{"id":"tas:act-2004-046","name":"Personal Information Protection Act 2004","slug":"personal-information-protection-act-2004","collection":"act","jurisdiction":"tas","status":"in_force","isInForce":true,"actNumber":"46 of 2004","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":176915,"registerId":"tas-tas:act-2004-046-current","compilationNumber":null,"startDate":"2026-04-05","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"# Part 1 Preliminary","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Short title","content":"### 1 Short title\n\n> This Act may be cited as the [Personal Information Protection Act 2004](/view/html/inforce/2026-04-12/act-2004-046) .","sortOrder":1},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"### 2 Commencement\n\n> This Act commences on a day to be proclaimed.","sortOrder":2},{"sectionNumber":"3","sectionType":"section","heading":"Interpretation","content":"### 3 Interpretation\n\n> In this Act –\n> \n> > ***basic personal information*** means the name, residential address, postal address, date of birth and gender of an individual;\n> \n> > ***complaint*** means a complaint made under [Part 4](#HP4@EN) ;\n> \n> > ***employee information*** includes personal information about an individual who is, was or applies to be an employee relating to –\n> > \n> > > > (a) the selection, employment, training, discipline or resignation of the individual; or\n> > > \n> > > > (b) the termination of the employment of the individual; or\n> > > \n> > > > (c) the terms and conditions of employment of the individual; or\n> > > \n> > > > (d) the performance or conduct of the individual in carrying out the duties or functions of employment; or\n> > > \n> > > > (e) the suitability of the individual for appointment or for employment held by the individual; or\n> > > \n> > > > (f) the hours of employment of the individual; or\n> > > \n> > > > (g) the salary or wages of the individual; or\n> > > \n> > > > (h) the membership of the individual of a professional association, trade association or trade union; or\n> > > \n> > > > (i) the recreation leave, long service leave, sick leave, personal leave, maternity leave, paternity leave or other leave of the individual; or\n> > > \n> > > > (j) information that supports employment statistical reporting and personnel planning; or\n> > > \n> > > > (k) information in relation to employees as required by law;\n> \n> > ***employment*** includes appointment or engagement to an office or position;\n> \n> > ***health information*** means –\n> > \n> > > > (a) personal information or opinion about –\n> > > > \n> > > > > > (i) the physical, mental or psychological health at any time of an individual; or\n> > > > > \n> > > > > > (ii) a disability at any time of an individual; or\n> > > > > \n> > > > > > (iii) an individual's expressed wishes about the future provision of health services to him or her; or\n> > > > > \n> > > > > > (iv) a health service provided, or to be provided, to an individual; or\n> > > \n> > > > (b) other personal information collected to provide, or in providing, a health service; or\n> > > \n> > > > (c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or\n> > > \n> > > > (d) genetic information about an individual that is or may be predictive of the health at any time of the individual or any of his or her descendants –\n> > \n> > other than prescribed information, a prescribed class of information or information contained in a prescribed class of documents;\n> \n> > ***health service*** means an activity, other than a prescribed activity, performed in relation to an individual that is intended or claimed by the individual or the person performing it –\n> > \n> > > > (a) to assess, maintain or improve the individual's health; or\n> > > \n> > > > (b) to diagnose the individual's illness, injury or disability; or\n> > > \n> > > > (c) to treat the individual's illness, injury or disability or suspected illness, injury or disability; or\n> > > \n> > > > (d) to dispense on prescription a drug or medical preparation; or\n> > > \n> > > > (e) to provide a disability service, palliative care service or aged care service; or\n> > > \n> > > > (f) to provide a prescribed service or a prescribed class of service in conjunction with any activity referred to in [paragraph (a)](#GS3@Nd37335360613426@Hpa@EN) , [(b)](#GS3@Nd37335360613426@Hpb@EN) , [(c)](#GS3@Nd37335360613426@Hpc@EN) , [(d)](#GS3@Nd37335360613426@Hpd@EN) or [(e)](#GS3@Nd37335360613426@Hpe@EN) ;\n> \n> > ***identifier*** means anything assigned by a personal information custodian to identify an individual for its operations, other than a name or ABN as defined in the [A New Tax System (Australian Business Number) Act 1999](/view/html/inforce/2026-04-12/act-2004-046) of the Commonwealth;\n> \n> > ***law enforcement agency*** means any of the following:\n> > \n> > > > (a) a police force or police service of –\n> > > > \n> > > > > > (i) the Commonwealth; or\n> > > > > \n> > > > > > (ii) this State; or\n> > > > > \n> > > > > > (iii) any other State or a Territory of the Commonwealth; or\n> > > > > \n> > > > > > (iv) any country;\n> > > \n> > > > (b) the Australian Crime Commission;\n> > > \n> > > > (c) a commission established or appointed under any Act of this State or any other State or a Territory of the Commonwealth or of the Commonwealth to investigate matters relating to criminal activity generally or of a specified class;\n> > > \n> > > > (d) a personal information custodian responsible for the performance of functions relating to –\n> > > > \n> > > > > > (i) the prevention, detection, investigation or prosecution of criminal offences or other offences that impose a penalty or sanction; or\n> > > > > \n> > > > > > (ii) the management of property seized or restrained under a law relating to the confiscation of the proceeds of crime or the enforcement of such a law;\n> > > \n> > > > (e) an agency established under the [Public Service Act 1999](/view/html/inforce/2026-04-12/act-2004-046) of the Commonwealth responsible for the performance of functions relating to –\n> > > > \n> > > > > > (i) the prevention, detection, investigation or prosecution of criminal offences or other offences that impose a penalty or sanction; or\n> > > > > \n> > > > > > (ii) the management of property seized or restrained under a law relating to the confiscation of the proceeds of crime or the enforcement of such a law;\n> > > \n> > > > (f) a personal information custodian or an individual or body contracted by a personal information custodian responsible for the execution or implementation of an order, decision or determination of a court or tribunal;\n> > > \n> > > > (g) a personal information custodian –\n> > > > \n> > > > > > (i) responsible for the issue of warrants; or\n> > > > > \n> > > > > > (ii) that provides correctional services; or\n> > > > > \n> > > > > > (iii) responsible for decisions relating to the release of persons from custody;\n> > > \n> > > > (h) a personal information custodian responsible for the protection of public revenue under any Act;\n> > > \n> > > > (i) a personal information custodian responsible for the administration or performance of a function under a law that imposes a penalty or sanction;\n> > > \n> > > > (j) the Attorney-General;\n> > > \n> > > > (k) the Solicitor-General appointed and holding office under the [Solicitor-General Act 1983](/view/html/inforce/2026-04-12/act-1983-013) ;\n> > > \n> > > > (l) the Director of Public Prosecutions appointed and holding office under the [Director of Public Prosecutions Act 1973](/view/html/inforce/2026-04-12/act-1973-011) ;\n> > > \n> > > > (la) [*\\[Section 3 Amended by No. 7 of 2024, s. 13, Applied:30 Aug 2024\\]*](/view/html/inforce/2024-08-30/act-2024-007#GS13@EN) the State Litigator;\n> > > \n> > > > (m) the Ombudsman;\n> > > \n> > > > (ma) [*\\[Section 3 Amended by No. 42 of 2013, s. 52, Applied:01 Jan 2014\\]*](/view/html/inforce/2014-01-01/act-2013-042#GS52@EN) the Anti-Discrimination Commissioner appointed under the [Anti-Discrimination Act 1998](/view/html/inforce/2026-04-12/act-1998-046) ;\n> > > \n> > > > (n) a prescribed organisation;\n> \n> > [*\\[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS5@Hpa@EN) ***law enforcement information*** means information referred to in [section 30](/view/html/inforce/2026-04-12/act-2009-070#GS30@EN) of the [Right to Information Act 2009](/view/html/inforce/2026-04-12/act-2009-070) ;\n> \n> > ***Ombudsman*** means the person appointed and holding office under the [Ombudsman Act 1978](/view/html/inforce/2026-04-12/act-1978-082) ;\n> \n> > ***personal information*** means any information or opinion in any recorded format about an individual –\n> > \n> > > > (a) whose identity is apparent or is reasonably ascertainable from the information or opinion; and\n> > > \n> > > > (b) who is alive or has not been dead for more than 25 years;\n> \n> > ***personal information contract*** means a contract between a personal information custodian and another person (whether a personal information custodian or not) relating to the collection, use or storage of personal information;\n> \n> [*\\[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS5@Hpb@EN)\n> \n> > [*\\[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS5@Hpb@EN) ***personal information custodian*** means any of the following:\n> > \n> > > > (a) a public authority;\n> > > \n> > > > (b) any body, organisation or person who has entered into a personal information contract relating to personal information;\n> > > \n> > > > (c) a prescribed body;\n> \n> > ***personal information protection principles*** means the personal information protection principles referred to in [section 16](#GS16@EN) ;\n> \n> > [*\\[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS5@Hpc@EN) ***public authority*** has the same meaning as in the [Right to Information Act 2009](/view/html/inforce/2026-04-12/act-2009-070) ;\n> \n> > ***public information*** means any personal information that is –\n> > \n> > > > (a) contained in a publicly available record or publication; or\n> > > \n> > > > (b) taken to be public information under any Act;\n> \n> [*\\[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS5@Hpd@EN)\n> \n> > ***record*** means a record in any format;\n> \n> > ***sensitive information*** means –\n> > \n> > > > (a) personal information or an opinion relating to personal information about an individual's –\n> > > > \n> > > > > > (i) racial or ethnic origin; or\n> > > > > \n> > > > > > (ii) political opinions; or\n> > > > > \n> > > > > > (iii) membership of a political association; or\n> > > > > \n> > > > > > (iv) religious beliefs or affiliations; or\n> > > > > \n> > > > > > (v) philosophical beliefs; or\n> > > > > \n> > > > > > (vi) membership of a professional or trade association; or\n> > > > > \n> > > > > > (vii) membership of a trade union; or\n> > > > > \n> > > > > > (viii) sexual preferences or practices; or\n> > > > > \n> > > > > > (ix) criminal record; and\n> > > \n> > > > (b) [*\\[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS5@Hpe@EN) health information about an individual;\n> \n> > [*\\[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS5@Hpf@EN) ***State Archivist*** has the same meaning as in the [Archives Act 1983](/view/html/inforce/2026-04-12/act-1983-076) .","sortOrder":3},{"sectionNumber":"3A","sectionType":"section","heading":"Reference to personal information in  Part 3A  and  Schedule 1","content":"### 3A Reference to personal information in  Part 3A  and  Schedule 1\n\n> [*\\[Section 3A Inserted by No. 71 of 2009, s. 6, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS6@EN) In [Part 3A](#HP3A@EN) and clause 6 of [Schedule 1](#JS1@EN) , a reference to personal information of a person includes the personal information of a deceased person, and rights given by this Act in respect of the personal information of a person are, where the person is a deceased person, to be taken to be rights that may be exercised in respect of that personal information by the next-of-kin of that person.","sortOrder":4},{"sectionNumber":"3B","sectionType":"section","heading":"Access to information of a medical or psychiatric nature","content":"### 3B Access to information of a medical or psychiatric nature\n\n> [*\\[Section 3B Inserted by No. 71 of 2009, s. 6, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS6@EN)\n> \n> > (1)  [*\\[Section 3B Subsection (1) amended by No. 3 of 2010, Sched. 1, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2010-003#JS1@Ja49@GC1@Hpa@EN) If –\n> > \n> > > > (a) a request is made to a personal information custodian for access to information of a medical or psychiatric nature concerning the person making the request; and\n> > > \n> > > > (b) it appears to the personal information custodian that the provision to that person of access to the information might be prejudicial to the physical or mental health or wellbeing of that person –\n> > \n> > the personal information custodian may direct that access to the information must not be provided to the person who made the request but must instead be provided to a medical practitioner nominated by that person.\n> \n> > (2)  [*\\[Section 3B Subsection (2) omitted by No. 3 of 2010, Sched. 1, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2010-003#JS1@Ja49@GC1@Hpb@EN) .  .  .  .  .  .  .  .","sortOrder":5},{"sectionNumber":"4","sectionType":"section","heading":"Relationship of Act to other laws","content":"### 4 Relationship of Act to other laws\n\n> If a provision of this Act is inconsistent with a provision made by or under any other Act –\n> \n> > > (a) that other provision prevails; and\n> > \n> > > (b) the provision of this Act has no effect to the extent of the inconsistency.","sortOrder":6},{"sectionNumber":"5","sectionType":"section","heading":"Act binds Crown","content":"### 5 Act binds Crown\n\n> > (1)  This Act binds the Crown in right of Tasmania and, so far as the legislative power of Parliament permits, in all its other capacities.\n> \n> > (2)  The Crown in any of its capacities is not liable to be prosecuted for an offence under this Act.","sortOrder":7},{"sectionNumber":"Part 2","sectionType":"part","heading":"Application and Exemptions","content":"# Part 2 Application and Exemptions","sortOrder":8},{"sectionNumber":"Division 1","sectionType":"division","heading":"Application","content":"## Division 1 Application","sortOrder":9},{"sectionNumber":"6","sectionType":"section","heading":"Application of personal information protection principles","content":"### 6 Application of personal information protection principles\n\n> > (1)  [Clauses 1](#JS1@GC1@EN) , [7](#JS1@GC7@EN) , [8](#JS1@GC8@EN) and [10](#JS1@GC10@EN) of [Schedule 1](#JS1@EN) apply only in relation to information collected after the commencement of this Act.\n> \n> > (2)  [Clauses 2](#JS1@GC2@EN) ,  [3](#JS1@GC3@EN) , [4](#JS1@GC4@EN) , [5](#JS1@GC5@EN) , [6](#JS1@GC6@EN) and [9](#JS1@GC9@EN) of [Schedule 1](#JS1@EN) apply in relation to information collected before or after the commencement of this Act.","sortOrder":10},{"sectionNumber":"Division 2","sectionType":"division","heading":"Exemptions","content":"## Division 2 Exemptions","sortOrder":11},{"sectionNumber":"7","sectionType":"section","heading":"Courts and tribunals","content":"### 7 Courts and tribunals\n\n> The following are exempt from the provisions of this Act:\n> \n> > > (a) a court or tribunal in the performance or exercise of judicial or quasi-judicial functions or powers;\n> > \n> > > (b) the holder of a judicial or quasi-judicial office or other office pertaining to a court or tribunal in the capacity of the holder of that office;\n> > \n> > > (c) the Solicitor-General appointed and holding office under the [Solicitor-General Act 1983](/view/html/inforce/2026-04-12/act-1983-013) ;\n> > \n> > > (d) any person employed in relation to the functions of the Solicitor-General;\n> > \n> > > (e) the Director of Public Prosecutions appointed and holding office under the [Director of Public Prosecutions Act 1973](/view/html/inforce/2026-04-12/act-1973-011) ;\n> > \n> > > (f) any person employed in relation to the functions of the Director of Public Prosecutions;\n> > \n> > > (fa) [*\\[Section 7 Amended by No. 7 of 2024, s. 14, Applied:30 Aug 2024\\]*](/view/html/inforce/2024-08-30/act-2024-007#GS14@EN) the State Litigator;\n> > \n> > > (fb) [*\\[Section 7 Amended by No. 7 of 2024, s. 14, Applied:30 Aug 2024\\]*](/view/html/inforce/2024-08-30/act-2024-007#GS14@EN) any person employed in relation to the functions of the State Litigator;\n> > \n> > > (g) the registry or other office of a court or tribunal in relation to any matter relating to the judicial or quasi-judicial functions of that court or tribunal;\n> > \n> > > (ga) [*\\[Section 7 Amended by No. 67 of 2009, s. 125, Applied:01 Oct 2010\\]*](/view/html/inforce/2010-10-01/act-2009-067#GS125@EN) the Integrity Commission;\n> > \n> > > (h) any person employed in such a registry or other office in relation to any such matter.","sortOrder":12},{"sectionNumber":"8","sectionType":"section","heading":"Public information","content":"### 8 Public information\n\n> This Act does not apply to public information.","sortOrder":13},{"sectionNumber":"9","sectionType":"section","heading":"Law enforcement information","content":"### 9 Law enforcement information\n\n> [*\\[Section 9 Amended by No. 37 of 2005, s. 4, Applied:05 Sep 2005\\]*](/view/html/inforce/2005-09-05/act-2005-037#GS4@EN) [Clauses 1(3)](#JS1@GC1@Gc3@EN) , [(4)](#JS1@GC1@Gc4@EN) and [(5)](#JS1@GC1@Gc5@EN) , [2(1)](#JS1@GC2@Gc1@EN) , [5(3)(c)](#JS1@GC5@Gc3@Hpc@EN) , [7](#JS1@GC7@EN) , [9](#JS1@GC9@EN) and [10(1)](#JS1@GC10@Gc1@Hpa@EN) of [Schedule 1](#JS1@EN) do not apply to any law enforcement information collected or held by a law enforcement agency if it considers that non-compliance is reasonably necessary –\n> \n> > > (a) for the purpose of any of its functions or activities; or\n> > \n> > > (b) for the enforcement of laws relating to the confiscation of the proceeds of crime; or\n> > \n> > > (c) in connection with the conduct of proceedings in any court or tribunal.","sortOrder":14},{"sectionNumber":"10","sectionType":"section","heading":"Employee information","content":"### 10 Employee information\n\n> [Clauses 1(4)](#JS1@GC1@Gc4@EN) and [(5)](#JS1@GC1@Gc5@EN) , [7](#JS1@GC7@EN) and [10](#JS1@GC10@EN) of [Schedule 1](#JS1@EN) do not apply to any employee information.","sortOrder":15},{"sectionNumber":"11","sectionType":"section","heading":"Unsolicited information","content":"### 11 Unsolicited information\n\n> [Clause 1](#JS1@GC1@EN) of [Schedule 1](#JS1@EN) does not apply to unsolicited information received by a personal information custodian.","sortOrder":16},{"sectionNumber":"12","sectionType":"section","heading":"Use of basic information","content":"### 12 Use of basic information\n\n> A personal information custodian may use or disclose personal information about an individual for a purpose other than the primary purpose of collection without the individual's consent if –\n> \n> > > (a) [*\\[Section 12 Amended by No. 71 of 2009, s. 7, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS7@EN) it is a public authority; and\n> > \n> > > (b) the information is basic personal information; and\n> > \n> > > (c) the use or disclosure is reasonably necessary for the efficient storage and use of that information; and\n> > \n> > > (d) the information is only used by, or disclosed to, another public sector body.","sortOrder":17},{"sectionNumber":"12A","sectionType":"section","heading":"Disclosure of information to Solicitor-General, &c.","content":"### 12A Disclosure of information to Solicitor-General, &c.\n\n> [*\\[Section 12A Inserted by No. 29 of 2017, Sched. 1, Applied:05 Sep 2017\\]*](/view/html/inforce/2017-09-05/act-2017-029#JS1@Ja9@GC1@EN) A personal information custodian may disclose to the following people personal information that is relevant for the purpose of obtaining legal advice:\n> \n> > > (a) the Solicitor-General appointed and holding office under the [Solicitor-General Act 1983](/view/html/inforce/2026-04-12/act-1983-013) ;\n> > \n> > > (b) any person employed in relation to the functions or duties of the Solicitor-General;\n> > \n> > > (c) the Director of Public Prosecutions appointed and holding office under the [Director of Public Prosecutions Act 1973](/view/html/inforce/2026-04-12/act-1973-011) ;\n> > \n> > > (d) any person employed in relation to the functions or duties of the Director of Public Prosecutions;\n> > \n> > > (da) [*\\[Section 12A Amended by No. 7 of 2024, s. 15, Applied:30 Aug 2024\\]*](/view/html/inforce/2024-08-30/act-2024-007#GS15@EN) the State Litigator;\n> > \n> > > (db) [*\\[Section 12A Amended by No. 7 of 2024, s. 15, Applied:30 Aug 2024\\]*](/view/html/inforce/2024-08-30/act-2024-007#GS15@EN) any person employed in relation to the functions or duties of the State Litigator;\n> > \n> > > (e) the Crown Solicitor for Tasmania appointed under the [State Service Act 2000](/view/html/inforce/2026-04-12/act-2000-085) ;\n> > \n> > > (f) any person employed in relation to the functions or duties of the Crown Solicitor.","sortOrder":18},{"sectionNumber":"13","sectionType":"section","heading":"Application for exemptions","content":"### 13 Application for exemptions\n\n> > (1)  A personal information custodian may apply to the Minister for an exemption from compliance with any or all provisions of this Act.\n> \n> > (2)  An application is to –\n> > \n> > > > (a) specify the provision or provisions to which the application relates; and\n> > > \n> > > > (b) specify the information or class or classes of information to which the application relates; and\n> > > \n> > > > (c) specify the personal information custodian or custodians or class or classes of personal information custodians to which the application applies; and\n> > > \n> > > > (d) specify the reasons for the exemption; and\n> > > \n> > > > (e) specify any public benefit involved; and\n> > > \n> > > > (f) specify any relevant law, code of practice or other instrument under which it proposes to operate; and\n> > > \n> > > > (g) include any other information the Minister determines.","sortOrder":19},{"sectionNumber":"14","sectionType":"section","heading":"Determination of exemption","content":"### 14 Determination of exemption\n\n> > (1)  The Minister may determine to –\n> > \n> > > > (a) approve an application if satisfied that the public benefit outweighs to a substantial degree the public benefit from compliance with the personal information protection principles; or\n> > > \n> > > > (b) refuse to approve the application if not so satisfied.\n> \n> > (2)  The Minister may approve an application subject to any conditions the Minister considers appropriate.\n> \n> > (3)  The Minister is to publish the determination and the details of the application in the *Gazette*.","sortOrder":20},{"sectionNumber":"15","sectionType":"section","heading":"Revocation of exemption","content":"### 15 Revocation of exemption\n\n> > (1)  The Minister may revoke a determination to approve an application for an exemption –\n> > \n> > > > (a) if satisfied that –\n> > > > \n> > > > > > (i) the reasons for granting that exemption no longer apply; or\n> > > > > \n> > > > > > (ii) [section 14(1)(a)](#GS14@Gs1@Hpa@EN) no longer applies; or\n> > > \n> > > > (b) at the request of the applicant.\n> \n> > (2)  The Minister is to publish the details of a revocation in the *Gazette*.","sortOrder":21},{"sectionNumber":"Part 3","sectionType":"part","heading":"Personal Information protection principles","content":"# Part 3 Personal Information protection principles","sortOrder":22},{"sectionNumber":"16","sectionType":"section","heading":"Personal information protection principles","content":"### 16 Personal information protection principles\n\n> The personal information protection principles that apply in Tasmania are those specified in [Schedule 1](#JS1@EN) .","sortOrder":23},{"sectionNumber":"17","sectionType":"section","heading":"Compliance with personal information protection principles","content":"### 17 Compliance with personal information protection principles\n\n> > (1)  A personal information custodian must comply with the personal information protection principles.\n> \n> > (2)  [Subsection (1)](#GS17@Gs1@EN) does not apply to anything done by a personal information custodian before the second anniversary of the commencement of this Act that is necessary for the performance of a contract entered into by the personal information custodian before the commencement of this Act.","sortOrder":24},{"sectionNumber":"Part 3A","sectionType":"part","heading":"Amendment of Personal Information","content":"# Part 3A Amendment of Personal Information","sortOrder":25},{"sectionNumber":"17A","sectionType":"section","heading":"Person may request amendment of information","content":"### 17A Person may request amendment of information\n\n> [*\\[Section 17A Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) If information of a person is held or used by a personal information custodian, the person can request the amendment of any part of that information if it is incorrect, incomplete, out of date or misleading.","sortOrder":26},{"sectionNumber":"17B","sectionType":"section","heading":"Form of request for amendment of information","content":"### 17B Form of request for amendment of information\n\n> [*\\[Section 17B Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) A request under [section 17A](#GS17A@EN) is to –\n> \n> > > (a) be in writing and addressed to the personal information custodian; and\n> > \n> > > (b) specify an address to which a notice under [section 17F](#GS17F@EN) is to be sent; and\n> > \n> > > (c) give particulars of the information the person believes is incomplete, incorrect, out of date or misleading; and\n> > \n> > > (d) specify the amendments that the person wants made to that information.","sortOrder":27},{"sectionNumber":"17C","sectionType":"section","heading":"Personal information custodian may amend information","content":"### 17C Personal information custodian may amend information\n\n> [*\\[Section 17C Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) If, following receipt of a request made under [section 17A](#GS17A@EN) , a personal information custodian decides to amend information, the personal information custodian may make the amendment by –\n> \n> > > (a) altering the information; or\n> > \n> > > (b) adding an appropriate notation to it.","sortOrder":28},{"sectionNumber":"17D","sectionType":"section","heading":"Notation to be added","content":"### 17D Notation to be added\n\n> [*\\[Section 17D Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) If a personal information custodian amends information by adding a notation to it, the notation must –\n> \n> > > (a) specify the way in which the information is incomplete, incorrect, out of date or misleading; and\n> > \n> > > (b) if the information is claimed to be out of date, set out the information required to bring it up to date.","sortOrder":29},{"sectionNumber":"17E","sectionType":"section","heading":"Time within which personal information custodian must notify claimant","content":"### 17E Time within which personal information custodian must notify claimant\n\n> [*\\[Section 17E Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) A personal information custodian must take all reasonable steps to enable a person to be notified of a decision on a request made under [section 17A](#GS17A@EN) as soon as practicable, but in any case not later than 20 working days after the request was received by or on behalf of the personal information custodian.","sortOrder":30},{"sectionNumber":"17F","sectionType":"section","heading":"Reasons to be given","content":"### 17F Reasons to be given\n\n> [*\\[Section 17F Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN)\n> \n> > (1)  If, in relation to a request made under [section 17A](#GS17A@EN) , a decision is made not to amend the information in the way requested, the personal information custodian that received the request must give the applicant written notice of the decision.\n> \n> > (2)  Notice given under [subsection (1)](#GS17F@Gs1@EN) is to –\n> > \n> > > > (a) state the reasons for the decision; and\n> > > \n> > > > (b) state the name and designation of the person who made the decision; and\n> > > \n> > > > (c) inform the applicant –\n> > > > \n> > > > > > (i) of the applicant's right to make a complaint about the decision; and\n> > > > > \n> > > > > > (ii) that the Ombudsman is the authority to whom a complaint can be made; and\n> > > > > \n> > > > > > (iii) of the time within which the complaint must be made.","sortOrder":31},{"sectionNumber":"17G","sectionType":"section","heading":"Requirement for notation","content":"### 17G Requirement for notation\n\n> [*\\[Section 17G Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) If a personal information custodian decides to refuse to amend information pursuant to a request made under [section 17A](#GS17A@EN) , the person who made the request may, at any time, by written notice, require the personal information custodian to add to the information a notation –\n> \n> > > (a) specifying the respects in which the information is claimed by the applicant to be incomplete, incorrect, out of date or misleading; and\n> > \n> > > (b) if the information is claimed to be out of date, setting out the information it is claimed is required to bring it up to date.","sortOrder":32},{"sectionNumber":"17H","sectionType":"section","heading":"Notice to be added to information","content":"### 17H Notice to be added to information\n\n> [*\\[Section 17H Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) If a notice is given to a personal information custodian under [section 17G](#GS17G@EN) , the personal information custodian must ensure –\n> \n> > > (a) that a notation as required by the notice is added to the information; and\n> > \n> > > (b) that, if the information to which the notation relates is disclosed to a person (including another personal information custodian), there is also furnished to that person a statement –\n> > > \n> > > > > (i) stating that the person to whom the information relates claims that it is incomplete, incorrect, out of date or misleading, as the case may be; and\n> > > > \n> > > > > (ii) giving particulars of the notation; and\n> > > > \n> > > > > (iii) if the personal information custodian considers it appropriate to do so, giving the reasons why the personal information custodian did not amend the information.","sortOrder":33},{"sectionNumber":"17I","sectionType":"section","heading":"How amendments to be made","content":"### 17I How amendments to be made\n\n> [*\\[Section 17I Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS8@EN) If a personal information custodian agrees to amend information in accordance with a request made under [section 17A](#GS17A@EN) , the amendment may take the form of a notation of the original document but no amendment is to be made that –\n> \n> > > (a) deletes or expunges the information which has been amended; or\n> > \n> > > (b) destroys the document –\n> \n> unless the State Archivist agrees.","sortOrder":34},{"sectionNumber":"Part 4","sectionType":"part","heading":"Complaints and Investigations","content":"# Part 4 Complaints and Investigations","sortOrder":35},{"sectionNumber":"18","sectionType":"section","heading":"Making of complaints","content":"### 18 Making of complaints\n\n> > (1)  A person may make a complaint to the Ombudsman in relation to a matter referred to in [subsection (2)](#GS18@Gs2@EN) if the person –\n> > \n> > > > (a) has raised the matter with the relevant personal information custodian; and\n> > > \n> > > > (b) is not satisfied with the response from the personal information custodian.\n> \n> > (2)  A complaint may be made by a person in relation to the alleged contravention by a personal information custodian of a personal information protection principle that applies to the person.\n> \n> > (3)  A complaint may be in writing or verbal, but the Ombudsman may require a verbal complaint to be put in writing.\n> \n> > (4)  The Ombudsman may –\n> > \n> > > > (a) require information about a complaint to be provided by the complainant in a particular manner or form; and\n> > > \n> > > > (b) require a complaint to be verified by statutory declaration.\n> \n> > (5)  [*\\[Section 18 Subsection (5) amended by No. 71 of 2009, s. 9, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS9@Hpa@EN) A complaint, other than a complaint about a decision to refuse a request to amend personal information made in accordance with [Part 3A](#HP3A@EN) , must be made within 6 months or any further period the Ombudsman may allow from the time the complainant first became aware of the matter which is the subject of the complaint.\n> \n> > (5A)  [*\\[Section 18 Subsection (5A) inserted by No. 71 of 2009, s. 9, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS9@Hpb@EN) A complaint about a decision to refuse a request to amend personal information made in accordance with [Part 3A](#HP3A@EN) must be made within 20 working days of the date on which the notice of the decision is given under [section 17F(1)](#GS17F@Gs1@EN) .\n> \n> > (6)  A complainant may amend or withdraw a complaint.","sortOrder":36},{"sectionNumber":"19","sectionType":"section","heading":"Preliminary assessment of complaints","content":"### 19 Preliminary assessment of complaints\n\n> > (1)  The Ombudsman may conduct a preliminary assessment of a complaint for the purpose of deciding whether to deal with the complaint.\n> \n> > (1A)  [*\\[Section 19 Subsection (1A) inserted by No. 29 of 2017, Sched. 1, Applied:05 Sep 2017\\]*](/view/html/inforce/2017-09-05/act-2017-029#JS1@Ja9@GC2@EN) If the Ombudsman has conducted a preliminary assessment under [subsection (1)](#GS19@Gs1@EN) , the Ombudsman may resolve the complaint without investigating it if, having regard to the nature and seriousness of the complaint, the Ombudsman believes the complaint may be resolved expeditiously.\n> \n> > (2)  The Ombudsman may decide not to deal with a complaint if satisfied that –\n> > \n> > > > (a) the complaint is frivolous, vexatious, lacking in substance or is not in good faith; or\n> > > \n> > > > (b) the subject matter of the complaint is trivial; or\n> > > \n> > > > (c) the subject matter of the complaint relates to a matter permitted or required under any law.\n> \n> > (3)  If the Ombudsman declines to deal with a complaint, the Ombudsman is to advise the complainant of the reasons for so declining.","sortOrder":37},{"sectionNumber":"20","sectionType":"section","heading":"Referral to other authorities","content":"### 20 Referral to other authorities\n\n> > (1)  [*\\[Section 20 Subsection (1) amended by No. 1 of 2016, Sched. 1, Applied:08 Apr 2016\\]*](/view/html/inforce/2016-04-08/act-2016-001#JS1@Ja3@GC1@Hpa@EN) The Ombudsman may refer a complaint for investigation or other action to any person, body or authority the Ombudsman considers appropriate in the circumstances.\n> \n> > (2)  The Ombudsman may only refer a complaint –\n> > \n> > > > (a) after appropriate consultation with the complainant and the relevant person, body or authority; and\n> > > \n> > > > (b) after taking their views into consideration.\n> \n> > (3)  [*\\[Section 20 Subsection (3) omitted by No. 1 of 2016, Sched. 1, Applied:08 Apr 2016\\]*](/view/html/inforce/2016-04-08/act-2016-001#JS1@Ja3@GC1@Hpb@EN) .  .  .  .  .  .  .  .","sortOrder":38},{"sectionNumber":"21","sectionType":"section","heading":"Dealing with complaints","content":"### 21 Dealing with complaints\n\n> > (1)  If the Ombudsman decides to deal with a complaint, the Ombudsman is to conduct any investigations in relation to the complaint in accordance with [Division 3](/view/html/inforce/2026-04-12/act-1978-082#HPIII@HD3@EN) of [Part III of the](/view/html/inforce/2026-04-12/act-1978-082#HPIII@EN) [Ombudsman Act 1978](/view/html/inforce/2026-04-12/act-1978-082) .\n> \n> > (2)  The Ombudsman may conduct an investigation into any general issue or matter under this Act.","sortOrder":39},{"sectionNumber":"22","sectionType":"section","heading":"Procedure on completion of investigation","content":"### 22 Procedure on completion of investigation\n\n> > (1)  If, on completion of an investigation of a complaint, the Ombudsman is of the opinion that a personal information custodian has contravened a personal information protection principle, the Ombudsman –\n> > \n> > > > (a) is to advise the complainant and the personal information custodian in writing of that opinion and the reasons on which it is based; and\n> > > \n> > > > (b) may make any recommendations the Ombudsman considers appropriate in relation to the subject matter of the complaint.\n> \n> > (2)  The Ombudsman is to give the Minister a copy of the advice and any recommendations.\n> \n> > (3)  The Minister is to table the advice and any recommendations in both Houses of Parliament within 5 sitting days of its receipt.","sortOrder":40},{"sectionNumber":"Part 5","sectionType":"part","heading":"Miscellaneous","content":"# Part 5 Miscellaneous","sortOrder":41},{"sectionNumber":"23","sectionType":"section","heading":"Regulations","content":"### 23 Regulations\n\n> The Governor may make regulations for the purpose of this Act.","sortOrder":42},{"sectionNumber":"24","sectionType":"section","heading":"Administration of Act","content":"### 24 Administration of Act\n\n> Until provision is made in relation to this Act by order under [section 4 of the](/view/html/inforce/2026-04-12/act-1990-004#GS4@EN) [Administrative Arrangements Act 1990](/view/html/inforce/2026-04-12/act-1990-004)  –\n> \n> > > (a) the administration of this Act is assigned to the Minister for Justice and Industrial Relations; and\n> > \n> > > (b) the department responsible to that Minister in relation to the administration of this Act is the Department of Justice.","sortOrder":43},{"sectionNumber":"SCHEDULE 1 - Personal Informat","sectionType":"part","heading":"SCHEDULE 1 - Personal Information Protection Principles","content":"# SCHEDULE 1 - Personal Informat SCHEDULE 1 - Personal Information Protection Principles\n\n[Sections 6](#GS6@EN) , [9](#GS9@EN) , [10](#GS10@EN) , [11](#GS11@EN) and [16](#GS16@EN)\n\n> **1.   **Collection****\n> \n> > > (1) A personal information custodian must not collect personal information unless the information is necessary for one or more of its functions or activities.\n> > \n> > > (2) A personal information custodian must collect personal information only by lawful means.\n> > \n> > > (3) Before collection, during collection or as soon as practicable after collection of personal information about an individual from the individual, the personal information custodian must take any reasonable steps necessary to ensure that the individual is aware of the following:\n> > > \n> > > > > (a) its identity and how to contact it;\n> > > > \n> > > > > (b) the individual's right of access to the information;\n> > > > \n> > > > > (c) the purposes for which the information is collected;\n> > > > \n> > > > > (d) the intended recipients or class of recipients of the information;\n> > > > \n> > > > > (e) any law that requires the information to be collected;\n> > > > \n> > > > > (f) the main consequences for the individual if all or part of the information is not provided.\n> > \n> > > (4) If it is reasonable and practicable to do so, a personal information custodian must collect personal information about an individual only from that individual.\n> > \n> > > (5) If a personal information custodian collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is made aware of the matters referred to in [subclause (3)](#JS1@GC1@Gc3@EN) unless doing so would pose a serious threat to the life, safety, health or welfare of any individual.\n\n> **2.   **Use and disclosure****\n> \n> > > (1) A personal information custodian must not use or disclose personal information about an individual for a purpose other than the purpose for which it was collected unless –\n> > > \n> > > > > (a) both of the following apply:\n> > > > > \n> > > > > > > (i) that purpose is related to the primary purpose and, if the personal information is sensitive information, that information is directly related to the primary purpose;\n> > > > > > \n> > > > > > > (ii) the individual would reasonably expect the personal information custodian to use or disclose the information for that purpose; or\n> > > > \n> > > > > (b) the individual has consented to the use or disclosure; or\n> > > > \n> > > > > (c) if the use or disclosure is necessary for research or the compilation or analysis of statistics in the public interest, other than for publication in a form that identifies any particular individual –\n> > > > > \n> > > > > > > (i) it is impracticable for the personal information custodian to seek the individual's consent before the use or disclosure; or\n> > > > > > \n> > > > > > > (ii) the personal information custodian reasonably believes that the recipient of the information is not likely to disclose the information; or\n> > > > \n> > > > > (d) the personal information custodian reasonably believes that the use or disclosure is necessary to lessen or prevent –\n> > > > > \n> > > > > > > (i) a serious threat to an individual's life, health, safety or welfare; or\n> > > > > > \n> > > > > > > (ii) a serious threat to public health or public safety; or\n> > > > \n> > > > > (e) the personal information custodian has reason to suspect that unlawful activity has been, is being or may be engaged in, and uses or discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities; or\n> > > > \n> > > > > (f) the use or disclosure is required or authorised by or under law; or\n> > > > \n> > > > > (g) the personal information custodian reasonably believes that the use or disclosure is reasonably necessary for any of the following purposes by or on behalf of a law enforcement agency:\n> > > > > \n> > > > > > > (i) the prevention, detection, investigation, prosecution or punishment of criminal offences or breaches of a law imposing a penalty or sanction;\n> > > > > > \n> > > > > > > (ii) the enforcement of laws relating to the confiscation of the proceeds of crime;\n> > > > > > \n> > > > > > > (iii) the protection of the public revenue;\n> > > > > > \n> > > > > > > (iv) the prevention, detection, investigation or remedying of conduct that is in the opinion of the personal information custodian seriously improper conduct;\n> > > > > > \n> > > > > > > (v) the preparation for, or conduct of, proceedings before any court or tribunal or implementation of any order of a court or tribunal;\n> > > > > > \n> > > > > > > (vi) the investigation of missing persons;\n> > > > > > \n> > > > > > > (vii) the investigation of a matter under the [Coroners Act 1995](/view/html/inforce/2026-04-12/act-1995-073) ; or\n> > > > \n> > > > > (h) the Australian Security Intelligence Organisation (ASIO) or the Australian Secret Intelligence Service (ASIS), in connection with its functions, has requested the personal information custodian to disclose the personal information and –\n> > > > > \n> > > > > > > (i) the disclosure is made to an officer or employee of ASIO or ASIS appropriately authorised in writing to receive the disclosure; and\n> > > > > > \n> > > > > > > (ii) an officer or employee of ASIO or ASIS so authorised certifies that the disclosure is connected with the performance by ASIO or ASIS of its functions; or\n> > > > \n> > > > > (i) the personal information is to be used as employee information in relation to –\n> > > > > \n> > > > > > > (i) the suitability of the individual for appointment; or\n> > > > > > \n> > > > > > > (ii) the suitability of the individual for employment held by the individual; or\n> > > > \n> > > > > (j) the personal information is employee information which is being transferred from one personal information custodian to another personal information custodian for use as employee information relating to the individual; or\n> > > > \n> > > > > (k) [subclause (4)](#JS1@GC2@Gc4@EN) or [section 12](#GS12@EN) applies.\n> > \n> > > (2) If a personal information custodian uses or discloses personal information under [subclause (1)(g)](#JS1@GC2@Gc1@Hpg@EN) , it must make a written note of the use or disclosure.\n> > \n> > > (3) [Subclause (1)](#JS1@GC2@Gc1@EN) applies to personal information collected by a personal information custodian that is a body corporate from a related body corporate as if the primary purpose of that collection were the primary purpose for which the related body corporate collected the information.\n> > \n> > > (4) A personal information custodian that provides a health service to an individual may disclose health information about the individual to a person who is responsible for the individual if –\n> > > \n> > > > > (a) the individual is –\n> > > > > \n> > > > > > > (i) physically or legally incapable of giving consent to the disclosure; or\n> > > > > > \n> > > > > > > (ii) physically unable to communicate consent to the disclosure; and\n> > > > \n> > > > > (b) the natural person providing the health service for the personal information custodian is satisfied that the disclosure –\n> > > > > \n> > > > > > > (i) is necessary to provide appropriate care or treatment of the individual; or\n> > > > > > \n> > > > > > > (ii) is made for compassionate reasons; and\n> > > > \n> > > > > (c) the disclosure is not contrary to any wish –\n> > > > > \n> > > > > > > (i) expressed by the individual before the individual became unable to give or communicate consent; and\n> > > > > > \n> > > > > > > (ii) of which the natural person is aware, or of which he or she could reasonably be expected to be aware; and\n> > > > \n> > > > > (d) the disclosure is limited to the extent reasonable and necessary for the purpose mentioned in [paragraph (b)](#JS1@GC2@Gc4@Hpb@EN) .\n> > \n> > > (5) A person is responsible for an individual if the person –\n> > > \n> > > > > (a) is a parent of the individual; or\n> > > > \n> > > > > (b) is a child or sibling of the individual and at least 18 years of age; or\n> > > > \n> > > > > (c) is a spouse of the individual; or\n> > > > \n> > > > > (d) is in a personal relationship, within the meaning of the [Relationships Act 2003](/view/html/inforce/2026-04-12/act-2004-046) , with the individual; or\n> > > > \n> > > > > (e) is a relative of the individual, at least 18 years of age and a member of the individual's household; or\n> > > > \n> > > > > (f) is a guardian of the individual; or\n> > > > \n> > > > > (g) is exercising enduring power of attorney granted by the individual that is exercisable in relation to decisions about the individual's health; or\n> > > > \n> > > > > (h) is nominated by the individual to be contacted in case of emergency.\n\n> **3.   **Data quality****\n> \n> > A personal information custodian must take reasonable steps to ensure that, having regard to the purpose for which the personal information is to be used, the personal information it collects, uses, holds or discloses is accurate, complete, up-to-date and relevant to its functions or activities.\n\n> **4.   **Data security****\n> \n> > > (1) A personal information custodian must take reasonable steps to protect the personal information it holds from misuse, loss, unauthorised access, modification or disclosure.\n> > \n> > > (2) A personal information custodian must take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for any purpose.\n> > \n> > > (3) A personal information custodian, the records of which are subject to the [Archives Act 1983](/view/html/inforce/2026-04-12/act-1983-076) , must take the reasonable steps referred to in [subclause (2)](#JS1@GC4@Gc2@EN) only with the approval of the State Archivist.\n\n> **5.   **Openness****\n> \n> > > (1) A personal information custodian must clearly set out in a document its policies on its management of personal information.\n> > \n> > > (2) A personal information custodian must make the document available to anyone who asks for it.\n> > \n> > > (3) On request by a person, a personal information custodian must take reasonable steps to advise the person, in general terms, of –\n> > > \n> > > > > (a) the sort of personal information it holds; and\n> > > > \n> > > > > (b) the purposes for which it holds the information; and\n> > > > \n> > > > > (c) how it collects, holds, uses and discloses that information.\n\n> **6.   **Access and correction****\n> \n> > > (1) [*\\[Schedule 1 Amended by No. 71 of 2009, s. 10, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS10@Hpa@EN) If a personal information custodian holds personal information about an individual, the personal information custodian –\n> > > \n> > > > > (a) may provide that individual with access to his or her personal information on receipt of a written request from the individual for access to his or her personal information; or\n> > > > \n> > > > > (b) if the personal information custodian –\n> > > > > \n> > > > > > > (i) notifies the individual of a decision to refuse a request under [paragraph (a)](#JS1@GC6@Gc1@Hpa@EN) ; or\n> > > > > > \n> > > > > > > (ii)  does not respond to a request under [paragraph (a)](#JS1@GC6@Gc1@Hpa@EN) within 20 working days –\n> > > > > > \n> > > > > > the personal information custodian, on receipt of a further written request from the individual for access to his or her personal information, must provide the individual with access to his or her personal information as if –\n> > > > > > \n> > > > > > > (iii) the written request were an application for assessed disclosure of information under [section 13](/view/html/inforce/2026-04-12/act-2009-070#GS13@EN) of the [Right to Information Act 2009](/view/html/inforce/2026-04-12/act-2009-070) ; and\n> > > > > > \n> > > > > > > (iv) the personal information custodian were subject to that Act; and\n> > > > > > \n> > > > > > > (v) a reference in that Act to a public authority or a Minister were a reference to a personal information custodian.\n> > \n> > > (2) [*\\[Schedule 1 Amended by No. 71 of 2009, s. 10, Applied:15 Jul 2010\\]*](/view/html/inforce/2010-07-15/act-2009-071#GS10@EN) An individual may request amendment of his or her personal information in accordance with [Part 3A](#HP3A@EN) if that information is incorrect, incomplete, out of date or misleading.\n\n> **7.   **Unique identifiers****\n> \n> > > (1) A personal information custodian must not assign a unique identifier to an individual unless it is necessary for it to carry out any of its functions efficiently.\n> > \n> > > (2) A personal information custodian must not adopt as its own unique identifier of an individual a unique identifier that has been assigned to the individual by another personal information custodian unless –\n> > > \n> > > > > (a) that adoption is necessary for it to carry out any of its functions efficiently; or\n> > > > \n> > > > > (b) it has obtained the consent of the individual to the use of the unique identifier; or\n> > > > \n> > > > > (c) it is a body, an organisation or an individual adopting the unique identifier created by a personal information custodian in the performance of its obligations to the personal information custodian under a personal information contract.\n> > \n> > > (3) A personal information custodian must not use or disclose a unique identifier assigned to an individual by another personal information custodian unless –\n> > > \n> > > > > (a) the use or disclosure is necessary for it to fulfil its obligations to the other personal information custodian; or\n> > > > \n> > > > > (b) [clause 2(1)](#JS1@GC2@Gc1@EN) applies.\n> > \n> > > (4) A personal information custodian must not require an individual to provide a unique identifier in order to obtain a service unless the provision –\n> > > \n> > > > > (a) is required or authorised by law; or\n> > > > \n> > > > > (b) is in connection with the purpose, or a directly related purpose, for which the unique identifier was assigned.\n\n> **8.   **Anonymity****\n> \n> > Wherever it is lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with a personal information custodian.\n\n> **9.   **Disclosure of information outside Tasmania****\n> \n> > A personal information custodian may disclose personal information about an individual to another person or other body who is outside Tasmania only if –\n> > \n> > > > (a) the personal information custodian reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that has principles for fair handling of the information that are substantially similar to the personal information protection principles; or\n> > > \n> > > > (b) the individual consents to the disclosure; or\n> > > \n> > > > (c) the disclosure is necessary for –\n> > > > \n> > > > > > (i) the performance of a contract between the individual and the personal information custodian; or\n> > > > > \n> > > > > > (ii) the conclusion or performance of a contract concluded in the interest of the individual between the personal information custodian and a third party; or\n> > > \n> > > > (d) the personal information custodian has taken reasonable steps to ensure that the information which it has disclosed is not to be held, used or disclosed by the recipient of the information inconsistently with the personal information protection principles; or\n> > > \n> > > > (e) the disclosure is authorised or required by any other law.\n\n> **10.   **Sensitive information****\n> \n> > > (1) A personal information custodian must not collect sensitive information about an individual unless –\n> > > \n> > > > > (a) the individual has consented; or\n> > > > \n> > > > > (b) the collection is required or permitted by law; or\n> > > > \n> > > > > (c) the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual and the individual to whom the information relates –\n> > > > > \n> > > > > > > (i) is physically or legally incapable of giving consent to the collection; or\n> > > > > > \n> > > > > > > (ii) physically cannot communicate consent to the collection; or\n> > > > > > \n> > > > > > > (iii) [*\\[Schedule 1 Amended by No. 69 of 2013, Sched. 1, Applied:17 Feb 2014\\]*](/view/html/inforce/2014-02-17/act-2013-069#JS1@Ja19@GC1@EN) is subject to a guardianship order under the [Guardianship and Administration Act 1995](/view/html/inforce/2026-04-12/act-1995-044) or an assessment order or treatment order under the [Mental Health Act 2013](/view/html/inforce/2026-04-12/act-2013-002) ; or\n> > > > \n> > > > > (d) the information is collected in the course of the activities of a non-profit personal information custodian that has only racial, ethnic, political, religious, philosophical, professional, trade or trade union aims and –\n> > > > > \n> > > > > > > (i) the information relates solely to the members of that personal information custodian or to individuals who have regular contact with it in connection with its activities; and\n> > > > > > \n> > > > > > > (ii) at or before the time of collection, the personal information custodian undertakes to the individual to whom the information relates that it will not disclose the information without the individual's consent; or\n> > > > \n> > > > > (e) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim; or\n> > > > \n> > > > > (f) [subclause (2)](#JS1@GC10@Gc2@EN) , [(3)](#JS1@GC10@Gc3@EN) , [(4)](#JS1@GC10@Gc4@EN) or [(6)](#JS1@GC10@Gc6@EN) applies.\n> > \n> > > (2) A personal information custodian may collect sensitive information about an individual if –\n> > > \n> > > > > (a) either of the following applies:\n> > > > > \n> > > > > > > (i) the collection is necessary for research or the compilation or analysis of statistics in the public interest and any resulting publication does not identify the individual;\n> > > > > > \n> > > > > > > (ii) the information relates to an individual's racial or ethnic origin and is collected for the purpose of welfare or educational services funded by government; and\n> > > > \n> > > > > (b) there is no reasonably practicable alternative to collecting the information for a purpose referred to in [paragraph (a)](#JS1@GC10@Gc2@Hpa@EN) ; and\n> > > > \n> > > > > (c) it is impracticable for the personal information custodian to seek the individual's consent to the collection.\n> > \n> > > (3) A personal information custodian may collect sensitive information that is health information about an individual if –\n> > > \n> > > > > (a) the information is necessary to provide a health service to the individual; and\n> > > > \n> > > > > (b) the information is collected –\n> > > > > \n> > > > > > > (i) as required by law, other than this Act; or\n> > > > > > \n> > > > > > > (ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the personal information custodian.\n> > \n> > > (4) A personal information custodian may collect sensitive information that is health information about an individual if –\n> > > \n> > > > > (a) the collection is necessary for any of the following purposes:\n> > > > > \n> > > > > > > (i) research relevant to public health or public safety;\n> > > > > > \n> > > > > > > (ii) the compilation or analysis of statistics relevant to public health or public safety;\n> > > > > > \n> > > > > > > (iii) the management, funding or monitoring of a health service; and\n> > > > \n> > > > > (b) that purpose cannot be served by the collection of information that does not identify the individual or from which the individual's identity cannot reasonably be ascertained; and\n> > > > \n> > > > > (c) it is impracticable for the personal information custodian to seek the individual's consent to the collection; and\n> > > > \n> > > > > (d) the information is collected –\n> > > > > \n> > > > > > > (i) as required by law, other than this Act; or\n> > > > > > \n> > > > > > > (ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the personal information custodian.\n> > \n> > > (5) If a personal information custodian collects sensitive information that is health information about an individual in accordance with [subclause (4)](#JS1@GC10@Gc4@EN) , it must take reasonable steps to permanently de-identify the information before disclosing it.\n> > \n> > > (6) [*\\[Schedule 1 Amended by No. 37 of 2005, s. 5, Applied:05 Sep 2005\\]*](/view/html/inforce/2005-09-05/act-2005-037#GS5@EN) A personal information custodian may collect sensitive information that is health information from an individual about another person without the consent of that other person, or without complying with [clause 1(5)](#JS1@GC1@Gc5@EN) , if both the following apply:\n> > > \n> > > > > (a) the collection is necessary for the provision of any health service provided to the individual;\n> > > > \n> > > > > (b) the information is relevant to the social or family history of the individual.","sortOrder":44}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"issue_detection":{"absurdities":[],"contradictions":[]},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":true,"description":"The Act's practical scope has been broadened and clarified by amendments. Notable changes include: extending certain rights to deceased persons' information (s 3A, inserted No. 71 of 2009 s 6); adding an access rule for medical/psychiatric records (s 3B, inserted No. 71 of 2009 s 6); creating an individual correction/amendment regime (Part 3A, ss 17A–17I, inserted No. 71 of 2009 s 8); refining law‑enforcement carve‑outs (s 9, amended No. 37 of 2005 s 4); and permitting disclosure to specific legal officers (s 12A, inserted 2017). Later amendments (including references to the State Litigator, 2024) further adjust actors and exceptions. These changes expand remedial pathways, clarify permitted disclosures and add administrative discretion (ss 13–15) compared with the original text."},"complexity_factors":["Dense definitional framework that determines coverage and exceptions (see s 3: definitions of personal information, sensitive information, health information, personal information custodian).","Multiple, specific exemptions and carve‑outs that alter application in practice (see ss 7–12: courts/tribunals, public information, law enforcement, employee information, unsolicited information, basic information use at s 12).","Detailed practical obligations across lifecycle of data (collection notice and purpose, access/correction, data quality, security, destruction/de‑identification) in Schedule 1 (clauses 1, 3, 4, 6).","Significant cross‑references to other statutes and bodies which affect operation and remedies (Right to Information Act 2009, Ombudsman Act 1978, Archives Act 1983 — see Schedule 1 cl 6 and ss 16, 21–22).","Ministerial discretion to grant, condition and revoke exemptions (ss 13–15) introduces administrative decision‑making and publication requirements.","Complaints and enforcement are channelled through the Ombudsman with procedural limits, timeframes and powers (ss 18–22), creating an administrative enforcement regime rather than criminal sanctions (s 5(2)).","Amendment and correction regime for individuals added as a separate Part (Part 3A, ss 17A–17I) with procedural requirements and time limits (see s 17E, 17F, 18(5A)).","Operational compliance burdens: requirements to make and keep written notes of certain disclosures (Schedule 1 cl 2(2)), notify individuals on collection (Schedule 1 cl 1(3)), and preserve records under archival rules (Schedule 1 cl 4(3), s 17I).","Temporal and transitional rules that limit which Schedule 1 clauses apply to information collected before commencement (s 6).","Recent amendment traces increase interpretive complexity (inserted and amended provisions across 2005–2024 noted in-margin), requiring attention to amendment history (see notes at ss 3, 3A, 3B, 9, 12A and Schedule 1 amendments)."],"plain_english_summary":"This Act sets rules for how personal information is collected, used, stored, disclosed and corrected in Tasmania. It applies to public authorities and other \"personal information custodians\", distinguishes sensitive and health information, limits overseas disclosure, and requires security, openness and access/correction rights. The Ombudsman manages complaints and investigations. Specified bodies and purposes are exempt and the Minister may grant or revoke exemptions, with procedural requirements for notification and record‑keeping."},"kimi_summary":{"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":true,"description":"The legislation has grown significantly beyond its original 2004 framework. The original Act established basic privacy principles and Ombudsman oversight. However, amendments — particularly the 2009 reforms (No. 71 of 2009) — substantially expanded scope: (1) Part 3A was entirely inserted, creating a detailed statutory scheme for amending personal information with 9 new sections (17A-17I); (2) Section 3A extended rights to deceased persons' information via next-of-kin; (3) Section 3B added special medical access protections; (4) Schedule 1 was heavily modified to integrate with the Right to Information Act 2009, effectively merging privacy access rights with FOI processes. Later amendments (2013, 2017, 2024) continued this expansion by adding new entities (State Litigator, Anti-Discrimination Commissioner) to definitions and exemptions. The Act now functions as a hybrid privacy/FOI interface statute rather than a standalone privacy code."},"complexity_factors":["Extensive defined terms section (Section 3) with 18+ defined terms, many of which are themselves cross-referenced to other Acts (Right to Information Act 2009, Archives Act 1983, etc.)","Nested conditional logic in Schedule 1 — particularly Clause 2 (Use and disclosure) with 11 separate exception pathways (2(1)(a) through (k)), many containing their own sub-conditions","Multiple amendment layers visible in the text — sections marked as inserted/amended by No. 71 of 2009, No. 7 of 2024, etc., creating a patchwork legislative history that must be mentally reconstructed","Complex exemption structure in Part 2 — courts/tribunals, law enforcement, employee information, public information, and ministerial discretionary exemptions all operate differently","Interaction between this Act and the Right to Information Act 2009 — Section 6 of Schedule 1 creates a 'deemed application' mechanism where privacy access requests can convert to RTI applications","Special handling rules for specific information types — health information, sensitive information, and employee information each have bespoke rules that override general principles","Temporal complexity — some principles apply only to post-commencement collection (Clause 1, 7, 8, 10 of Schedule 1) while others apply retrospectively (Clauses 2-6, 9)","Dead person data rules — Section 3A creates special provisions where next-of-kin can exercise rights over deceased persons' information in Part 3A and Schedule 1, clause 6"],"plain_english_summary":"This is Tasmania's **Personal Information Protection Act 2004** — the state's main privacy law that governs how Tasmanian government agencies and certain contractors handle your personal information.\n\n**What it does:**\nThe Act sets out **10 privacy principles** (in Schedule 1) that \"personal information custodians\" must follow when collecting, using, storing, and disclosing personal information. These custodians are mainly **public authorities** (government departments, agencies, etc.) and organisations that contract with them to handle personal data.\n\n**Key protections include:**\n- **Collection limits** — agencies can only collect information that's necessary for their work, and must tell you why they're collecting it\n- **Use and disclosure restrictions** — your information generally can't be used for purposes other than why it was collected, unless an exception applies (such as your consent, law enforcement needs, or serious threats to health/safety)\n- **Data quality and security** — agencies must keep information accurate and protect it from misuse or unauthorised access\n- **Access and correction rights** — you can request to see your personal information and ask for corrections if it's wrong, incomplete, or out of date\n- **Special rules for sensitive information** — stricter rules apply to information about your race, religion, health, sexual preferences, criminal record, etc.\n- **Cross-border protection** — limits on sending your personal information outside Tasmania unless proper safeguards exist\n\n**Who it affects:**\n- **Tasmanian government agencies** (\"public authorities\")\n- **Private contractors** who handle personal information for government (under \"personal information contracts\")\n- **All Tasmanians** who interact with these agencies — anyone whose personal information is held by government\n\n**Important exemptions:**\nThe Act doesn't apply to everything. Courts and tribunals acting in their judicial capacity are exempt, as is \"public information\" (already publicly available). Law enforcement agencies get significant exemptions for operational information, and there are special rules for employee information and health records.\n\n**Complaints process:**\nIf you believe an agency has breached your privacy, you must first complain to the agency itself. If unsatisfied, you can escalate to the **Ombudsman**, who can investigate and make recommendations.\n\n**Why it matters:**\nThis is Tasmania's equivalent of the federal *Privacy Act 1988* — it gives Tasmanians legal rights over how government handles their personal data, with the Ombudsman serving as the independent watchdog. The Act has been amended several times (notably in 2009, 2013, 2017, and 2024) to expand rights — particularly around amending incorrect information and accessing medical records safely."},"summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"The Act appears to have remained focused on its original intent: regulating the handling of personal information by Tasmanian public sector bodies and certain other organisations. Amendments since 2004 have refined and updated the framework but do not appear to represent a material departure from the original scope of protecting individual privacy rights in the Tasmanian context."},"complexity_factors":["Interaction and overlap with the Commonwealth Privacy Act 1988 creates jurisdictional complexity — users may struggle to identify which law applies to their situation","The Act applies to both public sector agencies and some private organisations, requiring users to determine whether their particular organisation is captured","Privacy principles are expressed at a high level of generality, requiring interpretation and case-by-case application to specific situations","Complaint and enforcement mechanisms involve multiple steps and bodies (e.g., the Ombudsman), which can be procedurally complex for laypersons","Numerous exemptions and exceptions to the core principles exist, meaning apparent rights may not apply in specific circumstances","The Act has been amended multiple times since 2004, meaning the current operative version requires cross-referencing with amending instruments","Technical definitions (e.g., what constitutes 'personal information' or a 'personal information custodian') carry significant legal weight and are not always intuitive"],"plain_english_summary":"The Personal Information Protection Act 2004 (Tas) is the state law that governs how Tasmanian government agencies—and some local public or private bodies—collect, store, use and share your personal information. It requires necessity, security, limited use/disclosure, access/correction rights and transparency. \n\nIt matters because it gives you rights to access, correct and complain if an agency misuses your data, and operates alongside (but separate from) the federal Privacy Act 1988."}},"importantCases":[],"_links":{"self":"/api/acts/personal-information-protection-act-2004","history":"/api/acts/personal-information-protection-act-2004/history","analysis":"/api/acts/personal-information-protection-act-2004/analysis","conflicts":"/api/acts/personal-information-protection-act-2004/conflicts","importantCases":"/api/acts/personal-information-protection-act-2004/important-cases","documents":"/api/acts/personal-information-protection-act-2004/documents"}}