding conciliation.
56 Subsection 30(3)
Prohibits omitting specified paragraph references.
57 Subsection 30(3)
Interference with individual privacy is prohibited.
Prohibits interference with individual privacy.
58 Subsection 30(6)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.183
59 Subsection 31(1)
Substitute paragraph 28A(2)(a) for paragraph 27(1)(b)
60 Subsection 31(2)
Substitute “entity” for “agency or organisation”.
61 Section 32 (heading)
32 Commissioner may report to the Minister if the Commissioner
The Commissioner must report to the Minister if certain activities are monitored.
The Commissioner has monitored certain activities.
The Commissioner must report to the Minister.
62 Subsection 32(1)
The Commissioner must report to the Minister about an activity or assessment if directed.
63 Subsection 32(2)
64 After section 33B
Inserts amendments of the Privacy Act 1988
33C Commissioner may conduct an assessment relating to the
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.184
33C(1) Commissioner may conduct an assessment relating to the
Commissioner must conduct an assessment of certain matters.
33C(2) Commissioner may conduct an assessment relating to the
Commissioner may conduct assessment in manner considered fit.
33D Commissioner may direct an agency to give a privacy impact
33D(1) Commissioner may direct an agency to give a privacy impact
Commissioner may direct an agency to give a privacy impact assessment.
33D(2) Commissioner may direct an agency to give a privacy impact
Must provide a privacy impact assessment.
33D(3) Commissioner may direct an agency to give a privacy impact
Agency must conduct a privacy impact assessment
33D(4) Commissioner may direct an agency to give a privacy impact
33D(5) Commissioner may direct an agency to give a privacy impact
Failure to comply with a direction is prohibited.
A privacy impact assessment is not a legislative instrument.
33D(6) Commissioner may direct an agency to give a privacy impact
Agency must comply with direction from Commissioner regarding privacy impact.
33D(7) Commissioner may direct an agency to give a privacy impact
Commissioner may direct an agency to give a privacy impact review after five years.
33E Commissioner may accept undertakings
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.185
33E(1) Commissioner may accept undertakings
Commissioner may accept undertakings for specified actions or refraining from taking action.
Obligation to take specified actions or refrain from taking action.
33E(2) Commissioner may accept undertakings
33E(3) Commissioner may accept undertakings
Commissioner must consent to withdraw or vary undertaking.
33E(4) Commissioner may accept undertakings
33E(5) Commissioner may accept undertakings
Commissioner may publish undertaking on website
33F Enforcement of undertakings
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.186
33F(1) Enforcement of undertakings
Commissioner may apply for order if entity breaches undertaking.
(c) the Commissioner considers that the entity has breached the undertaking;
33F(2) Enforcement of undertakings
Court may order entity to comply with undertaking or compensate for breach.
Entity has a duty to comply with the undertaking.
65 Subsections 34(1) and (2)
Substitute Commissioner's functions for 'functions referred to in section 27'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.187
66 At the end of Part IV
35A Commissioner may recognise external dispute resolution
35A(1) Commissioner may recognise external dispute resolution
Commissioner may recognise external dispute resolution scheme.
Classifies entities or classes of entities.
35A(2) Commissioner may recognise external dispute resolution
Commissioner must consider certain factors when recognising an external dispute resolution scheme.
Commissioner must consider certain factors.
(2) In considering whether to recognise an external dispute resolution scheme, the Commissioner...
Commissioner must consider factors that occur after scheme recognition.
35A(3) Commissioner may recognise external dispute resolution
Commissioner may specify period for recognition of external dispute resolution scheme and subject it to conditions.
35A(4) Commissioner may recognise external dispute resolution
Notice under subsection (1) is not a legislative instrument.
67 Part V (heading)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.188
68 Before Division 1 of Part V
36A Guide to this Part
Individuals have a right to complain about privacy interference and the Commissioner must investigate.
Individuals have a duty to complain about privacy interference.
An individual may complain to the Commissioner...
Entities must comply with determination declarations.
An entity to which a determination relates must comply with certain declarations...
Entities have a duty to comply with determination declarations.
Court proceedings can be commenced to enforce a determination.
After an investigation, the Commissioner may make a determination...
Determination is a basis for court proceedings.
The Commissioner must investigate complaints.
If a complaint is made, the Commissioner is required to investigate...
The Commissioner has a duty to investigate complaints.
69 Subsection 36(7) (note)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.189
70 Subsection 36(8)
Omit specific text and substitute with alternative text.
71 Subsection 36(8)
72 Subsection 38(1)
73 Paragraph 38(1)(a)
74 Subsection 38(2)
75 Subsection 38B(2)
Omit all words after 'representative' and substitute with specific clause.
Prohibits omitting words after 'representative'
76 Add at the end of subsection 38B(2)
Member may make complaint under section 36 if withdrawn from representative complaint.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.190
77 Subsections 40(1B) and (1C)
Repeal subsections and substitute with new provisions
78 Subsection 40(2)
Insertion of initiative clause after 'Commissioner may'
79 Paragraph 40(2)(a)
Insertion of 'or a breach of Australian Privacy Principle 1' after 'individual'
80 Section 40A
Repeal section and substitute with new provision
40A Conciliation of complaints
40A(1) Conciliation of complaints
Commissioner must attempt to conciliate a complaint if reasonably possible.
40A(2) Conciliation of complaints
Commissioner's decision not to investigate is a condition for subsection (1) not applying.
Commissioner's decision affects the applicability of subsection (1)
Commissioner's decision is a temporal subset of investigation decisions
Commissioner's decision overlaps with investigation decisions
40A(3) Conciliation of complaints
Commissioner must notify complainant and respondent if conciliation is not possible.
Temporal relationship between notification and conciliation process
(3) If the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner must, in writing, notify the complainant and respondent of that matter.
Implication of notification on conciliation process
Spread of information about notification
Assertion of notification by Commissioner
40A(4) Conciliation of complaints
Commissioner may decide not to investigate or further investigate a complaint.
Commissioner has the power to decide not to investigate.
40A(5) Conciliation of complaints
Complainant and respondent must agree for evidence to be admissible.
Obligation on the state to provide admissible evidence.
The complainant and respondent must agree.
Evidence is admissible unless they disagree.
81 Section 41 (heading)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.191
41 Commissioner may or must decide not to investigate etc. in
Commissioner must decide not to investigate in certain circumstances.
82 Subsection 41(1)
Prohibits Commissioner from accepting certain phrases.
83 At the end of paragraphs 41(1)(a) and (c)
Add “or” at the end of paragraphs 41(1)(a) and (c)
84 Paragraph 41(1)(d)
85 After paragraph 41(1)(d)
Investigation not warranted due to circumstances, complainant non-response, external dispute resolution scheme, or effective alternative
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.192
86 After subsection 41(1)
Cannot investigate complaint if complainant has withdrawn it.
87 Subsections 41(2) and (3)
88 Section 42
89 Section 42
Omit specified phrase from subsection 40(1B)
90 Section 42
Substitute 'respondent or any other person' for 'respondent'
91 At the end of section 42
The Commissioner may make inquiries of any person for the purpose of determining whether to investigate an act or practice under subsection 40(2).
92 After subsection 43(1)
Commissioner must inform person or entity before investigating an act or practice.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.193
93 Subsection 43(2)
94 Subsections 43(4), (5) and (6)
Commissioner may make a determination without holding a hearing under certain conditions.
Commissioner may make a determination without holding a hearing.
95 Subsection 43(7)
Omit provision allowing appearance before Commissioner and submissions.
Prohibits omission of provision allowing appearance before Commissioner and submissions.
96 Subsection 43(8A)
Omit reference to approved privacy code or National Privacy Principles.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.194
97 After section 43
43A Interested party may request a hearing
43A(1) Interested party may request a hearing
Request for hearing before Commissioner's determination
43A(2) Interested party may request a hearing
Commissioner must notify and give opportunity to make submission about request.
Must provide notification and opportunity for submission.
43A(3) Interested party may request a hearing
Defines 'interested party' for investigation purposes.
98 Subsection 44(4)
Substitute 'section' for 'sections 69 and'
99 Subsection 46(1)
Omit specific phrase from subsection 46(1)
100 Subsection 50(1)
101 At the end of paragraph 50(2)(a)
Add to a recognised external dispute resolution scheme
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.195
102 Subsection 50(2)
Prohibits the use of specified entities.
103 Paragraphs 50(2)(c) and (e)
104 At the end of paragraph 50(3)(a)
Add to recognised external dispute resolution scheme
105 Subsection 50A(2) (note 2)
The Commissioner may determine under section 53B that the determination applies in relation to an agency if the organisation has not complied with the determination.
106 Subparagraph 52(1)(b)(i)
107 After subparagraph 52(1)(b)(i)
Mandatory steps for respondent to prevent repeated conduct
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.196
108 Subparagraph 52(1)(b)(ii)
109 Subsection 52(1A)
Commissioner may make a determination that includes one or more of the following declarations.
Commissioner has an obligation to make a determination.
The Commissioner's determination includes one or more of the following declarations.
110 Subsection 52(1B)
Insertion of subsection (1A) after subsection (1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.197
111 Subsections 52(3A) and (3B)
Commissioner may consider necessary or appropriate orders in a determination.
Commissioner has an obligation to consider necessary or appropriate orders.
112 Subsection 53A(1)
Omit specific phrase from contract provision
113 Section 53B (heading)
53B Substituting an agency for a contracted service provider
114 Paragraph 53B(1)(a)
Repeal paragraph, substitute with new obligation under section 52 for contracted service providers.
Replace existing paragraph with new obligation.
115 After subparagraph 53B(1)(b)(i)
Declaration under paragraph 52(1A)(d) that one or more individuals are entitled to a specified amount by way of compensation.
116 Paragraph 53B(1)(c)
Omit 'respondent', substitute 'provider'.
117 Paragraph 53B(1)(d)
Insert “or individuals” after “complainant”.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.198
118 Paragraph 53B(1)(d)
Modify paragraph (b) of section 53B(1)(d)
119 Subsection 53B(2)
Insertion of phrase after 'writing that'
120 Subsection 53B(2)
121 Subsection 53B(2) (at the end of the note)
122 Subsection 54(1)
Modify 'respondent' to 'determination applies in relation to'
123 Section 55
Repeal section and substitute with new content.
55 Obligations of organisations and small business operators
Must not repeat or continue conduct covered by a declaration included in the determination.
124 Subsection 55A(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.199
Imposes a duty on others to substitute 'The' for 'Any of the'
125 Paragraphs 55A(1)(a) to (c)
Repeal paragraphs and substitute with new provisions
126 Subsection 55A(2)
Omit 'respondent', substitute 'person or entity in relation to which the determination applies'.
127 Subsection 55A(2)
Imposes a duty on the legislative body to replace 'the complainant' with 'an individual'
128 Subsection 55A(5)
129 Subsection 55A(5)
130 Paragraph 55A(6)(c)
Omit 'appearance', substitute 'hearing'.
131 Paragraph 55A(6)(c)
132 Subsection 55A(7A)
Prohibits the Commissioner from having due regard to specific matters.
Omit ‘matters that paragraph 29(a) requires the Commissioner to have due regard to’
133 Paragraphs 55B(1)(a) and (b) and (3)(a) and (b)
Repeal paragraphs and substitute with conditions for breach of Australian Privacy Principle or APP code
134 Subsection 57(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.200
Defines temporal interval for substitution
The substitution occurs at the specified time
The new phrase applies from the start of the agency's operation to its closure
Establishes implication between omitted phrase and alternative text
Omitting the phrase implies the use of an alternative text
The alternative text is used when the specified phrase is omitted
Propagates substitution to related agencies or executives
The substitution applies to all agencies and principal executives
All related agencies and principal executives must use the alternative text
Draws inference about agency or executive behavior
The substitution implies a change in agency or executive behavior
Agencies and executives must adapt to the new text
135 Section 58
58 Obligations of agencies
Agency must not repeat or continue conduct covered by a declaration included in the determination.
Agency must not repeat or continue conduct.
136 Section 59
Omit specific phrase from agency executive determination
Prohibits the principal executive of an agency from being the respondent to a determination
137 Paragraph 59(b)
138 After paragraph 59(b)
Obligation to take steps within specified period
139 At the end of paragraph 59(c)
Add 'or paragraph 52(1A)(c)' to the end of paragraph 59(c)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.201
Adding a clause to an existing provision
The text adds a new clause to paragraph 59(c)
A new obligation is imposed on the state
Extending a temporal interval by adding a new clause
The text adds 'or paragraph 52(1A)(c)' to the end of paragraph 59(c)
The new clause extends the temporal interval of the provision
Adding a new clause to an existing provision through diffusion
The new clause is diffused into the provision
Adding a new clause to an existing provision through cognitive AI
The new clause is added to the provision using cognitive AI
140 Subsection 60(1)
141 Subsection 60(1)
Insertion of 'or individual' after 'complainant'
142 Subsection 60(2)
143 Subsection 60(2)
144 Section 61
145 Subsection 62(3)
Application may be made by complainant or Commissioner
146 Subsection 62(4)
Omit 'respondent', substitute 'agency or principal executive'
147 Paragraph 62(5)(a)
148 At the end of section 62
Defines complainant for a representative complaint.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.202
149 Subsection 63(2A)
150 Paragraphs 67(aa) and (ab)
151 Sections 69 and 70A
152 Subsection 72(1)
153 Subsection 72(2) (heading)
154 Paragraph 72(2)(a)
Prohibits breach of Australian Privacy Principle or registered APP code
155 Paragraph 72(2)(b)
156 Paragraph 72(2)(b)
157 Subsection 72(2)
Omit 'make a written', substitute ', by legislative instrument, make a'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.203
158 Subsection 72(3)
159 Subsection 72(4)
160 Subsection 72(4)
161 Subsection 72(4)
Omit “organisation does”, substitute ‘APP entity does’.
162 Subsection 72(4)
163 Section 73 (heading)
73 Application by APP entity
164 Subsection 73(1)
Substitute 'An APP entity' for 'An agency or organisation'
165 Subsection 73(1)
Substitute “the entity” for “the agency or organisation”.
166 After subsection 73(1)
Prohibits Commissioner from dismissing frivolous applications
167 Section 74 (heading)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.204
74 Publication of application etc.
168 Subsection 74(1)
Omit all words after 'notice' and substitute with specific phrases.
Prohibit omission of words after 'notice'
169 At the end of subsection 75(1)
Add “unless the Commissioner dismisses the application under subsection 73(1A)”.
170 Subsection 79(3)
171 Section 80
172 Paragraph 80A(1)(a)
Substitute 'APP entity' for 'agency or organisation'
173 Subparagraphs 80A(1)(a)(i) and (ii)
Repeal subparagraphs and substitute with an Australian Privacy Principle or a registered APP code.
174 Paragraph 80A(1)(b)
Replace 'agency or organisation' with 'entity'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.205
175 Paragraph 80A(1)(b)
176 Subsection 80A(2)
Substitute legislative instrument for 'make a written temporary public interest'
177 Paragraph 80A(2)(a)
Omit 'agency or organisation', substitute 'APP entity'.
178 Subsection 80A(3)
Specify a period of up to 12 months for the determination to be in force.
179 Subsections 80B(1) and (2)
Entity not breaching section 15 or 26A if act/practice subject to temporary public interest determination.
Temporary public interest determination in force
Entity does act/practice without breaching section 15 or 26A
180 Subsection 80B(3)
181 Subsection 80B(3)
Omit 'organisation is taken to contravene section 16A', substitute 'APP entity is taken to contravene section 15 or 26A'
Prohibits organisation from contravening section 16A
Omit 'organisation is taken to contravene section 16A'
APP entity is taken to contravene section 15 or 26A
Replaces organisation with APP entity in the context of temporal intervals
182 Subsection 80B(3)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.206
183 Subsection 80B(3)
184 Section 80C
185 Paragraph 80D(2)(a)
Prohibits omitting specified subsection references
186 Paragraph 80P(1)(a)
187 Subsections 80P(4) and (5)
No breach of Australian Privacy Principle or APP code for authorized collection, use, or disclosure of personal information.
Authorized collection, use, or disclosure of personal information
188 Paragraphs 80Q(2)(a) and (b)
Grant permission for disclosure under Australian Privacy Principle or registered APP code
189 After Part VIA
Compilation and registration of amendments
80U Civil penalty provisions
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.207
80V Ancillary contravention of civil penalty provisions
80V(1) Ancillary contravention of civil penalty provisions
Prohibition on aiding, abetting, or inducing contravention of civil penalty provisions.
Prohibition on aiding, abetting, or inducing contravention.
80V(2) Ancillary contravention of civil penalty provisions
Entity taken to have contravened civil penalty provision if it contravenes subsection (1) in relation to a civil penalty provision.
If entity contravenes subsection (1), then it contravenes civil penalty provision.
Entity A contravenes civil penalty provision.
Temporal interval during which entity contravenes subsection (1) overlaps with temporal interval during which it contravenes civil penalty provision.
Entity A starts contravening subsection (1) at time T1 and ends at time T2.
T1 overlaps with T2 where T2 is the temporal interval during which Entity A contravenes civil penalty provision.
Entity that contravenes subsection (1) until it stops contravening civil penalty provision.
Entity A starts contravening subsection (1).
Entity A stops contravening civil penalty provision until Entity B stops contravening subsection (1).
Entity that contravenes subsection (1) diffuses to entity that contravenes civil penalty provision.
Entity A diffuses to Entity B where Entity B contravenes civil penalty provision.
CogAI recognizes entity that contravenes subsection (1) as entity that contravenes civil penalty provision.
CogAI recognizes Entity A as Entity B where Entity B contravenes civil penalty provision.
80W Civil penalty orders
80W(1) Civil penalty orders
Entity must pay pecuniary penalty if alleged to have contravened a civil penalty provision.
Entity has an obligation to pay pecuniary penalty.
80W(2) Civil penalty orders
The Commissioner must make the application within 6 years of the alleged contravention.
80W(3) Civil penalty orders
Entity must pay pecuniary penalty to the Commonwealth if found contravening civil penalty provision.
Entity has a duty to pay pecuniary penalty.
80W(4) Civil penalty orders
State has obligation to determine pecuniary penalty
80W(5) Civil penalty orders
80W(6) Civil penalty orders
Court must consider specific factors when determining pecuniary penalty.
(6) In determining the pecuniary penalty, the court...
Circumstances of contravention are considered.
(c) the circumstances in which the contravention took place;
(d) whether the entity has previously been found by a court...
(b) the nature and extent of any loss or damage suffered because of the contravention;
80X Civil enforcement of penalty
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.208
80X(1) Civil enforcement of penalty
A pecuniary penalty is a debt payable to the Commonwealth.
80X(2) Civil enforcement of penalty
The Commonwealth may enforce a civil penalty order as if it were an order made in civil proceedings.
80Y Conduct contravening more than one civil penalty provision
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.209
80Y(1) Conduct contravening more than one civil penalty provision
Entity must comply with multiple civil penalty provisions.
80Y(2) Conduct contravening more than one civil penalty provision
Entity is not liable to more than one pecuniary penalty under this Division in relation to the same conduct.
Entity's liability is limited by this provision.
Entity liable to pecuniary penalty under Division.
Entity not liable to more than one pecuniary penalty.
80Z Multiple contraventions
80Z(1) Multiple contraventions
Entity may be subject to a single civil penalty order for multiple contraventions of the same or similar character.
Entity is subject to a civil penalty order.
(1) The Federal Court or Federal Magistrates Court may make a single civil penalty order...
The entity must provide a civil penalty order.
Entity is subject to multiple contraventions of the same or similar character.
(b) the contraventions form, or are part of, a series of contraventions...
The entity must provide evidence of the contraventions.
Contraventions occur within the same temporal interval.
Contraventions occur in a recurring pattern.
Entity is subject to a civil penalty order for multiple contraventions.
80Z(2) Multiple contraventions
Pecuniary penalty must not exceed the sum of maximum pecuniary penalties for each contravention.
Pecuniary penalty ≤ Maximum pecuniary penalties for each contravention
(2) However, the pecuniary penalty must not exceed the sum of the maximum pecuniary penalties that could be ordered if a separate civil penalty order were made for each of the contraventions.
Temporal interval for determining pecuniary penalty
Pecuniary penalty = Maximum pecuniary penalties for each contravention
The pecuniary penalty must not exceed the sum of the maximum pecuniary penalties that could be ordered if a separate civil penalty order were made for each of the contraventions.
80ZA Proceedings may be heard together
Federal Court or Federal Magistrates Court may direct that proceedings for civil penalty orders are to be heard together.
80ZB Civil evidence and procedure rules for civil penalty orders
Federal Court or Federal Magistrates Court must apply rules of evidence and procedure for civil matters when hearing proceedings for a civil penalty order.
Obligation to apply rules of evidence and procedure
80ZC Contravening a civil penalty provision is not an offence
A contravention of a civil penalty provision is not an offence.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.210
It is not an offence to contravene a civil penalty provision.
It is not the case that it is an offence to contravene a civil penalty provision.
80ZD Civil proceedings after criminal proceedings
Federal Court cannot make a civil penalty order against an entity convicted of the same or substantially similar conduct.
Prohibition on making a civil penalty order
80ZE Criminal proceedings during civil proceedings
80ZE(1) Criminal proceedings during civil proceedings
Stay of civil penalty proceedings during criminal proceedings for the same or substantially similar conduct.
Prevents civil penalty proceedings during criminal proceedings for the same or substantially similar conduct.
(a) Criminal proceedings are commenced or have already been commenced against the entity for an offence; and (b) the offence is constituted by conduct that is the same, or substantially the same, as the conduct alleged to constitute the contravention.
The excerpt describes an overlap between temporal intervals of criminal proceedings and civil penalty proceedings.
The excerpt describes a recurring relationship between criminal proceedings and civil penalty proceedings.
The excerpt describes a diffusion of obligations from criminal proceedings to civil penalty proceedings.
The excerpt describes an inferential relationship between criminal proceedings and civil penalty proceedings.
80ZE(2) Criminal proceedings during civil proceedings
Proceedings dismissed if entity is not convicted of the offence.
Prohibits dismissal if entity is not convicted.
(2) The proceedings for the civil penalty order may be resumed...
Otherwise: (a) the proceedings are dismissed;
Classifies dismissal as a consequence of non-conviction.
80ZF Criminal proceedings after civil proceedings
Criminal proceedings may be commenced against an entity for conduct that is the same, or substantially the same, as conduct that would constitute a contravention of a civil penalty provision.
Prohibits conduct that would constitute a contravention of a civil penalty provision.
80ZG Evidence given in proceedings for civil penalty order not
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.211
80ZG(1) Evidence given in proceedings for civil penalty order not
Prevents admissibility of evidence in criminal proceedings if previously given or produced in civil penalty order proceedings for the same conduct.
Previous civil penalty order proceedings for the same conduct
No admissibility in criminal proceedings
80ZG(2) Evidence given in proceedings for civil penalty order not
Exemption from subsection (1) for criminal proceedings.
190 After paragraph 82(2)(a)
Inserts the Privacy Commissioner within the meaning of the Australian Information Commissioner Act 2010.
191 Paragraph 82(2)(b)
192 Subsection 82(3)
Insert 'and Privacy Commissioner' after 'Commissioner'
193 Paragraph 82(7)(a)
At least one person must have specific experience in industry, public administration, or health privacy.
194 Paragraph 82(7)(b)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.212
195 At the end of paragraph 82(7)(b)
196 Paragraph 82(7)(c)
Requires at least one person with extensive experience in information and communication technologies.
Requires a specific condition to be met.
197 Paragraphs 82(7)(d) and (e)
198 Paragraph 83(b)
Omit 'guidelines', substitute 'rules or guidelines'.
199 Subsections 95(5), 95A(7) and 95AA(3)
200 After section 95C
96 Review by the Administrative Appeals Tribunal
96(1) Review by the Administrative Appeals Tribunal
Application for review of certain decisions by the Administrative Appeals Tribunal.
96(2) Review by the Administrative Appeals Tribunal
Application must be made by the APP code developer
The APP code developer that developed the APP code must make an application.
96(3) Review by the Administrative Appeals Tribunal
Application must be made by the CR code developer.
201 After section 98
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.213
98A Treatment of partnerships
98A(1) Treatment of partnerships
If the Act would impose an obligation on a partnership, it is instead imposed on each partner.
If the Act would impose an obligation on a partnership
98A(2) Treatment of partnerships
Each partner in a partnership commits an offence if the partnership would otherwise commit one.
Each partner has an obligation to comply.
98A(3) Treatment of partnerships
Each partner is liable for the contravention if the partnership would have violated a civil penalty provision.
Each partner is liable for the contravention.
Partnership would have violated a civil penalty provision.
98A(4) Treatment of partnerships
A partner does not commit an offence if they do not know of the circumstances or take reasonable steps to correct them.
The partner does not know of the circumstances
98B Treatment of unincorporated associations
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.214
98B(1) Treatment of unincorporated associations
Imposes obligation on association members
98B(2) Treatment of unincorporated associations
Each member of an unincorporated association's committee of management is liable for an offence committed by the association.
98B(3) Treatment of unincorporated associations
Each member of the association's committee of management is liable for contravention if the association would have violated a civil penalty provision.
Association would have violated a civil penalty provision
98B(4) Treatment of unincorporated associations
Member of unincorporated association's committee of management has an obligation to correct contravention as soon as possible after becoming aware.
Member takes all reasonable steps to correct contravention
Trace of reasonable steps taken to correct contravention
98C Treatment of trusts
98C(1) Treatment of trusts
Imposes obligation on trustee, dischargeable by any trustee
98C(2) Treatment of trusts
Offence against the Act is transferred to each trustee of a trust.
Trustees are liable for the actions of the trust.
Each trustee is held liable for the offence.
98C(3) Treatment of trusts
Each trustee of a trust is liable for contravention of civil penalty provisions.
Liability for contravention of civil penalty provisions.
State is responsible for enforcing civil penalty provisions.
98C(4) Treatment of trusts
Trustee has an obligation to correct contravention as soon as possible after becoming aware of the circumstances.
Trustee has an obligation to correct contravention.
Trustee must take all reasonable steps to correct the contravention.
Trustee knows of circumstances that constitute contravention.
202 Subsection 99A(1)
Insertion of 'or for a civil penalty order'
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.215
203 Subsection 99A(2)
Insert 'or proceedings for a civil penalty order' after 'this Act'
204 Subsection 99A(3)
205 Subsection 99A(4)
206 Subsection 99A(9)
1 Section 2B
Australian Privacy Principle has the same meaning as in the Privacy Act 1988.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.216
2 Subsection 91-2(3)
Omit certain privacy principles and substitute with new ones.
Prohibits the use of certain privacy principles.
3 Subsection 92-7(4)
Prohibits the use of outdated privacy principles
4 Subsection 93-1(5)
5 Clause 1 of Schedule 1 (definition of personal information)
Repeal and substitute definition of personal information with the Privacy Act 1988.
Replace existing definition with new one.
6 Paragraphs 219GA(7)(a) and (b)
Repeal paragraphs and substitute with new text
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.217
7 Subsection 219GA(7)
Substitute 'authorised by this Act' for 'authorised by law'
8 Section 219PA
9 Subsection 35A(3)
Substitute Australian Privacy Principle 6 for the purposes of paragraph 6.2(b) of the Act.
10 Subsection 126(3)
Replace Privacy Act 1988 with Australian Privacy Principles
11 Subsections 13(1) and (2)
12 Subsection 16(2)
13 Subsection 43(1A) (note 2)
Substitute Australian Privacy Principle 6 for Information Privacy Principle 11 in section 14 of the Privacy Act 1988.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.218
14 Subsection 40(2)
Substitute Australian Privacy Principle 6 for the purposes of this Act.
15 Subsection 40(3)
16 Subsection 40(3) (note)
Replace Australian Privacy Principle 11 with Australian Privacy Principle 6.
17 Paragraphs 42(3)(a) and (b)
18 Subsection 42(3)
Omit “or authorised by law”, substitute ‘or authorised by this Act’.
Prohibits the use of 'or authorised by law'
Replaces a temporal interval with another one
19 Section 46 (note)
Omit section 14 of the Privacy Act 1988 and substitute Australian Privacy Principles.
20 Subsection 47(1) (note)
Replace section 14 of the Privacy Act 1988 with Australian Privacy Principles
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.219
21 Subsection 56(12)
Substitute Australian Privacy Principle 6 reference
22 Subsection 7A(1C)
23 Subsection 7A(1C) (note)
Omit paragraph (1)(c) of Information Privacy Principle 10 in section 14 of the Privacy Act 1988, substitute paragraph 6.2(b) of Australian Privacy Principle 6.
24 Paragraph 7A(1D)(a)
25 Subsection 7A(1D) (note)
26 Paragraph 85ZZ(2)(e)
Replace 'Information Privacy Principles' with 'Australian Privacy Principles'
27 Subsection 37ZB(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.220
28 Subsection 72Q(3)
29 Subsection 72Q(3) (note)
Omit and substitute a provision in the Privacy Act 1988.
30 Subsection 36A(4)
Replace 'authorised by law' with 'authorised by this Act'
31 Subsection 79(4)
Substitute 'to be authorised by this Act' for 'authorised by law'
Replace 'to be authorised by law' with 'authorised by this Act'
32 Subsection 45C(4)
Omit 'to be authorised by law', substitute 'to be authorised by this Act'.
Remove the phrase 'to be authorised by law'
33 Subsection 50D(1) (note 1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.221
34 Subsection 54A(1)
35 Subsection 65(7)
36 Subsection 4(1) (definition of personal information)
Substitute definition of personal information from Privacy Act 1988 and Healthcare Identifiers Act 2010.
Repeal previous definition of personal information
37 Section 5 (definition of National Privacy Principle)
38 Subsection 9(6)
Repeal subsection, substitute with new definition of healthcare identifier.
39 Section 18
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.222
40 Paragraph 23(b)
41 Paragraph 26(2)(c)
42 Subsection 19-60(1)
Substitute Australian Privacy Principles for information privacy principles.
43 Section 179-5 (paragraph (a) of the definition of personal
Repeal of paragraph and substitution with new definition for personal information
44 Subclause 23(1) of Schedule 1A
45 Clause 72 of Schedule 1A (paragraph (a) of the definition
Repeal and substitute paragraph (a) of the definition of VET personal information with new conditions.
Prohibits the collection of personal information without consent.
46 Subsection 36(2) (note 2)
Substitute Australian Privacy Principle 6
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.223
47 Subsection 35(4) (note)
Omit National Privacy Principle 2 in Schedule 3 to the Privacy Act 1988
Prohibits omitting National Privacy Principle 2 in Schedule 3 to the Privacy Act 1988
48 Subsection 36(3) (note)
Omit or substitute a provision in the Privacy Act 1988
49 Subsection 37(5) (note)
Omit specified paragraph from Privacy Act 1988
50 Subsection 71(2) (note)
51 Subsection 76(2) (note)
Omit a provision from the Privacy Act 1988
52 Paragraphs 140ZI(2)(a) and (b)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.224
53 Subsection 140ZI(2)
54 Subsection 336FD(1)
Disclosure of personal information is authorized if certain conditions are met.
Authorizes disclosure of personal information
55 Subsection 503A(7)
56 Subsection 409(4)
Substitute Australian Privacy Principles in section 14 of the Privacy Act 1988 with principles authorized by this Act.
Replace existing information with new information.
Omit ‘Information Privacy Principles set out in section 14 of the Privacy Act 1988’.
Australian Privacy Principles, to be authorised by this Act.
Specify that principles are authorized by this Act.
57 Subsection 43D(1)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.225
58 Subsection 9BA(5)
59 Subsection 9BA(6)
60 Subsection 9BA(7) (definition of personal information)
Definition of personal information substituted from Privacy Act 1988.
61 Subsection 135AB(3)
62 Subsection 135AC(1)
Substitute 'this Act' for the purposes of subparagraph 16B(1)(b)(i) of National Health Reform Act 2011
63 Subsection 127(3)
64 Sections 19, 20, 47, 52, 85, 86, 87, 88 and 89 (notes)
Omit certain paragraph from Privacy Act 1988
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.226
65 Paragraphs 210(2)(a) and (b)
66 Subsection 210(2)
67 Subsection 57(3) (note)
Omit certain principles in the Privacy Act 1988 and substitute others.
68 Subsections 7A(1D) and 8(2D)
69 Subsection 128(1) (note)
Omit section 14 of the Privacy Act 1988, substitute Australian Privacy Principles.
Obligation to omit section 14 of the Privacy Act 1988.
70 Subsection 207(7)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.227
71 Paragraph 73(1)(b)
72 Subsection 250-10(2)
Replace an obligation with another obligation
Obligation to be authorised by law is replaced with Obligation to be authorised by this Act
New obligation to be authorised by this Act
Replace an obligation with another obligation using a linear logic rule
73 Clause 1 of Schedule 1 (definition of personal information)
Repeal definition, substitute with Privacy Act 1988
74 Subsection 60(1) (note 1)
Omit paragraph (1)(d) of Information Privacy Principle 11 in section 14 of the Privacy Act 1988, substitute paragraph 6.2(b) of Australian Privacy Principle 6.
75 Section 66AZD
76 Section 66AZD (note)
77 Subsection 137A(3)
Omit specific subclauses from National Privacy Principle 7
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.228
78 Subsection 137A(3) (note 1)
Omit Subclause 7.1, substitute Australian Privacy Principle 9.
79 Subsection 202(8) (note)
Substitute Australian Privacy Principles for section 14 of the Privacy Act 1988
Imposes a duty on the legislative body to substitute
80 Subsection 105(2)
81 Subsection 299LA(3)
82 Subsection 299LA(3) (note 1)
83 Paragraph 12(3)(b)
Substitute Australian Privacy Principles
Imposes a duty on the State to substitute Australian Privacy Principles
84 Subparagraph 117(1)(k)(i)
Replace National Privacy Principles with Australian Privacy Principles.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.229
Imposes a duty to replace National Privacy Principles with Australian Privacy Principles.
85 Subparagraph 117(1)(k)(ii)
Omit ‘that Act that relate to those Principles’
Substitute ‘the Privacy Act 1988 that relate to those principles’
86 Subsection 118(1) (note)
87 Paragraph 118(4A)(a)
88 Paragraph 118(4A)(b)
89 Subsection 121(1A)
90 Subsection 122(3)
91 Subsection 130(1) (note)
92 Paragraph 134(1)(a)
93 Paragraph 134(1)(b)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.230
94 Section 303B (heading)
303B Acts taken to be authorised by this Act for purposes of Privacy
Acts taken to be authorised by this Act for purposes of Privacy
95 Subsections 303B(1) and (2)
96 Subclause 15(2) of Schedule 2
Replace outdated privacy principles with Australian Privacy Principles.
97 Subparagraphs 147(2)(l)(i) and (ia)
Repeal subparagraphs and substitute with Australian Privacy Principle 6.
Imposes an obligation to repeal subparagraphs.
98 Subsections 61(4B) and (5B)
Authorization required for certain actions
Action cannot be taken without authorization
99 Subsection 143(1) (note 2)
Omit and substitute certain principles in the Privacy Act 1988
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.231
Imposes an obligation on the legislative body to omit and substitute certain principles
100 Subsection 38AA(1)
Substitute 'An APP entity that holds' for 'A record keeper who has possession or control of'
101 Subsection 38AA(2)
Substitute Australian Privacy Principles with authorization from this Act.
102 Section 5 (definition of assessment)
Substitute “body” for “agency” in the definition of assessment.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.232
103 Section 5 (definition of credit information file)
Repeal the definition of credit information file.
104 Section 5 (definition of credit reporting agency)
Repeal the definition of credit reporting agency.
105 Section 5
credit reporting body has the same meaning as in the Privacy Act 1988.
106 Section 35A (heading)
35A Reporting entities may disclose certain personal information to
Reporting entities may disclose personal information to credit reporting bodies.
107 Paragraph 35A(1)(a)
108 Paragraph 35A(1)(b)
109 Paragraph 35A(1)(b)
Omit specific phrase from credit reporting agency
110 Subparagraph 35A(2)(a)(ii)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.233
111 Subparagraph 35A(2)(a)(iii)
112 Subparagraph 35A(2)(a)(iii)
Omit specific phrase from credit information file
113 Subparagraph 35A(2)(a)(iv)
114 Subparagraph 35A(2)(a)(v)
115 Subparagraph 35A(2)(a)(v)
Omit specific information from credit files.
Prohibits the disclosure of personal information.
116 Section 35B (heading)
35B Credit reporting bodies may use and disclose certain personal
Use and disclose personal information for identity verification purposes
117 Subsection 35B(1)
118 Paragraph 35B(1)(a)
119 Paragraph 35B(1)(b)
Omit specific information from credit reporting bodies.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.234
120 Paragraph 35B(2)(a)
121 Subsection 35B(3)
122 Subsection 35B(3)
Substitute 'this Act' for 'law' in paragraph 20E(3)(e)
123 Paragraph 35C(2)(b)
124 Section 35D
35D Verification information not to be collected or held by a credit
Credit reporting bodies must not collect or hold personal information about an individual related to a verification request.
Prohibition of collecting or holding personal information.
125 Section 35E (heading)
Repeal heading and substitute with new title.
35E Retention of verification information—credit reporting bodies
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.235
126 Sections 35E, 35F and 35G
127 Section 35L
35L Breach of requirement is an interference with privacy
Interference with privacy constitutes a breach of requirement.
Breach of requirement constitutes an act or practice involving an interference with the privacy of the individual.
Temporal overlap between breach and requirement
Breach of a requirement in relation to an individual
The breach overlaps with the requirement in relation to the individual.
The interference is recurring and involves an act or practice.
The breach diffuses to the requirement in relation to the individual.
Recognition of breach as interference with privacy
The breach is recognized as an act or practice involving an interference with the privacy of the individual.
128 Paragraph 29A(7)(b)
129 Paragraph 77A(9)(c)
130 Paragraph 91(9)(c)
131 Paragraph 88(3)(i) of the National Credit Code
Credit reporting bodies may collect and hold default information under the Privacy Act 1988.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.236
132 Paragraph 179D(2)(h) of the National Credit Code
Repeal paragraph and substitute with new provision
Prohibits collection and holding of default information
133 Section 355-200 in Schedule 1 (example)
134 Section 355-200 in Schedule 1 (example)
Omit specific requirement from credit information file.
Prohibits omitting specific requirement.
135 Paragraph 32(1)(b)
Repeal paragraph, substitute with new statement about APP code procedures.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.237
136 Section 116A
137 Subparagraph 117(1)(k)(iii)
138 Subparagraph 117(1)(k)(iv)
Substitute “the registered APP code” for “the approved privacy code”.
139 Subsection 118(1) (note)
Omit approved privacy code, substitute registered APP code.
140 Paragraph 118(4A)(c)
141 Paragraph 118(4A)(d)
Omit 'the approved privacy code' and substitute 'the registered APP code'.
142 Subsections 121(1A) and 122(3)
Prohibits the use of approved privacy codes.
143 Subsection 130(1) (note)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.238
144 Paragraphs 134(1)(c) and (d)
145 Subsections 303B(1), 303B(2) and 303C(1)
Prohibits the use of 'an approved privacy code'
146 Subparagraph 147(2)(l)(ib)
Omit 'approved privacy code', substitute 'registered APP code'.
Prohibits the use of 'approved privacy code'
147 Paragraph 20(4A)(b)
Omit certain words from a provision related to the Privacy Act 1988.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.239
148 Subsection 9(2) (table item 3, column headed
149 Paragraphs 12(4)(a) and (b)
Repeal paragraphs and substitute with new functions and powers.
Replace existing paragraphs with new ones.
150 Paragraph 12(4)(c)
Repeal guidelines under Privacy Act 1988
Prohibits making guidelines under Privacy Act 1988
151 Paragraph 12(4)(d)
Repeal and substitute rules under specific acts.
Prohibits the issue, variation or revocation of rules under specific acts.
152 Paragraph 12(4)(e)
Omit paragraph 27(1)(r), substitute paragraph 28B(1)(c)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.240
153 Paragraph 12(4)(f)
154 Paragraph 25(k)
155 Paragraph 32(1)(a)
Substitute section 17 and paragraph 28A(1)(d) for omitted paragraphs.
Replaces omitted provisions with new ones.
156 Subsection 85ZZG(1)
157 Subsection 5(2)
158 Section 12 (heading)
12 Rules relating to privacy
159 Section 12
Omit 'guidelines' and substitute 'rules'.
160 Subsection 13(2)
Omit 'guidelines in the Schedule', substitute 'rules issued under section 12'.
Prohibition of 'guidelines in the Schedule'
161 Subsections 13(3) and (4)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.241
162 Subsection 13(7)
Omit “Part 5 and section 99”, substitute ‘Part V’.
163 Subsection 14(1)
164 Subsection 29(3)
165 Section 135AA (heading)
135AA Privacy rules
166 Subsection 135AA(3) (heading)
Repeal heading, substitute 'Issuing rules'
167 Subsections 135AA(3) and (3A)
168 Subsection 135AA(4) (heading)
169 Subsection 135AA(4)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.242
170 Subsection 135AA(5) (heading)
Repeal heading and substitute with new content
171 Subsections 135AA(5) and (5A)
172 Subsection 135AA(5AA)
173 Subsections 135AA(5B) and (6)
174 Subsection 135AA(8) (heading)
175 Subsection 135AA(8)
176 Section 135AB (heading)
135AB Breaches of the privacy rules
177 Subsections 135AB(1) and (2)
178 Subsection 137A(3) (note 2)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.243
179 Section 147
180 Subsection 299LA(3) (note 2)
1 Definitions
Defines terms for Schedule 1 to this Act
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.244
2 Application—court/tribunal orders
Definition of court/tribunal order applies to existing orders
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.245
3 Saving—guidelines relating to medical research etc.
Guidelines issued under certain subsections of the Privacy Act have effect after commencement as if they had been issued or approved under those subsections, as amended.
Guidelines have effect after commencement.
4 Application—credit reporting
Applicability of amendments to credit reporting
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.246
Amendments apply to existing credit reports
Schedule 2 amendments apply in relation to credit applied for, or provided, before or after the commencement time.
The amendments apply to existing credit reports.
Definition of serious credit infringement applies to acts done before or after the commencement time
The definition of serious credit infringement in subsection 6(1) of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to an act done before or after the commencement time.
The definition of serious credit infringement applies to acts done before or after the commencement time.
Paragraph 6N(k) of the Privacy Act applies to activities done before or after the commencement time
Paragraph 6N(k) of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to activities done before or after the commencement time.
The paragraph applies to activities done before or after the commencement time.
Section 6R of the Privacy Act applies to information requests made before or after the commencement time
Section 6R of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to an information request made before or after the commencement time.
The section applies to information requests made before or after the commencement time.
Section 6V of the Privacy Act applies to monthly payments due and payable on or after the day this Act receives the Royal Assent
Section 6V of the Privacy Act, as inserted by Schedule 2 to this Act, applies in relation to a monthly payment that is due and payable on or after the day this Act receives the Royal Assent.
The section applies to monthly payments due and payable on or after the day this Act receives the Royal Assent.
5 Privacy codes may be developed etc. during the transition
Function or power may be performed or exercised during the transition period as if the Privacy Act was in force.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.247
6 Application—section 13G of the Privacy Act
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.248
7 Saving—guidelines relating to tax file number information
Guidelines have effect after commencement time as if they had been rules issued under section 17 of the Privacy Act.
Guidelines have effect after commencement time.
Guidelines have effect during the period after commencement time.
8 Saving—guidelines prepared and published under the
Guidelines prepared under Privacy Act have effect after commencement time.
9 Audits by the Commissioner
The Commissioner may continue an audit after the commencement time.
The Commissioner has a duty to continue the audit.
10 Application—amendment made by item 75 of Schedule 4
Amendment applies in relation to representative complaints lodged after commencement time.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.249
11 Application—paragraph 41(1)(db) of the Privacy Act
Paragraph 41(1)(db) of the Privacy Act applies in relation to a request made after commencement time.
12 Saving—public interest determinations
Defines a temporal interval for the determination's effect after commencement time.
(2) The determination has effect, after the commencement time, as if it had been made under that section, as amended by Schedule 4 to this Act.
Defines a duty for the Commissioner to vary the determination after commencement time.
(3) The Commissioner may, by legislative instrument, vary the determination after the commencement time to take account of the amendments of the Privacy Act made by this Act.
Defines a duty for the Commissioner to consult any person or entity when varying the determination.
(4) In deciding whether to vary the determination, the Commissioner may: (a) consult any person or entity; and (b) take into account any matter that the Commissioner considers relevant.
13 Application—subsection 73(1A) of the Privacy Act
Application of subsection 73(1A) of the Privacy Act after commencement time
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.250
14 Application—review by the Administrative Appeals
Applicability of Privacy Act provisions to decisions made after commencement time.
Applicability of Privacy Act provisions.
Tribunal Paragraphs 96(1)(c), (e), (f) and (g) of the Privacy Act, as inserted by Schedule 4 to this Act, apply in relation to a decision made after the commencement time.
Applicability of Privacy Act provisions to decisions made during commencement interval.
The provisions apply during the commencement interval.
The provisions diffuse during the commencement interval.
15 Saving—guidelines issued under other Acts
Saving—guidelines issued under other Acts
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.251
16 Pre-commencement complaints
Complaints about acts or practices made before commencement time can be dealt with under the Privacy Act after commencement.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.252
Obligation to investigate complaints before commencement time.
(a) before the commencement time, a complaint about an act or practice was made to the Commissioner...
Temporal relation between commencement time and complaints.
17 Pre-commencement own initiative investigations
Commissioner may continue investigation under Privacy Act after commencement time.
18 Pre-commencement acts and practices
An act or practice done before commencement time may be an interference with individual privacy.
Obligation to respect individual privacy.
Act or practice done before commencement time.
19 Regulations may deal with transitional etc. matters
Governor-General may make regulations dealing with transitional, application or saving nature relating to the amendments made by this Act.
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.253
12 Dec
Remains in force until 12 Dec 2012 (s 2(1) items 1, 10, 12, 16, 18)
privacy-amendment-enhancing-privacy-protection-act-2012.pdf, p.256
Overlaps with commencement of Statute Law Revision Act (No. 1) 2015
Implies that the section remains in force until 12 Dec 2012
The section remains in force until 12 Dec 2012
25 Feb