{"id":"F2008B00565","name":"Queensland Club Industry Privacy Code","slug":"queensland-club-industry-privacy-code","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"repealed","isInForce":false,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":71856,"registerId":"commonwealth-F2008B00565-current","compilationNumber":null,"startDate":"2026-04-02","status":"Repealed","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Queensland Club Industry","sectionType":"part","heading":"Queensland Club Industry","content":"# Queensland Club Industry","sortOrder":0},{"sectionNumber":"PRIVACY CODE","sectionType":"part","heading":"PRIVACY CODE","content":"# PRIVACY CODE\n\n© Clubs Queensland 2001\n\nAll rights reserved. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without prior written permission from Clubs Queensland. In the event of publication, statutory copyright is claimed.","sortOrder":1},{"sectionNumber":"Contents","sectionType":"section","heading":"Contents","content":"##### Contents\n\n1. Recitals......................................................................1\n2. Legislative Requirements.......................................................2\n3. Definitions....................................................................4\n4. Rationale.....................................................................5\n5. Goals 5\n6. Privacy Principles and Scenarios................................................5\n\nPrivacy Principle 1 - Collection and Quality of Information\n\nPrivacy Principle 2 - Use and Disclosure of Information\n\nPrivacy Principle 3 - Access, Correction and Openness of Information\n\nPrivacy Principle 4 - Security of Information\n\nPrivacy Principle 5 - Transborder Flow of Information\n\n7. Application of the Privacy Code...............................................13\n\n(a) General Club Administration and Operation\n\n(b) Information Collected Under Other Legislation Applicable to Clubs\n\n(c) Reciprocal Members\n\n(d) Contractors\n\n8. Breach of the Privacy Code..................................................15\n\n9. Complaint Facilitation Procedures.............................................16\n\n10. Staff Training.............................................................17\n\n11. Acceptance of and Release from the Privacy Code.............................17\n\n12. Implementation of the Privacy Code..........................................18\n\n13. Administration of the Privacy Code...........................................18\n\n14. Review of the Privacy Code.................................................19\n\nForms and Signage\n\nA. Approval Letter from the Privacy Commissioner\n\nB. Summary of the NPPs\n\nC. Club Privacy Code\n\nD. Club Privacy Practices\n\nE. Register of Complaints and Actions\n\nF. Register of Training\n\nG. Acceptance of the Queensland Club Industry Privacy Code\n\nH. Release from the Queensland Club Industry Privacy Code","sortOrder":2},{"sectionNumber":"(i) prejudice the prevention, detection,","sectionType":"section","heading":"(i) prejudice the prevention, detection, investigation, prosecution or punishment of criminal offices or breaches of any law;","content":"##### (i) prejudice the prevention, detection, investigation, prosecution or punishment of criminal offices or breaches of any law;","sortOrder":3},{"sectionNumber":"(ii) prejudice the enforcement of laws r","sectionType":"section","heading":"(ii) prejudice the enforcement of laws relating to the confiscation of proceeds of crime;","content":"##### (ii) prejudice the enforcement of laws relating to the confiscation of proceeds of crime;","sortOrder":4},{"sectionNumber":"(iii) prejudice the protection of the pu","sectionType":"section","heading":"(iii) prejudice the protection of the public revenue;","content":"##### (iii) prejudice the protection of the public revenue;","sortOrder":5},{"sectionNumber":"(iv) prejudice the prevention, detection","sectionType":"section","heading":"(iv) prejudice the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct;","content":"##### (iv) prejudice the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct;","sortOrder":6},{"sectionNumber":"(v) prejudice the preparation for, or co","sectionType":"section","heading":"(v) prejudice the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders; or","content":"##### (v) prejudice the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders; or","sortOrder":7},{"sectionNumber":"(vi) damage the national security arrang","sectionType":"section","heading":"(vi) damage the national security arrangements;","content":"##### (vi) damage the national security arrangements;\n\nof or by an Enforcement Body.\n\n(b) Where access to personal information would reveal evaluative information generated within the member club in connection with a commercially sensitive decision-making process, the member club will not provide direct access but will give an explanation for the decision not to allow access to that information.\n\n(c) Where appropriate, the member club may facilitate mutually agreed intermediaries from both parties (member club and member or patron) in regard to information that cannot be made available to the member or patron.\n\n(d) The member club will not charge any fees for lodging a request for access to personal information but may charge a reasonable fee for providing access to personal information.\n\n(e) If a member or patron informs the member club in writing that the information held by the club about himself or herself is not accurate, complete or up-to-date, the member club will (if the assertion by the member or patron is correct) endeavour to update the information as soon as reasonably practical.\n\n(f) The member club will take reasonable steps to include with the requested information a statement claiming that the information is not accurate, complete or up-to-date if the member or patron and the member club are unable to agree that the information is accurate, complete and up-to-date and the member or patron requests the club to provide the statement.\n\n(g) The member club will a provide reason for any denial of access or refusal to correct personal information.\n\n(h) The member club will put the signage in Appendix C in a prominent location in the member club to inform members and patrons about its information management practices, including the type of information it holds, for what purpose, and how it collects, holds, uses and disclosures information.\n\nScenario\n\nThe following scenario explains a practical application of Privacy Principle 3. The scenario is not definitive and member clubs should take into consideration their own circumstances when dealing with privacy issues at their venues.\n\nJohn had been a regular member of the Yellow Hill Club for many years. As a result, he was well known to the club staff and management. He decided to use his contacts at the club to help the local gambling support group better target people who may have a problem with gambling in the area. John asked the club to release relevant details, including the number of people regularly playing the pokies at the club and contact details of those seeking self-exclusion from the club.\n\nIndividuals can only access their own personal information and not the personal information of others. Accordingly, the Yellow Club declined to release the information, citing that it would unreasonably impact on the privacy of its members and patrons. Also the information was commercially-sensitive and the release would commercially disadvantage the club, as the area had three hotels competing in the same market as the club. However, to meet its privacy obligations, the club arranged a meeting with John and the local support group and provided them with general statistical information.\n\nOn a separate occasion, John received a letter from the Yellow Hill Club requesting renewal of his membership. He noticed that his phone number was incorrect and wondered what other information held by the club was also incorrect. He contacted the Club Manager and requested access to his personal information held by the club. After completing the relevant form, John was provided with his personal information held by the club. He noticed that his phone number, e-mail address and date of birth were all incorrect. John requested that these details be corrected. Once the Club Manager had verified the new details, John’s record was updated.\n\n6.4 Privacy Principle 4 - Security of Information\n\n(a) The member club will take reasonable steps to safeguard the information it collects and holds by locating the information in a secure place in the club (eg: a lockable filing cabinet in the Club Manager’s office etc.).\n\n(b) The member club will establish clear guidelines as to which staff members can access personal information and under what circumstances (eg: when the Club Manager is on annual/sick leave).\n\n(c) The member club will prevent unauthorised access, modification or disclosure and misuse or loss of personal information by putting in place appropriate measures, such as, installing lock and key, designating some areas as “For Staff Only” etc. In the case of computer records, the member club will put in place appropriate protection mechanisms such as use of a password, virus protection software and firewall.\n\n(d) In respect of those member clubs that have internet and email facilities, the member club will implement an email/internet policy/statement regarding the transmission of personal information through the internet and by email. The member club will provide regular training and education sessions to ensure staff understand their privacy obligations relating to the use of the email and internet facilities provided by the member club.\n\n(e) The member club will take reasonable steps to destroy or de-identify any information that is no longer needed (such as, shredding or pulping paper records, and deleting or erasing information stored electronically).\n\n(f) The member club, as far as practicable, will not permit staff members to discuss personal, health and sensitive information of members and patrons in front of other members and patrons or members of the community.\n\nScenario\n\nThe following scenario explains a practical application of Privacy Principle 4. The scenario is not definitive and member clubs should take into consideration their own circumstances when dealing with privacy issues at their venues.\n\nThe Blissvale Club, being a small club with only a few staff, welcomed all offers of assistance when it organised major functions at the club. The Club Manager would ask the volunteers to help in various ways, including taking turns to telephone members and patrons to confirm their attendance at the functions at the club. After receiving three separate calls, only one of which related to the functions at the club, Alice, who was a regular member of the club, lodged a complaint with the Club Manager that her personal information was being passed around. She explained that of the three calls she received, two were unrelated to the functions at the club. In fact, both were attempts to sell her some products that she had not solicited.\n\nThe Blissvale Club had clearly failed to take reasonable steps to safeguard the personal information of its members and patrons by allowing access to the information to unauthorised persons, in this case volunteers, working at the club. In addition, the volunteers misused the information by passing it to third parties. The Blissvale Club should locate the information in a secure place in the club and also establish clear guidelines and a privacy policy as to who can access personal information. The club should also take reasonable steps to prevent any misuse of the information, as it happened in this case.\n\n6.5 Privacy Principle 5 - Transborder Flows of Information\n\n(a) Subject to clause 6.5(b), the member club will only transfer personal information of a member or patron to a recipient in a foreign country if:\n\n- the member or patron consents to the transfer; or\n- where the transfer is for the benefit of the member or patron and it is impracticable to obtain the consent of the member or patron to the transfer and if it were practicable to obtain such consent, the member or patron would be likely to give it; or\n- the transfer is necessary for the conclusion or performance of a contract between the member or patron and the organisation, or for the implementation of pre-contractual measures taken in response to the member’s or patron’s request, or\n- the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the member or patron between the organisation and a third party.\n\n(b) The member club will not transfer information to a recipient in a foreign country in circumstances where the:\n\n- recipient of the information is in a jurisdiction that does not have adequate protection similar to the protection accorded under the Privacy Code and Privacy Act; or\n- the member or patron about whom the information relates has not consented to the transfer of information; or\n- information may be used in ways which are inconsistent with the Privacy Code.\n\n(c) In some instances, the member club may ask for a written assurance from the parties involved that the information will remain secure before transferring the information.\n\nScenario\n\nThe following scenario explains a practical application of Privacy Principle 5. The scenario is not definitive and member clubs should take into consideration their own circumstances when dealing with privacy issues at their venues.\n\nThe Long Road Club, situated in Brisbane, received a request from a hotel in Germany for contact details of its members so that it may offer discounts to those members travelling to Germany. Although the club was satisfied that the hotel adhered to the stringent privacy obligations imposed on organisations within the European Community, it was not satisfied that its members would consent to the disclosure of their personal details. The club also felt the disclosure would be inconsistent with its privacy statement.\n\nRather than disclose the information, the Long Road Club requested the hotel to send its brochures and any discount offers to the club. The Long Road Club then displayed the brochures and offers in the club for the information of its members and patrons. Members and patrons could then contact the hotel personally for further information. The Long Road Club also mentioned the offer in its newsletter.\n\n7. Application of the Privacy Code\n\n7.1 General Administration and Operation\n\n(a) Membership Application Form\n\neg: The member club should, in addition to providing its proper trading name and contact details, include a privacy statement explaining why the personal information is being collected, details of individuals and organisations likely to receive the information, how the member or patron can access, update and amend the personal information held by the club, any consequences that may result if the requested information is not provided by the member or patron and how the member or patron can request the member club to cease sending direct marketing materials to them.\n\n(b) Membership Database\n\neg: The member club should keep accurate, complete and up-to-date records and also ensure that both physical and electronic databases are secure.\n\n(c) Members’/Reciprocal Members’ and Visitors’/Guests’ Sign-in Registers\n\neg: For Members’/Reciprocal and Visitors’/Guests’ Sign-in Registers (“Registers”) that were printed prior to 21 December 2001 and do not facilitate the prevention of unauthorised access to the Registers, member clubs will ensure that:\n\n- Registers are placed in appropriate locations to prevent them from being stolen; and\n- an appropriate sign is displayed within close proximity of the Registers, notifying patrons, visitors and members that they are to complete and sign the Sign‑in Register (as required under the Liquor Act (Qld) 1992) and that their personal information (name, address and membership number) recorded in the Sign-in Register may be able to be seen by other members of the public who read or sign the Sign-in Register.\n\nIn respect of the Visitors’/Guests’ Sign in Register (“Visitor Register”) and to assist member clubs with new obligations under this Privacy Code in respect of direct marketing, member clubs must include on each of the tear off slips of the Visitor Register a statement such as “Please tick here (insert box) if you do not wish to receive any direct marketing materials”.\n\n(d) Internet and E-mail\n\neg: The member club should circulate an appropriate email/internet policy/statement outlining (among other things) how email correspondence is to be internally and externally handled, and other internet usage restrictions to be imposed upon staff.\n\n(e) Club Website\n\neg: If the member club uses cookies, web bugs or other means in respect of their website, they need to advise the public accordingly, and may include in a relevant policy the following statement: “This website uses cookies. A cookie can record your name and address and other personal details such as your credit card number. You can turn off cookies in your browser. However, this may result in some parts of the website not being accessible to you.”\n\n(f) Loyalty Programs\n\neg: The member club should inform members and patrons that their personal information may be used by loyalty programs operated by the member club and can include a statement in its promotional brochures as follows: “The club will not send you direct marketing materials, if you have indicated that you do not wish to receive them.”\n\n(g) Advertising and Promotions\n\neg: The member club should not associate members’ or patrons’ names with prize winnings. When contacted by members and/or patrons (either by email, post, telephone or otherwise) to request the member club to cease sending further direct marketing material, the member club must ensure that no further direct marketing material is sent, unless otherwise notified.\n\n(h) Correspondence\n\neg: The member club should put in place procedures that ensure all letters, emails or other correspondence are only able to be accessed by the intended recipients. This means that only those to whom correspondence is addressed should have access to the information, unless another person has the appropriate authority to access the information.\n\n(i) Exclusions\n\nThe member club should follow the procedures in relation to self-exclusion and exclusions requested by a third party as set out in the Queensland Responsible Gambling Resource Manual to assure members’/patrons’ information remain confidential.\n\n(j) Video Surveillance\n\neg: The member club should ensure that access, storage and security of video tapes are by authorised staff only. In instances where the member club maintains video surveillance, in accordance with relevant industry legislation (such as, the Liquor Act (Qld) 1992), appropriate signage notifying the public that they are under surveillance will be displayed.\n\n7.2 Information Collected Under Other Legislation Applicable to Clubs\n\n(a) Gaming Machine Act (Qld) 1991\n\neg: The member club should ensure that all personal information relating to the Self-exclusion Deed remains confidential.\n\n(b) Liquor Act (Qld) 1992\n\neg: The member club should ensure that personal information requested by staff when checking proof of age remains confidential.\n\n(c) Keno Act (Qld) 1996\n\neg: The member club should ensure that personal information requested by staff when checking proof of age remains confidential.\n\n(d) TAB Act (Qld) 1999\n\neg: The member club should ensure that personal information requested by staff when checking proof of age remains confidential.\n\n(e) Workplace Health and Safety Act (Qld) 1995\n\neg: The member club should ensure that records held by the designated Workplace Health and Safety Officer remain confidential.\n\n(f) Anti-Discrimination (Qld) Act 1991\n\neg: The member club should ensure that records held by the designated Officer remain confidential.\n\n7.3 Reciprocal Members\n\nThe member club will treat the privacy concerns of reciprocal club members in the same way as it would deal with the privacy concerns of its members.\n\n7.4 Contractors\n\nIn respect of contractors, the member club will make the contractor aware of the privacy principles in the club’s advertisement for provision of contractual services and also during the negotiation process. Where there is a dispute in respect of whether the contractor is bound by obligations under this Privacy Code or another code, the matter will be dealt with in accordance with the Privacy Act.\n\n7.5 Appendix D outlines some best practices that member clubs will adhere to when dealing with the above issues. Member clubs should note that the above is not an exhaustive list but only the most common examples of the application of the Privacy Code.\n\n8. Breach of the Privacy Code\n\n8.1 The following constitutes a breach of the Privacy Code:\n\n(a) The member club does not fully comply with its obligations under the Privacy Code.\n\n(b) The member club acts or engages or repeats a practice that is contrary to or inconsistent with the Privacy Code.\n\n(c) The member club fails to respond to a complaint by a member or patron.\n\n(d) The member club fails to act on a directive by the Privacy Commissioner or the Privacy Code Administrator.\n\n(e) The member club fails to rectify any action or practice that is contrary to or inconsistent with the Privacy Code.\n\n9. Complaint Facilitation Procedures\n\n9.1 The Privacy Code relies on the Privacy Commissioner to deal with all unresolved privacy related complaints. Accordingly, the complaint handling procedures established under the Privacy Code and the Privacy Act (and accompanying guidelines) will apply to the resolution of a privacy complaint made against a member club under the Privacy Code. To avoid any doubt, member clubs must not deal with any privacy complaint other than in accordance with the Privacy Act. If a complaint is instigated or made by a member or patron whilst the member club is (or was) bound by the Privacy Code, the member club will be required to resolve the matter to the extent provided in the Privacy Code.\n\n9.2 However, as the Privacy Act requires a complainant in most instances to complain about the alleged breach to the relevant member club (respondent) in the first instance, the member club will in these cases endeavour to respond to the complainant’s concerns as follows:\n\n(a) The member club will designate a staff member as the point of contact in the club regarding privacy issues.\n\n(b) The designated staff member will liaise with the complainant and identify and define the nature and cause of the complaint (and ask, if necessary, for the complaint to be put in writing).\n\n(c) The designated staff member will then inform the complainant of their rights under the Privacy Code and Privacy Act, and the timeframe (within 30 days) in which the club will be able to respond to the complaint. For example, the designated staff member will inform the complainant that they may take their complaint directly to the Privacy Commissioner in the event that the complainant is not satisfied with the outcome after the initial approach and discussion with the member club.\n\n(d) The designated staff member will inform the complainant of the response, if any, by the member club, including the basis (legislation, Privacy Code, policies) on which the response was framed.\n\n(e) If the outcome of this liaison between the complainant and the member club is not to the satisfaction of the complainant, the designated staff member will advise the complainant that the complaint is escalated and should be handled in accordance with the procedures under the Privacy Act (see: Section 36 of the Privacy Act).\n\n9.3 The designated staff member will record details of the complaint and action taken in the Register of Complaints and Actions in Appendix E.\n\n9.4 The member club is obliged to comply with any declaration made by the Privacy Commissioner (for example, if the Privacy Commissioner declares that a certain activity of a member club is contrary to the Privacy Code and/or Privacy Act (see: Sections 52, 55(2) and 55A of the Privacy Act), that member club must not repeat or continue the relevant activity or conduct). In this regard, member clubs must provide all reasonable co-operation as requested by the Privacy Commissioner.\n\n9.5 The member club must ensure that each of the above steps are undertaken within a reasonably appropriate timeframe so that any decision (if any decision is required to be made) is made expeditiously and in a manner that does not compromise the integrity or quality of any such decision.\n\n10. Staff Training\n\n10.1 All staff will be provided with appropriate training regarding the Privacy Code so that they are aware of the content, procedures and application of the Privacy Code, including referring all privacy complainants to the designated staff member who would be the point of contact for privacy issues in the member club.\n\n10.2 In addition, the designated staff member who will be responsible for privacy issues will undergo further training so that he/she is well informed and better positioned to facilitate in instances where the complainant is required to first contact the club (respondent) before approaching the Privacy Commissioner.\n\n10.3 The member club will keep a record of all training in the Register of Training in Appendix F.\n\n11. Acceptance of and Release from the Privacy Code\n\n11.1 The Privacy Code is voluntary and the member club has a choice to either accept or not accept compliance with the Privacy Code.\n\n11.2 If the member club decides to accept the Privacy Code, the member club will then indicate its formal acceptance by completing the Acceptance of the Queensland Club Industry Privacy Code form in Appendix G.\n\n11.3 The member club can complete the Release from the Queensland Club Industry Privacy Code form in Appendix H at any time after formally accepting the Privacy Code, if the member club decides to opt out of the Privacy Code. However, if a complaint is instigated or made by a member or patron whilst the member club is (or was) bound by the Privacy Code, the member club will be required to resolve the matter to the extent provided in the Privacy Code.\n\n11.4 The member club can re-subscribe to the Privacy Code at any time after the date referred to in clause 11.3, provided it meets the requirements set out in clause 11.2 and makes a written application for re-subscription and receives written approval for re-subscription from the Code Administrator.\n\n11.5 Member clubs must return the completed forms/documents referred to in clauses 11.2, 11.3 and 11.4 to the Privacy Code Administrator (in person, by fax or post) to enable the Privacy Code Administrator to maintain accurate, complete and up-to-date electronic and paper records of the Privacy Code members, as required by the Privacy Commissioner.\n\n11.6 Member clubs that cease to be financial members of Clubs Queensland will automatically cease to be bound by the Privacy Code.\n\n11.7 Where a member club does not accept the Privacy Code, the NPPs will apply unless the member club is exempt from the operation of the Privacy Act\n\n12. Implementation of the Privacy Code\n\n12.1 Once the member club has accepted the Privacy Code, it will have all measures in place within one month of the date of the acceptance.\n\n12.2 The member club will inform members and patrons about the various aspects of the Privacy Code and will prominently display the availability of the Privacy Code in a suitable location in the club.\n\n12.3 The member club will undertake regular audits of the operation of the club privacy procedures to ensure that the procedures fully comply with the Privacy Code.\n\n12.4 The member club will lodge a report with the Privacy Commissioner on the operation of the Privacy Code and other matters as specified by the Privacy Commissioner within two months after the end of the financial year of the club. Specifically, this report will outline the number and nature of privacy complaints made against the member club and the amount of time spent dealing with privacy complaints. The report will be in an electronic form using the template issued by the Privacy Commissioner.\n\n13. Administration of the Privacy Code\n\n13.1 Clubs Queensland will adopt the role of the Privacy Code Administrator and will be responsible for the administration of the Privacy Code. It will allocate sufficient resources for the administration and continuity of the Privacy Code.\n\n13.2 The Privacy Code Administrator will liase with member clubs in relation to the implementation and compliance with the Privacy Code. Member clubs will direct any questions or feedback in relation to the Privacy Code to the Privacy Code Administrator.\n\n13.3 The Privacy Code Administrator will be responsible for (amongst other things) complying with the reporting and review requirements under the Privacy Code and Privacy Act.\n\n13.4 Each individual club will nominate a staff member who (amongst other things) will be responsible for the general administration of the Privacy Code at club level. The designated staff member, in addition to facilitating complaints as discussed above, must (amongst other things) report to the Privacy Code Administrator the number and nature of all complaints received and the amount of time spent dealing with each complaint.\n\n13.5 The nominated staff member of each member club must also advise the Privacy Code Administrator (in writing) of any systemic problems that they discover through their own complaint experiences. If any systemic problems are identified, then the Privacy Code Administrator will endeavour to address them appropriately and in accordance with the Privacy Act.\n\n13.6 The Privacy Code Administrator will also maintain an accurate, up to date easily accessible on-line record of Privacy Code members on its website, with a hypertext link to the Privacy Commissioner’s website.\n\n13.7 If any at any stage the Privacy Commissioner revokes the Privacy Code (in accordance with its powers under Section 18BE of the Privacy Act), the Privacy Code Administrator will advise the member clubs, public and all other interested parties accordingly.\n\n13.8 All member clubs and individuals are requested to contact Clubs Queensland to obtain any information they require about the Privacy Code Administrator.\n\n14. Review of the Privacy Code\n\n14.1 As the Privacy Code Administrator, Clubs Queensland will, in consultation with the public, its member clubs and other interested parties, review the Privacy Code at least every three years and is committed to allocating sufficient resources for the review process. The Privacy Code Administrator will provide the review report, with a response to the review report by the Privacy Code Administrator, to the Privacy Commissioner within 30 days of the review being finalised. The Privacy Code Administrator will make available a copy of the above review report to member clubs upon a written request.\n\n14.2 The Privacy Code Administrator will make necessary changes and amendments to the Privacy Code from time to time, in consultation with its member clubs, and will seek the approval of the changes and amendments from the Privacy Commissioner before incorporating the changes and amendments in the Privacy Code.\n\n14.3 Where the Privacy Code Administrator proposes major changes and amendments to the Privacy Code, it will (among other things) undertake adequate consultation with the public, its members clubs and other interested parties and include a report on the result of the consultation process with the application for approval for the variation of the Privacy Code to the Privacy Commissioner.\n\n\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\n\n \nAppendix A\n\n\\[Insert Approval Letter from the Privacy Commissioner\\]\n\n \nAppendix B\n\nSUMMARY OF NPPs\n\nMember clubs should note that this following summary of the NPPs (and any reference to the NPPs) is for information purposes only and member clubs and their members and/or patrons should refer to and comply with the Privacy Code’s Privacy Principles (as set out in Section 6 of this Privacy Code)\n\n| National Privacy Principles (NPPs) | Application |\n| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| NPP 1 – CollectionCollection of personal information must (among other things) be fair, lawful and not intrusive. A person, from whom information is being collected, must be told the organisation’s name, the purpose of collection, that the person can get access to their personal information and what happens if the organisation does not give the information. | Only applies to information collected after 21 December 2001(or for small businesses (not health services) applies to information collected after 21 December 2002). |\n| NPP 2 - Use and DisclosureAn organisation should only use or disclose information for the purpose it was collected unless the person has consented, or the secondary purpose is related to the primary purpose and a person would reasonably expect such use or disclosure, or the use is for direct marketing in specified circumstances, or in circumstances related to public interest such as law enforcement and public or individual health and safety. | Only applies to information collected after 21 December 2001(or for small businesses (not health services) applies to information collected after 21 December 2002). |\n| NPP 3 - Data QualityAn organisation must (among other things) take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to date. | In respect of collection, it only applies to information collected after 21 December 2001(or for small businesses (not health services) applies to information collected after 21 December 2002).In respect of use and disclosure, it applies regardless of when it was collected.(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected). |\n| NPP 4 - Data securityAn organisation must (among other things) take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure. | Applies regardless of when information was collected(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected). |\n| NPP 5 – OpennessAn organisation must have a policy document or Privacy Code outlining its information handling practices and make this available to anyone who asks. | Applies regardless of when information was collected(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected). |\n| NPP 6 - Access and correctionGenerally speaking, an organisation must give an individual access to personal information it holds about that individual on request. | If information already held is not used or disclosed, it only applies to information collected after 21 December 2001.But if information already held is used or disclosed after commencement of the Privacy Act, then rights of access and correction apply unless unreasonable administrative burden or cause the organisation unreasonable expense.(or for small businesses (not health services), applies to information collected after 21 December 2002, no exception like the above). |\n| NPP 7 - IdentifiersGenerally speaking, an organisation must not adopt, use or disclose, an identifier that has been assigned by a Commonwealth government agency (such as a Tax File Number). | Applies regardless of when information collected(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected). |\n| NPP 8 – AnonymityOrganisations must give people the option to interact anonymously whenever it is lawful and practicable to do. | Only applies to information collected after 21 December 2001(for small businesses, only applies to transactions entered into with an organisation after 21 December 2002). |\n| NPP 9 - Transborder Data FlowAn organisation can only (among other things) transfer personal information to a recipient in a foreign country where the foreign recipient has similar privacy restrictions imposed and in circumstances where the information will have appropriate protection. | Applies regardless of when information collected(for small business, delay in application until 21 December 2002, then applies regardless of when collected). |\n| NPP 10 - Sensitive InformationAn organisation must not collect sensitive information unless the individual about whom the information relates has consented, it is required by law, or in other specified circumstances, for example, relating to health services provision and individual or public health or safety. | Only applies to information collected after 21 December 2001(or for small businesses (not health services), applies to information collected after 21 December 2002). |\n\n \nAppendix C\n\n![](image.002.png) \nAppendix D\n\n###### ![](image.003.png) \nAppendix E\n\n###### ![](image.004.png)\n\n###### Appendix E\n\nAppendix F\n\n```html\n

REGISTER OF TRAINING

Staff Details Name/ ID

Read and signed the following documents

Other Privacy Training Undertaken (Date, Course Title, Certification etc)

Queensland Club Industry Privacy Code

In-house Procedures (eg: Privacy Complaint Resolution Procedures etc)

\n```\n\n###### \nAppendix G\n\n![](image.005.png) \nAppendix H\n\n![](image.006.png)","sortOrder":8},{"sectionNumber":"Collection of personal information must ","sectionType":"part","heading":"Collection of personal information must (among other things) be fair, lawful and not intrusive. A person, from whom information is being collected, must be told the organisation’s name, the purpose of collection, that the person can get access to their personal information and what happens if the organisation does not give the information.","content":"NPP 1 – Collection\n\n## Collection of personal information must (among other things) be fair, lawful and not intrusive. A person, from whom information is being collected, must be told the organisation’s name, the purpose of collection, that the person can get access to their personal information and what happens if the organisation does not give the information.","sortOrder":9},{"sectionNumber":"But if information already held is used ","sectionType":"part","heading":"But if information already held is used or disclosed after commencement of the Privacy Act, then rights of access and correction apply unless","content":"# But if information already held is used or disclosed after commencement of the Privacy Act, then rights of access and correction apply unless\n\n unreasonable administrative burden or\n\n cause the organisation unreasonable expense.\n\n(or for small businesses (not health services), applies to information collected after 21 December 2002, no exception like the above).","sortOrder":10},{"sectionNumber":"Appendix E","sectionType":"section","heading":"Appendix E","content":"###### ![](image.003.png) \nAppendix E\n\n###### ![](image.004.png)","sortOrder":11},{"sectionNumber":"Appendix G","sectionType":"section","heading":"Appendix G","content":"###### \nAppendix G\n\n![](image.005.png) \nAppendix H\n\n![](image.006.png)","sortOrder":13}],"analysis":{"kimi_summary":{"_metrics":{"model":"kimi-k2.5","source":"moonshot-realtime","completionTokens":2052},"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"This is the original 2001 code as approved by the Privacy Commissioner. It maintains its original intended scope as a voluntary, industry-specific replacement for the NPPs applicable to Queensland clubs, without evidence of subsequent expansion beyond that purpose."},"complexity_factors":["Cross-references to the *Privacy Act 1988* (Cth) and National Privacy Principles (NPPs)","Voluntary opt-in/opt-out mechanism with continuing liability for complaints arising during membership period","Multiple operational contexts requiring different treatment (gaming machines, liquor licensing, workplace health and safety, reciprocal members, contractors)","Nested exceptions for law enforcement access, commercial sensitivity, and transborder data flows","Administrative burden including mandatory staff training registers, complaint registers, annual reporting, and triennial reviews"],"plain_english_summary":"This voluntary privacy code, approved by the federal Privacy Commissioner and offered by Clubs Queensland, lets member clubs opt in to industry‑specific rules in place of the standard National Privacy Principles. It tailors obligations on collection, use, access/correction, security and overseas disclosures for clubs (RSLs, leagues and similar), requires practical safeguards and complaint handling, and is administered and reviewed by Clubs Queensland. It matters because it gives clubs a practical, legally‑compliant framework for managing member and patron data."},"flash_summary":{"complexity_score":5,"scope_assessment":{"changed":false,"description":"The text presents a self-contained, voluntary industry code applying to Clubs Queensland members and explains interaction with the Privacy Act and NPPs. There is no internal indication in the document that the code's scope was altered from its stated purpose: it binds opt-in clubs and leaves NPPs to apply where clubs do not accept the code (cl.11.1)."},"complexity_factors":["Interplay with Commonwealth Privacy Act and National Privacy Principles (NPPs) requiring cross-referencing and legal interpretation (Appendix B; cl.9.1).","Voluntary membership model with opt-in, opt-out and re-subscription procedures that affect who is bound and when (cl.11.1–11.5).","Administrative obligations on Clubs Queensland as Code Administrator, including reporting, review and maintaining member registers (cl.13.1–13.7, cl.14.1–14.3).","Operational compliance requirements for individual clubs: signage, staff training, designated contact officers, secure storage, registers and complaint registers (cl.6.3–6.5; cl.9.2; cl.10.1–10.3; Appendices C–F).","Complaint and enforcement linkage to the Privacy Commissioner and statutory powers (cl.8.1; cl.9.1; references to Sections 36, 52, 55(2), 55A of the Privacy Act).","Mixed substantive rules (collection, use, access, security, transborder transfers) that vary by timing of collection and by whether an entity is a 'small business', creating conditional application and exemptions (Appendix B summaries of NPP timing and scope).","Specific duties for transborder transfers and contractor relationships that may require consent or contractual assurances (cl.6.5; cl.7.4).","Recordkeeping and reporting format requirements (electronic template to Privacy Commissioner) create operational and IT burdens (cl.12.4)."],"plain_english_summary":"This is a voluntary privacy code for Queensland club industry members that implements the National Privacy Principles as club-level rules. Clubs that accept the code must adopt privacy policies, signage, staff training, complaint-handling, secure recordkeeping and annual reporting to the Privacy Commissioner (see cl.11.1, cl.12.4, cl.13.1). Member clubs pay the compliance costs; Clubs Queensland administers the code and the Privacy Commissioner handles enforcement and unresolved complaints. The code limits how clubs collect, use, disclose and transfer personal information and creates access and correction duties for clubs."}},"importantCases":[],"_links":{"self":"/api/acts/queensland-club-industry-privacy-code","history":"/api/acts/queensland-club-industry-privacy-code/history","analysis":"/api/acts/queensland-club-industry-privacy-code/analysis","conflicts":"/api/acts/queensland-club-industry-privacy-code/conflicts","importantCases":"/api/acts/queensland-club-industry-privacy-code/important-cases","documents":"/api/acts/queensland-club-industry-privacy-code/documents"}}