37Contraventions of privacy obligations in APP‑equivalent agreements

37 Contraventions of privacy obligations in APP‑equivalent agreements

(1) This section applies to an entity if the entity has an APP‑equivalent agreement with the Commonwealth. (2) An act or practice of the entity that contravenes a term of the agreement in relation to an individual and collecting, holding, using or disclosing their personal information is taken to be: (a) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and (b) covered by sections 13, 13G and 13H of that Act.

Note: An act or practice that is, or may be, an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.

(3) The entity is taken, for the purposes of Part V of the Privacy Act 1988 and any other provision of that Act that relates to that Part, to be an organisation (within the meaning of that Act) if: (a) an act or practice of the entity has contravened, or may have contravened, the term of the agreement in relation to an individual; and (b) the act or practice is the subject of a complaint to, or an investigation by, the Information Commissioner under Part V of the Privacy Act 1988. (4) Sections 80V and 80W of the Privacy Act 1988 apply in relation to the term of the agreement as if the term were a provision of that Act.