16EPrivacy coverage condition

16E Privacy coverage condition

(1) For the purposes of sections 13, 13A and 13B, the privacy coverage condition is met, in relation to an entity, if: (a) the entity is an APP entity; or (b) the Privacy Act 1988 applies to the entity, in relation to its collection and use of data as part of the project, as if the entity were an organisation within the meaning of that Act; or (c) the entity is subject to an APP‑equivalence term of the data sharing agreement in relation to its collection and use of data as part of the project; or (d) a law of a State or Territory that provides for all of the following applies in relation to the entity’s collection and use of data as part of the project: (i) protection of personal information comparable to that provided by the Australian Privacy Principles; (ii) monitoring of compliance with the law; (iii) a means for an individual to seek recourse if the individual’s personal information is dealt with in a way contrary to the law. (2) An APP‑equivalence term is a term of a data sharing agreement prohibiting an entity from collecting or using personal information under the agreement in any way that would, if the entity were an organisation within the meaning of the Privacy Act 1988, breach an Australian Privacy Principle. (3) An act or practice engaged in by an entity that is an organisation referred to in paragraphs 7B(2)(a) and (b) of the Privacy Act 1988 is not, despite subsection 7B(2) of that Act, exempt for the purposes of paragraph 7(1)(ee) of that Act if the act or practice is collecting or using personal information as part of a project.

Note: Paragraphs 7B(2)(a) and (b) of the Privacy Act 1988 refer to an organisation that would be a small business operator if it were not a contracted service provider for a Commonwealth contract (within the meaning of the Privacy Act 1988).

(4) Except as provided by subsection (3) and Part 3.3, nothing in this Act affects the operation of the Privacy Act 1988 in relation to a data scheme entity that is an APP entity.

Note: Part 3.3 (data breach responsibilities) deals with the relationship between this Act and the requirements of Part IIIC of the Privacy Act 1988 (notification of eligible data breaches).