entries found. Privacy Act 1988
4 June 2026
Compilation information and notes on amendments.
Classifies the text as a compilation of the Privacy Act 1988.
The text is classified as a compilation.
1 Short title
entries-found-privacy-act-1988.pdf, p.19
2 Commencement
2A Objects of this Act
3 Saving of certain State and Territory laws
entries-found-privacy-act-1988.pdf, p.20
3(1) Saving of certain State and Territory laws
Saving of certain State and Territory laws
Obligation to save certain State and Territory laws
3(2) Saving of certain State and Territory laws
This section does not apply to Schedule 2.
3A Application of the Criminal Code
Chapter 2 of the Criminal Code applies to all offences against this Act.
entries-found-privacy-act-1988.pdf, p.21
4 Act to bind the Crown
4(1) Act to bind the Crown
The Act binds the Crown in right of the Commonwealth, States, Australian Capital Territory, and Northern Territory.
4(2) Act to bind the Crown
The Crown is not liable to prosecution for an offence.
Nothing in this Act renders the Crown...
4(3) Act to bind the Crown
Prevents Crown from being an agency for the purposes of the Act
Nothing in this Act shall be taken to have the effect of making the Crown...
Crown is not an agency for the purposes of this Act
Excludes Crown from being an agency during the Act's application
Crown is not an agency for the purposes of this Act during the Act's application
Contradicts claim that Crown is an agency
5A Extension to external Territories
5A(1) Extension to external Territories
This Act extends to all external Territories.
(1) This Act extends to all external Territories.
This Act applies to all external Territories.
5A(2) Extension to external Territories
5B Extra-territorial operation of Act
Agencies can operate outside Australia and external Territories under this Act.
This Act extends to an act done, or practice engaged in...
outside Australia and external Territories
6 Interpretation
entries-found-privacy-act-1988.pdf, p.24
6AA Meaning of responsible person
entries-found-privacy-act-1988.pdf, p.52
6AA(1) Meaning of responsible person
Defines a responsible person for an individual.
(1) A responsible person for an individual is:
(i) at least 18 years old; and (ii) a member of the individual’s household;
6AA(2) Meaning of responsible person
Defines a child for the purposes of subsection (1)
6A Breach of an Australian Privacy Principle
entries-found-privacy-act-1988.pdf, p.54
6A(1) Breach of an Australian Privacy Principle
Breach of an Australian Privacy Principle is defined as an act or practice contrary to or inconsistent with the principle.
6A(2) Breach of an Australian Privacy Principle
Exemption for contracted service providers
(2) An act or practice does not breach an Australian Privacy Principle...
...and (ii) for the purposes of meeting (directly or indirectly) an obligation under the contract;
Exemption based on contractual provision
(b) the act or practice is authorised by a provision of the contract that is inconsistent with the principle.
6A(3) Breach of an Australian Privacy Principle
No breach if disclosure for archival purposes
6A(4) Breach of an Australian Privacy Principle
Exemption from breach of Australian Privacy Principle for acts done outside Australia and required by foreign law
6A(5) Breach of an Australian Privacy Principle
Despite subsection (1), certain subsections have effect.
6B Breach of a registered APP code
entries-found-privacy-act-1988.pdf, p.55
6B(1) Breach of a registered APP code
Act or practice is contrary to a registered APP code.
6B(2) Breach of a registered APP code
Exemptions for contracted service providers
6B(3) Breach of a registered APP code
6B(4) Breach of a registered APP code
Exemption from breach of APP code for acts done outside Australia and external Territories
Temporal interval outside Australia and external Territories
6BA Breach of the registered CR code
Act or practice breaches CR code if it is contrary to the code.
entries-found-privacy-act-1988.pdf, p.56
Act or practice is contrary to the code.
Temporal relation: Act or practice breaches CR code during its execution.
Breach of CR code occurs during the act or practice's execution.
Act or practice implies breach of CR code if it is contrary to the code.
Breach of CR code implies act or practice.
Breach of CR code diffuses to all acts or practices that are contrary to the code.
All acts or practices that are contrary to the code diffuse breach of CR code.
CogAI recognizes breach of CR code in act or practice if it is contrary to the code.
Breach of CR code is recognized by CogAI in act or practice.
6C Organisations
6C(1) Organisations
6C(2) Organisations
Definition of a legal person's capacities and organisations.
6C(3) Organisations
State or Territory Minister, Department of State, body established for a public purpose
Incorporated company, society or association; association registered or recognised under industrial disputes law
Excluded from State or Territory authority
Governor of a State, Australian Capital Territory Executive, Administrator of the Northern Territory
Appointment made under a law of a State or Territory; office established by or under a law of a State or Territory
Person holding or performing duties of an office
Office not the head of a State or Territory Department
6D Small business and small business operators
entries-found-privacy-act-1988.pdf, p.59
6D(1) Small business and small business operators
Business must meet annual turnover threshold to be considered small business.
Business is a small business at a time if...
6D(2) Small business and small business operators
Business is a small business if annual turnover for the current year is $3,000,000 or less.
Obligation to classify business as small business
The state imposes an obligation on businesses to be classified as small businesses if annual turnover for the current year is $3,000,000 or less.
Temporal relation between business classification and annual turnover
The business is classified as small if its annual turnover for the current year holds within $3,000,000.
Temporal relation between financial years and business classification
The business is classified as small during the current financial year if its annual turnover holds within $3,000,000.
Spread of classification to related businesses
The classification of one business as small diffuses to other businesses with similar annual turnover.
6D(3) Small business and small business operators
6D(4) Small business and small business operators
Exempts certain entities from being considered small business operators.
Carries on a business with annual turnover over $3,000,000
Financial year ended after the later of...
6DA What is the annual turnover of a business?
entries-found-privacy-act-1988.pdf, p.61
6DA(1) What is the annual turnover of a business?
Defines annual turnover of a business for tax purposes.
Requires businesses to report their annual turnover accurately.
6DA(2) What is the annual turnover of a business?
Business must calculate annual turnover using a formula.
6E Small business operator treated as organisation
entries-found-privacy-act-1988.pdf, p.62
6E(1A) Small business operator treated as organisation
Small business operator treated as organisation
6E(1B) Small business operator treated as organisation
6E(1C) Small business operator treated as organisation
6E(1D) Small business operator treated as organisation
Applicability of the Act to small business operators with accreditation under subsection 56CA(1) of the Competition and Consumer Act 2010
The Act applies to small business operators with accreditation under subsection 56CA(1)
Note: The regulations may prescribe different modifications of the Act for different small business operators
See subsection 33(3A) of the Acts Interpretation Act 1901
Regulations treating a small business operator as an organisation
The regulations may prescribe different modifications of the Act for different small business operators
6E(1) Small business operator treated as organisation
6EA Small business operators choosing to be treated as
entries-found-privacy-act-1988.pdf, p.65
6EA(1) Small business operators choosing to be treated as
This Act applies in relation to a small business operator as if the operator were an organisation.
The Act applies to small business operators.
6EA(2) Small business operators choosing to be treated as
Can choose to be treated as an organisation
6EA(3) Small business operators choosing to be treated as
Must enter operator's name and ABN in a register.
6EA(4) Small business operators choosing to be treated as
Duty to remove material from register upon revocation of choice.
6EA(5) Small business operators choosing to be treated as
Commissioner's discretion to decide register form and keeping method
6EA(6) Small business operators choosing to be treated as
Must make register available to public, but not all information
6F State instrumentalities etc. treated as organisations
entries-found-privacy-act-1988.pdf, p.66
6F(1) State instrumentalities etc. treated as organisations
Applicability to state instrumentalities and authorities
States the applicability of the Act to state instrumentalities and authorities
...as if the authority or instrumentality were an organisation.
6F(3) State instrumentalities etc. treated as organisations
Consultation requirement before prescribing State or Territory authority
6FA Meaning of health information
6FB Meaning of health service
entries-found-privacy-act-1988.pdf, p.67
6FB(1) Meaning of health service
An activity is a health service if it meets certain conditions.
(1) An activity performed in relation to an individual is a health service if the activity is intended or claimed...
Conditions for a health service (continued)
(a) to assess, maintain or improve the individual’s health;
Temporal relationship between activities
(b) where the individual’s health cannot be maintained or improved-
(e) to record the individual’s health for the purposes of assessing, maintaining, improving or managing the individual’s health.
(c) to diagnose the individual’s illness, disability or injury;
6FB(2) Meaning of health service
The dispensing of a drug on prescription by a pharmacist is a health service.
(2) The dispensing on prescription of a drug or medicinal preparation by a pharmacist is a health service.
The dispensing on prescription of a drug or medicinal preparation by a pharmacist is a health service.
The dispensing on prescription of a drug or medicinal preparation by a pharmacist during the provision of a health service.
6FB(3) Meaning of health service
Health service definition includes physical and psychological health.
Subclass relationship between health service and aged care, palliative care or care for a person with a disability
An activity mentioned in subsection (1) or (2) that takes place in the course of providing aged care, palliative care or care for a person with a disability is a health service.
6G Meaning of credit provider
entries-found-privacy-act-1988.pdf, p.69
6G(1) Meaning of credit provider
Defines what constitutes a credit provider.
Specifies the temporal relationship between the provision of credit and the carrying on of a business or undertaking.
(ii) a substantial part of the business or undertaking is the provision of credit;
the organisation or operator carries on a business or undertaking that involves providing credit;
Specifies the relationship between the provision of credit and the carrying on of a retail business.
(c) an organisation or small business operator: (i) that carries on a retail business;
that, in the course of the business, issues credit cards to individuals in connection with the sale of goods, or the supply of services, by the organisation or operator (as the case may be);
Specifies that an agency, organisation or small business operator must be prescribed by the regulations to be considered a credit provider.
(d) an agency, organisation or small business operator: (i) that carries on a business or undertaking that involves providing credit;
6G(2) Meaning of credit provider
Repayment of credit deferred for at least 7 days is an obligation.
6H Agents of credit providers
entries-found-privacy-act-1988.pdf, p.70
6H(1) Agents of credit providers
An agent acting on behalf of a principal is considered a credit provider.
6H(2) Agents of credit providers
Exemption for certain credit providers from subsection (1)
6H(3) Agents of credit providers
Credit provider must provide credit with agent's involvement.
Obligation to provide credit with agent's involvement.
6H(4) Agents of credit providers
Application to principal is taken as application to both principal and agent.
6J Securitisation arrangements etc.
Securitisation entity must perform tasks necessary for purchasing, funding or managing credit by means of a securitisation arrangement.
entries-found-privacy-act-1988.pdf, p.71
Must perform tasks necessary for purchasing, funding or managing credit by means of a securitisation arrangement.
Securitisation entity is an organisation or small business operator.
(a) an organisation or small business operator (the securitisation entity)
Securitisation arrangement is a financial instrument.
Credit must be provided by, or credit for which an application has been made to, a credit provider.
(c) the credit has been provided by, or is credit for which an application has been made to, a credit provider;
(b) the securitisation entity performs a task that is reasonably necessary for...
6K Acquisition of the rights of a credit provider
entries-found-privacy-act-1988.pdf, p.72
6K(1) Acquisition of the rights of a credit provider
Acquirer becomes a credit provider in relation to the credit.
(acquirer acquires rights of original credit provider)
(acquirer is a credit provider in relation to the credit)
Acquirer becomes a credit provider during the assignment/subrogation
Acquirer's assignment/subrogation implies it becomes a credit provider
Acquirer's assignment/subrogation diffuses its rights as a credit provider
Acquirer asserts it becomes a credit provider
6K(2) Acquisition of the rights of a credit provider
Credit is taken to have been provided by the acquirer for the purposes of this Act.
Credit is taken to have been provided by the acquirer.
6K(3) Acquisition of the rights of a credit provider
Application to original credit provider is taken as application to acquirer.
Duty to treat application as if made to acquirer
If subsection (1) of this section applies in relation to credit for which an application has been made to the original credit provider, then...
Temporal relationship between applications
The application is taken, for the purposes of this Act, to have been made to the acquirer.
6L Meaning of access seeker
entries-found-privacy-act-1988.pdf, p.73
6L(1) Meaning of access seeker
Defines an access seeker in relation to credit reporting information or credit eligibility information about an individual.
Identifies the subject of the obligation.
(1) An access seeker in relation to credit reporting information, or credit eligibility information, about an individual is:
the individual; or a person: (i) who is assisting the individual to deal with a credit reporting body or credit provider; and (ii) who is authorised, in writing, by the individual to make a request in relation to the information under subsection 20R(1) or 21T(1).
6L(2) Meaning of access seeker
Individuals cannot authorise certain persons under subsection 6G(5) or (6).
Individuals must not authorise certain persons.
Obligation to comply with subsection 6G(5) or (6)
Individuals are obligated to comply with subsection 6G(5) or (6).
Prohibition of authorisation by credit providers, mortgage insurers, and trade insurers
Credit providers, mortgage insurers, and trade insurers are prohibited from authorising certain persons.
No authorisation allowed for these entities.
The prohibition applies during the period specified in subsection 6G(5) or (6).
6L(3) Meaning of access seeker
Exempts certain persons from the application of a rule.
(3) Subparagraph (1)(b)(ii) does not apply to a person who provides the National Relay Service or a person prescribed by the regulations.
Defines a temporal interval during which the exemption applies.
Defines a recurring pattern of exemption.
Spreads the exemption to related persons.
Identifies the exemption as a rule of law.
6M Meaning of credit and amount of credit
6M(1) Meaning of credit and amount of credit
Definition of credit and amount of credit
6M(2) Meaning of credit and amount of credit
Defines the amount of credit as the deferred debt, excluding fees and charges.
6N Meaning of credit information
Defines personal information about an individual for credit reporting purposes.
entries-found-privacy-act-1988.pdf, p.74
Identifies key elements of personal information.
Identification information about the individual; or consumer credit liability information about the individual; or repayment history information about the individual; or financial hardship information about the individual; or a statement that an information request has been made in relation to the individual by a credit provider, mortgage insurer or trade insurer;
Personal information about the individual.
Includes default information and payment information about the individual.
Default information about the individual; or payment information about the individual;
Default and payment information about the individual.
Includes new arrangement information and court proceedings information about the individual.
New arrangement information about the individual; or court proceedings information about the individual;
New arrangement and court proceedings information about the individual.
Includes personal insolvency information about the individual.
Personal insolvency information about the individual;
Personal insolvency information about the individual.
Includes publicly available information about the individual.
Publicly available information about the individual;
Publicly available information about the individual.
6P Meaning of credit reporting business
entries-found-privacy-act-1988.pdf, p.75
6P(1) Meaning of credit reporting business
6P(2) Meaning of credit reporting business
Information about credit worthiness must be provided for assessing consumer credit applications.
Must provide information about credit worthiness.
6P(3) Meaning of credit reporting business
Disregard provision of information about credit worthiness to a related body corporate.
6P(4) Meaning of credit reporting business
Business or undertaking not a credit reporting business if included in prescribed class
6Q Meaning of default information
entries-found-privacy-act-1988.pdf, p.76
6Q(1) Meaning of default information
Default information about an individual is required to be provided by a credit provider.
Obligation to provide default information.
The individual is at least 60 days overdue in making the payment.
Default information must be provided by the credit provider.
6Q(2) Meaning of default information
Individual must pay overdue payment after notice and recovery attempts.
(a) the provider has given the individual written notice of the borrower’s default that gave rise to the individual’s obligation to make the overdue payment; and (b) the notice requests that the individual pay the amount of the overdue payment;
The individual must pay the overdue payment.
Must pay overdue payment after recovery attempts
(d) in addition to giving the notice, the provider has taken other steps to recover the amount of the overdue payment from the individual; and (e) the provider is not prevented by a statute of limitations from recovering the amount of the overdue payment.
The individual must pay the overdue payment after recovery attempts.
(e) the provider is not prevented by a statute of limitations from recovering the amount of the overdue payment.
The provider can recover the overdue payment.
(d) in addition to giving the notice, the provider has taken other steps to recover the amount of the overdue payment from the individual;
The provider takes recurring recovery attempts.
Must pay overdue payment after notice and recovery attempts
The individual must pay the overdue payment after notice and recovery attempts.
6QA Meanings of financial hardship arrangement and financial
entries-found-privacy-act-1988.pdf, p.77
6QA(1) Meanings of financial hardship arrangement and financial
Definition of financial hardship arrangement
6QA(2) Meanings of financial hardship arrangement and financial
Definition of financial hardship arrangement and financial hardship
6QA(3) Meanings of financial hardship arrangement and financial
Defines financial hardship arrangement and its scope.
6R Meaning of information request
entries-found-privacy-act-1988.pdf, p.79
6R(1) Meaning of information request
Credit provider must provide information about individual upon request.
6R(2) Meaning of information request
Mortgage insurer must provide information to an individual upon request.
6R(3) Meaning of information request
Trade insurer must provide information to individual upon request.
6S Meaning of new arrangement information
entries-found-privacy-act-1988.pdf, p.80
6S(1) Meaning of new arrangement information
Credit provider must disclose new arrangement information about an individual when certain conditions are met.
Obligation to disclose new arrangement information
a credit provider has disclosed default information about an individual to a credit reporting body
new arrangement information must be provided
6S(2) Meaning of new arrangement information
Credit provider must disclose opinion to credit reporting body if serious credit infringement suspected.
Disclosure of opinion to credit reporting body
Credit provider has opinion of serious credit infringement
Disclosure to credit reporting body required
6T Meaning of payment information
Payment information is a statement that the amount of overdue payment has been paid.
entries-found-privacy-act-1988.pdf, p.81
Imposes a duty on the state to provide accurate payment information.
6U Meaning of personal insolvency information
(1) Personal insolvency information about an individual is...
Describes temporal relationship between bankruptcy and personal insolvency information
...a debt agreement proposal given by the individual
Describes universal property of personal insolvency information
(ii) a debt agreement proposal given by the individual;
...a debt agreement made by the individual
Identifies type of relationship between personal insolvency information and bankruptcy
(iii) a debt agreement made by the individual;
...a personal insolvency agreement executed by the individual
6V Meaning of repayment history information
entries-found-privacy-act-1988.pdf, p.82
6V(1) Meaning of repayment history information
Repayment history information must include whether the individual has met an obligation to make a monthly payment.
The individual has met an obligation to make a monthly payment.
(a) whether or not the individual has met an obligation to make a monthly payment that is due and payable in relation to the consumer credit;
The individual does not have met an obligation to make a monthly payment.
The monthly payment due date and the day on which the payment is made must be within a certain time interval.
(b) the day on which the monthly payment is due and payable;
the monthly payment due date and the day on which the payment is made are during a certain time interval
The repayment history information must be provided for every consumer credit.
(1) If a credit provider provides consumer credit to an individual, the following information about the consumer credit is repayment history information about the individual:
The credit provider must provide the repayment history information.
6V(1A) Meaning of repayment history information
Repayment history information is to be determined by reference to the obligation as affected.
6V(1B) Meaning of repayment history information
An individual is taken to have met the obligation to make a monthly payment.
6V(2) Meaning of repayment history information
Regulations may determine if an individual has met a monthly payment obligation.
Determines if an individual has met a monthly payment obligation.
(2) The regulations may make provision in relation to: (a) whether or not an individual has met an obligation to make a monthly payment that is due and payable in relation to consumer credit;
Defines the temporal scope of consumer credit repayment history information.
Applies to all consumer credit repayment history information.
Allows regulations to determine if an individual has met a monthly payment obligation.
Classifies consumer credit repayment history information.
7 Acts and practices of agencies, organisations etc.
Defines the scope of references to acts and practices in the Act.
entries-found-privacy-act-1988.pdf, p.84
Refers to an act or practice done by a specified entity.
7A Acts of certain agencies treated as acts of organisation
entries-found-privacy-act-1988.pdf, p.87
7A(1) Acts of certain agencies treated as acts of organisation
Acts of certain agencies treated as acts of organisation
(1) This Act applies, with the prescribed modifications (if any), in relation to an act or practice described in subsection (2) or (3)
the agency mentioned in that subsection were the organisation
Agency's actions are during its existence
7A(2) Acts of certain agencies treated as acts of organisation
Agency regulations must specify in Part I of Schedule 2 to the Freedom of Information Act 1982.
Regulations must specify agency in Schedule 2.
7A(3) Acts of certain agencies treated as acts of organisation
7B Exempt acts and exempt practices of organisations
entries-found-privacy-act-1988.pdf, p.88
7B(1) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations
7B(2) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations for the purposes of paragraph 7(1)(ee)
Exemption from obligations under Commonwealth contracts
7B(3) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations related to employment relationships.
(3) An act done, or practice engaged in, by an organisation that is or was an employer of an individual, is exempt for the purposes of paragraph 7(1)(ee)
7B(4) Exempt acts and exempt practices of organisations
Media organisation must observe privacy standards when engaging in journalism or certain practices.
Media organisation must observe privacy standards.
Privacy standards have been published in writing by the organisation or a person or body representing a class of media organisations.
The organisation must observe these standards.
Media organisation is an entity that observes privacy standards.
The organisation is an entity that observes these standards.
Media organisation must observe privacy standards at all times when engaging in journalism or certain practices.
The organisation must observe these standards at all times.
Media organisation must observe privacy standards for an indefinite period when engaging in journalism or certain practices.
The organisation must observe these standards indefinitely.
Media organisation must observe privacy standards if they have been publicly committed to doing so.
The organisation must observe these standards if they have been publicly committed to doing so.
Media organisation must observe privacy standards if they are engaged in journalism or certain practices.
The organisation must observe these standards if they are engaging in journalism or certain practices.
7B(5) Exempt acts and exempt practices of organisations
Exempt acts and practices of organisations under certain conditions.
7C Political acts and practices are exempt
entries-found-privacy-act-1988.pdf, p.90
7C(1) Political acts and practices are exempt
Political representatives are exempt from certain duties when performing specific acts or practices.
7C(2) Political acts and practices are exempt
Exemptions for political acts and practices
7C(3) Political acts and practices are exempt
Exempts political acts and practices for meeting obligations under a contract.
(3) An act done, or practice engaged in...
7C(4) Political acts and practices are exempt
Exempts political acts and practices for certain purposes.
Allows the exemption of political acts and practices.
...is exempt for the purposes of paragraph 7(1)(ee)
Defines a temporal interval for exemption purposes.
...if the act is done or the practice is engaged in for any purpose in connection with one or more of the following:
Defines a recurring trace for exemption purposes.
...for any purpose in connection with one or more of the following:
Represents knowledge about exemption purposes.
Validates schema for exemption purposes.
7C(5) Political acts and practices are exempt
Agents or principals are exempt from the operation of the Act.
(5) Subsection (4) does not otherwise affect the operation of the Act in relation to agents or principals.
The excerpt refers to a temporal relation between two intervals.
The excerpt implies that agents or principals are exempt from the operation of the Act.
The excerpt propagates a rule about exemption for agents or principals.
The excerpt represents knowledge about exemption for agents or principals.
7C(6) Political acts and practices are exempt
Defines Parliament for the purpose of electoral law.
8 Acts and practices of, and disclosure of information to, staff of
entries-found-privacy-act-1988.pdf, p.92
8(1) Acts and practices of, and disclosure of information to, staff of
Treat acts and practices of staff as done by agency/organisation
8(2) Acts and practices of, and disclosure of information to, staff of
Treat act or practice as agency's if record not held by agency that holds it.
Treats act or practice as agency's if record not held by agency that holds it.
...that act or practice shall be treated as the act or the practice of the agency that holds that record.
8(3) Acts and practices of, and disclosure of information to, staff of
An act done by a partner is attributed to the organisation.
An act done by a partner is taken to have been done by the organisation.
The organisation is attributed with the action.
Extension of temporal intervals to include partners' actions.
The organisation's temporal interval extends to include its partners' actions.
Recurring trace of partners' actions in the organisation.
The organisation's recurring trace includes its partners' actions.
Diffusion of information from partners to the organisation.
A communication made to a partner is taken to have been made to the organisation.
The organisation receives information from its partners.
Representation of knowledge about partners in the organisation.
The organisation represents its partners' actions in its knowledge base.
8(4) Acts and practices of, and disclosure of information to, staff of
An act done by a member of the committee is taken to have been done by the organisation.
Implication of an act on the organisation.
An act done by a member is taken to have been done by the committee.
Temporal inclusion of an act on the organisation.
An act is taken to have been done by the committee.
8(5) Acts and practices of, and disclosure of information to, staff of
An act done by a trustee is attributed to the organisation.
10 Agencies that are taken to hold a record
entries-found-privacy-act-1988.pdf, p.94
10(4) Agencies that are taken to hold a record
Agency responsible for record is determined by agency that placed it in care or custody.
Temporal interval for agency's responsibility
Agency that placed the record in care or custody.
The period during which the agency was responsible for the record.
Agency is regarded as holding the record
The agency by or on behalf of which the record was placed in that care or custody.
Agency's responsibility implies its holding the record
If the agency is responsible for the record, then it holds the record.
Agency's responsibility implies its holding the record (diffusion)
If the agency is responsible for the record, then it holds the record (diffusion).
Agency's responsibility implies its holding the record (cognitive AI)
If the agency is responsible for the record, then it holds the record (cognitive AI).
10(5) Agencies that are taken to hold a record
Agency responsible for record of personal information
...that agency or, if that agency no longer exists...
Record held by agency during its existence
(5) Where a record...that agency no longer exists
...the agency to whose functions the contents of the record are most closely related
Agency's existence implies responsibility for record
(5) Where a record...the agency no longer exists
Record diffused to related agency upon existence change
Agency recognized as holder based on record content
(5) Where a record...the contents of the record are most closely related
11 File number recipients
11(1) File number recipients
A person in possession or control of a record with tax file number information is regarded as a file number recipient.
(1) A person who is (whether lawfully or unlawfully) in possession or control of a record that contains tax file number information shall be regarded, for the purposes of this Act, as a file number recipient.
Possession or control during the existence of the record
A person in possession or control of a record with tax file number information is regarded as a file number recipient during the existence of the record.
11(2) File number recipients
File number recipient in relation to a record
11(3) File number recipients
Agency must treat file number recipient as such for purposes of the Act.
Agency must treat file number recipient as such.
12A Act not to apply in relation to State banking or insurance
Prohibition on application of Act to State banking or insurance within the State concerned.
entries-found-privacy-act-1988.pdf, p.95
12B Severability—additional effect of this Act
entries-found-privacy-act-1988.pdf, p.96
12B(1) Severability—additional effect of this Act
Regulated entities must comply with the Act.
12B(2) Severability—additional effect of this Act
Severability—additional effect of this Act
Implies the operation in relation to regulated entities is confined to an operation giving effect to the Covenant and Convention.
(2) This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to an operation to give effect to...
...and in particalr Articles 17 and 24(1) of the Covenant; and Article 16 of the Convention on the Rights of the Child done at New York on 20 November 1989 ([1991] ATS 4).
The operation in relation to regulated entities occurs during an operation giving effect to the Covenant and Convention.
...and in particular Articles 17 and 24(1) of the Covenant; and Article 16 of the Convention on the Rights of the Child done at New York on 20 November 1989 ([1991] ATS 4).
12B(3) Severability—additional effect of this Act
it would have if its operation in relation to regulated entities were expressly confined...
(3) This Act also has the effect it would have...
...if its operation in relation to regulated entities were expressly confined to acts or practices covered by section 5B
12B(4) Severability—additional effect of this Act
This Act has the effect it would have if its operation in relation to regulated entities were expressly confined to regulated entities that are corporations.
(4) This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to regulated entities that are corporations.
The provision refers to the relation between the operation of the Act and the existence of regulated entities.
The operation of the Act is related to the existence of regulated entities.
The provision refers to an ordered trace between the operation of the Act and its effect.
There is an ordered trace between the operation of the Act and its effect.
The provision refers to the diffusion of the effect of the Act.
The effect of the Act is diffused to regulated entities that are corporations.
12B(5) Severability—additional effect of this Act
Expressly confine operation to acts or practices of regulated entities taking place in the course of, or in relation to, trade or commerce.
Temporal relation between operation and trade/commerce
(5) This Act also has the effect it would have if its operation in relation to regulated entities were expressly confined to acts or practices of regulated entities taking place in the course of, or in relation to, trade or commerce:
Recurring trace of operation on trade/commerce
Express prohibition on operation outside trade/commerce
12B(5A) Severability—additional effect of this Act
Regulated entities must comply with the Act's operation in relation to their acts or practices.
12B(6) Severability—additional effect of this Act
Severability provision with additional effect on regulated entities
12B(7) Severability—additional effect of this Act
12B(8) Severability—additional effect of this Act
12B(9) Severability—additional effect of this Act
13 Interferences with privacy
entries-found-privacy-act-1988.pdf, p.98
13(1) Interferences with privacy
Breach of Australian Privacy Principle or APP code constitutes an interference with privacy.
Interference with privacy requires breach of principle or code.
13(2) Interferences with privacy
Interference with privacy defined as breach of Part IIIA or registered CR code.
(2) An act or practice of an entity is an interference...
13(3) Interferences with privacy
Interference with privacy is prohibited if it breaches an Australian Privacy Principle or a registered APP code.
Prohibition of interference with privacy
An act or practice is an interference with the privacy of an individual if...
...breach an Australian Privacy Principle or a registered APP code.
Temporal relation between contract provision and APP code
(3) An act or practice of an organisation is an interference with the privacy of an individual if...(ii) a registered APP code that binds the organisation;
...inconsistent with the principle or code;...
Recurring trace of contractual provision and APP code
Diffusion of information about personal data
(3) An act or practice of an organisation is an interference with the privacy of an individual if...(a) the act or practice relates to personal information about the individual;
...personal information because of a provision of the contract that is inconsistent with the principle or code;...
Knowledge representation of privacy principles and APP codes
(3) An act or practice of an organisation is an interference with the privacy of an individual if...(i) an Australian Privacy Principle; or (ii) a registered APP code that binds the organisation;
...in relation to the personal information because of a provision of the contract that is inconsistent with the principle or code;...
13(4) Interferences with privacy
Interference with tax file number information is prohibited.
Prohibits interference with tax file number information.
(4) An act or practice is an interference...
13(4A) Interferences with privacy
13(5) Interferences with privacy
Interference with privacy defined as breach of specific acts or rules.
(5) An act or practice is an interference with the privacy of an individual...
An act or practice is not an interference with the privacy of an individual if it does not meet this condition.
Defines temporal overlap between actions.
(5) An act or practice is an interference with the privacy of an individual if...
An action overlaps in time with another action if it meets this condition.
Defines recurring traces between actions.
An action forms a recurring trace with another action if it meets this condition.
An action diffuses to another action if it meets this condition.
Classifies actions as interfering with privacy based on specific criteria.
An action is classified as interfering with privacy if it meets this condition.
13B Related bodies corporate
entries-found-privacy-act-1988.pdf, p.100
13B(1) Related bodies corporate
Sharing personal information between related bodies corporate is permitted.
Temporal relation between related bodies corporate
13B(1A) Related bodies corporate
Exempt from privacy principles for certain related bodies corporate
13B(2) Related bodies corporate
Organisation's act or practice may be an interference with individual's privacy.
13C Change in partnership because of change in partners
Compliance with Australian Privacy Principles and APP code is required when passing on personal information from an old to a new partnership.
entries-found-privacy-act-1988.pdf, p.101
The new partnership must comply with the Australian Privacy Principles and APP code.
Compliance is not required, but recommended.
The new partnership may comply with the Australian Privacy Principles and APP code.
Compliance with the Australian Privacy Principles and APP code is not required.
The new partnership does not need to comply with the Australian Privacy Principles and APP code.
13D Overseas act required by foreign law
entries-found-privacy-act-1988.pdf, p.102
13D(1) Overseas act required by foreign law
An act or practice outside Australia and an external Territory is not an interference with the privacy of an individual if required by a foreign country's law.
13D(2) Overseas act required by foreign law
Subsection (1) has effect despite subsections 13(1) and (3).
13E Effect of sections 13B, 13C and 13D
Organisations may still interfere with individual privacy despite sections 13B, 13C and 13D.
13F Act or practice not covered by section 13 is not an interference
An act or practice not covered by section 13 is an obligation to respect individual privacy.
13G Civil penalty provision for serious interference with privacy of
13G(1) Civil penalty provision for serious interference with privacy of
Entity contravenes subsection if it interferes with privacy of an individual in a serious manner.
Entity must not interfere with privacy of an individual.
Entity does an act or engages in a practice that is an interference with the privacy of an individual.
Interference with privacy overlaps with serious interference.
The entity does an act or engages in a practice that is an interference with the privacy of an individual.
Interference with privacy is classified as serious by the AI system.
The court may determine that an entity has contravened section 13H if the court is satisfied of paragraph (a) but not paragraph (b).
13G(1A) Civil penalty provision for serious interference with privacy of
Civil penalty provision for serious interference with privacy of
13G(1B) Civil penalty provision for serious interference with privacy of
Maximum pecuniary penalty for serious interference with privacy
Prohibits serious interference with privacy
(1B) In determining whether an interference with privacy is serious...
13G(2) Civil penalty provision for serious interference with privacy of
Maximum penalty for serious interference with privacy of individuals
Prohibits contravention of subsection (1)
13G(3) Civil penalty provision for serious interference with privacy of
Maximum penalty amount for contravention of subsection (1)
13H Civil penalty provision for interference with privacy of
entries-found-privacy-act-1988.pdf, p.105
13H(1) Civil penalty provision for interference with privacy of
Interference with privacy of an individual is prohibited.
13H(2) Civil penalty provision for interference with privacy of
Civil penalty provision for interference with privacy of
13H(3) Civil penalty provision for interference with privacy of
13J Alternative orders
Court may impose pecuniary penalty order instead of section 13G if interference with privacy is not serious.
13K Civil penalty provision for which infringement notices or
entries-found-privacy-act-1988.pdf, p.106
13K(1) Civil penalty provision for which infringement notices or
Non-compliance with Australian Privacy Principles
Entity must comply with Australian Privacy Principles
Classification of non-compliant data breaches
Data breach statement must be compliant with regulations
Data breach statement must be classified as non-compliant
Eligible data breach must be reported and addressed
13K(2) Civil penalty provision for which infringement notices or
Failure to comply with subsection 26WK(3) is prohibited.
Overlapping of entity's statement and subsection 26WK(3)
Entity prepares a statement under section 26WK (eligible data breaches)
Recurring trace of entity's non-compliance
Entity contravenes this subsection if statement does not comply with subsection 26WK(3)
Spreading of entity's non-compliance to other entities
Analyzing entity's statement for compliance with subsection 26WK(3)
Statement does not comply with subsection 26WK(3)
13K(3) Civil penalty provision for which infringement notices or
13K(4) Civil penalty provision for which infringement notices or
Maximum penalty amount for contravention of subsections (1) and (2)
(4) The amount of the penalty payable by a person...
14 Australian Privacy Principles
entries-found-privacy-act-1988.pdf, p.108
14(1) Australian Privacy Principles
Australian Privacy Principles are set out in Schedule 1.
14(2) Australian Privacy Principles
Reference to Australian Privacy Principle with a specific number is an obligation.
Australian Privacy Principle with that number must be followed.
15 APP entities must comply with Australian Privacy Principles
Must not breach Australian Privacy Principle
16 Personal, family or household affairs
Exemptions from Australian Privacy Principles for personal, family or household affairs
Nothing in the Australian Privacy Principles applies to...
16A Permitted general situations in relation to the collection, use or
Permitted general situations for collection, use or disclosure of personal information
the entity is an entity of a kind specified in an item in column 1 of the table
Item applies to information or identifier
the item in column 2 of the table applies to the information or identifier
such conditions as are specified in the item in column 3 of the table are satisfied
16B Permitted health situations in relation to the collection, use or
entries-found-privacy-act-1988.pdf, p.111
16B(1) Permitted health situations in relation to the collection, use or
Permitted health situations for collection of health information
Permits the collection of health information under certain conditions
(1) A permitted health situation exists in relation to the collection by an organisation of health information about an individual if:...
The collection of health information occurs during permitted health situations
(i) the collection is required or authorised by or under an Australian law (other than this Act); or...
The collection of health information occurs until permitted health situations cease
(ii) the information is collected in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.
The collection of health information occurs through permitted health situations
(b) either: (i) the collection is required or authorised by or under an Australian law (other than this Act); or...
The collection of health information occurs under permitted health situations
(a) the information is necessary to provide a health service to the individual; and...
16B(1A) Permitted health situations in relation to the collection, use or
Organisation must collect family, social or medical history of an individual to provide health service.
Must provide health information for a specific purpose.
(a) it is necessary for the organisation to collect...
...to provide a health service to the patient; and (b)...
Health information is collected from the patient or a responsible person.
(c) the health information is collected by...
...the patient or, if the patient is physically or legally incapable of giving the information...
Organisation's action implies a duty to provide health service.
Health information is related to family, social or medical history.
Organisation's action involves processing health information.
16B(2) Permitted health situations in relation to the collection, use or
Collection of health information necessary for research relevant to public health or public safety.
Obligation to collect health information for research.
(2) A permitted health situation exists in relation to the collection by an organisation of health information about an individual if:
Collection during research relevant to public health or public safety.
Recurring collection for research purposes.
Collection through research relevant to public health or public safety.
16C Acts and practices of overseas recipients of personal
entries-found-privacy-act-1988.pdf, p.114
16C(1) Acts and practices of overseas recipients of personal
Disclosing personal information to an overseas recipient without complying with Australian Privacy Principle 8.1 is prohibited.
Prohibition of disclosure without compliance with Australian Privacy Principle 8.1.
(a) an APP entity discloses personal information about an individual to an overseas recipient; and (b) Australian Privacy Principle 8.1 applies to the disclosure of the information;
Prohibition of act or practice that would be a breach of Australian Privacy Principles if those principles applied.
(d) the overseas recipient does an act, or engages in a practice, in relation to the information that would be a breach of the Australian Privacy Principles (other than Australian Privacy Principle 1);
Temporal overlap between disclosure and compliance with Australian Privacy Principle 8.1.
The disclosure overlaps with compliance.
(c) the Australian Privacy Principles do not apply, under this Act, to an act done, or a practice engaged in, by the overseas recipient in relation to the information;
16C(2) Acts and practices of overseas recipients of personal
The act done by the overseas recipient is taken to be a breach of Australian Privacy Principles.
(2) The act done, or the practice engaged in, by the overseas recipient is taken...
The act done by the overseas recipient is an obligation.
The act done by the overseas recipient occurred during an obligation.
The act done by the overseas recipient implies an obligation.
The obligation diffuses to the overseas recipient.
17 Rules relating to tax file number information
The Commissioner must issue rules concerning tax file number information.
entries-found-privacy-act-1988.pdf, p.115
18 File number recipients to comply with rules
Prohibits file number recipients from breaching rules issued under section 17.
File number recipient shall not do an act
19 Guide to this Part
Guides this Part dealing with credit reporting privacy.
entries-found-privacy-act-1988.pdf, p.116
20 Guide to this Division
Rules for credit reporting bodies regarding handling of specific information and assessments.
entries-found-privacy-act-1988.pdf, p.117
Imposes a duty on credit reporting bodies.
Applies to the handling of specific information and assessments.
20A Application of this Division and the Australian Privacy
20A(1) Application of this Division and the Australian Privacy
This Division applies to a credit reporting body in relation to the specified information types.
The Division applies to a credit reporting body.
...in relation to the specified information types.
20A(2) Application of this Division and the Australian Privacy
Exempts credit reporting bodies from Australian Privacy Principles for certain types of personal information.
Prohibits the application of Australian Privacy Principles
(2) The Australian Privacy Principles do not apply to a credit reporting body in relation to...
...personal information that is: (a) credit reporting information; or (b) CP derived information; or (c) a pre-screening assessment.
Excludes personal information from Australian Privacy Principles during certain time periods
Excludes personal information from Australian Privacy Principles through diffusion
Excludes personal information from Australian Privacy Principles through cognitive AI exclusion
20B Open and transparent management of credit reporting
entries-found-privacy-act-1988.pdf, p.118
20B(1) Open and transparent management of credit reporting
Ensure open and transparent management of credit reporting
Obligation to ensure open and transparent management
20B(2) Open and transparent management of credit reporting
Credit reporting body must implement practices and procedures to comply with Division and registered CR code.
Obligation to implement practices and procedures.
20B(3) Open and transparent management of credit reporting
Credit reporting bodies must have a clearly expressed and up-to-date policy about credit reporting information management.
20B(4) Open and transparent management of credit reporting
Credit reporting body must provide certain information to individuals.
20B(5) Open and transparent management of credit reporting
Credit reporting bodies must make the policy available free of charge and in an appropriate form.
20B(6) Open and transparent management of credit reporting
Credit reporting bodies must provide copies of their policies in a requested form.
20C Collection of solicited credit information
Prohibition on collecting credit information about an individual.
entries-found-privacy-act-1988.pdf, p.119
Prohibits the collection of credit information.
20D Dealing with unsolicited credit information
entries-found-privacy-act-1988.pdf, p.121
20D(1) Dealing with unsolicited credit information
Credit reporting body must determine if it could have collected information under section 20C if solicited.
20D(2) Dealing with unsolicited credit information
Use or disclose credit information for making determination under subsection (1)
(2) The credit reporting body may use or disclose the credit information
for the purposes of making the determination under subsection (1)
Within temporal interval for making determination
Through diffusion for making determination
20D(3) Dealing with unsolicited credit information
Applicable sections for unsolicited credit information
Section applies to unsolicited credit information
20E Use or disclosure of credit reporting information
entries-found-privacy-act-1988.pdf, p.122
20E(1) Use or disclosure of credit reporting information
Prohibition on using or disclosing credit reporting information
20E(2) Use or disclosure of credit reporting information
Permitted disclosures of credit reporting information
20E(3) Use or disclosure of credit reporting information
Disclosure of credit reporting information is permitted under certain conditions.
20E(4) Use or disclosure of credit reporting information
Do not disclose credit reporting information about financial hardship unless recipient is a licensed credit provider or mortgage insurer.
Temporal interval for disclosure restriction
20E(4A) Use or disclosure of credit reporting information
Credit reporting body must not disclose financial hardship information to a credit provider or mortgage insurer under certain conditions.
Request for financial hardship information
20F Permitted CRB disclosures in relation to individuals
Permitted CRB disclosures in relation to individuals
entries-found-privacy-act-1988.pdf, p.125
20G Use or disclosure of credit reporting information for the
entries-found-privacy-act-1988.pdf, p.126
20G(1) Use or disclosure of credit reporting information for the
Use or disclosure of credit reporting information for direct marketing is prohibited.
Prohibition of using or disclosing credit reporting information for direct marketing.
The Act prohibits the use or disclosure of credit reporting information for direct marketing.
Prohibition of using or disclosing credit reporting information for direct marketing during a specific time period.
The Act prohibits the use or disclosure of credit reporting information for direct marketing during a specific time period.
Direct marketing is prohibited during this time period.
Prohibition of Information Dissemination
Prohibition of disseminating credit reporting information for direct marketing.
The Act prohibits the dissemination of credit reporting information for direct marketing.
Dissemination of credit reporting information is prohibited.
Prohibition of using artificial intelligence to drive direct marketing.
The Act prohibits the use of artificial intelligence to drive direct marketing.
Artificial intelligence is prohibited from driving direct marketing.
20G(2) Use or disclosure of credit reporting information for the
Permits use of credit reporting information for direct marketing by a licensed provider in Australia.
Defines the scope of direct marketing by a licensed provider
(2) Subsection (1) does not apply to the use by the credit reporting body...
The individual has not made a request under subsection (5).
Establishes an exception for licensed providers
The body complies with any requirements that are set out in the registered CR code.
20G(3) Use or disclosure of credit reporting information for the
Credit reporting body must regard eligibility requirements nominated by provider.
20G(4) Use or disclosure of credit reporting information for the
Prohibition on using credit reporting information for pre-screening
20G(5) Use or disclosure of credit reporting information for the
Request for non-use of credit reporting information
The credit reporting body is permitted to use the information.
The credit reporting body is allowed to use the information.
20G(6) Use or disclosure of credit reporting information for the
No charge for request or effect of request
Prohibits charging individual for request or effect of request
20H Use or disclosure of pre-screening assessments
entries-found-privacy-act-1988.pdf, p.128
20H(1) Use or disclosure of pre-screening assessments
Use or disclosure of pre-screening assessments is prohibited.
20H(2) Use or disclosure of pre-screening assessments
Disclosure of pre-screening assessments for direct marketing with an Australian link.
20H(3) Use or disclosure of pre-screening assessments
Credit reporting body must make a written note of disclosure.
20H(4) Use or disclosure of pre-screening assessments
Recipient must not use or disclose pre-screening assessment.
Prohibition of using or disclosing pre-screening assessments.
20H(5) Use or disclosure of pre-screening assessments
Permits use of pre-screening assessment for direct marketing by or on behalf of credit provider.
20H(6) Use or disclosure of pre-screening assessments
Recipient must make a written note of use of pre-screening assessment.
20H(7) Use or disclosure of pre-screening assessments
No application of Australian Privacy Principles for APP entities
Excluding APP entities from privacy principles
20J Destruction of pre-screening assessment
entries-found-privacy-act-1988.pdf, p.129
20J(1) Destruction of pre-screening assessment
Destroy pre-screening assessment if no longer needed or required by law.
(1) If an entity has possession or control of a pre-screening assessment...
...the entity must destroy the assessment if:
20J(2) Destruction of pre-screening assessment
Australian Privacy Principle 11.2 does not apply to the entity in relation to the pre-screening assessment.
20K No use or disclosure of credit reporting information during a
No use or disclosure of credit reporting information during a ban period
Prohibits use or disclosure of credit reporting information during a ban period
The individual requests the body not to use or disclose the information under this Division.
The body shall not use or disclose the information.
Restricts use or disclosure to a specific time period
(1) If: (a) a credit reporting body holds credit reporting information about an individual; and (b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); and (c) the individual requests the body not to use or disclose the information under this Division;
(1) If: (a) a credit reporting body holds credit reporting information about an individual; and (b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); and (c) the individual requests the body not to use or disclose the information under this Division.
20L Adoption of government related identifiers
entries-found-privacy-act-1988.pdf, p.131
20L(1) Adoption of government related identifiers
Cannot adopt government related identifier as its own
Prohibition of adopting government related identifier
(a) a credit reporting body holds credit reporting information about an individual; and (b) the information is a government related identifier of the individual;
the body must not adopt the government related identifier as its own identifier of the individual.
Temporal interval for adopting government related identifier
Diffusing prohibition to credit reporting bodies
Classification of government related identifier by credit reporting bodies
20L(2) Adoption of government related identifiers
Exemption from subsection (1) for adoption required or authorised by law or court order.
...if the adoption of the government related identifier is required or authorised by or under an Australian law or a court/tribunal order.
Temporal relationship between subsections
20M Use or disclosure of credit reporting information that is
Must not use or disclose de-identified credit reporting information
Prohibition on use or disclosure of de-identified credit reporting information
20N Quality of credit reporting information
entries-found-privacy-act-1988.pdf, p.132
20N(1) Quality of credit reporting information
Ensure accurate, up-to-date and complete credit information
20N(2) Quality of credit reporting information
Ensure accuracy, completeness, and relevance of credit reporting information
Duty to ensure accuracy, completeness, and relevance
20N(3) Quality of credit reporting information
Ensure accuracy, completeness, and regular audits of credit information agreements.
Enter into agreements that require providers to ensure accurate credit information.
Regular audits must be conducted by an independent person.
Regular audits must be conducted within a certain timeframe.
Regular audits are a necessary condition for compliance.
20P False or misleading credit reporting information
entries-found-privacy-act-1988.pdf, p.133
20P(1) False or misleading credit reporting information
Using or disclosing false credit reporting information under this Division is prohibited.
Prohibition of using or disclosing false credit reporting information.
(a) the body uses or discloses credit reporting information under this Division (other than subsections 20D(2) and 20T(4));
(b) the information is false or misleading in a material particular.
Temporal interval for using or disclosing credit reporting information.
the information is false or misleading in a material particular.
Recurring trace for using or disclosing credit reporting information.
Diffusing the prohibition of using or disclosing false credit reporting information.
Classification of credit reporting information as true or false using artificial intelligence.
20P(2) False or misleading credit reporting information
Prohibition on using or disclosing false or misleading credit reporting information.
20Q Security of credit reporting information
Credit reporting bodies must protect credit information from misuse, interference, loss, unauthorized access, modification or disclosure.
20R Access to credit reporting information
entries-found-privacy-act-1988.pdf, p.134
20R(1) Access to credit reporting information
Must provide access to credit reporting information on request.
20R(1A) Access to credit reporting information
Access to credit reporting information is required.
Requires access to credit reporting information.
20R(2) Access to credit reporting information
Credit reporting body is not required to give access to credit reporting information under certain conditions.
Prohibition on giving access to credit reporting information
Temporal overlap between conditions for denying access to credit reporting information
Recurring trace of conditions for denying access to credit reporting information
Diffusion of conditions for denying access to credit reporting information through enforcement related activities
20S Correction of credit reporting information
entries-found-privacy-act-1988.pdf, p.137
20S(1) Correction of credit reporting information
Correct inaccurate, out-of-date, incomplete, irrelevant or misleading credit reporting information.
Obligation to correct inaccurate information
20S(2) Correction of credit reporting information
Body must provide written notice of correction within a reasonable period.
20S(3) Correction of credit reporting information
Exemption from notice under subsection (2) for impracticability or court order.
Exemption from notice under subsection (2)
...or the credit reporting body is required by or under an Australian law, or a court/tribunal order...
...it is impracticable for the credit reporting body to give the notice under that subsection.
...the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notice under that subsection.
Prohibition on giving notice under subsection (2)
...or the credit reporting body is required by or under an Australian law, or a court/tribunal order, not to give the notice under that subsection.
Permission for exemption from subsection (2)
20T Individual may request the correction of credit information etc.
Request for correction of personal information
Obligation to correct personal information
20U Notice of correction etc. must be given
entries-found-privacy-act-1988.pdf, p.139
20U(1) Notice of correction etc. must be given
Individual must provide notice of correction to credit reporting body.
20U(2) Notice of correction etc. must be given
Credit reporting body must provide written notice of correction to individual and recipient.
20U(3) Notice of correction etc. must be given
Credit reporting body must correct personal information within a reasonable period and provide written notice with reasons.
20U(4) Notice of correction etc. must be given
No notice required under certain impracticable circumstances
20V Destruction etc. of credit reporting information after the
entries-found-privacy-act-1988.pdf, p.140
20V(1) Destruction etc. of credit reporting information after the
Destruction of credit information after retention period ends.
(1) This section applies if: (a) a credit reporting body holds credit information about an individual; and (b) the retention period for the information ends.
Artificial intelligence application of destruction
20V(2) Destruction etc. of credit reporting information after the
Destroy credit information within 1 month after retention period ends.
20V(3) Destruction etc. of credit reporting information after the
Cannot destroy credit information if correction request or dispute is pending.
(3) Despite subsection (2), the credit reporting body must neither...
Retention period overlaps with correction request or dispute.
(b) there is a pending dispute in relation to the information.
20V(4) Destruction etc. of credit reporting information after the
Credit reporting body must retain credit information under certain circumstances.
(4) Subsection (2) does not apply if the credit reporting body is required by or under an Australian law, or a court/tribunal order, to retain the credit information.
Credit reporting bodies must retain credit information for at least some time period
Credit reporting bodies are entities that must retain credit information
20V(5) Destruction etc. of credit reporting information after the
Credit reporting body must destroy CRB derived information or de-identify it under certain conditions.
Obligation to destroy CRB derived information
Temporal interval for destruction of CRB derived information
(5) The credit reporting body must destroy any CRB derived information about the individual that was derived from the credit information...
Artificial intelligence application for de-identification
20V(6) Destruction etc. of credit reporting information after the
Destroy CRB derived information if pending correction or dispute
Prohibition of destroying CRB derived information
(6) Despite subsection (5), the credit reporting body must neither...
if immediately before the retention period ends:
20V(7) Destruction etc. of credit reporting information after the
Credit reporting body not required to destroy CRB-derived information under certain circumstances.
20W Retention period for credit information—general
Retention period for credit information—general
entries-found-privacy-act-1988.pdf, p.141
20X Retention period for credit information—personal insolvency
Retention period for credit information—personal insolvency
entries-found-privacy-act-1988.pdf, p.143
20Y Destruction of credit reporting information in cases of fraud
entries-found-privacy-act-1988.pdf, p.145
20Y(1) Destruction of credit reporting information in cases of fraud
Destruction of credit reporting information in cases of fraud
Obligation to destroy credit reporting information in cases of fraud
20Y(2) Destruction of credit reporting information in cases of fraud
Credit reporting body must destroy credit information and notify parties.
20Z Dealing with information if there is a pending correction
entries-found-privacy-act-1988.pdf, p.146
20Z(1) Dealing with information if there is a pending correction
Notification of Commissioner required when credit reporting body holds information about an individual under certain conditions.
20Z(2) Dealing with information if there is a pending correction
Notify the Commissioner of a matter related to information dealing with a pending correction.
20Z(3) Dealing with information if there is a pending correction
Prohibition on using or disclosing information under Subdivision D of this Division.
The credit reporting body must not use or disclose the information
The credit reporting body must not use or disclose the information under Subdivision D of this Division.
20Z(4) Dealing with information if there is a pending correction
Use or disclose information for pending correction request or dispute, or under Australian law or court order.
The credit reporting body may use or disclose the information.
if the use or disclosure is for the purposes of the pending correction request, or pending dispute, in relation to the information;
if the use or disclosure is required by or under an Australian law or a court/tribunal order;
The use or disclosure of the information is required by or under an Australian law or a court/tribunal order.
The credit reporting body may use or disclose the information if: (a) the use or disclosure is for the purposes of the pending correction request, or pending dispute, in relation to the information;
20Z(5) Dealing with information if there is a pending correction
Credit reporting body must make a written note of use or disclosure of information.
20Z(6) Dealing with information if there is a pending correction
Commissioner may direct credit reporting body to destroy or de-identify information by a specified day.
20Z(7) Dealing with information if there is a pending correction
Must comply with direction from Commissioner
20Z(8) Dealing with information if there is a pending correction
Section applies to credit reporting information de-identified by the credit reporting body.
Section applies to specified information
20ZA Dealing with information if an Australian law etc. requires it
Credit reporting bodies must retain information if required by an Australian law.
entries-found-privacy-act-1988.pdf, p.147
Credit reporting bodies must retain information
Information must be retained for at least the duration specified in the law
An Australian law specifies a retention period
If an Australian law requires information to be retained, then credit reporting bodies must retain it
An Australian law requires information to be retained
Information is a type of data that can be diffused through credit reporting bodies
Data retention is required by an Australian law
Information is a type of cognitive input for credit reporting bodies
21 Guide to this Division
Rules for credit providers' handling of credit information, eligibility information, and CRB-derived information.
entries-found-privacy-act-1988.pdf, p.149
21A Application of this Division to credit providers
21A(1) Application of this Division to credit providers
This Division applies to a credit provider in relation to the specified information.
The Division applies to a credit provider.
21A(2) Application of this Division to credit providers
Permits credit providers to consider information privacy under this Division instead of Australian Privacy Principles.
21B Open and transparent management of credit information etc.
Ensure open and transparent management of credit information
Duty to manage credit information transparently
21C Additional notification requirements for the collection of
entries-found-privacy-act-1988.pdf, p.152
21C(1) Additional notification requirements for the collection of
Notify individual of personal info disclosure to credit reporting body
Notification occurs at or before collection of personal info
(1) At or before the time a credit provider collects personal information about an individual that the provider is likely to disclose to a credit reporting body, the provider must:
Notification implies awareness of disclosure matters
Notification diffuses awareness of disclosure matters
21C(2) Additional notification requirements for the collection of
Credit provider must comply with Australian Privacy Principle 5 for personal information.
Obligation to comply with Australian Privacy Principle 5.
21C(3) Additional notification requirements for the collection of
Credit provider must notify about credit reporting policy and procedures.
21D Disclosure of credit information to a credit reporting body
entries-found-privacy-act-1988.pdf, p.153
21D(1) Disclosure of credit information to a credit reporting body
Disclose credit information to a credit reporting body
21D(2) Disclosure of credit information to a credit reporting body
Disclosure of credit information to a credit reporting body is permitted under certain conditions.
Requires a relation between identifiable temporal intervals for conditional commencement.
21D(3) Disclosure of credit information to a credit reporting body
Credit information disclosure to credit reporting body
Obligation to disclose credit information
21E Payment information must be disclosed to a credit reporting
Credit provider must disclose payment information after overdue payment is made.
entries-found-privacy-act-1988.pdf, p.155
21EA Financial hardship information must be disclosed
Credit provider must disclose financial hardship information to credit reporting body.
21F Limitation on the disclosure of credit information during a ban
entries-found-privacy-act-1988.pdf, p.156
21F(1) Limitation on the disclosure of credit information during a ban
Credit reporting body must disclose information to credit provider during ban period.
(a) a credit reporting body holds credit reporting information about an individual;
(d) during the ban period, the provider provides the consumer credit to which the application relates to the individual, or the person purporting to be the individual.
the body is not permitted to disclose the information because there is a ban period for the information;
Credit provider must provide credit during ban period
(c) the body is not permitted to disclose the information because there is a ban period for the information;
the provider provides the consumer credit to which the application relates to the individual, or the person purporting to be the individual.
State must ensure disclosure and provision
21F(2) Limitation on the disclosure of credit information during a ban
Credit provider must not disclose credit information to a credit reporting body.
21F(3) Limitation on the disclosure of credit information during a ban
Credit provider must verify individual's identity before disclosing credit information.
Reasonable steps taken to verify identity
21G Use or disclosure of credit eligibility information
21G(1) Use or disclosure of credit eligibility information
Use or disclosure of credit eligibility information is prohibited.
21G(2) Use or disclosure of credit eligibility information
Permitted disclosures of credit eligibility information
21G(3) Use or disclosure of credit eligibility information
Permitted disclosure of credit eligibility information
Prohibition on disclosure of credit eligibility information
21H Permitted CP uses in relation to individuals
Permitted CP uses in relation to individuals
entries-found-privacy-act-1988.pdf, p.159
(a) the relevant credit reporting information was disclosed to the provider under a provision specified in column 1 of the table for the purpose (if any) specified in that column; and (b) the provider uses the credit eligibility information for the purpose specified in column 2 of the table.
(a) the relevant credit reporting information was not disclosed to the provider under a provision specified in column 1 of the table for the purpose (if any) specified in that column; or (b) the provider uses the credit eligibility information for a purpose other than the one specified in column 2 of the table.
21J Permitted CP disclosures between credit providers
entries-found-privacy-act-1988.pdf, p.161
21J(1) Permitted CP disclosures between credit providers
Permitted CP disclosures between credit providers
Permits disclosure of credit eligibility information
(1) A disclosure by a credit provider...
21J(2) Permitted CP disclosures between credit providers
Consent must be given in writing for certain disclosures.
21J(3) Permitted CP disclosures between credit providers
21J(4) Permitted CP disclosures between credit providers
21K Permitted CP disclosures relating to guarantees etc.
entries-found-privacy-act-1988.pdf, p.163
21K(1) Permitted CP disclosures relating to guarantees etc.
Disclosure of credit eligibility information is permitted for certain purposes.
Permission to disclose credit eligibility information.
21K(2) Permitted CP disclosures relating to guarantees etc.
Consent for credit application must be given in writing under certain conditions.
Permits the consent to be given in writing under certain conditions.
21K(3) Permitted CP disclosures relating to guarantees etc.
Permitted CP disclosures relating to guarantees etc.
21L Permitted CP disclosures to mortgage insurers
Permitted CP disclosures to mortgage insurers
entries-found-privacy-act-1988.pdf, p.164
21M Permitted CP disclosures to debt collectors
21M(1) Permitted CP disclosures to debt collectors
Permitted CP disclosures to debt collectors
Permits credit providers to disclose credit eligibility information
(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:
Requires that the disclosure be made for the primary purpose of collecting payments
(c) The information is disclosed to the person or body for the primary purpose of the person or body collecting payments that are overdue in relation to:
(i) Consumer credit provided by the provider to the individual; or (ii) Commercial credit provided by the provider to a person;
(d) The information is information of a kind referred to in subsection (2).
Note: See section 21NA for additional rules about the disclosure of credit eligibility information under this subsection.
21M(2) Permitted CP disclosures to debt collectors
Debt collectors may disclose certain information about individuals.
Classifies the key as a permission provision.
21N Permitted CP disclosures to other recipients
Disclosure of credit eligibility information to State or Territory authorities is permitted under certain conditions.
entries-found-privacy-act-1988.pdf, p.165
(a) the disclosure is to a State or Territory authority; and (b) the functions or responsibilities of the authority include...
(i) giving assistance (directly or indirectly) that facilitates the provision of mortgage credit to individuals; or (ii) the management or supervision of schemes or arrangements under which such assistance is given;
the information is disclosed for the purpose of enabling the authority:
21NA Disclosures to certain persons and bodies that do not have an
entries-found-privacy-act-1988.pdf, p.167
21NA(1) Disclosures to certain persons and bodies that do not have an
Ensure compliance with certain provisions when disclosing credit eligibility information to unrelated bodies or persons.
21NA(2) Disclosures to certain persons and bodies that do not have an
Debt collectors must comply with the provisions of this Act.
The provisions of this Act apply to debt collectors.
21NA(3) Disclosures to certain persons and bodies that do not have an
Credit provider must disclose credit eligibility information to certain persons and bodies.
21P Notification of a refusal of an application for consumer credit
entries-found-privacy-act-1988.pdf, p.168
21P(1) Notification of a refusal of an application for consumer credit
Credit provider must not refuse an application for consumer credit based on certain information.
Prohibition of refusal based on credit eligibility information.
(a) a credit provider refuses an application for consumer credit...
...the refusal is based wholly or partly on credit eligibility information about one or more of the following:
Temporal interval for notification of refusal.
...the individual; or (ii) jointly by an individual and one or more other persons...
Recurring trace of credit reporting body disclosure.
(c) a credit reporting body disclosed the relevant credit reporting information to the provider for the purposes of assessing the application.
Information flow from credit reporting body to provider.
Knowledge representation of credit eligibility information.
(b) the refusal is based wholly or partly on credit eligibility information about one or more of the following:
...the individual; or (ii) a person who is proposing to act as a guarantor in relation to the consumer credit...
21P(2) Notification of a refusal of an application for consumer credit
Credit provider must notify individual of refusal with specific details.
21Q Quality of credit eligibility information
entries-found-privacy-act-1988.pdf, p.169
21Q(1) Quality of credit eligibility information
Ensure accurate, up-to-date and complete credit eligibility information.
21Q(2) Quality of credit eligibility information
Ensure accurate, up-to-date, complete and relevant credit eligibility information.
Obligation to ensure accurate credit eligibility information.
21Q(3) Quality of credit eligibility information
Australian Privacy Principle 10 does not apply to credit providers in relation to credit eligibility information.
Prohibits the application of Australian Privacy Principle 10 to credit providers.
(3) If a credit provider is an APP entity, Australian Privacy Principle 10 does not apply to the provider in relation to credit eligibility information.
Defines the temporal scope of the prohibition.
Applies the prohibition to all relevant entities.
Applies the prohibition using artificial intelligence.
21R False or misleading credit information or credit eligibility
entries-found-privacy-act-1988.pdf, p.170
21R(1) False or misleading credit information or credit eligibility
Disclosing false or misleading credit information is an offence.
Prohibits the act of disclosing false or misleading credit information.
21R(2) False or misleading credit information or credit eligibility
Using or disclosing false credit eligibility information is prohibited.
Prohibition of using or disclosing false credit eligibility information.
(2) A credit provider commits an offence if...
21R(3) False or misleading credit information or credit eligibility
Credit provider must not disclose false or misleading credit information.
21R(4) False or misleading credit information or credit eligibility
Prohibition on using or disclosing false or misleading credit eligibility information.
21S Security of credit eligibility information
21S(1) Security of credit eligibility information
Must protect credit eligibility information from misuse, interference, loss, unauthorized access, modification or disclosure.
Obligation to protect credit eligibility information
Must take reasonable steps to protect the information
Must protect credit eligibility information from unauthorized access at all times
Credit provider has a duty to protect sensitive data
Unauthorized access is a critical risk that must be mitigated
21S(2) Security of credit eligibility information
Credit provider must destroy or de-identify credit eligibility information
21S(3) Security of credit eligibility information
Australian Privacy Principle 11 does not apply to credit providers in relation to credit eligibility information.
Exemption from Australian Privacy Principle 11
Australian Privacy Principle 11 does not apply
21T Access to credit eligibility information
entries-found-privacy-act-1988.pdf, p.171
21T(1) Access to credit eligibility information
Must provide access to credit eligibility information on request
21T(2) Access to credit eligibility information
Credit provider is not required to give access to credit eligibility information under certain conditions.
Prohibits giving access to credit eligibility information
21U Correction of credit information or credit eligibility
entries-found-privacy-act-1988.pdf, p.173
21U(1) Correction of credit information or credit eligibility
Credit provider must correct inaccurate credit information.
Obligation to correct inaccurate credit information.
21U(2) Correction of credit information or credit eligibility
Provider must give written notice of correction within a reasonable period.
21V Individual may request the correction of credit information etc.
entries-found-privacy-act-1988.pdf, p.174
21V(1) Individual may request the correction of credit information etc.
Request to correct personal information about an individual.
Individual has a right to request correction of personal information.
Personal information about an individual is included in the definition of credit information.
21V(2) Individual may request the correction of credit information etc.
Credit provider must correct inaccurate personal information within a specified period.
Obligation to correct inaccurate personal information
21V(3) Individual may request the correction of credit information etc.
Credit provider must consult interested party about individual's request.
the provider must consult that interested party, or those interested parties, about the individual’s request.
21V(4) Individual may request the correction of credit information etc.
Use of personal information for consultation purposes is authorized.
21V(5) Individual may request the correction of credit information etc.
Credit provider cannot charge for request or correction of credit information.
(5) The credit provider must not charge...
21V(6) Individual may request the correction of credit information etc.
Australian Privacy Principle 13 obligation for APP entities
Obligation to comply with Australian Privacy Principle 13
(6) If a credit provider is an APP entity, Australian Privacy Principle 13:
Occurrence of Australian Privacy Principle 13 for APP entities
Trace of Australian Privacy Principle 13 application for APP entities
Diffusion of Australian Privacy Principle 13 obligations for APP entities
Cognitive processing of Australian Privacy Principle 13 for APP entities
21W Notice of correction etc. must be given
entries-found-privacy-act-1988.pdf, p.176
21W(1) Notice of correction etc. must be given
Individuals must provide notice of correction for personal information.
21W(2) Notice of correction etc. must be given
Credit provider must give written notice of correction to individual and recipients.
Correction must be made within a reasonable period
21W(3) Notice of correction etc. must be given
Correct personal information within a reasonable period
21W(4) Notice of correction etc. must be given
No notice is required under paragraph (2)(c) if impracticable to provide it.
(4) Paragraph (2)(c) does not apply if it is impracticable for the credit provider to give the notice under that paragraph.
21W(5) Notice of correction etc. must be given
No notice required under subsection (2) or (3) if mandated by law or court order.
Australian law or court order supersedes subsection (2) or (3)
Temporal overlap between exemption and subsection (2) or (3)
Exemption supersedes subsection (2) or (3) if mandated by law or court order
Temporal tracing of exemption and subsection (2) or (3)
Diffusion of exemption through Australian law and court orders
Recognition of exemption as a subclass of obligation
Subsection (2) or (3) does not apply if mandated by law or court order
22 Guide to this Division
Rules for handling regulated information apply to affected recipients.
entries-found-privacy-act-1988.pdf, p.178
22A Open and transparent management of regulated information
22A(1) Open and transparent management of regulated information
Ensure open and transparent management of regulated information
22A(2) Open and transparent management of regulated information
Implement practices, procedures and systems to comply with Division and registered CR code
Obligation to comply with Division and registered CR code
(2) An affected information recipient must take such steps as are reasonable in the circumstances
to implement practices, procedures and systems relating to the recipient's functions or activities
Temporal interval: Reasonable circumstances -> Implementation
Recurring trace: Implementation -> Compliance with Division and registered CR code
Spread of implementation: Practices, procedures and systems -> Compliance with Division and registered CR code
Recognition of implementation: Practices, procedures and systems -> Compliance with Division and registered CR code
22A(3) Open and transparent management of regulated information
Recipient must have a clearly expressed policy about management of regulated information.
Recipient must have a clearly expressed policy.
22A(4) Open and transparent management of regulated information
Recipient must provide information about regulated data collection and use.
22A(5) Open and transparent management of regulated information
Affected information recipient must make policy available
Policy availability during reasonable steps
(5) An affected information recipient must take such steps as are reasonable in the circumstances to make the policy available:
22A(6) Open and transparent management of regulated information
Recipient must provide a copy of requested policy in a particular form.
22B Additional notification requirements for affected information
Recipient must provide information about access and complaint procedures
entries-found-privacy-act-1988.pdf, p.180
22C Use or disclosure of information by mortgage insurers or trade
22C(1) Use or disclosure of information by mortgage insurers or trade
Insurer must not use or disclose personal information about an individual.
Insurer must not use or disclose personal information.
22C(2) Use or disclosure of information by mortgage insurers or trade
Permitted disclosure of information under certain conditions.
Indicates that disclosure is permitted under specific conditions.
22C(3) Use or disclosure of information by mortgage insurers or trade
Disclosure of information is permitted if required or authorised by Australian law or court/tribunal order.
Permitted by Australian law or court/tribunal order
22C(4) Use or disclosure of information by mortgage insurers or trade
Exemption from Australian Privacy Principles for APP entities
APP entities are exempt from Australian Privacy Principles
22C(5) Use or disclosure of information by mortgage insurers or trade
Mortgage insurer or trade must be an APP entity.
22D Use or disclosure of information by a related body corporate
entries-found-privacy-act-1988.pdf, p.182
22D(1) Use or disclosure of information by a related body corporate
Body corporate must not use or disclose credit information about an individual.
Prohibition of using or disclosing credit information.
22D(2) Use or disclosure of information by a related body corporate
Permits use or disclosure of information by a related body corporate under certain conditions.
22D(3) Use or disclosure of information by a related body corporate
Permits use or disclosure of information by a related body corporate
22D(4) Use or disclosure of information by a related body corporate
Australian Privacy Principles do not apply to APP entities.
Applying Australian Privacy Principles is obligatory for APP entities.
Australian Privacy Principles do not apply.
22D(5) Use or disclosure of information by a related body corporate
Body corporate is exempt from APPII if it's an APP entity and the info is a government related identifier of the individual.
Australian Privacy Principle 9.2 does not apply
22E Use or disclosure of information by credit managers etc.
entries-found-privacy-act-1988.pdf, p.183
22E(1) Use or disclosure of information by credit managers etc.
Prohibition on using or disclosing credit information without consent.
Prohibition on using or disclosing credit information.
(1) If: a person holds or held credit eligibility information about an individual; and the information was disclosed to the person by a credit provider under paragraph 21G(3)(c); the person must not use or disclose the information, or any personal information about the individual derived from that information.
The prohibition applies to information disclosed under paragraph 21G(3)(c).
(b) the information was disclosed to the person by a credit provider under paragraph 21G(3)(c);
The prohibition is in effect while the information is held or used.
(1) If: a person holds or held credit eligibility information about an individual; and
The credit provider has an obligation to ensure the information is not used or disclosed.
The person holding the information has an obligation not to use or disclose it.
(a) a person holds or held credit eligibility information about an individual; and
22E(2) Use or disclosure of information by credit managers etc.
Use of information for disclosed purpose is permitted.
22F Use or disclosure of information by advisers etc.
entries-found-privacy-act-1988.pdf, p.184
22F(1) Use or disclosure of information by advisers etc.
Recipient must not use or disclose credit eligibility information about an individual.
Prohibition of using or disclosing credit eligibility information.
the recipient must not use or disclose the information.
Restriction on temporal scope of prohibition.
(b) the information was disclosed to the recipient by a credit provider under subsection 21N(2);
Recurring trace of prohibition on recipients.
(a) any of the following (the recipient) holds or held credit eligibility information about an individual:
Restriction on information flow to recipients.
Knowledge representation of prohibition on recipients.
22F(2) Use or disclosure of information by advisers etc.
22F(3) Use or disclosure of information by advisers etc.
22F(4) Use or disclosure of information by advisers etc.
22F(5) Use or disclosure of information by advisers etc.
Exemption from Australian Privacy Principle 9.2 for APP entities with government-related identifiers.
23 Guide to this Division
Respondent must investigate and make a decision on complaints.
entries-found-privacy-act-1988.pdf, p.186
23A Individual may complain about a breach of a provision of this
23A(1) Individual may complain about a breach of a provision of this
23A(2) Individual may complain about a breach of a provision of this
Complain about a breach of provisions related to credit reporting
Individual has a right to complain about a breach of provisions
Excerpt specifies a temporal interval for complaint-making
An individual may complain about a breach within the scope of this Part
23A(3) Individual may complain about a breach of a provision of this
Must specify the nature of the complaint upon making a complaint.
Must specify the nature of the complaint.
Obligation to specify the nature of the complaint.
23A(4) Individual may complain about a breach of a provision of this
No charge for complaint about personal information destruction or de-identification.
Complaint about personal information destruction or de-identification
23A(5) Individual may complain about a breach of a provision of this
Credit provider cannot charge individual for complaint or dealing with complaint.
The credit provider must not charge the individual.
23B Dealing with complaints
entries-found-privacy-act-1988.pdf, p.187
23B(1) Dealing with complaints
Respondent must acknowledge complaint and investigate within 7 days.
Must provide written notice and investigate complaint
23B(2) Dealing with complaints
Respondent must consult credit reporting body or provider about complaint.
Requires consultation within a certain timeframe
(2) If the respondent for the complaint considers that it is necessary to consult a credit reporting body or credit provider about the complaint, the respondent must consult the body or provider.
Requires consultation in response to complaint
Spreads information about consultation requirement
23B(3) Dealing with complaints
Use or disclosure of personal information for consultation purposes is authorized.
Use or disclosure of personal information for consultation purposes.
23C Notification requirements relating to correction complaints
entries-found-privacy-act-1988.pdf, p.188
23C(1) Notification requirements relating to correction complaints
Notification requirements for correction complaints
23C(2) Notification requirements relating to correction complaints
Respondent must notify provider of complaint and decision.
23C(3) Notification requirements relating to correction complaints
Respondent must notify body or provider of complaint making and decision making.
23C(4) Notification requirements relating to correction complaints
Credit reporting body must notify recipient of complaint if disclosure made under Division 2 and decision not yet made.
23C(5) Notification requirements relating to correction complaints
Credit provider must notify about disclosure of personal information under complaint.
...a credit provider discloses personal information...
...a decision about the complaint under subsection 23B(4) has not been made
Notification must be provided before decision-making
...a credit provider discloses personal information under complaint.
24 Obtaining credit reporting information from a credit reporting
entries-found-privacy-act-1988.pdf, p.191
24(1) Obtaining credit reporting information from a credit reporting
Obtaining credit reporting information from a credit reporting body without permission is an offence.
Prohibition of obtaining credit reporting information without permission.
Entity obtains credit reporting information from a credit reporting body.
Temporal relation between obtaining credit reporting information and committing an offence.
Entity obtains credit reporting information.
Entity commits an offence at a later time.
24(2) Obtaining credit reporting information from a credit reporting
Obtaining credit reporting information by false pretence is an offence.
Prohibition of obtaining credit reporting information by false pretence.
Entity obtains credit reporting information by false pretence.
Entity has an obligation to obtain credit reporting information lawfully.
Entity must obtain credit reporting information lawfully.
Information obtained by false pretence overlaps with lawful information.
Information is obtained by false pretence.
Lawful information does not overlap with information obtained by false pretence.
False pretence is prohibited when obtaining credit reporting information.
24(3) Obtaining credit reporting information from a credit reporting
Entity must not obtain credit reporting information without permission or be an access seeker.
Prohibition of obtaining credit reporting information
Temporal interval for obtaining credit reporting information
if the entity is not: (a) an entity to which...
(b) an access seeker for the information.
24A Obtaining credit eligibility information from a credit provider
entries-found-privacy-act-1988.pdf, p.192
24A(1) Obtaining credit eligibility information from a credit provider
Obtaining credit eligibility information from a credit provider without permission is an offence.
Prohibition of obtaining credit eligibility information without permission.
Entity obtains credit eligibility information from a credit provider.
Prohibition of disclosing credit eligibility information without permission.
Entity is not an access seeker for the information.
24A(2) Obtaining credit eligibility information from a credit provider
Obtaining credit eligibility information by false pretence is an offence.
Prohibition of obtaining credit eligibility information by false pretence.
Entity obtains credit eligibility information by false pretence.
Obligation to not obtain credit eligibility information by false pretence.
Entity has a duty to provide accurate information.
Entity must not obtain credit eligibility information by false pretence.
Temporal overlap between obtaining credit eligibility information and committing an offence.
Obtaining credit eligibility information occurs before committing an offence.
Temporal overlap between the two events.
Inference of committing an offence from obtaining credit eligibility information.
24A(3) Obtaining credit eligibility information from a credit provider
An entity must not obtain credit eligibility information from a credit provider unless it is an entity to which the provider is permitted to disclose the information or an access seeker for the information.
Prohibition of obtaining credit eligibility information from a credit provider
Entity must not obtain credit eligibility information
unless it is an entity to which the provider is permitted to disclose the information or an access seeker for the information.
Temporal interval of when an entity can obtain credit eligibility information from a credit provider
Entity must not obtain credit eligibility information unless it is within the permitted time frame or seeking access to the information.
Recurring trace of entities that can obtain credit eligibility information from a credit provider
Entity must be an entity to which the provider is permitted to disclose the information or an access seeker for the information.
Diffusion of knowledge about entities that can obtain credit eligibility information from a credit provider
Entity must not obtain credit eligibility information unless it is an entity to which the provider is permitted to disclose the information or an access seeker for the information.
Recognition of entities that can obtain credit eligibility information from a credit provider
24A(4) Obtaining credit eligibility information from a credit provider
Cannot obtain credit eligibility information by false pretence
25 Compensation orders
entries-found-privacy-act-1988.pdf, p.194
25(1) Compensation orders
Compensation order for loss or damage suffered due to contravention of Part.
25(2) Compensation orders
Court may make compensation order within 6 years of cause of action.
Order may only be made if application is made in order of time
25(3) Compensation orders
25A Other orders to compensate loss or damage
25A(1) Other orders to compensate loss or damage
Loss or damage resulting from contravention of this Part
25A(2) Other orders to compensate loss or damage
Compensate loss or damage suffered by a person.
Imposes an obligation on the State to compensate loss or damage.
25A(3) Other orders to compensate loss or damage
Order to perform reasonable act or course of conduct
25A(4) Other orders to compensate loss or damage
Court may make order to compensate loss or damage within 6 years of cause of action.
25A(5) Other orders to compensate loss or damage
Entity must pay amount to person as a debt.
25B Review of operation of this Part
entries-found-privacy-act-1988.pdf, p.196
25B(1) Review of operation of this Part
Minister must conduct an independent review of the operation of this Part.
Minister must conduct an independent review.
25B(2) Review of operation of this Part
Completion of review report by a certain date.
25B(3) Review of operation of this Part
The Minister must cause a copy of the report to be tabled in each House of the Parliament within 15 sitting days.
The Minister must cause a copy of the report to be tabled in each House of the Parliament.
26 Guide to this Part
entries-found-privacy-act-1988.pdf, p.197
The Commissioner includes an APP code on the Codes Register.
An entity bound by the code must not breach it.
26A APP entities to comply with binding registered APP codes
entries-found-privacy-act-1988.pdf, p.199
26B What is a registered APP code
26B(1) What is a registered APP code
A registered APP code must be included on the Codes Register and in force.
Must be included on the Codes Register and in force.
26B(2) What is a registered APP code
A registered APP code is a legislative instrument.
26B(3) What is a registered APP code
No retrospective application of legislative instruments to registered APP codes.
Prohibits retrospective application of legislative instruments.
does not apply to a registered APP code.
Imposes an obligation on the State to respect the retrospective application of legislative instruments for non-registered codes.
Establishes the temporal relationship between the retrospective application and the registration.
does not apply to a registered APP code before it is included on the Codes Register: see paragraph 26C(2)(c).
Describes the temporal scope of the obligation.
does not apply to a registered APP code until it is included on the Codes Register: see paragraph 26C(2)(c).
26C What is an APP code
26C(1) What is an APP code
An APP code is a written code of practice about information privacy.
26C(2) What is an APP code
Must specify how APP principles are applied and which entities are bound
(b) specify the APP entities that are bound by the code,
Set out period during which the code is in force
(c) set out the period during which the code is in force (which must not start before the day the code is registered under section 26H).
26D Extension of Act to exempt acts or practices covered by
This Act applies in relation to the code as if that act or practice were not exempt.
entries-found-privacy-act-1988.pdf, p.200
If a registered APP code covers an act or practice that is exempt, this Act applies.
A registered APP code covers an act or practice.
The exemption occurs within the meaning of subsection 7B(1), (2) or (3).
Subsection 7B(1), (2) or (3) defines when an act or practice is exempt.
26E Development of APP codes by APP code developers
entries-found-privacy-act-1988.pdf, p.201
26E(1) Development of APP codes by APP code developers
An APP code developer may develop an APP code at the Commissioner's request.
26E(2) Development of APP codes by APP code developers
Commissioner may request APP code developer to develop an APP code.
26E(3) Development of APP codes by APP code developers
Request must specify period and effect of section 26A
Specify period and effect of section 26A
26E(4) Development of APP codes by APP code developers
The period must run for at least 120 days from the date the request is made.
(4) The period must run for at least 120 days from the date the request is made;
(4) The period may be extended by the Commissioner;
26E(5) Development of APP codes by APP code developers
Specify matters and entities bound by the APP code
26E(6) Development of APP codes by APP code developers
Commissioner cannot require APP code to cover exempt act or practice.
26E(7) Development of APP codes by APP code developers
Publicly available copy of request must be made by the Commissioner.
Obligation to make publicly available copy of request.
26F Application for registration of APP codes
entries-found-privacy-act-1988.pdf, p.202
26F(1) Application for registration of APP codes
Developer may apply for registration of APP code.
26F(2) Application for registration of APP codes
Must make draft publicly available and invite public submissions
Obligation to make draft publicly available
26F(3) Application for registration of APP codes
Application must be made in specified form and manner.
Information as specified by the Commissioner
26F(4) Application for registration of APP codes
Commissioner's consent required for varying APP code
26G Development of APP codes by the Commissioner—following a
26G(1) Development of APP codes by the Commissioner—following a
Non-compliance with Commissioner's request
26G(2) Development of APP codes by the Commissioner—following a
Commissioner may develop APP code if in public interest.
26G(3) Development of APP codes by the Commissioner—following a
Commissioner must make draft of APP code publicly available and invite public submissions.
Must make draft of APP code publicly available.
26GA Development of APP codes by the Commissioner—at the
entries-found-privacy-act-1988.pdf, p.203
26GA(1) Development of APP codes by the Commissioner—at the
Minister may direct Commissioner to develop APP code if in public interest.
26GA(2) Development of APP codes by the Commissioner—at the
Specify matters that the code must deal with and APP entities to be bound by the code.
Specify matters that the code must deal with
Specify APP entities to be bound by the code
26GA(3) Development of APP codes by the Commissioner—at the
Commissioner must develop and register code
26GA(4) Development of APP codes by the Commissioner—at the
The Commissioner must develop and register an APP code if directed by the Minister.
Obligation to develop and register APP code
The Minister has given the Commissioner a direction
The Commissioner must develop and register an APP code
26GB Development of APP codes by the Commissioner—temporary
entries-found-privacy-act-1988.pdf, p.204
26GB(1) Development of APP codes by the Commissioner—temporary
The Minister may direct the Commissioner to develop a temporary APP code.
Describes a temporal relationship between the development of the code and its implementation.
Provides a justification for the Minister's decision.
26GB(2) Development of APP codes by the Commissioner—temporary
Temporary development of APP codes by the Commissioner
26GB(3) Development of APP codes by the Commissioner—temporary
26GB(4) Development of APP codes by the Commissioner—temporary
Commissioner must develop and register temporary APP code on Minister's direction.
26GB(5) Development of APP codes by the Commissioner—temporary
Temporary APP code must not cover exempt acts or practices.
Prohibition of exempt acts or practices.
26GB(6) Development of APP codes by the Commissioner—temporary
Commissioner may consult persons for developing temporary APP code.
26GB(7) Development of APP codes by the Commissioner—temporary
The temporary APP code period must not exceed 12 months.
26GB(8) Development of APP codes by the Commissioner—temporary
Section 42 of the Legislation Act 2003 does not apply to a temporary APP code that is a registered APP code.
26GC Development of APP codes by the Commissioner—Children’s
The Commissioner must develop an APP code about online privacy for children.
entries-found-privacy-act-1988.pdf, p.205
26H Commissioner may register APP codes
entries-found-privacy-act-1988.pdf, p.208
26H(1) Commissioner may register APP codes
26H(2) Commissioner may register APP codes
Commissioner may consult persons and consider guidelines when deciding to register APP code
26H(3) Commissioner may register APP codes
Commissioner must give written notice of decision to developer
26J Variation of registered APP codes
entries-found-privacy-act-1988.pdf, p.209
26J(1) Variation of registered APP codes
Commissioner may approve variation of registered APP code
Commissioner has the power to approve variations
26J(2) Variation of registered APP codes
Information specified by the Commissioner
26J(3) Variation of registered APP codes
Variation of registered APP codes must not deal with exempt acts or practices.
Prohibits variation of registered APP codes with exempt acts or practices.
26J(4) Variation of registered APP codes
Duty to consult and consider public comment on variation
(a) draft of the variation, (b) consultation results, (c) opportunity for public comment
26J(5) Variation of registered APP codes
Consider relevant guidelines when deciding to approve a variation.
26K Removal of registered APP codes
entries-found-privacy-act-1988.pdf, p.210
26K(1) Removal of registered APP codes
The Commissioner may remove a registered APP code from the Codes Register.
The Commissioner may remove a registered APP code.
26K(2) Removal of registered APP codes
26K(3) Removal of registered APP codes
Consultation and public comment requirement before removing registered APP code
Duty to consult and consider public comment
...and consider the extent to which members of the public have been given an opportunity to comment on the proposed removal.
...the extent to which members of the public have been given an opportunity to comment on the proposed removal.
Recommendation for consultation and public comment
Temporal interval for consultation and public comment requirement
26K(4) Removal of registered APP codes
Consider relevant guidelines when removing registered APP codes
26L Entities to comply with the registered CR code if bound by the
entries-found-privacy-act-1988.pdf, p.212
26M What is the registered CR code
26M(1) What is the registered CR code
The registered CR code is the CR code that is included on the Codes Register.
26M(2) What is the registered CR code
The registered CR code is a legislative instrument.
26M(3) What is the registered CR code
Subsection 12(2) of the Legislation Act 2003 does not apply to the registered CR code.
Subsection 12(2) does not apply to the registered CR code.
26N What is a CR code
26N(1) What is a CR code
A written code of practice about credit reporting is required.
A CR code is a written code of practice about credit reporting.
26N(2) What is a CR code
A CR code must set out how to apply Part IIIA provisions and make provision for matters required or permitted by Part IIIA.
Must provide a CR code that sets out how to apply Part IIIA provisions.
(2) A CR code must: (a) set out how one or more of the provisions of Part IIIA are to be applied or complied with;
A CR code must set out how to apply Part IIIA provisions.
Must make provision for matters required or permitted by Part IIIA.
(2) A CR code must: (b) make provision for, or in relation to, matters required or permitted by Part IIIA to be provided for by the registered CR code;
A CR code must make provision for matters required or permitted by Part IIIA.
(2) A CR code must: (c) bind all credit reporting bodies;
A CR code must bind all credit reporting bodies.
Must specify the credit providers that are bound by the code.
(2) A CR code must: (d) specify the credit providers that are bound by the code, or a way of determining which credit providers are bound;
A CR code must specify the credit providers that are bound by the code.
Must specify any other entities subject to Part IIIA that are bound by the code.
(2) A CR code must: (e) specify any other entities subject to Part IIIA that are bound by the code, or a way of determining which of those entities are bound.
A CR code must specify any other entities subject to Part IIIA that are bound by the code.
26N(3) What is a CR code
Imposes additional requirements on CR codes
(3) A CR code may do one or more of the following:
26P Development of CR code by CR code developers
entries-found-privacy-act-1988.pdf, p.213
26P(1) Development of CR code by CR code developers
Commissioner may request CR code developer to develop a CR code.
26P(2) Development of CR code by CR code developers
Specify period for compliance and effect of section 26L
26P(3) Development of CR code by CR code developers
Minimum duration for a request to be made
(3) The period must run for at least 120 days from the date the request is made
26Q Application for registration of CR code
entries-found-privacy-act-1988.pdf, p.214
26Q(1) Application for registration of CR code
Developer may apply for registration of CR code
26Q(2) Application for registration of CR code
Must make draft publicly available, invite public submissions, and consider submissions.
26Q(3) Application for registration of CR code
26Q(4) Application for registration of CR code
Consent required from Commissioner to vary CR code
26R Development of CR code by the Commissioner
entries-found-privacy-act-1988.pdf, p.215
26R(1) Development of CR code by the Commissioner
Commissioner may develop CR code under certain conditions.
Commissioner has the power to develop CR code.
26R(2) Development of CR code by the Commissioner
Commissioner must make draft publicly available and invite public submissions.
Must provide draft and consider submissions.
26S Commissioner may register CR code
26S(1) Commissioner may register CR code
26S(2) Commissioner may register CR code
Commissioner must consult with persons and consider guidelines when deciding to register CR code.
Commissioner must consult with persons and consider guidelines.
Consultation must occur within a certain timeframe.
Consultation MUST BE BETWEEN a certain timeframe and the decision to register CR code.
Guidelines inform consultation decisions
If guidelines exist, then consultation must occur.
26S(3) Commissioner may register CR code
Commissioner must give written notice to developer if not registering CR code
26T Variation of the registered CR code
entries-found-privacy-act-1988.pdf, p.216
26T(1) Variation of the registered CR code
Commissioner may approve variation of registered CR code
Commissioner has the power to approve variation
26T(2) Variation of the registered CR code
26T(3) Variation of the registered CR code
Commissioner must consult and consider public comments before approving a variation.
Draft of the variation and opportunity for public comment
Commissioner has a duty to consult and consider public comments.
26T(4) Variation of the registered CR code
26T(5) Variation of the registered CR code
Commissioner must remove original code and register varied CR code.
Duty to remove original code and register varied CR code.
26T(6) Variation of the registered CR code
Variation of the registered CR code comes into effect on a specified day after approval.
26T(7) Variation of the registered CR code
An approval is not a legislative instrument.
Temporal relation between CR code variation and legislative instrument status
An approval is not a legislative instrument. Note: The CR code, as varied, is a legislative instrument once it is included on the Codes Register: see section 26M.
26U Codes Register
entries-found-privacy-act-1988.pdf, p.218
26U(1) Codes Register
The Commissioner must keep a register of APP codes and CR codes.
26U(2) Codes Register
Commissioner must include certain codes on the Codes Register.
26U(3) Codes Register
The Commissioner must make the Codes Register available on the website.
26U(4) Codes Register
Commissioner may charge fees for providing copies or extracts from the Codes Register.
26V Guidelines relating to codes
26V(1) Guidelines relating to codes
Commissioner may make written guidelines to assist with APP code development or application.
26V(2) Guidelines relating to codes
Commissioner must make written guidelines about certain matters.
26V(3) Guidelines relating to codes
Commissioner may publish guidelines on website
26V(4) Guidelines relating to codes
Guidelines are not a legislative instrument.
26W Review of operation of registered codes
entries-found-privacy-act-1988.pdf, p.219
26W(1) Review of operation of registered codes
Commissioner may review operation of registered APP code.
26W(2) Review of operation of registered codes
Commissioner may review operation of registered CR code.
26WA Guide to this Part
Notification of eligible data breaches is required.
Reasonable grounds to believe a breach has occurred or direction from the Commissioner.
entries-found-privacy-act-1988.pdf, p.220
26WB Entity
Definition of entity for purposes of the Part
26WC Deemed holding of information
entries-found-privacy-act-1988.pdf, p.221
26WC(1) Deemed holding of information
The APP entity is required to hold the personal information.
Requires the APP entity to hold the personal information.
26WC(2) Deemed holding of information
Credit provider must comply with subsection 21S(1) in relation to credit eligibility information.
the credit provider were required to comply with subsection 21S(1) in relation to the credit eligibility information.
26WD Exception—notification under the My Health Records Act
Notification of eligible data breaches is exempt from this Part if notified under the My Health Records Act.
entries-found-privacy-act-1988.pdf, p.222
Prohibition on applying this Part in relation to notified breaches
26WE Eligible data breach
An APP entity must comply with section 15 if it holds personal information relating to one or more individuals.
entries-found-privacy-act-1988.pdf, p.223
The APP entity holds personal information relating to one or more individuals.
The APP entity must comply with section 15.
The APP entity is required under section 15 not to do an act, or engage in a practice, that breaches Australian Privacy Principle 11.1.
A credit reporting body holds credit reporting information relating to one or more individuals and is required to comply with section 20Q.
The credit reporting body must comply with section 15.
Conditional duty based on subsection 21S(1)
A credit provider holds credit eligibility information relating to one or more individuals and is required to comply with subsection 21S(1).
The credit provider must comply with section 15.
A file number recipient holds tax file number information relating to one or more individuals and is required under section 18 not to do an act, or engage in a practice, that breaches a section 17 rule.
The file number recipient must comply with section 15.
26WF Exception—remedial action
entries-found-privacy-act-1988.pdf, p.224
26WF(1) Exception—remedial action
Prohibition on disclosing information that would likely result in serious harm to individuals.
(a) an access to, or disclosure of, information is covered by paragraph 26WE(2)(a); and (b) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, takes action in relation to the access or disclosure; and (c) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, does so before the access or disclosure results in serious harm to any of the individuals to whom the information relates;
(e) an eligible data breach of the APP entity, credit reporting body, credit provider or file number recipient, as the case may be; or (f) an eligible data breach of any other entity.
26WF(2) Exception—remedial action
No notification required if action taken before access/disclosure results in serious harm
26WG Whether access or disclosure would be likely, or would not be
Determine likelihood of serious harm from access or disclosure
entries-found-privacy-act-1988.pdf, p.227
26WH Assessment of suspected eligible data breach
entries-found-privacy-act-1988.pdf, p.229
26WH(1) Assessment of suspected eligible data breach
Entity must assess suspected eligible data breach
Assessment must occur between awareness and lack of belief in data breach
(a) an entity is aware that there are reasonable grounds to suspect that there may have been an eligible data breach of the entity;
26WH(2) Assessment of suspected eligible data breach
Entity must carry out assessment and take steps to ensure completion within 30 days.
Entity must carry out assessment and take steps.
26WJ Exception—eligible data breaches of other entities
Compliance with section 26WH is required for eligible data breaches of other entities.
26WK Statement about eligible data breach
entries-found-privacy-act-1988.pdf, p.230
26WK(1) Statement about eligible data breach
Entity must report data breach if reasonable grounds exist.
Section applies to data breaches within a certain timeframe
(1) This section applies if an entity is aware that there are reasonable grounds to believe that there has been an eligible data breach of the entity.
26WK(2) Statement about eligible data breach
Entity must prepare statement and give copy to Commissioner upon becoming aware of data breach.
Entity must perform action during data breach awareness
(2) The entity must: (a) both: (i) prepare a statement that complies with subsection (3); and (ii) give a copy of the statement to the Commissioner;
Entity must inform Commissioner upon becoming aware of data breach
Entity must perform action upon becoming aware of data breach
26WK(3) Statement about eligible data breach
Entity must provide statement about eligible data breach.
26WK(4) Statement about eligible data breach
Entity must notify other entities of eligible data breaches.
Must provide notification to other entities.
26WL Entity must notify eligible data breach
entries-found-privacy-act-1988.pdf, p.231
26WL(1) Entity must notify eligible data breach
Entity must notify eligible data breach upon reasonable grounds to believe a breach has occurred.
Notification statement complying with subsection 26WK(3)
Reasonable grounds to believe a data breach has occurred
Entity has prepared a statement that relates to the eligible data breach
Entity has reasonable grounds to believe a data breach has occurred
Statement is related to the data breach at some point in time
Notification is required at some point in time
Notification is required if the entity believes a breach has occurred
Statement complies with subsection 26WK(3)
26WL(2) Entity must notify eligible data breach
Notification of individuals at risk and publicisation
26WM Exception—eligible data breaches of other entities
Exemption for eligible data breaches of other entities
entries-found-privacy-act-1988.pdf, p.232
26WN Exception—enforcement related activities
Exemption from notification for certain enforcement activities
26WP Exception—inconsistency with secrecy provisions
entries-found-privacy-act-1988.pdf, p.233
26WP(1) Exception—inconsistency with secrecy provisions
Prohibition on disclosure of information related to secrecy provisions
Prohibits the use or disclosure of information
(a) is a provision of a law of the Commonwealth (other than this Act)
(b) prohibits or regulates the use or disclosure of information
Temporal relation between secrecy provisions and other laws
secrecy provision means a provision that...
26WP(2) Exception—inconsistency with secrecy provisions
Entity exempted from subsection 26WK(2) if compliance with secrecy provision is inconsistent.
Compliance with secrecy provision is inconsistent
26WP(3) Exception—inconsistency with secrecy provisions
Exemption from section 26WL if secrecy provisions apply
Granting permission to entities inconsistent with secrecy provisions
26WP(4) Exception—inconsistency with secrecy provisions
Prescribed secrecy provision means a secrecy provision specified in the regulations.
Indicates a relationship between two concepts.
Describes the conditions under which a secrecy provision is prescribed.
26WP(5) Exception—inconsistency with secrecy provisions
Exempts certain provisions from secrecy requirements.
Exempts specified provisions from secrecy requirements.
26WQ Exception—declaration by Commissioner
entries-found-privacy-act-1988.pdf, p.234
26WQ(1) Exception—declaration by Commissioner
Commissioner may declare sections 26WK and 26WL do not apply in relation to an eligible data breach.
Declaration of exemption from obligations.
26WQ(2) Exception—declaration by Commissioner
Commissioner's power to extend time for compliance with subsection 26WL(2)
Commissioner's power to extend time for compliance
26WQ(3) Exception—declaration by Commissioner
The Commissioner must make a declaration only if it is reasonable in the circumstances.
The Commissioner must make a declaration.
The Commissioner's decision is based on relevant advice.
26WQ(4) Exception—declaration by Commissioner
Commissioner may have regard for certain advice
26WQ(5) Exception—declaration by Commissioner
Commissioner may give notice of declaration to entity on initiative or application.
26WQ(6) Exception—declaration by Commissioner
Application format for declaration by Commissioner
26WQ(7) Exception—declaration by Commissioner
Entity must declare to Commissioner under specific circumstances.
26WR Commissioner may direct entity to notify eligible data breach
entries-found-privacy-act-1988.pdf, p.237
26WR(1) Commissioner may direct entity to notify eligible data breach
Entity must prepare statement and notify Commissioner upon data breach
26WR(2) Commissioner may direct entity to notify eligible data breach
26WR(3) Commissioner may direct entity to notify eligible data breach
Entity must notify eligible data breach upon request from Commissioner.
Submission to the Commissioner within a specified period.
26WS Exception—enforcement related activities
Entity exempt from direction under subsection 26WR(1)
entries-found-privacy-act-1988.pdf, p.239
26WT Exception—inconsistency with secrecy provisions
26WT(1) Exception—inconsistency with secrecy provisions
Prohibits the use or disclosure of information related to secrecy provisions
(a) is a provision of a law of the Commonwealth (other than this Act); and (b) prohibits or regulates the use or disclosure of information.
Classifies secrecy provisions as those that prohibit or regulate the use or disclosure of information
Regulates the use or disclosure of information related to secrecy provisions
26WT(2) Exception—inconsistency with secrecy provisions
Entity exempted from secrecy provisions due to inconsistency with other secrecy provisions.
Entity exempted from secrecy provisions.
26WU Power to obtain information and documents relating to
entries-found-privacy-act-1988.pdf, p.241
26WU(1) Power to obtain information and documents relating to
Commissioner may obtain information and documents from a person or entity.
Commissioner may obtain information and documents.
26WU(2) Power to obtain information and documents relating to
The entity must provide information and documents related to data breaches.
Entity must provide information and documents.
26WU(3) Power to obtain information and documents relating to
Notice requiring information and documents
26X Eligible data breach declaration
entries-found-privacy-act-1988.pdf, p.243
26X(1) Eligible data breach declaration
Minister must make declaration under certain conditions.
26X(2) Eligible data breach declaration
Eligible data breach declaration requirements
Declaration must specify required information
(a) the kind or kinds of personal information to which the declaration applies;
26XA When declarations cease to be in force
Cease of force for eligible data breach declaration
entries-found-privacy-act-1988.pdf, p.245
26XB Authorisation of collection, use and disclosure of personal
entries-found-privacy-act-1988.pdf, p.246
26XB(1) Authorisation of collection, use and disclosure of personal
Entity may collect, use or disclose personal information under specified conditions.
Permission to collect, use or disclose personal information.
Entity reasonably believes individual is at risk from eligible data breach.
Information type specified in declaration.
Information of a kind or kinds specified in the declaration.
26XB(2) Authorisation of collection, use and disclosure of personal
Entity not liable for contravening secrecy provision if authorized by subsection (1)
Exemption from liability for secrecy provision
26XB(3) Authorisation of collection, use and disclosure of personal
Liability for breach of duty of confidence
(3) An entity is not liable to any proceedings for contravening a duty of confidence in respect of a disclosure of personal information authorized by subsection (1).
26XB(4) Authorisation of collection, use and disclosure of personal
An entity must not breach an Australian Privacy Principle or a registered APP code in respect of authorized collection, use, or disclosure of personal information.
Prohibition on unauthorized collection, use, or disclosure of personal information.
Breach of Australian Privacy Principle or APP code
26XB(5) Authorisation of collection, use and disclosure of personal
Authorized collection, use and disclosure of personal information by agency officers or employees.
Agency authorization required for officer/employee actions.
Agency must authorize officer/employee actions.
Officer/employee authorized to collect, use and disclose personal information.
26XB(6) Authorisation of collection, use and disclosure of personal
Defines secrecy provisions and their scope.
The designated secrecy provision includes sections of the Australian Security Intelligence Organisation Act 1979.
Subclasses specific laws and regulations.
The designated secrecy provision subclasses sections of the Australian Security Intelligence Organisation Act 1979.
These laws are subclasses of the designated secrecy provision.
Defines the scope of the secrecy provisions during specific periods.
The secrecy provisions apply during the period specified in section 34GE(4) of the Australian Security Intelligence Organisation Act 1979.
This provision applies during this period.
Defines the scope of the secrecy provisions until specific periods.
The secrecy provisions apply until the period specified in section 34GE(4) of the Australian Security Intelligence Organisation Act 1979.
This provision applies until this period.
The designated secrecy provision includes sections of the Crimes Act 1914.
The designated secrecy provision subclasses section 15LC of the Crimes Act 1914.
This law is a subclass of the designated secrecy provision.
26XC Disclosure of information—offence
entries-found-privacy-act-1988.pdf, p.248
26XC(1) Disclosure of information—offence
Disclosing personal information without consent is an offence.
Prohibits disclosure of personal information.
(1) A person (the first person) commits an offence if: (a) personal information that relates to an individual is disclosed to the first person because of the operation of this Division; and (b) the first person subsequently discloses the personal information.
Penalty: 60 penalty units or imprisonment for 1 year, or both.
Traces disclosure of personal information over time.
Prohibits subsequent disclosure of personal information.
(b) the first person subsequently discloses the personal information.
Discovers overlap between disclosure and subsequent disclosure.
(a) personal information that relates to an individual is disclosed to the first person because of the operation of this Division; and (b) the first person subsequently discloses the personal information.
26XC(2) Disclosure of information—offence
Disclosure of information—offence: exemptions
26XC(3) Disclosure of information—offence
Authorisation of disclosure of personal information
Authorises the disclosure of personal information
26XC(4) Disclosure of information—offence
Court must include any tribunal, authority or person having power to require production of documents or answering of questions.
Includes any tribunal, authority or person...
26XD Division not limited by secrecy provisions
entries-found-privacy-act-1988.pdf, p.249
26XD(1) Division not limited by secrecy provisions
Operation of Division not limited by secrecy provisions of other Commonwealth laws.
Exclusion of operation by secrecy provisions
(1) The operation of this Division is not limited by a secrecy provision...
...except to the extent that the secrecy provision expressly excludes the operation of this section.
Concurrent operation with State and Territory laws
Note: Section 3 provides for the concurrent operation of State and Territory laws.
26XD(2) Division not limited by secrecy provisions
No requirement to collect, use or disclose personal information
26XD(3) Division not limited by secrecy provisions
26XE Constitutional basis of this Division
Relies on Commonwealth's legislative powers under paragraph 51(xxix) of the Constitution.
Relies on Commonwealth's legislative powers
Obligation to give effect to Australia's obligations under relevant international agreements
Relates to the date of entry into force of the International Covenant on Civil and Political Rights
Defines the scope of this Division using natural language processing techniques
Article 17 of the International Covenant on Civil and Political Rights
Division applies to Australia's obligations under relevant international agreements
Defines the scope of this Division using schema.org vocabulary
26XF Additional operation of this Division
entries-found-privacy-act-1988.pdf, p.250
26XF(1) Additional operation of this Division
26XF(2) Additional operation of this Division
Reference to a collection, use or disclosure confined to a corporation to which paragraph 51(xx) of the Constitution applies.
26XF(3) Additional operation of this Division
Reference to collection, use or disclosure confined to banking business within the State.
Restricts collection, use or disclosure to banking business within the State.
(3) This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure that occurs in the course of, or in relation to, the carrying on of the business of banking (within the meaning of paragraph 51(xiii) of the Constitution), other than State banking not extending beyond the limits of the State concerned.
26XF(4) Additional operation of this Division
Reference to collection, use or disclosure confined to insurance business within the meaning of paragraph 51(xiv) of the Constitution.
Restricts disclosure to insurance business
26XF(5) Additional operation of this Division
Reference to collection, use or disclosure confined to trade or commerce
26XF(6) Additional operation of this Division
Reference to collection, use or disclosure confined to a specific service.
26XF(7) Additional operation of this Division
Reference to collection, use or disclosure confined to a Territory.
26XF(8) Additional operation of this Division
Reference to a collection, use or disclosure confined to an alien within the meaning of paragraph 51(xix) of the Constitution.
26XF(9) Additional operation of this Division
Reference to collection, use or disclosure outside Australia has the same effect as if it were confined within Australia.
If a reference to collection, use or disclosure is made outside Australia.
Then it has the same effect as if it were confined within Australia.
The temporal interval of a reference to collection, use or disclosure outside Australia is greater than or equal to the temporal interval of a reference to collection, use or disclosure within Australia.
The temporal interval of a reference to collection, use or disclosure outside Australia is less than or equal to the temporal interval of a reference to collection, use or disclosure within Australia.
The set of collections, uses or disclosures outside Australia is a subset of the set of collections, uses or disclosures within Australia.
The knowledge representation of a reference to collection, use or disclosure outside Australia is a subset of the knowledge representation of a reference to collection, use or disclosure within Australia.
26XF(10) Additional operation of this Division
This Division has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure by a Commonwealth entity.
26XG Interaction with section 12B
Section 12B does not apply in relation to this Division.
entries-found-privacy-act-1988.pdf, p.252
26XH Compensation for acquisition of property
26XH(1) Compensation for acquisition of property
Compensation for acquisition of property on just terms
26XH(2) Compensation for acquisition of property
Compensation for acquisition of property
27 Functions of the Commissioner
entries-found-privacy-act-1988.pdf, p.253
27(1) Functions of the Commissioner
The Commissioner has various functions conferred by law.
Commissioner's functions are obligations.
27(2) Functions of the Commissioner
Commissioner has power to perform functions
Commissioner's power to perform functions
The Commissioner has power to do all things necessary or convenient.
Commissioner's actions occur during function performance
The Commissioner can do all things necessary or convenient for the performance of the Commissioner’s functions.
Power implies ability to perform function
The Commissioner's functions are all things necessary or convenient for the performance of the Commissioner’s functions.
27(3) Functions of the Commissioner
Commissioner may establish a panel to assist in performing functions.
Establishment of a panel is an obligation.
27(4) Functions of the Commissioner
Section 38 of the Healthcare Identifiers Act 2010 applies in relation to an investigation.
28 Guidance related functions of the Commissioner
entries-found-privacy-act-1988.pdf, p.254
28(1) Guidance related functions of the Commissioner
Guidance related functions of the Commissioner
28(2) Guidance related functions of the Commissioner
28(3) Guidance related functions of the Commissioner
28(4) Guidance related functions of the Commissioner
Guidelines made under paragraph (1)(a) are not a legislative instrument.
28A Monitoring related functions of the Commissioner
28A(1) Monitoring related functions of the Commissioner
The Commissioner must monitor the security and accuracy of information held by entities.
28A(2) Monitoring related functions of the Commissioner
The Commissioner must examine proposed laws and proposals for data matching or linkage to ensure they do not interfere with individual privacy.
The Commissioner must examine proposed laws and proposals.
28B Advice related functions of the Commissioner
entries-found-privacy-act-1988.pdf, p.256
28B(1) Advice related functions of the Commissioner
The Commissioner must provide advice to a Minister or entity about matters relevant to the operation of this Act.
28B(2) Advice related functions of the Commissioner
Functions may be performed by Commissioner on request or initiative.
28B(3) Advice related functions of the Commissioner
The Commissioner may perform a function whenever necessary.
28B(4) Advice related functions of the Commissioner
Instrument is not a legislative instrument if Minister is informed in writing or report is provided in writing.
Minister informed in writing or report provided in writing
29 Commissioner must have due regard to the objects of the Act
Commissioner must have due regard to the objects of the Act
entries-found-privacy-act-1988.pdf, p.257
30 Reports following investigation of act or practice
entries-found-privacy-act-1988.pdf, p.258
30(1) Reports following investigation of act or practice
Commissioner must report to Minister about act or practice if directed by Minister or if Commissioner thinks it's an interference with individual's privacy and conciliation was unsuccessful.
Commissioner has investigated act or practice
Reporting occurs within a specific temporal interval
30(2) Reports following investigation of act or practice
Commissioner must report to Minister about practice following investigation.
30(3) Reports following investigation of act or practice
Commissioner must report findings and recommendations to Minister and relevant parties.
Report with findings, recommendations, and compensation information (if applicable)
30(4) Reports following investigation of act or practice
Commissioner must provide a further report to Minister if certain conditions not met after 60 days
31 Report following examination of proposed law
entries-found-privacy-act-1988.pdf, p.260
31(1) Report following examination of proposed law
Obligation to report following examination of proposed law
(1) Where the Commissioner has examined a proposed Commonwealth law under paragraph 28A(2)(a), subsections (2) and (3) of this section have effect.
Temporal interval starts with examination
Temporal interval contains examination report
Diffusion to Commissioner's examination report
Argument for mandatory reporting obligation
31(2) Report following examination of proposed law
Report to Minister if proposed law would require or authorise acts interfering with individual privacy.
Requires Commissioner to report and recommend amendment.
31(3) Report following examination of proposed law
The Commissioner must report to the Minister about proposed laws.
31(4) Report following examination of proposed law
Commissioner may give further report to Minister on public interest
31(5) Report following examination of proposed law
Report must be laid before each House of Parliament within 15 sitting days.
32 Commissioner may report to the Minister if the Commissioner
32(1) Commissioner may report to the Minister if the Commissioner
The Commissioner must report to the Minister about an activity or assessment if directed by the Minister.
The Commissioner must report to the Minister.
The Commissioner reports only if directed by the Minister.
32(2) Commissioner may report to the Minister if the Commissioner
Commissioner must report to Minister under certain circumstances.
32(3) Commissioner may report to the Minister if the Commissioner
Minister must report to Parliament within 15 days of receiving a report from the Commissioner.
33 Exclusion of certain matters from reports
entries-found-privacy-act-1988.pdf, p.261
33(1) Exclusion of certain matters from reports
Commissioner may exclude matters from reports if desirable, considering obligations under subsections (2) and (3).
33(2) Exclusion of certain matters from reports
Consider prejudice to security, defence, international relations, and government relations when deciding whether to exclude matter from a report.
Consider the deontic implications of excluding matter from a report.
(2) In deciding under subsection (1) whether or not to exclude matter from a report, the Commissioner shall have regard to...
...the need to prevent prejudice to the security, defence or international relations of Australia;
Consider the temporal interval within which the matter must be reported.
Consider the temporal interval until which the matter must be reported.
Consider how the matter may be disseminated through various channels.
Argue that excluding the matter is necessary for national security.
33A Commissioner may share information with other authorities
entries-found-privacy-act-1988.pdf, p.262
33A(1) Commissioner may share information with other authorities
Commissioner may share information with other authorities
33A(2) Commissioner may share information with other authorities
Commissioner must share information with covered authorities
Temporal interval for sharing information
33A(3) Commissioner may share information with other authorities
Commissioner may share information with other authorities under certain conditions.
Commissioner has permission to share information.
(3) The Commissioner may only share information or documents...
Information must be shared within a reasonable timeframe.
(b) the Commissioner is satisfied on reasonable grounds that the receiving body has satisfactory arrangements in place for protecting the information or documents.
Commissioner must ensure receiving body has adequate safeguards.
33A(4) Commissioner may share information with other authorities
Sharing of information with other authorities is permitted under certain conditions.
Permission to share information with other authorities.
(4) If the Commissioner acquired the information or documents from an agency, the Commissioner may only share the information or documents with a receiving body under this section if the receiving body is an agency.
Temporal interval for sharing of information.
Recurring trace of sharing of information.
Diffusion of information to authorized agencies.
33A(5) Commissioner may share information with other authorities
Receiving body may use shared information for its original purpose.
33A(6) Commissioner may share information with other authorities
33B Commissioner may disclose certain information if in the public
entries-found-privacy-act-1988.pdf, p.264
33B(1) Commissioner may disclose certain information if in the public
Disclosure of information in public interest
33B(2) Commissioner may disclose certain information if in the public
Commissioner must consider certain factors when deciding to disclose information.
Commissioner has an obligation to consider certain factors.
(2) In determining under subsection (1) whether the Commissioner is satisfied that a disclosure is in the public interest...
The Commissioner must have regard to the following:
Commissioner's decision-making process has temporal bounds.
Commissioner's decision-making process is influenced by external factors.
Commissioner's decision-making process involves weighing competing factors.
33B(3) Commissioner may disclose certain information if in the public
Commissioner may disclose certain information if in the public domain.
33C Commissioner may conduct an assessment relating to the
Commissioner may conduct an assessment of certain matters.
entries-found-privacy-act-1988.pdf, p.265
33D Commissioner may direct an agency to give a privacy impact
entries-found-privacy-act-1988.pdf, p.267
33D(1) Commissioner may direct an agency to give a privacy impact
Commissioner may direct an agency to give a privacy impact assessment.
33D(2) Commissioner may direct an agency to give a privacy impact
Commissioner may direct an agency to give a privacy impact
33E Inquiries by Commissioner
entries-found-privacy-act-1988.pdf, p.269
33E(1) Inquiries by Commissioner
Commissioner may conduct or approve a public inquiry into a specified matter.
33E(2) Inquiries by Commissioner
Commissioner must specify acts and types of personal information for inquiry.
33E(3) Inquiries by Commissioner
The inquiry must be completed by a specified date and conducted in a certain manner.
The inquiry must be completed by a specified date.
(3) The direction or approval may also specify any one or more of the following:
The inquiry must be completed within a specified date range.
The inquiry is subject to recurring directions.
33E(4) Inquiries by Commissioner
Variation of direction or approval by Minister
33E(5) Inquiries by Commissioner
Commissioner must conduct a public inquiry.
33E(6) Inquiries by Commissioner
Commissioner may conduct inquiry in manner deemed fit by Commissioner.
33F Commissioner may invite submissions
Commissioner may invite submissions on matters of a public inquiry.
entries-found-privacy-act-1988.pdf, p.270
33G Commissioner not bound by the rules of evidence
Commissioner's discretion in gathering evidence
33H Commissioner’s powers
Sections 44 and 45 apply to a public inquiry in the same way as they do to an investigation under Part V.
33J Reporting on public inquiries
33J(1) Reporting on public inquiries
Must give report to Minister after completing public inquiry.
33J(2) Reporting on public inquiries
Must provide a copy of the report to entities under paragraph 33E(3)(c)
33J(3) Reporting on public inquiries
Reporting on public inquiries is required.
33J(4) Reporting on public inquiries
Report must not include certain findings or recommendations.
33J(5) Reporting on public inquiries
Table a copy of the report within 15 sitting days.
33J(6) Reporting on public inquiries
The Commissioner must make the report publicly available unless directed otherwise.
The Commissioner must make the report publicly available.
34 Provisions relating to documents exempt under the Freedom of
entries-found-privacy-act-1988.pdf, p.272
34(1) Provisions relating to documents exempt under the Freedom of
Commissioner shall not provide information about a document's existence or non-existence.
Commissioner is prohibited from providing information.
34(2) Provisions relating to documents exempt under the Freedom of
Prohibition on disclosing exempt document contents
Prohibits disclosure of exempt document contents
34(3) Provisions relating to documents exempt under the Freedom of
Definition of expression used in this section and the Freedom of Information Act 1982
Expression used in this section and the Freedom of Information Act 1982 has the same meaning
Same meaning as in the Freedom of Information Act 1982
35 Direction where refusal or failure to amend exempt document
35(1) Direction where refusal or failure to amend exempt document
Agency must amend document upon Commissioner's recommendation.
35(2) Direction where refusal or failure to amend exempt document
Agency must comply with direction given in accordance with subsection (1).
35(3) Direction where refusal or failure to amend exempt document
Amend means correct, delete, or add a document.
35(4) Direction where refusal or failure to amend exempt document
35A Commissioner may recognise external dispute resolution
entries-found-privacy-act-1988.pdf, p.274
35A(1) Commissioner may recognise external dispute resolution
Commissioner may recognise external dispute resolution scheme
Permission to recognise external dispute resolution scheme
Recognition for entities or classes of entities
35A(2) Commissioner may recognise external dispute resolution
Commissioner must consider certain factors when recognising an external dispute resolution scheme.
Commissioner must consider certain factors.
(2) In considering whether to recognise an external dispute resolution scheme, the Commissioner...
Commissioner must consider factors that occur after scheme recognition.
35A(3) Commissioner may recognise external dispute resolution
Commissioner may specify period for recognition of external dispute resolution scheme and subject it to conditions.
Commissioner may specify period for recognition of external dispute resolution scheme.
35A(4) Commissioner may recognise external dispute resolution
Commissioner must recognise external dispute resolution.
36A Guide to this Part
Individuals have a right to complain about privacy interference and the Commissioner must investigate.
entries-found-privacy-act-1988.pdf, p.275
An individual may complain to the Commissioner about an act or practice that may be an interference with the privacy of the individual.
The Commissioner must investigate complaints.
If a complaint is made, the Commissioner is required to investigate the act or practice except in certain circumstances.
The Commissioner must investigate the complaint.
36 Complaints
entries-found-privacy-act-1988.pdf, p.276
36(1) Complaints
Individuals may complain about privacy interference.
36(2) Complaints
Any individual may make a complaint on behalf of all individuals affected.
36(2A) Complaints
Section has effect subject to section 38.
36(3) Complaints
Obligation to provide written complaints.
36(4) Complaints
Duty to provide assistance to a person making a complaint.
36(5) Complaints
36(6) Complaints
Agency must be respondent in complaint about its act or practice.
36(7) Complaints
Organisation is respondent in complaint case
36B Complaints relating to the data sharing scheme
entries-found-privacy-act-1988.pdf, p.277
36B(1) Complaints relating to the data sharing scheme
Commissioner must share information with NDC on complaints related to data sharing scheme.
36B(2) Complaints relating to the data sharing scheme
The Commissioner may only share information and documents acquired in the course of exercising powers or performing functions under this Act.
36B(3) Complaints relating to the data sharing scheme
Commissioner may share information with NDC under this section.
37 Principal executive of agency
Specifies the principal executive of an agency.
38 Conditions for making a representative complaint
Conditions for making a representative complaint
entries-found-privacy-act-1988.pdf, p.278
38A Commissioner may determine that a complaint is not to
entries-found-privacy-act-1988.pdf, p.279
38A(1) Commissioner may determine that a complaint is not to
Commissioner may determine that a complaint should no longer continue as a representative complaint.
Prohibits the continuation of a complaint.
38A(2) Commissioner may determine that a complaint is not to
Commissioner may not make a determination that a complaint is not to proceed as a representative complaint.
Prohibition of making a determination that a complaint is not to proceed as a representative complaint.
(2) The Commissioner may only make such a determination if...
The Commissioner may not make a determination that a complaint is not to proceed as a representative complaint.
38B Additional rules applying to the determination of representative
entries-found-privacy-act-1988.pdf, p.280
38B(1) Additional rules applying to the determination of representative
Commissioner may replace complainant with another class member if unable to represent interests.
38B(2) Additional rules applying to the determination of representative
A class member may withdraw from a representative complaint under certain conditions.
38B(3) Additional rules applying to the determination of representative
Notice must be given to class members at any stage.
38C Amendment of representative complaints
Commissioner may amend complaint to allow for representative complaints under certain conditions.
Commissioner has the power to amend a complaint.
The amendment is conditional on certain conditions being met.
39 Class member for representative complaint not entitled to lodge
Not entitled to lodge a complaint in respect of the same subject matter.
entries-found-privacy-act-1988.pdf, p.281
Prohibits lodging a complaint in respect of the same subject matter.
40 Investigations
40(1) Investigations
Commissioner must investigate an act or practice if a complaint has been made under section 36.
40(1A) Investigations
Cannot investigate complaint if complainant did not complain to respondent first.
Complainant did not complain to respondent first
Cannot investigate during complainant's complaint to respondent
Complainant complained to respondent before making complaint to Commissioner
Investigation is prohibited during this time period
Prohibition applies if complainant did not complain to respondent first
Investigation is prohibited if this condition is true
40(1B) Investigations
Exemptions from subsection (1A) for certain acts or practices.
40(2) Investigations
Commissioner may investigate an act or practice on their own initiative if it may be an interference with privacy or a breach of Australian Privacy Principle 1.
40A Conciliation of complaints
entries-found-privacy-act-1988.pdf, p.282
40A(1) Conciliation of complaints
Commissioner must attempt to conciliate complaint if reasonably possible
40A(2) Conciliation of complaints
Commissioner's decision not to investigate is a condition for subsection (1) not applying.
Commissioner's decision affects the applicability of subsection (1)
Commissioner's decision is a temporal subset of the conditions under which subsection (1) applies
Commissioner's decision affects applicability
Commissioner's decision not to investigate further is a condition for subsection (1) not applying
40A(3) Conciliation of complaints
Commissioner must notify complainant and respondent if conciliation is not possible.
40A(4) Conciliation of complaints
Commissioner may decide not to investigate or further investigate a complaint.
40A(5) Conciliation of complaints
Complainant and respondent must agree for evidence to be admissible in hearings or legal proceedings.
Permission to exclude evidence without agreement
Things done in furtherance of a fraud or offence are excluded.
Evidence is not admissible if it was done in furtherance of a crime.
Evidence is admissible within the agreed time frame.
41 Commissioner may or must decide not to investigate etc. in
entries-found-privacy-act-1988.pdf, p.283
41(1) Commissioner may or must decide not to investigate etc. in
Commissioner may decide not to investigate an act or practice under certain conditions.
Commissioner may decide not to investigate
within the period specified by the Commissioner
Complainant has not responded within a specified time frame
41(1A) Commissioner may or must decide not to investigate etc. in
Commissioner must not investigate further if complainant withdraws complaint.
42 Preliminary inquiries
entries-found-privacy-act-1988.pdf, p.284
42(1) Preliminary inquiries
Commissioner may make inquiries of respondent or other person.
42(2) Preliminary inquiries
Commissioner may make inquiries of any person for the purpose of determining whether to investigate an act or practice under subsection 40(2).
43 Conduct of investigations
entries-found-privacy-act-1988.pdf, p.285
43(1) Conduct of investigations
Inform respondent before commencing investigation.
43(1A) Conduct of investigations
Inform agency of investigation before starting to investigate an act or practice.
Must inform agency before investigation.
43(2) Conduct of investigations
Commissioner's discretion on investigation manner
43(3) Conduct of investigations
Commissioner may obtain information and make inquiries as they think fit.
Commissioner has the power to obtain information and make inquiries.
The Commissioner may have access to certain information.
43(4) Conduct of investigations
Commissioner may determine investigation outcome without hearing under certain conditions.
Commissioner's discretion to determine investigation outcome.
43A Interested party may request a hearing
entries-found-privacy-act-1988.pdf, p.287
43A(1) Interested party may request a hearing
Request for a hearing before Commissioner's determination.
43A(2) Interested party may request a hearing
Commissioner must notify and give opportunity to make submission about request.
Must provide notification and opportunity for submission.
43A(3) Interested party may request a hearing
Defines 'interested party' for investigation purposes.
44 Power to obtain information and documents
44(1) Power to obtain information and documents
Commissioner may require person to provide information or document.
44(2) Power to obtain information and documents
Notice must state place for information or document production.
Must provide notice with specified details.
45 Power to examine witnesses
Power to administer oath or affirmation and examine witnesses
entries-found-privacy-act-1988.pdf, p.288
Commissioner has obligation to administer oath or affirmation and examine witnesses
46 Directions to persons to attend compulsory conference
entries-found-privacy-act-1988.pdf, p.289
46(1) Directions to persons to attend compulsory conference
46(2) Directions to persons to attend compulsory conference
Failure to attend a conference without excuse or release is an offence.
(2) A person who has been directed to attend a conference...
commits an offence punishable on conviction
Temporal interval for imprisonment or fine
by imprisonment for a period not exceeding 6 months or a fine not exceeding 10 penalty units
Recurring trace of failure to attend without excuse or release
Diffusion of obligation to attend a conference
Cognitive AI application for obligation to attend a conference
46(2A) Directions to persons to attend compulsory conference
A defendant must provide a reasonable excuse if they do not attend a compulsory conference.
Subsection (2A) does not apply if the person has a reasonable excuse.
(2A) Subsection (2) does not apply if the person has a reasonable excuse.
47 Conduct of compulsory conference
entries-found-privacy-act-1988.pdf, p.290
47(1) Conduct of compulsory conference
The Commissioner may require a person to produce a document.
47(2) Conduct of compulsory conference
Conference must be conducted in private manner
Must conduct conference in private manner
(2) A conference under this Division shall be held in private and shall...
47(3) Conduct of compulsory conference
A body of persons must attend a conference if a member, officer or employee attends on their behalf.
Deems attendance if a representative attends.
47(4) Conduct of compulsory conference
Individuals and bodies cannot be represented by someone other than a member, officer or employee.
Prohibits representation by someone other than a member, officer or employee.
48 Complainant and certain other persons to be informed of various
Inform complainant and respondent of decision and reasons.
49 Investigation under section 40 to cease if certain offences may
entries-found-privacy-act-1988.pdf, p.291
49(1) Investigation under section 40 to cease if certain offences may
Discontinue investigation except to the extent that it concerns matters unconnected with the offence.
49(2) Investigation under section 40 to cease if certain offences may
Notice to be given if proceedings for an offence are discontinued.
49(3) Investigation under section 40 to cease if certain offences may
Commissioner may continue investigation upon receiving notice.
49(4) Investigation under section 40 to cease if certain offences may
Cease investigation under section 40 if certain offences may occur
49A Investigation under section 40 to cease if civil penalty provision
Inform Registrar of opinion that civil penalty provision may have been contravened.
Copy of complaint to Registrar of Personal Property Securities
entries-found-privacy-act-1988.pdf, p.292
49B Transfer of complaints from the Inspector-General of
Transfer of complaints from the Inspector-General of Intelligence and Security
entries-found-privacy-act-1988.pdf, p.293
50 Reference of matters to other authorities
50A Substitution of respondent to complaint
entries-found-privacy-act-1988.pdf, p.296
50A(1) Substitution of respondent to complaint
Commissioner can substitute an agency for an organisation as respondent to a complaint under certain conditions.
Commissioner has the power to substitute an agency for an organisation.
The organisation must have existed before the Commissioner makes a determination under section 52.
50A(2) Substitution of respondent to complaint
50A(3) Substitution of respondent to complaint
Agency must provide written submissions on proposed amendment.
50A(4) Substitution of respondent to complaint
Commissioner satisfies subsection 43(1A) if amends complaint during investigation.
Commissioner has an obligation to satisfy subsection 43(1A)
(4) If the Commissioner amends the complaint...
The Commissioner is taken to have satisfied subsection 43(1A)
Commissioner has permission to amend complaint during investigation
The Commissioner is not obligated to satisfy subsection 43(1A)
Commissioner's action implies satisfaction of subsection 43(1A)
The Commissioner satisfies subsection 43(1A)
Commissioner's action occurs during investigation
The Commissioner's action satisfies subsection 43(1A)
51 Effect of investigation by Auditor-General
Commissioner must stop investigation if Auditor-General is investigating the same matter.
entries-found-privacy-act-1988.pdf, p.297
52 Determination of the Commissioner
entries-found-privacy-act-1988.pdf, p.298
52(1) Determination of the Commissioner
Commissioner may make a determination after investigating a complaint.
Commissioner has the power to make a determination.
The Commissioner is responsible for making determinations.
52(1A) Determination of the Commissioner
Commissioner may make a determination that includes one or more of the following: declaration that person or entity must take specified steps, prepare and publish statement, perform reasonable act to redress loss or damage, etc.
Declaration that person or entity must take specified steps
Classification of conduct into one of the following categories: interference with privacy, etc.
52A Determination—requirement to notify conduct constituting
Respondent must notify conduct constituting interference with privacy of individual within 14 days.
Statement setting out identity and contact details, description of conduct, and agency (if applicable).
entries-found-privacy-act-1988.pdf, p.301
Statement must include identity and contact details.
Notification must occur within a specified time frame.
53 Determination must identify the class members who are to be
Identify class members affected by determination
entries-found-privacy-act-1988.pdf, p.302
53A Notice to be given to outsourcing agency
53A(1) Notice to be given to outsourcing agency
Commissioner must give notice to agencies
53A(2) Notice to be given to outsourcing agency
The Commissioner must consult with the agency before giving a recommendation.
53A(3) Notice to be given to outsourcing agency
Agency must notify Commissioner of proposed action within 60 days.
53B Substituting an agency for a contracted service provider
Prohibition on certain actions by a contracted service provider
entries-found-privacy-act-1988.pdf, p.303
Forbids the specified actions by a contracted service provider
Subclass of agency for a contracted service provider
54 Application of Division
entries-found-privacy-act-1988.pdf, p.305
54(1) Application of Division
Division applies to determinations made under section 52 after commencement.
to a determination made under section 52
54(2) Application of Division
Agency is excluded from eligible hearing service providers.
55 Obligations of organisations and small business operators
Must not repeat or continue conduct covered by a declaration, take specified steps within a period, perform an act or course of conduct, and prepare a statement.
Prohibition on repeating or continuing conduct
Obligation to take specified steps within a period
Steps must be taken within a specified period
55A Proceedings in the Federal Court or Federal Circuit and Family
entries-found-privacy-act-1988.pdf, p.306
55A(1) Proceedings in the Federal Court or Federal Circuit and Family
Who can commence proceedings for an order to enforce a determination.
55A(2) Proceedings in the Federal Court or Federal Circuit and Family
Court may make orders if person/entity has engaged in conduct that constitutes an interference with the privacy of an individual.
55A(3) Proceedings in the Federal Court or Federal Circuit and Family
Grant interim injunction pending proceedings determination
55A(4) Proceedings in the Federal Court or Federal Circuit and Family
Court cannot require giving undertaking as a condition for interim injunction.
55A(5) Proceedings in the Federal Court or Federal Circuit and Family
Court must deal with question of privacy interference de novo.
Obligation to deal with question of privacy interference de novo.
55A(6) Proceedings in the Federal Court or Federal Circuit and Family
Court may receive certain documents as evidence in proceedings about a determination made by the Commissioner.
Court obligation to receive certain documents as evidence.
55A(7A) Proceedings in the Federal Court or Federal Circuit and Family
Court must have due regard to the objects of this Act when conducting a hearing and making an order.
Duty to consider the objects of this Act
55A(8) Proceedings in the Federal Court or Federal Circuit and Family
Defines 'complainant' in relation to a representative complaint.
55B Evidentiary certificate
entries-found-privacy-act-1988.pdf, p.307
55B(1) Evidentiary certificate
The Commissioner must issue a written certificate setting out findings of fact.
55B(3) Evidentiary certificate
Certificate is prima facie evidence of facts found by the Commissioner, except for specified breaches.
55B(4) Evidentiary certificate
A document purporting to be a certificate must be taken as a valid certificate unless proven otherwise.
Obligation to take a document as a valid certificate
57 Application of Division
entries-found-privacy-act-1988.pdf, p.308
57(1) Application of Division
This Division applies to a determination that is made under section 52 and that applies in relation to an agency or the principal executive of an agency.
57(2) Application of Division
Agency does not include an eligible hearing service provider.
58 Obligations of agencies
Agency must not repeat or continue conduct covered by a declaration, take specified steps, perform act or course of conduct, and prepare statement.
Agency must not repeat or continue conduct.
Agency must perform act or course of conduct.
59 Obligations of principal executive of agency
Principal executive of agency must comply with obligations.
60 Compensation and expenses
entries-found-privacy-act-1988.pdf, p.309
60(1) Compensation and expenses
Entitlement to payment if declaration includes specified amount.
Class hierarchy: Declaration -> Entitlement
60(2) Compensation and expenses
Agency must pay debt to complainant or individual
60(3) Compensation and expenses
62 Enforcement of determination against an agency
entries-found-privacy-act-1988.pdf, p.310
62(1) Enforcement of determination against an agency
62(2) Enforcement of determination against an agency
Application to Federal Court or Family Court for order directing principal executive to comply with section 59.
62(3) Enforcement of determination against an agency
Application for enforcement of determination against an agency
State has obligation to enforce determination
62(4) Enforcement of determination against an agency
Court may make orders to secure compliance by agency or principal executive.
62(5) Enforcement of determination against an agency
Application for review of determination under section 52 cannot be made until certain conditions are met.
(5) An application may not be made under this section in relation to a determination under section 52 until:
Application for review of determination under section 52 cannot be made until the time has expired for making an application under section 96.
62(6) Enforcement of determination against an agency
Defines complainant for a representative complaint.
63 Legal assistance
entries-found-privacy-act-1988.pdf, p.311
63(1) Legal assistance
Respondent may apply for legal assistance under this section.
63(2) Legal assistance
A person may apply for legal assistance from the Attorney-General.
Describes the temporal relationship between commencement and application.
(2) A person who: (a) has commenced or proposes to commence proceedings in the Federal Court or the Federal Circuit and Family Court of Australia (Division 2) under section 55;
63(2A) Legal assistance
No application can enforce a determination relating to a code complaint or an APP complaint.
63(3) Legal assistance
Granting of financial assistance by the Commonwealth to an applicant under subsection (1) or (2)
Permission to grant financial assistance
64 Commissioner etc. not to be sued
Commissioner not liable for actions in good faith
entries-found-privacy-act-1988.pdf, p.312
If Commissioner acts in good faith, they are not liable
This provision justifies Commissioner's actions in good faith
65 Failure to attend etc. before Commissioner
65(1) Failure to attend etc. before Commissioner
Refusal to attend before Commissioner is prohibited.
Imprisonment for 12 months or 20 penalty units, or both.
Temporal overlap between refusal to attend and imprisonment
Recurring trace of refusal to attend and imprisonment
Justification of imprisonment as a consequence of refusal to attend
65(2) Failure to attend etc. before Commissioner
Must provide a reasonable excuse for missing court appearance.
Defendant bears the evidential burden of providing an excuse.
65(3) Failure to attend etc. before Commissioner
Furnishing false or misleading information to the Commissioner is prohibited.
Prohibition of furnishing false or misleading information.
66 Failure to give information etc.
entries-found-privacy-act-1988.pdf, p.313
66(1) Failure to give information etc.
Refusal to provide information or answer questions under the Act is prohibited.
Prohibition of refusal to provide information or answer questions.
The person is required to give information, answer a question, or produce a document or record under this Act.
The person contravenes subsection (1) if the person refuses or fails to do so.
Prohibition of refusal to provide information or answer questions for corporations.
(1AA) A person commits an offence if: the person is a corporation; and the person engages in conduct that constitutes a system of conduct or a pattern of behaviour; and the system of conduct or pattern of behaviour results in 2 or more contraventions of subsection (1).
The person commits an offence if the person is a corporation and engages in conduct that constitutes a system of conduct or a pattern of behaviour.
66(1A) Failure to give information etc.
Journalist has a reasonable excuse to withhold information.
Journalist is excused from providing information
Journalist believes they have a reasonable excuse
Journalist has reason to believe they can withhold information without revealing identities
Information withholding until identity revealed
Information will be withheld until the journalist reveals the identity of the informant
Information will not be provided until the identity is revealed
Withholding information implies the journalist has a reasonable excuse
Temporal overlap between information withholding and identity revelation
The temporal overlap between the two events is relevant to the journalist's excuse
66(1B) Failure to give information etc.
No obligation to provide information if reasonable excuse exists.
Reasonable excuse as a justification for non-compliance.
Person bears evidential burden to prove reasonable excuse.
66(2) Failure to give information etc.
(document includes a record). (information includes an answer to a question)
67 Protection from civil actions
Protection from civil actions for acts done in good faith
entries-found-privacy-act-1988.pdf, p.316
Obligation to protect from civil actions
No civil action can be brought against the person
Temporal overlap between good faith and civil action
Good faith acts must occur before or at the same time as the civil action
The temporal overlap is necessary for protection from civil actions
Temporal reach of good faith and civil action
Good faith acts must occur before the civil action starts or ends
The temporal reach is necessary for protection from civil actions
Diffusion of good faith and civil action
Good faith acts must diffuse to the civil action
The diffusion is necessary for protection from civil actions
Recognition of good faith and civil action
Good faith acts must be recognized by the Commissioner or other authorities
The recognition is necessary for protection from civil actions
70 Certain documents and information not required to be disclosed
70(1) Certain documents and information not required to be disclosed
The Commissioner must not exercise a power under this Act that requires a person to give any information concerning the matter or produce the document or other record.
The Commissioner must not exercise a power under this Act.
70(2) Certain documents and information not required to be disclosed
Attorney-General must certify that disclosure of information would be contrary to public interest.
Attorney-General has an obligation to certify.
70B Application of this Part to former organisations
This Part operates in relation to an act or practice of the organisation (while it was an organisation); and the individual, body corporate, partnership, unincorporated association or trust; as if he, she or it were still (and had been at all relevant times) an organisation.
entries-found-privacy-act-1988.pdf, p.318
71 Interpretation
Real and substantial interest in an application
entries-found-privacy-act-1988.pdf, p.319
72 Power to make, and effect of, determinations
72(2) Power to make, and effect of, determinations
Commissioner may make a determination if public interest outweighs adherence to APP code or principle.
72(3) Power to make, and effect of, determinations
Exemptions from contravention of certain sections
72(4) Power to make, and effect of, determinations
Commissioner's power to make determinations that APP entities do not contravene section 15
Commissioner's ability to make determinations
73 Application by APP entity
entries-found-privacy-act-1988.pdf, p.320
73(1) Application by APP entity
Application for determination under section 72
73(1A) Application by APP entity
Dismiss frivolous, vexatious applications.
Prohibits making frivolous applications.
(1A) If an application is made under subsection (1); and the Commissioner is satisfied that the application is frivolous, vexatious...
the Commissioner may, in writing, dismiss the application.
73(2) Application by APP entity
CEO may make an application on behalf of other agencies.
73(3) Application by APP entity
Reference to agency is a reference to CEO of National Health and Medical Research Council.
73(4) Application by APP entity
Application by APP entity has effect as if determination had been made on an application by that agency.
74 Publication of application etc.
entries-found-privacy-act-1988.pdf, p.321
74(1) Publication of application etc.
The Commissioner must publish notice of receipt of an application.
74(2) Publication of application etc.
Prohibition on disclosure of exempt documents without agency consent
75 Draft determination
75(1) Draft determination
Commissioner prepares draft determination
75(2) Draft determination
Agency must notify Commissioner of interest in application within specified period.
Commissioner must be notified of interest
75(2A) Draft determination
Commissioner must send written invitation to organisation and issue corresponding invitations.
Commissioner must send written invitation.
76 Conference
entries-found-privacy-act-1988.pdf, p.322
76(1) Conference
Commissioner must hold conference upon notification.
76(2) Conference
76(3) Conference
Conference day not to exceed 30 days after latest expiration date of invitations.
76(4) Conference
Notice must be given to agency or organisation and individuals.
77 Conduct of conference
77(1) Conduct of conference
Agency or organisation must be represented by an officer or employee at the conference.
Agency has entitlement to be represented.
77(2) Conduct of conference
Entitlement to attend and participate in a conference
The Commissioner considers presence appropriate
77(3) Conduct of conference
Exclude from conference a person who uses insulting language or creates/disturbs the conference.
78 Determination of application
Commissioner must make a determination after complying with Part 1.
entries-found-privacy-act-1988.pdf, p.323
79 Making of determination
79(1) Making of determination
The Commissioner must take account of all matters raised at the conference.
The Commissioner must make a determination.
The Commissioner's duty to consider all matters raised at the conference is contained within the duty to make a determination.
If the Commissioner makes a determination, then they must consider all matters raised at the conference.
The Commissioner shall, in making a determination...
The Commissioner's duty to consider all matters raised at the conference is a duty diffusion.
The Commissioner's action of considering all matters raised at the conference is a cognitive action.
79(2) Making of determination
Commissioner must consider submissions when making a determination.
80A Temporary public interest determinations
entries-found-privacy-act-1988.pdf, p.324
80A(1) Temporary public interest determinations
Commissioner must determine if public interest outweighs adherence to APP principles or codes.
80A(2) Temporary public interest determinations
Commissioner may make a determination on request or initiative
80A(3) Temporary public interest determinations
Temporary public interest determinations
Defines the duration of the determination
(3) The Commissioner must specify in the determination a period of up to 12 months
a period of up to 12 months during which the determination is in force
Specifies the duration of the determination as an obligation
Defines the duration of the determination as an ordered trace
80B Effect of temporary public interest determination
80B(1) Effect of temporary public interest determination
Entity not in breach if act or practice subject to temporary public interest determination
Temporary public interest determination in force
80B(3) Effect of temporary public interest determination
Commissioner may make a determination that no APP entity contravenes section 15 or 26A under certain conditions.
80B(4) Effect of temporary public interest determination
Effect of temporary public interest determination
80D Commissioner may continue to consider application
entries-found-privacy-act-1988.pdf, p.325
80D(1) Commissioner may continue to consider application
Commissioner may continue to consider application despite previous determination.
Continuation of consideration despite previous determination.
Previous determination does not prevent continuation.
Commissioner may continue to consider application.
Commissioner has made a determination under Division about an act or practice.
Rebutting the effect of previous determination.
80D(2) Commissioner may continue to consider application
Commissioner must continue to consider application upon certain conditions.
The Commissioner has a duty to continue considering the application.
80E Register of determinations
entries-found-privacy-act-1988.pdf, p.326
80E(1) Register of determinations
The Commissioner must keep a register of determinations.
80E(2) Register of determinations
Commissioner's discretion over register form and keeping
80E(3) Register of determinations
The Commissioner must make the register available to the public.
(3) The Commissioner must make the register available to the public in the way that the Commissioner determines.
The register is accessible to the public during its registration process
Public access implies availability of information
The availability of the register implies its accessibility to the public
The diffusion of information implies its accessibility to the public through the register
The AI system recognizes the accessibility of the register to the public
80E(4) Register of determinations
Commissioner may charge fees for making register available to public or providing copies of register.
80F Object
Special provision for collection, use and disclosure of personal information in emergencies and disasters.
entries-found-privacy-act-1988.pdf, p.327
80G Interpretation
80J Declaration of emergency—events of national significance
entries-found-privacy-act-1988.pdf, p.329
80J(1) Declaration of emergency—events of national significance
Declaration of emergency—events of national significance
State has the power to declare an emergency
80J(2) Declaration of emergency—events of national significance
Permission to make a declaration under this section
(2) The Prime Minister or the Minister may, by writing...
80J(3) Declaration of emergency—events of national significance
A declaration under this section is a legislative instrument.
Declaration is a legislative instrument.
80K Declaration of emergency—events outside Australia
entries-found-privacy-act-1988.pdf, p.330
80K(1) Declaration of emergency—events outside Australia
Declaration of emergency outside Australia
(1) The Prime Minister or the Minister may, in writing...
80K(2) Declaration of emergency—events outside Australia
Minister must consult other Minister before making declaration under section.
80K(3) Declaration of emergency—events outside Australia
80KA Matters covered by declarations
80KA(1) Matters covered by declarations
Emergency declaration must specify personal information details
Must specify personal information details
Specify the kind or kinds of personal information to which the declaration applies
80KA(2) Matters covered by declarations
Entities or classes of entities may include a State or Territory authority, but must not include media organisations.
Special Broadcasting Service Corporation
80KA(3) Matters covered by declarations
Permitted purpose must relate to Commonwealth's response to emergency or disaster.
(3) A permitted purpose specified for the purposes of paragraph (1)(d)
must be a purpose that directly relates to the Commonwealth’s response to an emergency or disaster in respect of which an emergency declaration is in force.
Temporal relation to emergency declaration
in respect of which an emergency declaration is in force.
Artificial intelligence recognizes permitted purpose
80KA(4) Matters covered by declarations
Permitted purposes in relation to an emergency or disaster
Temporal overlap between permitted purposes and emergencies/disasters
(4) Without limiting subsection (3), any of the following may be specified as a permitted purpose in relation to an emergency or disaster:
Implications for decision-making regarding permitted purposes
Spread of permitted purposes through emergencies/disasters
Inferences about permitted purposes based on emergencies/disasters
80N When declarations cease to be in force
Emergency declaration ceases at specified time, repeal, or end of 12 months.
entries-found-privacy-act-1988.pdf, p.332
Describes temporal interval for declaration cessation
80P Authorisation of collection, use and disclosure of personal
entries-found-privacy-act-1988.pdf, p.334
80P(1) Authorisation of collection, use and disclosure of personal
Information of a kind specified in the declaration.
The collection, use or disclosure is for a permitted purpose specified in the declaration.
80P(2) Authorisation of collection, use and disclosure of personal
Liability for secrecy provision contravention
Entity's obligation to comply with secrecy provisions
...unless the secrecy provision is a designated secrecy provision
80P(3) Authorisation of collection, use and disclosure of personal
Temporal relationship between liability and breach
80P(4) Authorisation of collection, use and disclosure of personal
An entity must not breach an Australian Privacy Principle or a registered APP code in respect of collection, use or disclosure of personal information authorized by subsection (1).
Entity must not breach Australian Privacy Principle or APP code.
(4) An entity does not breach an Australian Privacy Principle, or a registered APP code that binds the entity...
...in respect of a collection, use or disclosure of personal information authorized by subsection (1).
Collection, use or disclosure of personal information occurs during emergencies and disasters.
Entity must not breach Australian Privacy Principle or APP code in emergencies and disasters.
80P(6) Authorisation of collection, use and disclosure of personal
Authorisation of collection, use and disclosure of personal information by agency officers or employees.
Agency authorisation required for collection, use and disclosure of personal information.
Agency officer or employee must be authorised by the agency to collect, use or disclose personal information.
Collection, use or disclosure of personal information is authorised only if the officer or employee is authorised by the agency.
Collection, use or disclosure of personal information must occur during agency duty.
The officer or employee must be performing their duties when collecting, using or disclosing personal information.
The collection, use or disclosure of personal information must occur while the officer or employee is on duty.
Agency must authorise collection, use and disclosure of personal information.
The agency must authorise the collection, use and disclosure of personal information.
The agency's authorisation is a necessary condition for the collection, use and disclosure of personal information.
Agency must authorise collection, use and disclosure of personal information by officers or employees.
The agency must authorise the collection, use and disclosure of personal information by its officers or employees.
The agency's authorisation is a necessary condition for the collection, use and disclosure of personal information by its officers or employees.
80P(7) Authorisation of collection, use and disclosure of personal
80Q Disclosure of information—offence
entries-found-privacy-act-1988.pdf, p.336
80Q(1) Disclosure of information—offence
Disclosing personal information without permission is an offence.
Prohibition of disclosing personal information
(a) personal information that relates to an individual is disclosed
(c) the first person is not a responsible person for the individual
80Q(2) Disclosure of information—offence
(2) Subsection (1) does not apply to the following disclosures:
80Q(3) Disclosure of information—offence
Disclosure of personal information is authorised by this section.
Authorises disclosure of personal information
80Q(4) Disclosure of information—offence
80R Operation of Part
entries-found-privacy-act-1988.pdf, p.337
80R(1) Operation of Part
Operation of Part is not limited by secrecy provisions of other Commonwealth laws.
Section 3 provides for concurrent operation of State and Territory laws.
(1) The operation of this Part is not limited by a secrecy provision of any other Commonwealth law (whether made before or after the commencement of this Act) except to the extent that the secrecy provision expressly excludes the operation of this section.
80R(2) Operation of Part
80S Severability—additional effect of Part
80S(1) Severability—additional effect of Part
Part has effect in relation to a collection, use or disclosure
80S(2) Severability—additional effect of Part
This Part has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure by a corporation.
80S(3) Severability—additional effect of Part
Severability clause with additional effect on trade or commerce
...it would have if its operation in relation to a collection, use or disclosure were expressly confined...
Defines temporal intervals for trade or commerce
(3) This Part also has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined...
Defines sequence of events for trade or commerce
Describes spread of obligation across trade or commerce
Describes role of cognitive agents in trade or commerce
80S(4) Severability—additional effect of Part
80T Compensation for acquisition of property—constitutional safety
entries-found-privacy-act-1988.pdf, p.339
80T(1) Compensation for acquisition of property—constitutional safety
Temporal overlap between operation and acquisition
(1) If the operation of this Part would result in an acquisition of property from a person otherwise than on just terms, the Commonwealth is liable to pay a reasonable amount of compensation to the person.
Temporal relationship between operation and acquisition
Compensation diffusion through operation
Compensation inference through operation
80T(2) Compensation for acquisition of property—constitutional safety
Person may institute proceedings for recovery of compensation if Commonwealth and person do not agree on amount.
80T(3) Compensation for acquisition of property—constitutional safety
Defines terms for acquisition of property
80TA Simplified outline of this Part
Monitoring and investigation powers under Part 2 and Part 3 of the Regulatory Powers Act.
entries-found-privacy-act-1988.pdf, p.340
80TB Monitoring powers
entries-found-privacy-act-1988.pdf, p.341
80TB(1) Monitoring powers
Monitoring powers for certain provisions under Part 2 of the Regulatory Powers Act.
Imposes a duty on the State to monitor certain provisions.
Classifies the provisions subject to monitoring under Part 2 of the Regulatory Powers Act.
80TB(2) Monitoring powers
Information subject to monitoring under Part 2 of the Regulatory Powers Act.
80TB(3) Monitoring powers
Monitoring powers subject to the Regulatory Powers Act.
80TC Modifications of Part 2 of the Regulatory Powers Act
Use of force in executing a monitoring warrant
entries-found-privacy-act-1988.pdf, p.344
80TD Investigation powers
entries-found-privacy-act-1988.pdf, p.345
80TD(1) Investigation powers
Provisions subject to investigation under Part 3 of the Regulatory Powers Act
Investigation powers apply to specified provisions
Part 3 of the Regulatory Powers Act creates a framework for investigating whether a provision has been contravened.
The provision is subject to investigation under Part 3 of the Regulatory Powers Act.
Part 3 of the Regulatory Powers Act includes powers of entry, search and seizure
Investigation powers apply during specified periods
The provision is subject to investigation under Part 3 of the Regulatory Powers Act during the specified period.
The provision is subject to investigation under Part 3 of the Regulatory Powers Act everywhere.
Provisions are subject to investigation if they relate to an offence provision in this Act
The provision is subject to investigation under Part 3 of the Regulatory Powers Act if it is an offence provision, or a civil penalty provision, in this Act.
The provision is subject to investigation under Part 3 of the Regulatory Powers Act if it relates to an offence provision in this Act.
Provisions are subject to investigation if they relate to a civil penalty provision enforceable by the Commissioner under the Digital ID Act 2024
The provision is subject to investigation under Part 3 of the Regulatory Powers Act if it is any of the following: (i) a civil penalty provision that is enforceable by the Commissioner under the Digital ID Act 2024;
The provision is subject to investigation under Part 3 of the Regulatory Powers Act if it relates to a civil penalty provision enforceable by the Commissioner under the Digital ID Act 2024.
80TD(2) Investigation powers
Authorized applicants for evidential material
Person is authorized applicant if they meet certain conditions.
Person has authority to request evidential material.
80TE Modifications of Part 3 of the Regulatory Powers Act
entries-found-privacy-act-1988.pdf, p.348
80TE(1) Modifications of Part 3 of the Regulatory Powers Act
Authorized persons may use force against things necessary and reasonable in the circumstances.
80TE(2) Modifications of Part 3 of the Regulatory Powers Act
List premises subject to investigation under Part 3 of the Regulatory Powers Act
80U Civil penalty provisions
entries-found-privacy-act-1988.pdf, p.350
80U(1) Civil penalty provisions
Civil penalty provisions must be enforced under Part 4 of the Regulatory Powers Act.
80U(2) Civil penalty provisions
Commissioner is authorised applicant for civil penalty provisions.
80U(3) Civil penalty provisions
List of relevant courts for civil penalty provisions
Relevant court for civil penalty provisions
80U(4) Civil penalty provisions
Extends Part 4 of the Regulatory Powers Act to external Territories.
80UA Powers of court to make other orders
Court may make order in proceedings where entity has contravened a civil penalty provision.
80UB Infringement notices
entries-found-privacy-act-1988.pdf, p.352
80UB(1) Infringement notices
Infringement notices can be issued for certain provisions under Part 5 of the Regulatory Powers Act.
80UB(1A) Infringement notices
Prohibition on infringement notice exceeding penalty units for listed corporations
Prohibits infringement notice exceeding penalty units for listed corporations
(1A) Despite subsection 104(2) of the Regulatory Powers Act...
Restricts infringement notice to a single alleged contravention
Infers penalty units for listed corporations from infringement notice
80UB(1B) Infringement notices
Penalty unit calculation for infringement notices
80UB(2) Infringement notices
Identifies infringement officers for the purpose of Part 5 of the Regulatory Powers Act.
Identifies entities with a specific role.
80UB(3) Infringement notices
Commissioner is the relevant chief executive for a provision.
80UB(4) Infringement notices
Part 5 of the Regulatory Powers Act applies to every external Territory.
Applicability of the Regulatory Powers Act
80UC Compliance notices
entries-found-privacy-act-1988.pdf, p.354
80UC(1) Compliance notices
Notice may be given by the Commissioner or staff member to an entity for contravening subsection 13K(1)
Commissioner or staff member may give notice
Notice may be given during Commissioner's reasonable belief
Commissioner reasonably believes entity has contravened subsection 13K(1)
Commissioner has authority to vary or revoke notice
80UC(2) Compliance notices
Entity must take action to address contravention within a reasonable period.
Details of contravention, action to be taken, and steps to prevent repetition.
80UC(3) Compliance notices
Entity must comply with compliance notice
80UC(4) Compliance notices
Failure to comply with a compliance notice is prohibited.
80UC(5) Compliance notices
Section 80U deals with civil penalty provisions in this Act.
Subsection (4) is a civil penalty provision.
80UC(6) Compliance notices
Maximum penalty for contravention of subsection (4)
Penalty amount must not exceed 200 units
80UC(7) Compliance notices
Compliance with notice does not admit to contravening subsection.
Compliance implies no admission of contravention.
(7) An entity that complies with a notice given under subsection (1)
not taken by that compliance: to have admitted to contravening that subsection;
Compliance implies no finding of contravention.
not taken by that compliance: to have been found to have contravened that subsection;
Compliance overlaps with the period of notice.
in relation to a contravention of subsection 13K(1) or (2);
Compliance repeats the period of notice.
Compliance justifies the absence of civil penalty.
is not taken by that compliance: to have been found to have contravened that subsection;
80UC(8) Compliance notices
The Commissioner must not apply for an order under Part 4 of the Regulatory Powers Act in relation to a contravention of subsections 13G(1), 13H(1) or 13K(1) or (2) of this Act constituted by particular conduct engaged in by an entity, if certain conditions are met.
80UD Review of compliance notices
entries-found-privacy-act-1988.pdf, p.356
80UD(1) Review of compliance notices
Entity may apply for review of compliance notice on grounds that entity has not committed contravention or notice does not comply with subsection 80UC(2).
Entity has the right to apply for review.
80UD(2) Review of compliance notices
Court may stay operation of notice on terms and conditions.
80UD(3) Review of compliance notices
Court may confirm, cancel or vary compliance notice.
80V Enforceable undertakings
entries-found-privacy-act-1988.pdf, p.358
80V(1) Enforceable undertakings
Enforceable undertakings under Part 6 of the Regulatory Powers Act
80V(2) Enforceable undertakings
Commissioner is authorised person for specified provisions.
80V(3) Enforceable undertakings
List of relevant courts for enforceable undertakings
80V(4) Enforceable undertakings
Commissioner may publish undertaking given in relation to provision on website.
80V(5) Enforceable undertakings
Part 6 of the Regulatory Powers Act applies to every external Territory.
Part of the Regulatory Powers Act applies to every external Territory.
80W Injunctions
entries-found-privacy-act-1988.pdf, p.359
80W(1) Injunctions
Enforceability under Part 7 of the Regulatory Powers Act
80W(2) Injunctions
List of persons authorized to take actions under the Regulatory Powers Act
80W(3) Injunctions
List of relevant courts for the purposes of Part 7 of the Regulatory Powers Act.
Federal Court and Federal Circuit and Family Court of Australia (Division 2)
Specifies temporal interval for relevant courts
(3) For the purposes of Part 7 of the Regulatory Powers Act
80W(4) Injunctions
Part 7 of the Regulatory Powers Act applies to external Territories.
Part 7 applies in relation to provisions mentioned in subsection (1)
81 Interpretation
entries-found-privacy-act-1988.pdf, p.360
Advisory Committee means the Privacy Advisory Committee
member means a member of the Advisory Committee.
82 Establishment and membership
82(1) Establishment and membership
Establishment of a Privacy Advisory Committee is mandatory.
82(2) Establishment and membership
The Advisory Committee must consist of the Commissioner and not more than 8 other members.
82(3) Establishment and membership
A member must be appointed by the Governor-General.
82(4) Establishment and membership
Term of appointment for appointed members
(4) An appointed member holds office, subject to this Act
Term of appointment is a temporal interval
(4) An appointed member holds office, subject to this Act, for such period, not exceeding 5 years, as is specified in the instrument of the member’s appointment
Term of appointment is a recurring trace
Eligible for re-appointment after term ends
(4) An appointed member holds office, subject to this Act, for such period, not exceeding 5 years, as is specified in the instrument of the member’s appointment, but is eligible for re-appointment
82(5) Establishment and membership
The Commissioner shall be convenor of the Committee.
82(6) Establishment and membership
Ensure majority of appointed members are not officers, employees, or staff of the Commonwealth.
82(7) Establishment and membership
At least one member must have specific experience in industry, public administration, health privacy, trade union movement, information and communication technologies, civil liberties, or represent general community interests.
82(10) Establishment and membership
Terms and conditions for appointed members' office
82(11) Establishment and membership
Performance of Advisory Committee function is not affected by vacancies in membership.
83 Functions
The Advisory Committee must advise the Commissioner on matters relevant to his or her functions.
entries-found-privacy-act-1988.pdf, p.361
84 Leave of absence
Grant leave of absence to member on terms and conditions set by convenor.
entries-found-privacy-act-1988.pdf, p.362
85 Removal and resignation of members
85(1) Removal and resignation of members
The Governor-General may terminate the appointment of an appointed member for misbehaviour or physical or mental incapacity.
85(2) Removal and resignation of members
Termination of appointment for bankruptcy, non-compliance, or absence without leave.
Prohibition of actions leading to termination.
(2) The Governor-General shall terminate the appointment...
The Governor-General may not appoint a member who meets these conditions.
The termination occurs after three consecutive meetings of the Advisory Committee.
85(3) Removal and resignation of members
Member may resign by delivering notice to Governor-General.
86 Disclosure of interests of members
86(1) Disclosure of interests of members
Member must disclose pecuniary interest in matter being considered by Advisory Committee.
Member must disclose pecuniary interest.
86(2) Disclosure of interests of members
A disclosure under subsection (1) at a meeting of the Advisory Committee shall be recorded in the minutes of the meeting.
87 Meetings of Advisory Committee
entries-found-privacy-act-1988.pdf, p.363
87(1) Meetings of Advisory Committee
Convenor may convene Advisory Committee meetings as necessary.
87(2) Meetings of Advisory Committee
Determination of Advisory Committee meeting places and times
87(3) Meetings of Advisory Committee
The convenor must preside at all meetings of the Advisory Committee when present.
87(4) Meetings of Advisory Committee
Duty to elect a presider when convenor is absent
87(5) Meetings of Advisory Committee
Quorum requirements for Advisory Committee meetings
87(6) Meetings of Advisory Committee
Record keeping obligation for Advisory Committee
88 Travel allowance
89 Obligations of confidence to which Part applies
Reference to an obligation of confidence in this Part.
entries-found-privacy-act-1988.pdf, p.364
90 Application of Part
90(1) Application of Part
Obligation of confidence to another person in respect of personal information.
90(2) Application of Part
Exemption from Part's application for criminal penalties only
Prohibits application of Part in certain cases
(2) This Part does not apply where a criminal penalty only may be imposed in respect of the breach.
91 Effect of Part on other laws
Does not limit or restrict other laws, principles, or rules.
92 Extension of certain obligations of confidence
Subjecting individuals to an obligation of confidence if they acquire personal info about another person with knowledge of the original obligation.
entries-found-privacy-act-1988.pdf, p.365
Imposes a duty on individuals to maintain confidentiality.
Acquiring personal info about another person with knowledge of the original obligation.
Subjecting individuals to an obligation of confidence.
Establishes a temporal relationship between the acquisition and knowledge of the obligation.
Knowledge of the original obligation during the acquisition.
Describes a temporal relationship between the knowledge and application of the obligation.
Knowledge of the original obligation until the application.
Establishes a conditional relationship between the acquisition and knowledge of the obligation.
Knowledge of the original obligation if the acquisition.
Describes a relationship between the individual and the obligation.
Individuals with knowledge of the original obligation.
93 Relief for breach etc. of certain obligations of confidence
93(1) Relief for breach etc. of certain obligations of confidence
A confider may recover damages from a confidant in respect of a breach of an obligation of confidence with respect to personal information.
Confider may recover damages from confidant
Temporal interval for breach of obligation of confidence
Breach occurs between confider and confidant
Confider may recover damages within a certain time frame
Confider's obligation to keep information confidential is diffused to confidant
Confidant has a corresponding obligation to keep information confidential
Cognitive agent for obligation of confidence
Confider and confidant are cognitive agents with obligations
Obligation of confidence is a type of cognitive task
Confider and confidant must follow schema for confidential information
Obligation of confidence is a type of schema-based task
93(2) Relief for breach etc. of certain obligations of confidence
Confider's right to relief in respect of breach
Confider has a right to relief in respect of breach
(2) Subsection (1) does not limit or restrict any other right that the confider has to relief in respect of the breach.
The confider has a right to relief in respect of breach
Relief overlaps with obligations of confidence
Relief diffuses into obligations of confidence
Confider has capability to provide relief
The confider has capability to provide relief
93(3) Relief for breach etc. of certain obligations of confidence
Rights of person to whom information relates against breach or threatened breach of obligation
94 Jurisdiction of courts
94(1) Jurisdiction of courts
Jurisdiction of courts extends to matters arising under this Part.
(1) The jurisdiction of the courts of the Australian Capital Territory...
The jurisdiction extends to matters arising under this Part.
Temporal interval: Jurisdiction starts at commencement
The jurisdiction starts during the commencement.
Jurisdiction implies authority to decide matters arising under this Part
The jurisdiction implies authority to decide matters arising under this Part.
Jurisdiction diffuses to all courts in the Australian Capital Territory
The jurisdiction diffuses to all courts in the Australian Capital Territory.
Jurisdiction recognized by artificial intelligence systems
The jurisdiction is recognized by artificial intelligence systems.
94(2) Jurisdiction of courts
Court jurisdiction not affected by subsection (1)
94A Schedule 2
entries-found-privacy-act-1988.pdf, p.366
94A(1) Schedule 2
94A(2) Schedule 2
Disregard expressions in Schedule 2 when interpreting other provisions.
Expression in Schedule 2 is to be disregarded.
Other provisions are interpreted without considering expression in Schedule 2.
94A(3) Schedule 2
Schedule 2 is to be disregarded in determining the meaning of a provision of this Act.
95 Medical research guidelines
95(1) Medical research guidelines
CEO may issue guidelines for protecting privacy in medical research
95(2) Medical research guidelines
Public interest in research promotion outweighs adherence to Australian Privacy Principles.
Prohibition of guideline approval without public interest consideration.
Commissioner shall not approve guidelines
95(3) Medical research guidelines
Guidelines shall be issued by being published in the Gazette.
95(4) Medical research guidelines
Exemption from breach of Australian Privacy Principle for medical research
Exempts acts from breach of Australian Privacy Principle for medical research
...the act shall be regarded as not breaching that Australian Privacy Principle.
Specifies temporal interval during which exemption applies
...and in accordance with guidelines under subsection (1);...
95A Guidelines for Australian Privacy Principles about health
entries-found-privacy-act-1988.pdf, p.367
95A(1) Guidelines for Australian Privacy Principles about health
Commissioner approves guidelines for use and disclosure.
Allows Commissioner to approve guidelines.
95A(2) Guidelines for Australian Privacy Principles about health
Commissioner may approve guidelines for health information use and disclosure.
95A(3) Guidelines for Australian Privacy Principles about health
Approval required for guidelines on health information disclosure.
95A(4) Guidelines for Australian Privacy Principles about health
Commissioner may approve guidelines for health information collection
95AA Guidelines for Australian Privacy Principles about genetic
entries-found-privacy-act-1988.pdf, p.368
95AA(1) Guidelines for Australian Privacy Principles about genetic
Commissioner may approve guidelines for use and disclosure
95AA(2) Guidelines for Australian Privacy Principles about genetic
Commissioner may approve guidelines for use and disclosure of genetic information.
95B Requirements for Commonwealth contracts
95B(1) Requirements for Commonwealth contracts
Agency must ensure contracted service provider does not breach Australian Privacy Principle.
95B(2) Requirements for Commonwealth contracts
Agency must ensure contract does not authorise contracted service provider to engage in certain acts or practices.
Prohibition of engaging in certain acts or practices.
(2) The agency must ensure that the Commonwealth contract does not authorise a contracted service provider for the contract to do or engage in such an act or practice.
The agency must ensure that the contract does not authorise the provision to engage in certain acts or practices.
Prohibition of engaging in certain acts or practices within a specific time frame.
The provision is prohibited within the specified time frame.
Prohibition of engaging in certain acts or practices through diffusion.
The provision is prohibited through diffusion.
Prohibition of engaging in certain acts or practices using cognitive AI.
The provision is prohibited using cognitive AI.
95B(3) Requirements for Commonwealth contracts
Agency must ensure Commonwealth contract provisions prevent unauthorized subcontracting.
Obligation to ensure Commonwealth contract provisions prevent unauthorized subcontracting.
(3) The agency must also ensure that the Commonwealth contract contains provisions to ensure that such an act or practice is not authorized by a subcontract.
Temporal relationship between requirement and provision.
Implication of requirement on Commonwealth contracts.
Spread of requirement to related contracts.
95B(4) Requirements for Commonwealth contracts
A subcontract is a contract under which a contracted service provider for the Commonwealth contract is engaged to provide services.
Classification of a subcontract as an obligation.
95B(5) Requirements for Commonwealth contracts
Agency must comply with section requirements regardless of its role in the contract.
Agency must comply with section requirements.
95C Disclosure of certain provisions of Commonwealth contracts
Party must inform person of inconsistent contract provisions.
entries-found-privacy-act-1988.pdf, p.369
96 Review by the Administrative Review Tribunal
Application for review of certain decisions by the Administrative Review Tribunal.
Application for review of certain decisions.
98A Treatment of partnerships
entries-found-privacy-act-1988.pdf, p.371
98A(1) Treatment of partnerships
If this Act would impose an obligation on a partnership, the obligation is imposed instead on each partner.
98A(2) Treatment of partnerships
Each partner in a partnership commits an offence if the partnership would otherwise commit one.
Each partner has an obligation to comply with the law.
98A(3) Treatment of partnerships
Each partner is liable for the contravention if the partnership would have violated a civil penalty provision.
Each partner is liable for the contravention.
Partnership would have violated a civil penalty provision.
98A(4) Treatment of partnerships
Partner must take reasonable steps to correct contravention after becoming aware of circumstances.
Partner has an obligation to correct contravention.
Partner must know of circumstances before taking action.
Partner's actions are part of a recurring trace.
98B Treatment of unincorporated associations
98B(1) Treatment of unincorporated associations
Imposes obligation on association members
98B(2) Treatment of unincorporated associations
If an offence against this Act would be committed by an unincorporated association, the offence is taken to
An offence against this Act would be committed by an unincorporated association
98C Treatment of trusts
entries-found-privacy-act-1988.pdf, p.372
98C(1) Treatment of trusts
Imposes obligation on trustee, dischargeable by any trustee
98C(2) Treatment of trusts
Offence against the Act is transferred to each trustee of a trust.
98C(3) Treatment of trusts
Each trustee of a trust is liable for contravening a civil penalty provision.
Liability for contravening a civil penalty provision.
Trustee is liable for contravening a civil penalty provision.
Temporal relation between the trust and the civil penalty provision.
The trust exists before the civil penalty provision.
The trust existed before the civil penalty provision.
Trustee is liable for contravening a civil penalty provision if the trust would contravene it.
If the trust would contravene a civil penalty provision, then each trustee of the trust is liable for contravening that provision.
Each trustee of a trust is liable for contravening a civil penalty provision if the trust would contravene it.
Liability for contravening a civil penalty provision propagates to each trustee of the trust.
Each trustee of the trust is liable for contravening a civil penalty provision.
The liability for contravening a civil penalty provision propagates to each trustee of the trust.
Trustee is a knowledge representation of NaturalPerson.
Each trustee of the trust is a legal person.
98C(4) Treatment of trusts
Trustee has an obligation to correct contravention as soon as possible after becoming aware of the circumstances.
Trustee has an obligation to correct contravention.
Trustee must take all reasonable steps to correct the contravention.
Trustee knows of circumstances that constitute contravention.
Trustee must take all reasonable steps to correct contravention as soon as possible after becoming aware of the circumstances.
Trustee takes all reasonable steps to correct the contravention.
Trustee is not required to take action if they do not know of the circumstances that constitute the contravention.
Trustee does not have a duty to correct the contravention.
Trustee has a duty to correct the contravention.
99A Conduct of directors, employees and agents
entries-found-privacy-act-1988.pdf, p.373
99A(1) Conduct of directors, employees and agents
Establishing state of mind for directors, employees and agents
(a) that the conduct was engaged in by a director, employee or agent of the body corporate within the scope of his or her actual or apparent authority; and (b) that the director, employee or agent had the state of mind.
Establishing obligations for directors, employees and agents
Implication for directors, employees and agents
99A(2) Conduct of directors, employees and agents
Body corporate must take precautions to avoid conduct of directors, employees and agents.
100 Regulations
entries-found-privacy-act-1988.pdf, p.375
100(1) Regulations
Governor-General may make regulations not inconsistent with the Act.
100(1A) Regulations
The Minister must be satisfied that the laws of a country or binding scheme protect personal information in a substantially similar way to Australian Privacy Principles.
100(1B) Regulations
Regulations may prescribe a country or binding scheme for Australian Privacy Principle 8.3 subject to conditions.
The regulations may prescribe a country or binding scheme.
subject to conditions in relation to a specified entity or class of entities;
a country or binding scheme for Australian Privacy Principle 8.3
(1B) The regulations may prescribe a country or binding scheme.
for Australian Privacy Principle 8.3 subject to conditions.
100(2) Regulations
The Minister must be satisfied that certain conditions are met before regulations can be made.
The Minister must satisfy certain conditions before taking action.
(2) Before the Governor-General makes regulations...
The regulation-making process is governed by certain conditions.
1 Australian Privacy Principle 1—open and transparent
Management of personal information is an obligation.
entries-found-privacy-act-1988.pdf, p.379
Obligation to manage personal information
1 Section 1
Ensure open and transparent management of personal information
Duty to comply with Australian Privacy Principles
Must implement practices, procedures and systems to comply with Australian Privacy Principles and a registered APP code.
Obligation to comply with Australian Privacy Principles and a registered APP code.
Entity must have a clearly expressed and up-to-date policy about personal information management.
Entity must have a clearly expressed and up-to-date policy.
Must provide personal information in privacy policy
Obligation to provide personal information
An APP entity must make its APP privacy policy available.
entries-found-privacy-act-1988.pdf, p.380
Entity must provide a copy of the APP privacy policy in a requested form.
Entity must provide the requested information.
2 Australian Privacy Principle 2—anonymity and pseudonymity
Australian Privacy Principle 2—anonymity and pseudonymity
2 Section 2
Must provide option to not identify themselves or use pseudonym when dealing with APP entity.
Exemption from Subclause 2.1 for APP entities dealing with individuals who have identified themselves or whose identification is impracticable.
APP entity is required or authorised to deal with individuals who have identified themselves.
Temporal relationship between the APP entity's requirement to deal with individuals and the court/tribunal order
it is required or authorised by or under an Australian law, or a court/tribunal order
Recurring relationship between the APP entity's requirement to deal with individuals and the impracticability of dealing with those who have not identified themselves or used a pseudonym
it is impracticable for the APP entity to deal with individuals who have not identified themselves or who have used a pseudonym.
Grant of permission to the APP entity to deal with individuals under certain circumstances
the APP entity is required or authorised by or under an Australian law, or a court/tribunal order
Imposition of an obligation on the APP entity to deal with individuals who have identified themselves or whose identification is impracticable
3 Australian Privacy Principle 3—collection of solicited personal
Collection of solicited personal information is an obligation.
entries-found-privacy-act-1988.pdf, p.382
Obligation to collect solicited personal information.
3 Section 3
No personal information can be collected unless necessary for functions or activities.
Prohibits collecting personal information unless necessary.
Organisations must not collect personal information unless necessary for their functions.
Prohibition on collecting personal information
Entity must not collect personal information
An APP entity must not collect sensitive information about an individual unless certain conditions are met.
Prohibition of collecting sensitive information
The entity must not collect the information.
Relationship between the entity's functions and activities and the collection of information
The information is collected for one or more of the entity's functions or activities.
The collection of information is related to the entity's functions or activities.
Recurring trace of the entity's functions and activities
One or more of the entity's functions or activities are directly related to the collection of information.
The entity's functions and activities form a recurring trace with the collection of information.
Sensitive information is collected about an individual unless certain conditions are met.
The diffusion of sensitive information is affected by the conditions.
An APP entity can be classified using AI if it meets this condition.
The entity is classified as an APP entity if it meets this condition.
Collection of personal information is permitted under certain circumstances.
Permission to collect personal information under certain circumstances.
Classification of permitted general and health situations.
Temporal relation between collection of information and enforcement-related activities.
Must collect personal information only by lawful and fair means.
entries-found-privacy-act-1988.pdf, p.383
Obligation to collect personal information
Classification of data collection methods
Must collect personal information from individual only with consent
This principle applies to the collection of personal information solicited by an APP entity.
entries-found-privacy-act-1988.pdf, p.384
Obligation to protect personal information
The APP entity is responsible for protecting personal information
The APP entity must comply with this principle
4 Australian Privacy Principle 4—dealing with unsolicited personal
Dealing with unsolicited personal information
4 Section 4
Determine whether the entity could have collected information under Australian Privacy Principle 3 if solicited.
Use or disclose personal information for making determination under subclause 4.1.
Personal information may be used or disclosed
During the purposes of making determination
Purposes of making determination include during certain time period
Determination made during personal information use
Destroy personal information if it cannot be collected or is not in a Commonwealth record.
Mandatory destruction of personal information.
Applying Australian Privacy Principles if subclause 4.3 does not apply
Temporal interval for applying principles
Subclause 4.3 does not apply in relation to personal info
5 Australian Privacy Principle 5—notification of the collection of
Notification of collection of personal information
entries-found-privacy-act-1988.pdf, p.385
5 Section 5
Notify individual of personal information collected
6 Australian Privacy Principle 6—use or disclosure of personal
Use or disclosure of personal information is an obligation.
entries-found-privacy-act-1988.pdf, p.387
6 Section 6
Must not use or disclose personal information for another purpose without consent.
Prohibits use or disclosure of personal information for another purpose.
Use or disclose personal information for secondary purpose if individual expects it, or required by law or court order.
Obligation to use or disclose personal information for secondary purpose if individual expects it.
The individual would reasonably expect the APP entity to use or disclose the information for the secondary purpose.
Use or disclose personal information for secondary purpose.
Obligation to use or disclose personal information if required by law or court order.
The use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order.
Use or disclosure of personal information occurs during permitted general situation.
A permitted general situation exists in relation to the use or disclosure of the information by the APP entity.
Disclosure of personal information by an agency is subject to guidelines.
entries-found-privacy-act-1988.pdf, p.388
Entity must de-identify personal information before disclosure.
Duty to de-identify personal information.
Must make a written note of use or disclosure in accordance with paragraph 6.2(e)
If an APP entity is a body corporate and collects personal information from a related body corporate, this principle applies.
Entity collects personal information from a related body corporate
The entity’s primary purpose for the collection of the information is related to the primary purpose for which the related body corporate collected the information.
APP entity is a body corporate and collects personal information from a related body corporate
Exemption from data protection principle for direct marketing and government-related identifiers.
entries-found-privacy-act-1988.pdf, p.389
Exempts organisations from data protection principle for specified purposes.
7 Australian Privacy Principle 7—direct marketing
7 Section 7
Organisation must not use or disclose personal information for direct marketing.
Prohibition of using or disclosing personal information for direct marketing.
Organisation holds personal information about an individual.
The organisation must not use or disclose the information for the purpose of direct marketing.
If an organisation holds personal information about an individual, then the organisation must not use or disclose the information for the purpose of direct marketing.
The temporal interval for the prohibition is when the organisation holds personal information about an individual.
The recurring trace for the prohibition is when the organisation holds personal information about an individual.
The diffusion of the prohibition is when the organisation uses or discloses the information for the purpose of direct marketing.
Knowledge representation for prohibition.
The knowledge representation for the prohibition is that the organisation must not use or disclose the information for the purpose of direct marketing.
Organisation may use or disclose personal information for direct marketing under certain conditions.
Personal information (other than sensitive information)
entries-found-privacy-act-1988.pdf, p.390
Organisation permits use or disclosure of personal information for direct marketing under certain conditions.
the organisation collected the information from the individual and the individual would not reasonably expect the organisation to use or disclose the information for that purpose
Organisation classifies personal information as suitable for direct marketing under certain conditions.
either the individual has consented to the use or disclosure of the information for that purpose or it is impracticable to obtain that consent
Use or disclosure of personal information occurs within a specific time frame.
the organisation provides a simple means by which the individual may easily request not to receive direct marketing communications from the organisation
Organisation justifies use or disclosure of personal information for direct marketing under certain conditions.
in each direct marketing communication with the individual, the organisation includes a prominent statement that the individual may make such a request or otherwise draws the individual’s attention to the fact that the individual may make such a request
Use or disclosure of personal information spreads to other individuals.
the individual has not made such a request to the organisation
Use of sensitive information for direct marketing with individual consent.
Use of sensitive information for direct marketing
entries-found-privacy-act-1988.pdf, p.391
Organisation is a contracted service provider
Individual has right to request not to receive direct marketing communications.
Organisation must not charge individual for request making or giving effect to the request.
Organisation must not charge individual.
Request making or giving effect to the request.
entries-found-privacy-act-1988.pdf, p.392
8 Australian Privacy Principle 8—cross-border disclosure of
Australian Privacy Principle 8—cross-border disclosure of personal information
8 Section 8
Ensure reasonable steps are taken to prevent breach of Australian Privacy Principles when disclosing personal information overseas.
APP entity discloses personal information overseas
Disclosure of personal information is permitted under certain conditions.
Disclosure permitted under certain conditions
Disclosure of personal information to overseas recipient is subject to certain conditions.
entries-found-privacy-act-1988.pdf, p.394
Obligation to disclose personal information
9 Australian Privacy Principle 9—adoption, use or disclosure of
Adoption of government related identifiers is an obligation.
9 Section 9
Organisation cannot adopt government related identifier of individual without authorisation.
Prohibition on adopting government related identifier.
Organisation must not use or disclose government-related identifier unless certain conditions apply.
Prohibition of using or disclosing government-related identifier.
Organisation must not use or disclose...
Organisations must comply with regulations regarding government-related identifiers.
entries-found-privacy-act-1988.pdf, p.395
a) Identifier is prescribed by the regulations
10 Australian Privacy Principle 10—quality of personal information
entries-found-privacy-act-1988.pdf, p.396
10 Section 10
Ensure personal information is accurate, up-to-date and complete.
Ensure personal information is accurate, up-to-date, complete and relevant.
11 Australian Privacy Principle 11—security of personal
11 Section 11
Protect personal information from misuse, interference, loss, unauthorized access, modification or disclosure.
Entity obligated to protect personal information
Destroy personal information if no longer needed
Mandatory duty to destroy personal information
an APP entity holds personal information about an individual
the entity must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de-identified
Time interval for destruction of personal information
the entity no longer needs the information for any purpose
the entity must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de-identified within a reasonable time period
Conditional obligation to destroy personal information
the entity must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de-identified until it is no longer needed
Mandatory duty to ensure destruction of personal information
the entity is not required by or under an Australian law
Steps including technical and organisational measures are required.
entries-found-privacy-act-1988.pdf, p.397
12 Australian Privacy Principle 12—access to personal information
entries-found-privacy-act-1988.pdf, p.398
12 Section 12
Entity must provide access to personal information on request.
Entity may refuse access to personal information under certain conditions.
Entity not required to give individual access to personal information under certain conditions.
Entity is prohibited from giving access to personal information under certain conditions.
Respond to request for access to personal information within a specified timeframe.
Access to requested information in the manner requested by the individual.
entries-found-privacy-act-1988.pdf, p.399
Entity must provide access to personal information in a reasonable manner.
entries-found-privacy-act-1988.pdf, p.400
Access may be given through a mutually agreed intermediary.
Entity cannot charge individual for making request or giving access to personal information.
Entity must not charge excessive fee for access to personal information
Entity charges individual for access to personal information
Entity must provide written notice to individual if access to personal information is refused
written notice with reasons for refusal, mechanisms for complaint, and other prescribed matters
Entity has a duty to provide written notice
Must provide explanation for refusal of access to personal information
entries-found-privacy-act-1988.pdf, p.401
13 Australian Privacy Principle 13—correction of personal
13 Section 13
Entity must correct inaccurate or incomplete personal information upon request.
Notification of correction to third parties
Entity must notify other APP entity of correction upon request.
Entity must take steps to give notification.
Entity must provide written notice to individual upon refusal to correct personal information.
entries-found-privacy-act-1988.pdf, p.402
Entity must correct inaccurate personal information upon request.
Correcting inaccurate personal information
Entity must correct inaccurate personal information.
Must respond to request within 30 days or reasonable period
Response to request, correction of personal information
1 Objects of this Schedule
Establishes a cause of action for serious invasions of privacy and provides for defences, remedies and exemptions.
entries-found-privacy-act-1988.pdf, p.403
Balances the public interest in protecting privacy with other public interests
2 Simplified outline of this Schedule
Establishes a cause of action in tort for serious invasions of privacy.
3 Crown to be bound
entries-found-privacy-act-1988.pdf, p.404
4 Constitutional basis of this Schedule
5 Additional operation of this Schedule
5(1) Additional operation of this Schedule
This Schedule also has effect as provided by this clause.
5(2) Additional operation of this Schedule
This Schedule also has the effect it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy using a service to which paragraph 51(v) of the Constitution applies.
5(3) Additional operation of this Schedule
Reference to invasion of privacy confined to corporations with constitutional protection
5(4) Additional operation of this Schedule
Reference to invasion of privacy confined to a Territory.
5(5) Additional operation of this Schedule
Reference to invasion of privacy confined to specific contexts.
(5) This Schedule also has the effect it would have if...
...an invasion of privacy in the course of trade or commerce:
This Schedule also has the effect it would have if...
...an invasion of privacy were expressly confined to...
5(6) Additional operation of this Schedule
Reference to invasion of privacy confined to specific business activities
Definitions for terms used in the Schedule
entries-found-privacy-act-1988.pdf, p.406
7 Cause of action
entries-found-privacy-act-1988.pdf, p.409
7(1) Cause of action
Plaintiff has a cause of action in tort against defendant if certain conditions are met.
(1) An individual (the plaintiff) has a cause of action in tort against another person (the defendant)
Defendant invaded the plaintiff's privacy
(a) the defendant invaded the plaintiff’s privacy by doing one or both of the following:
The defendant invaded the plaintiff's privacy
Plaintiff would have had a reasonable expectation of privacy
(b) a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances:
The plaintiff would have had a reasonable expectation of privacy
7(2) Cause of action
Invasion of privacy is actionable without proof of damage.
7(3) Cause of action
List of matters that may constitute a countervailing public interest
8 Defences
entries-found-privacy-act-1988.pdf, p.411
8(1) Defences
Obligation to defend against invasion of privacy
8(2) Defences
Defence to defamation claim based on invasion of privacy
Australian law provides a related defence
Defendant's obligation to prove related defence
8(3) Defences
Related defence for the purposes of this clause
8A Determination whether exemption applies
entries-found-privacy-act-1988.pdf, p.412
8A(1) Determination whether exemption applies
Court may determine exemption applicability
8A(2) Determination whether exemption applies
Court may make determination on application or its own motion.
8A(3) Determination whether exemption applies
Court must make determination before trial commences
8A(4) Determination whether exemption applies
Court's powers not limited by this clause.
9 Injunctions
9(1) Injunctions
Court may grant injunction to restrain defendant from invading plaintiff's privacy.
Court has discretion to issue injunctions
9(2) Injunctions
Court must consider public interest when granting injunction.
Grant injunction if public interest is considered
Temporal interval: Public interest consideration must be considered before granting injunction
Court must have particular regard to the public interest...
Public interest consideration is a necessary temporal condition for granting injunction
Temporal interval: Public interest consideration is a sufficient condition for granting injunction
Court must consider public interest when...
Granting injunction is contingent on public interest consideration
Diffusion: Public interest consideration is a necessary condition for granting injunction
Public interest consideration is a necessary diffusion condition for granting injunction
CogAI: Public interest consideration is a necessary condition for granting injunction
Public interest consideration is a necessary CogAI condition for granting injunction
10 Summary judgment
10(1) Summary judgment
The court may give judgment for the defendant if the court is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings.
The court is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings.
The court may give judgment for the defendant
Satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings
If the court is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings, then the court may give judgment for the defendant
10(2) Summary judgment
11 Damages
entries-found-privacy-act-1988.pdf, p.413
11(1) Damages
Court may award damages to the plaintiff.
11(2) Damages
Prohibition of awarding aggravated damages
11(3) Damages
Court may award damages for emotional distress.
Court must award damages for emotional distress.
11(4) Damages
Court may award exemplary damages in exceptional circumstances.
11(5) Damages
$478,550 or the maximum amount of damages for non-economic loss that may be awarded in defamation proceedings under an Australian law
Temporal relation between limits on damages
$478,550 and the maximum amount of damages for non-economic loss that may be awarded in defamation proceedings under an Australian law
11(6) Damages
Court may consider certain factors when determining damages.
12 Other remedies
entries-found-privacy-act-1988.pdf, p.414
12(1) Other remedies
Court may grant additional remedies in circumstances.
12(2) Other remedies
Remedies for invasion of privacy may include an account of profits, injunction, apology order, correction order, destruction or delivery up of material, and declaration that the defendant has seriously invaded the plaintiff's privacy.
The state must provide remedies for invasion of privacy.
...the defendant has seriously invaded the plaintiff's privacy.
13 The effect of an apology on liability
Apology does not constitute an admission of fault or liability in invasion of privacy cases.
Apology excludes admission of fault or liability.
Apology made by defendant in connection with invasion of privacy.
14 When proceedings must be commenced
entries-found-privacy-act-1988.pdf, p.415
14(1) When proceedings must be commenced
Must commence proceedings within a certain timeframe after becoming aware of the invasion of privacy.
Obligation to commence proceedings within a certain timeframe.
Temporal relationship between commencement and awareness of invasion of privacy.
...within 1 year after the day on which the plaintiff became aware...
...or within 3 years after the invasion of privacy occurred.
Temporal interval for commencement of proceedings.
14(2) When proceedings must be commenced
Plaintiff may apply for an order to commence proceedings before a specified day.
14(3) When proceedings must be commenced
Court may make order if plaintiff did not reasonably commence proceedings.
If plaintiff did not reasonably commence proceedings, court must make order.
14(4) When proceedings must be commenced
Commencement of proceedings within 6 years after invasion of privacy
Obligation to commence proceedings within time limit
The day specified in the order must not be later than 6 years after the day on which the invasion of privacy occurred.
Proceedings must be commenced within 6 years after invasion of privacy
Temporal interval within which proceedings must be commenced
Proceedings must be commenced within a temporal interval of 6 years after invasion of privacy
Temporal trace of proceedings commencement
Proceedings commence within a temporal trace of 6 years after invasion of privacy
Diffusion of information about proceedings commencement
Information about proceedings commencement is diffused within a temporal interval of 6 years after invasion of privacy
Artificial intelligence application in proceedings commencement
Artificial intelligence is applied in proceedings commencement within a temporal interval of 6 years after invasion of privacy
15 Journalists etc.
entries-found-privacy-act-1988.pdf, p.416
15(1) Journalists etc.
Exempts journalists and their assistants from the Schedule's provisions regarding invasion of privacy.
Exempts journalists and their assistants from the Schedule's provisions.
The Schedule does not apply to an invasion of privacy by any of...
Journalists and their assistants are exempt from the Schedule's provisions.
Exempts journalists and their assistants during the collection, preparation for publication or publication of journalistic material.
(1) This Schedule does not apply to an invasion of privacy by any of...
The exemption applies during the collection, preparation for publication or publication of journalistic material.
Exempts journalists and their assistants during the diffusion of information.
The exemption applies during the diffusion of information.
Exempts journalists and their assistants during the processing of information.
The exemption applies during the processing of information.
15(1A) Journalists etc.
Exemption for journalistic material from invasion of privacy
Exempts publication or distribution of journalistic material from invasion of privacy
15(2) Journalists etc.
Journalist must adhere to standards of professional conduct or a code of practice.
15(3) Journalists etc.
Material is journalistic material if it has the character of news, current affairs or a documentary.
Defines the scope of journalistic material
Material consists of commentary or opinion on, or analysis of, news, current affairs or a documentary.
It has the character of news, current affairs or a documentary.
Describes the temporal scope of journalistic material
(3) Material is journalistic material if it: (a) has the character of news, current affairs or a documentary; or (b) consists of commentary or opinion on, or analysis of, news, current affairs or a documentary; or (c) consists of editorial content relating to news, current affairs or a documentary.
It is journalistic material during the specified conditions.
It is journalistic material until the specified conditions are met.
Describes the condition for material to be considered journalistic
It is journalistic material if the specified conditions are met.
Describes the relationship between material and journalistic material
15(4) Journalists etc.
Journalist's invasion of privacy is immaterial to standards or code of practice.
Invasion of privacy is an obligation regardless of standards or code.
It is immaterial whether the invasion of privacy breaches the standards or the code of practice to which the journalist is subject.
16 Agencies and State and Territory authorities (other than
Exemption from Schedule application for invasion of privacy in good faith
entries-found-privacy-act-1988.pdf, p.417
State, Territory authority (other than intelligence agency or law enforcement body) must provide exemption
16A Staff members of agencies or State and Territory authorities
Good faith invasion of privacy is excused for agency functions.
Good faith invasion of privacy is excused.
Staff member invades individual's privacy in good faith.
Agency function or power is not affected.
16B Law enforcement bodies
Exemption from Schedule 2 Statutory Tort for Serious Invasions of Privacy
17 Intelligence agencies
entries-found-privacy-act-1988.pdf, p.418
18 Persons under 18
Exemption for minors from privacy invasion
19 Single publication rule
entries-found-privacy-act-1988.pdf, p.419
19(1) Single publication rule
Prohibits subsequent publication of substantially the same information in a materially different manner.
(a) a publisher publishes information that relates to an individual to the public (the first publication); and (b) the publisher or an associate of the publisher subsequently publishes (whether or not to the public) information that is substantially the same (the subsequent publication); and (c) the manner of the subsequent publication is not materially different from the manner of the first publication.
(1) This clause applies if: (a) a publisher publishes information that relates to an individual to the public (the first publication); and (b) the publisher or an associate of the publisher subsequently publishes (whether or not to the public) information that is substantially the same (the subsequent publication); and (c) the manner of the subsequent publication is not materially different from the manner of the first publication.
Defines a temporal interval for 'subsequent publication' based on the definition of 'materially different'.
(c) the manner of the subsequent publication is not materially different from the manner of the first publication.
The subsequent publication overlaps with the first publication in terms of time.
Defines a temporal relationship for 'subsequent publication' based on the definition of 'materially different'.
The subsequent publication will eventually be materially different from the first publication.
Defines a relationship between 'subsequent publication' and 'materially different'.
The subsequent publication diffuses into the first publication.
The CogAI recognizes that the subsequent publication is materially different from the first publication.
19(2) Single publication rule
Invasion of privacy occurs on the day of first publication.
Invasion of privacy takes effect on the day of first publication.
(2) If an invasion of the individual’s privacy consists of the first publication or the subsequent publication, the invasion of privacy is taken to occur on the day of the first publication for the purposes of this Schedule.
The invasion of privacy occurs on the day of first publication.
The invasion of privacy occurs between the first and subsequent publications.
The invasion of privacy is a recurring trace that occurs between the first and subsequent publications.
This provision diffuses to other sections of the schedule.
This provision applies to cognitive artificial agents.
19(3) Single publication rule
Court may consider level of prominence and extent of subsequent publication when determining material difference in manner.
Court may consider certain factors when determining material difference.
Court considers temporal intervals of publication.
(3) In determining whether the manner of the subsequent publication is materially different from the manner of the first publication, the court may have regard to:
19(4) Single publication rule
Definition of associate for single publication rule
associate is defined as an employee, contractor, associated entity, or employee of an associated entity
The definition applies to employees, contractors, associated entities, and employees of associated entities
20 Deceased persons
entries-found-privacy-act-1988.pdf, p.420
20(1) Deceased persons
No action can be asserted, continued or enforced under this Schedule in relation to an invasion of privacy by a deceased person.
Prohibition on asserting, continuing or enforcing an action
(1) A person (including a personal representative of a deceased person) cannot assert, continue or enforce an action under this Schedule in relation to:
(1) A person (including a personal representative of a deceased person)
20(2) Deceased persons
Court discretion to determine costs for discontinued proceedings.
21 Saving of other laws and remedies
This Schedule is not intended to exclude or limit the concurrent operation of any law
22 Intervention of Information Commissioner
The Information Commissioner may intervene in proceedings.
23 Jurisdiction
23(1) Jurisdiction
Jurisdiction is conferred on the Federal Circuit and Family Court of Australia (Division 2) in relation to matters arising under this Schedule.
The Federal Circuit and Family Court of Australia (Division 2) has jurisdiction in relation to matters arising under this Schedule.
Jurisdiction is conferred on the Federal Circuit and Family Court of Australia (Division 2) during the period when this Schedule applies.
State courts and the Federal Court of Australia are excluded from jurisdiction in relation to matters arising under this Schedule.
The Federal Circuit and Family Court of Australia (Division 2) is included in the jurisdiction conferred on the Federal Circuit and Family Court of Australia.
23(2) Jurisdiction
Jurisdiction is conferred on the courts of the Territories.
23(3) Jurisdiction
Jurisdiction is conferred under subclause (2): only so far as the Constitution permits; and within the limits (other than limits of locality) of the jurisdiction of the court.
14 Dec 1988
entries-found-privacy-act-1988.pdf, p.425
1 Jan 1989 (s 2 and
17 Jan 1990
22 Oct 1990
24 Dec 1990
12 Sept 1991
11 Dec 1992
Data-matching Program (Assistance and Tax) Act
23 Jan 1991
Conditional commencement of Crimes Legislation Amendment Act 1991
Requires relation between identifiable temporal intervals for conditional commencement
4 Mar 1991
Conditional commencement of Industrial Relations Legislation Amendment Act 1991
27 June 1991
13 Dec 1991
Conditional commencement of Law and Justice Legislation Amendment Act (No. 4) 1992
entries-found-privacy-act-1988.pdf, p.426
Conditional commencement specified in s 2(13)
7 Dec 1992
9 June 1993
18 Jan 1994
23 June 1994
29 June 1994
1 July 1994 (s 2(1) and
19 Dec 1994
Human Rights Legislation Amendment Act 1995
Imposes a duty on the State to amend human rights legislation
28 June 1995
Conditional commencement of Statute Law Revision Act 1996
25 Oct 1996
Law and Justice Legislation Amendment Act 1997
17 Apr 1997
18 June 1997
entries-found-privacy-act-1988.pdf, p.427
6 July 2005
18 June 1997 (s 2(1)
23 Mar 2006
29 June 1998
1 July 1998 (s 2(2))
17 June 1999
11 Nov 1999
Australian Security Intelligence Organisation Legislation Amendment Act 1999
10 Dec 1999
29 Feb 2000
entries-found-privacy-act-1988.pdf, p.428
8 July 2009
Australian Federal Police Legislation Amendment Act 2000
7 Mar 2000
Privacy Amendment (Private Sector) Act 155, 2000
21 Dec 2000
6 Apr 2001
Requires s 4(1), (2) and Sch 40 items 1–9, 11–13
24 May 2001
28 June 2001
Amendment of section 4–14 and Schedule 3
entries-found-privacy-act-1988.pdf, p.429
27 Nov 2003
Conditional commencement of National Crime Authority Legislation Amendment Act 2001
1 Oct 2001
Abolition of Compulsory Age Retirement (Statutory Officeholders) Act 2001
Prohibits compulsory age retirement for statutory officeholders
Establishment of Australian Crime Commission
10 Dec 2002
17 Dec 2003
17 June 2004 (s 2(1)
21 Apr 2004
21 Apr 2004 (s 2)
Administrative Appeals Tribunal Amendment Act 2005
1 Apr 2005
Conditional commencement of Intelligence Services Legislation Amendment Act 2005
entries-found-privacy-act-1988.pdf, p.430
4 Nov 2005
6 Apr 2006
Amendment of Statute Law Revision Act 2008
3 July 2008
National Health and Medical Research Council Amendment Act 50, 2006
9 June 2006
1 July 2006 (s 2(1)
30 June 2006
14 Sept 2006
Privacy Legislation Amendment (Emergencies and Disasters) Act 2006
6 Dec 2006
12 Dec 2006
entries-found-privacy-act-1988.pdf, p.431
Quarantine Amendment (Commission of Inquiry) Act 2007
24 Sept 2007
24 Sept 2007 (s 2)
31 Oct 2008
1 Nov 2008 (s 2)
Equal treatment in Commonwealth laws—General law reform
Same-sex relationships are equal to others
Commonwealth laws must treat same-sex relationships equally
The law reform must have occurred after the previous law
9 Dec 2008
Customs Legislation Amendment (Name Change) Act 2009
22 May 2009
23 May 2009 (s 2)
State referral and consequential amendments
25 June 2009
1 July 2009 (s 2(1)
Discrimination and Other Human Rights Legislation Amendment Act 2009
8 Oct 2009
14 Dec 2009
entries-found-privacy-act-1988.pdf, p.432
Item 9 of Crimes Legislation Amendment (Serious and Organised Crime) Act (No. 2) 2010
19 Feb 2010
Conditional commencement of Statute Law Revision Act 2010
1 Mar 2010
Freedom of Information Amendment (Reform) Act 2010
Classifies the Act as a legislative provision
31 May 2010
28 June 2010
29 June 2010 (s 2(1)
10 Dec 2010
Tax Laws Amendment (Confidentiality of Taxpayer Information) Act 2010
Imposes a duty on the State to protect taxpayer information
16 Dec 2010
2 Mar 2011
Conditional commencement of Statute Law Revision Act 2011
entries-found-privacy-act-1988.pdf, p.433
22 Mar 2011
8 Apr 2011
27 June 2011
Combating the Financing of People Smuggling and Other Measures Act 2011
28 June 2011
28 June 2011 (s 2(1)
4 Apr 2012
Conditional commencement of Telecommunications Interception and Other Legislation Amendment (State Bodies) Act 2012 on 5 Apr 2012.
27 June 2012
Freedom of Information Amendment (Parliamentary Budget Office) Act 2012
4 Dec 2012
The commencement occurs during the period from 4 December 2012 to 31 December 2012.
The commencement of the Act occurs during the period from 4 December 2012 to 31 December 2012.
Implication of commencement on application
The commencement of the Act implies its application.
12 Dec 2012
entries-found-privacy-act-1988.pdf, p.434
25 Feb 2015
14 Feb 2013
1 July 2013 (s 2(1)
14 Mar 2013
2 Oct 2014
13 Apr 2015
entries-found-privacy-act-1988.pdf, p.435
Items 1 and 3 of Schedule 1, items 7–12.
20 May 2015
30 Oct 2017
26 May 2015
23 Mar 2016
16 June 2015
entries-found-privacy-act-1988.pdf, p.436
23 Aug 2017
10 Sept 2015
Crimes Legislation Amendment (Powers, Offences and Other Measures) Act 2015
26 Nov 2015
Health Legislation Amendment (eHealth) Act 2015
Definition of Defence Legislation Amendment (First Principles) Act 2015
2 Dec 2015
1 July 2016 (s 2(1)
11 Feb 2016
Item 6 of Courts Administration Legislation Amendment Act 2016
18 Mar 2016
5 May 2016
entries-found-privacy-act-1988.pdf, p.437
23 Sept 2016
Law Enforcement Legislation Amendment (State Bodies and Other Measures) Act 2016
30 Nov 2016
Schedule 1 (items 1, 56–58): 1 December 2016 (s 2(1) items 2, 4)
22 Feb 2017
Public Governance and Resources Legislation Amendment Act (No. 1) 92, 2017
Regulatory Powers (Standardisation Reform) Act 2017
6 Nov 2017
Establishment of the Australian Signals Directorate Act 2018
11 Apr 2018
10 Dec 2018
Imposes a duty on Treasury Laws Amendment (Consumer Data Right) Act 2019
entries-found-privacy-act-1988.pdf, p.438
12 Aug 2019
Amendment of Data-matching and Other Matters Act 2019
12 Dec 2019
Commencement of Interactive Gambling Amendment (National Self-exclusion Register) Act 2019
12 Dec
Amendment of Australian Sports Anti-Doping Authority Amendment (Sport Integrity Australia) Act 2020
Identifies temporal interval for commencement
6 Mar 2020
Commences on 1 July 2020 for specified items in Schedule 4
15 May
15 Dec
Conditional commencement of Territories Legislation Amendment Act 2020
entries-found-privacy-act-1988.pdf, p.439
17 Dec
17 June 2021 (s 2(1)
Mandatory Credit Reporting and Other Measures
16 Feb
1 July 2022 (s 2(1)
1 Mar 2021
Surveillance Legislation Amendment (Identify and Disrupt) Act 2021
3 Sept
31 Mar
Consequential and Transitional Provisions
entries-found-privacy-act-1988.pdf, p.440
1 July 2023 (s 2(1)
13 Sept
Conditional commencement of Inspector-General of Intelligence and Security and Other Legislation Amendment (Modernisation) Act 2023
Conditionally commenced on 14 Sept 2023 (s 2(1) item 8)
Requires an ordered or recurring trace for conditional commencement
Classifies the legal effect as Undertaking
No explicit duty, ban conduct, grant permission, or create a right
20 Sept
Conditional commencement of Statute Law Amendment (Prescribed Forms and Other Updates) Act 2023
Conditional commencement of National Security Legislation Amendment (Comprehensive Review and Other Measures No. 3) Act 2024
21 May
30 May
Conditional commencement of the Administrative Review Tribunal (Consequential and Transitional Provisions No. 2) Act 2024
entries-found-privacy-act-1988.pdf, p.441
Requires temporal intervals for commencement
31 May
Mandatory commencement of Privacy and Other Legislation Amendment Act 2024
10 Dec
Strengthening Oversight of the National Intelligence Community Act 2025
Imposes a duty on the government to strengthen oversight of the National Intelligence Community
4 Dec 2025