The Information Privacy Act 2009 sets rules for how public sector agencies collect, store, use, disclose and manage personal information. It requires agencies and their contracted service providers to follow Queensland privacy principles, report and respond to eligible data breaches, keep registers and publish response policies, and gives the Information Commissioner investigative, guideline and compliance powers. It affects public agencies, their contractors and individuals whose data they hold; it matters because it allocates compliance costs to agencies and creates reporting duties and regulatory oversight.
The Information Privacy Act 2009 (Qld) governs how Queensland Government agencies collect, hold, use and disclose personal information. Its primary object under s 3 is to provide for the fair collection and handling of personal information in the public sector environment. The Act must be applied and interpreted to further that primary object.
The Act applies to Queensland public sector agencies (defined broadly in s 11 by reference to the Right to Information Act 2009 (Qld)) and to contracted service providers who perform government functions on behalf of agencies. It does not apply to private sector organisations, which are regulated under the Commonwealth Privacy Act 1988 where they are "organisations" under that Act.
The Act operates subject to other Acts that regulate personal information (s 7). Where a more specific piece of legislation governs privacy in a particular context (for example, the Health Practitioner Regulation National Law), that law prevails over the QPPs in the event of a conflict.
Section 6 establishes that the Act applies to the collection of personal information regardless of when it was collected, and to storage, handling, accessing, amendment, management, transfer, use and disclosure of personal information regardless of when it was collected.
Main concepts
Personal information. Defined in s 11 as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true, and whether or not the information or opinion is recorded in material form.
Current sections
Direct links to the current provisions in Information Privacy Act 2009.
301
ch.1-pt.1
Introductory
Introductory
sec.1
Short title
sec.1 Short title
This Act may be cited as the Information Privacy Act 2009 .
sec.2
Commencement
sec.2 Commencement
This Act commences on a day to be fixed by proclamation.
sec.3
Object of Act
sec.3 Object of Act
The primary object of this Act is to provide for the fair collection and handling in the public sector environment of personal information.
The Act must be applied and interpreted to further the primary object.
s 3 amd 2023 No. 32 s 8
(sec.3-ssec.1) The primary object of this Act is to provide for the fair collection and handling in the public sector environment of personal information.
(sec.3-ssec.2) The Act must be applied and interpreted to further the primary object.
sec.4
Section sec.4
s 4 om 2023 No. 32 s 9
sec.5
Section sec.5
s 5 om 2023 No. 32 s 9
sec.6
Scope of personal information under this Act
sec.6 Scope of personal information under this Act
This Act applies to the collection of personal information, regardless of when it came into existence, and to the storage, handling, accessing, amendment, management, transfer, use and disclosure of personal information regardless of when it was collected.
sec.7
Relationship with other laws regulating personal information
sec.7 Relationship with other laws regulating personal information
This Act is intended to operate subject to the provisions of other Acts regulating—
the collection, storage, handling, accessing, amendment, management, transfer and use of personal information; or
the disclosure, within the meaning of section 23 , of personal information.
Without limiting subsection (1) , the operation of QPPs 6.1 and 6.2(d) and the permitted health situation mentioned in schedule 4 , section 5 do not override any law with respect to assisted and substituted decision-making, including, for example, the Guardianship and Administration Act 2000 and the Powers of Attorney Act 1998 .
s 7 sub 2023 No. 32 s 10
(sec.7-ssec.1) This Act is intended to operate subject to the provisions of other Acts regulating— the collection, storage, handling, accessing, amendment, management, transfer and use of personal information; or the disclosure, within the meaning of section 23 , of personal information.
(sec.7-ssec.2) Without limiting subsection (1) , the operation of QPPs 6.1 and 6.2(d) and the permitted health situation mentioned in schedule 4 , section 5 do not override any law with respect to assisted and substituted decision-making, including, for example, the Guardianship and Administration Act 2000 and the Powers of Attorney Act 1998 .
(a) the collection, storage, handling, accessing, amendment, management, transfer and use of personal information; or
(b) the disclosure, within the meaning of section 23 , of personal information.
sec.8
Relationship with other Acts regulating disposal of information
sec.8 Relationship with other Acts regulating disposal of information
This Act does not affect the provisions of other Acts regulating the disposal of information (however described).
s 8 amd 2023 No. 33 s 107 sch 5
sec.9
Section sec.9
s 9 om 2023 No. 32 s 11
sec.10
Act binds State
sec.10 Act binds State
This Act binds the State.
ch.1-pt.2
Interpretation
Interpretation
sec.11
Definitions
sec.11 Definitions
The dictionary in schedule 5 defines particular words used in this Act.
sec.12
Meaning of personal information
sec.12 Meaning of personal information
Personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable from the information or opinion—
whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.
s 12 sub 2023 No. 32 s 12
(a) whether the information or opinion is true or not; and
(b) whether the information or opinion is recorded in a material form or not.
sec.13
Meaning of held or holds in relation to personal information
sec.13 Meaning of held or holds in relation to personal information
Personal information is held by a relevant entity, or the entity holds personal information, if the personal information is contained in a document in the possession, or under the control, of the relevant entity.
s 13 sub 2023 No. 32 s 12
sec.14
Section sec.14
s 14 om 2023 No. 32 s 12
sec.15
Meaning of document
sec.15 Meaning of document
In this Act, a document does not include a document to which the privacy principle requirements do not apply.
s 15 sub 2023 No. 32 s 13
sec.16
Meaning of document to which the privacy principle requirements do not apply
sec.16 Meaning of document to which the privacy principle requirements do not apply
In this Act, a document to which the privacy principle requirements do not apply means a document mentioned in schedule 1 .
s 16 sub 2023 No. 32 s 14
sec.17
Section sec.17
s 17 om 2023 No. 32 s 15
sec.18
Meaning of agency
sec.18 Meaning of agency
In this Act, an agency means—
a Minister; or
a department; or
a local government; or
a public authority.
However, in this Act, agency does not include an excluded entity.
For this Act—
a board, council, committee, subcommittee or other body established by government to help, or to perform functions connected with, an agency is not a separate agency, but is taken to be comprised within the agency; and
a reference to an agency includes a reference to a body that is taken to be comprised within the agency; and
a reference to local government includes a reference to the Wide Bay Water Corporation.
In this section—
excluded entity means—
an entity mentioned in schedule 2 , part 1 ; or
an entity mentioned in schedule 2 , part 2 in relation to the function mentioned in that part.
s 18 amd 2023 No. 32 s 16
(sec.18-ssec.1) In this Act, an agency means— a Minister; or a department; or a local government; or a public authority.
(sec.18-ssec.2) However, in this Act, agency does not include an excluded entity.
(sec.18-ssec.3) For this Act— a board, council, committee, subcommittee or other body established by government to help, or to perform functions connected with, an agency is not a separate agency, but is taken to be comprised within the agency; and a reference to an agency includes a reference to a body that is taken to be comprised within the agency; and a reference to local government includes a reference to the Wide Bay Water Corporation.
(sec.18-ssec.4) In this section— excluded entity means— an entity mentioned in schedule 2 , part 1 ; or an entity mentioned in schedule 2 , part 2 in relation to the function mentioned in that part.
(a) a Minister; or
(b) a department; or
(c) a local government; or
(d) a public authority.
(a) a board, council, committee, subcommittee or other body established by government to help, or to perform functions connected with, an agency is not a separate agency, but is taken to be comprised within the agency; and
(b) a reference to an agency includes a reference to a body that is taken to be comprised within the agency; and
(c) a reference to local government includes a reference to the Wide Bay Water Corporation.
(a) an entity mentioned in schedule 2 , part 1 ; or
(b) an entity mentioned in schedule 2 , part 2 in relation to the function mentioned in that part.
sec.19
Section sec.19
s 19 om 2023 No. 32 s 17
sec.20
Special provision about application of Act to a Minister
sec.20 Special provision about application of Act to a Minister
If a provision of this Act applies to a Minister, the provision applies only for acts done, or practices engaged in, as the case may be, in the Minister’s capacity as a Minister in relation to the affairs of an agency administered by the Minister.
s 20 amd 2023 No. 32 s 18
sec.21
Meaning of public authority
sec.21 Meaning of public authority
In this Act, public authority means any of the following entities—
Under the Acts Interpretation Act 1954 , schedule 1 —
entity includes a person and an unincorporated body.
an entity—
established for a public purpose by an Act; or
established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
an entity created by the Governor in Council or a Minister;
another entity declared by regulation to be a public authority for this Act, being an entity—
supported directly or indirectly by government funds or other government assistance; or
over which government is in a position to exercise control; or
established under an Act; or
given public functions under an Act;
subject to subsection (4) , a person holding an office established under an Act;
a person holding an appointment—
made by the Governor in Council or Minister otherwise than under an Act; and
declared by regulation to be an appointment the holder of which is a public authority for this Act.
For subsection (1) (c) , an entity may be declared by regulation to be a public authority for this Act in relation to only a part of the entity’s functions.
A prescribed entity is not a public authority in relation to documents received, or created, by it in performing a function other than the public function given under an Act.
A person is not a public authority merely because the person holds—
an office the duties of which are performed as duties of employment as an agency’s officer; or
an office of member of a body; or
an office established under an Act for the purposes of an agency.
In this section—
prescribed entity means an entity that is a public authority only because it is given public functions under an Act and is declared by regulation to be a public authority for this Act.
s 21 amd 2013 No. 39 s 110 (1) sch 3 pt 1 ; 2023 No. 32 s 19
(sec.21-ssec.1) In this Act, public authority means any of the following entities— Under the Acts Interpretation Act 1954 , schedule 1 — entity includes a person and an unincorporated body. an entity— established for a public purpose by an Act; or established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ; an entity created by the Governor in Council or a Minister; another entity declared by regulation to be a public authority for this Act, being an entity— supported directly or indirectly by government funds or other government assistance; or over which government is in a position to exercise control; or established under an Act; or given public functions under an Act; subject to subsection (4) , a person holding an office established under an Act; a person holding an appointment— made by the Governor in Council or Minister otherwise than under an Act; and declared by regulation to be an appointment the holder of which is a public authority for this Act.
(sec.21-ssec.2) For subsection (1) (c) , an entity may be declared by regulation to be a public authority for this Act in relation to only a part of the entity’s functions.
(sec.21-ssec.3) A prescribed entity is not a public authority in relation to documents received, or created, by it in performing a function other than the public function given under an Act.
(sec.21-ssec.4) A person is not a public authority merely because the person holds— an office the duties of which are performed as duties of employment as an agency’s officer; or an office of member of a body; or an office established under an Act for the purposes of an agency.
(sec.21-ssec.5) In this section— prescribed entity means an entity that is a public authority only because it is given public functions under an Act and is declared by regulation to be a public authority for this Act.
(a) an entity— (i) established for a public purpose by an Act; or (ii) established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
(i) established for a public purpose by an Act; or
(ii) established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
(b) an entity created by the Governor in Council or a Minister;
(c) another entity declared by regulation to be a public authority for this Act, being an entity— (i) supported directly or indirectly by government funds or other government assistance; or (ii) over which government is in a position to exercise control; or (iii) established under an Act; or (iv) given public functions under an Act;
(i) supported directly or indirectly by government funds or other government assistance; or
(ii) over which government is in a position to exercise control; or
(iii) established under an Act; or
(iv) given public functions under an Act;
(d) subject to subsection (4) , a person holding an office established under an Act;
(e) a person holding an appointment— (i) made by the Governor in Council or Minister otherwise than under an Act; and (ii) declared by regulation to be an appointment the holder of which is a public authority for this Act.
(i) made by the Governor in Council or Minister otherwise than under an Act; and
(ii) declared by regulation to be an appointment the holder of which is a public authority for this Act.
(i) established for a public purpose by an Act; or
(ii) established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
(i) supported directly or indirectly by government funds or other government assistance; or
(ii) over which government is in a position to exercise control; or
(iii) established under an Act; or
(iv) given public functions under an Act;
(i) made by the Governor in Council or Minister otherwise than under an Act; and
(ii) declared by regulation to be an appointment the holder of which is a public authority for this Act.
(a) an office the duties of which are performed as duties of employment as an agency’s officer; or
(b) an office of member of a body; or
(c) an office established under an Act for the purposes of an agency.
sec.22
Section sec.22
s 22 om 2023 No. 32 s 141 s ch 1 pt 2
sec.23
What it means to disclose personal information and to use personal information
sec.23 What it means to disclose personal information and to use personal information
An entity (the first entity ) discloses personal information to another entity (the second entity ) if—
the second entity does not know the personal information, and is not in a position to be able to find it out; and
the first entity gives the second entity the personal information, or places it in a position to be able to find it out; and
the first entity ceases to have control over the second entity in relation to who will know the personal information in the future.
An entity uses personal information if it—
manipulates, searches or otherwise deals with the information; or
takes the information into account in the making of a decision; or
transfers the information from a part of the entity having particular functions to a part of the entity having different functions.
Subsection (2) does not limit what actions may be use of the personal information.
However, use of the personal information does not include the action of disclosing the personal information to another entity.
s 23 amd 2023 No. 32 s 20
(sec.23-ssec.1) An entity (the first entity ) discloses personal information to another entity (the second entity ) if— the second entity does not know the personal information, and is not in a position to be able to find it out; and the first entity gives the second entity the personal information, or places it in a position to be able to find it out; and the first entity ceases to have control over the second entity in relation to who will know the personal information in the future.
(sec.23-ssec.2) An entity uses personal information if it— manipulates, searches or otherwise deals with the information; or takes the information into account in the making of a decision; or transfers the information from a part of the entity having particular functions to a part of the entity having different functions.
(sec.23-ssec.3) Subsection (2) does not limit what actions may be use of the personal information.
(sec.23-ssec.4) However, use of the personal information does not include the action of disclosing the personal information to another entity.
(a) the second entity does not know the personal information, and is not in a position to be able to find it out; and
(b) the first entity gives the second entity the personal information, or places it in a position to be able to find it out; and
(c) the first entity ceases to have control over the second entity in relation to who will know the personal information in the future.
(a) manipulates, searches or otherwise deals with the information; or
(b) takes the information into account in the making of a decision; or
(c) transfers the information from a part of the entity having particular functions to a part of the entity having different functions.
sec.24
References to doing an act or engaging in a practice
sec.24 References to doing an act or engaging in a practice
In this Act, a reference to doing an act or engaging in a practice in contravention of a requirement includes a reference to a failure to act or a failure to engage in a practice in contravention of the requirement.
s 24 sub 2023 No. 32 s 21
sec.25
Section sec.25
s 25 om 2023 No. 32 s 21
ch.2-pt.1
Compliance with QPPs by agencies
Compliance with QPPs by agencies
sec.26
Queensland privacy principles
sec.26 Queensland privacy principles
Each Queensland privacy principle ( QPP ) is set out in schedule 3 .
In this Act, a reference to a QPP followed by a number is a reference to the provision of schedule 3 having that number.
s 26 sub 2023 No. 32 s 22
(sec.26-ssec.1) Each Queensland privacy principle ( QPP ) is set out in schedule 3 .
(sec.26-ssec.2) In this Act, a reference to a QPP followed by a number is a reference to the provision of schedule 3 having that number.
sec.27
Agencies to comply with QPPs
sec.27 Agencies to comply with QPPs
An agency must comply with the QPPs.
For the application of the Act in relation to a Minister, see also section 20 .
Without limiting subsection (1) , the agency must not do an act or engage in a practice that contravenes, or is otherwise inconsistent with, a requirement of a QPP.
An act or practice mentioned in subsection (2) includes any act or practice relating to the agency’s collection, storage, handling, accessing, amendment, management, transfer, use or disclosure of personal information.
s 27 amd 2011 No. 32 s 332 sch 1 pt 2 (amd 2012 No. 9 s 47 ); 2023 No. 32 s 23
(sec.27-ssec.1) An agency must comply with the QPPs. For the application of the Act in relation to a Minister, see also section 20 .
(sec.27-ssec.2) Without limiting subsection (1) , the agency must not do an act or engage in a practice that contravenes, or is otherwise inconsistent with, a requirement of a QPP.
(sec.27-ssec.3) An act or practice mentioned in subsection (2) includes any act or practice relating to the agency’s collection, storage, handling, accessing, amendment, management, transfer, use or disclosure of personal information.
sec.28
Noncompliance with particular QPPs
sec.28 Noncompliance with particular QPPs
An agency is not required to comply with a prescribed QPP in relation to an individual’s personal information if the information is related to or connected with personal information of the individual that has previously been published, or given for the purpose of publication, by the individual.
In this section—
prescribed QPP means QPP 6 or 10.2.
publish , for personal information, means publish the information by way of television, newspaper, radio, internet or other form of communication.
s 28 amd 2023 No. 32 s 24
(sec.28-ssec.1) An agency is not required to comply with a prescribed QPP in relation to an individual’s personal information if the information is related to or connected with personal information of the individual that has previously been published, or given for the purpose of publication, by the individual.
(sec.28-ssec.2) In this section— prescribed QPP means QPP 6 or 10.2. publish , for personal information, means publish the information by way of television, newspaper, radio, internet or other form of communication.
sec.29
Special provision for law enforcement agencies
sec.29 Special provision for law enforcement agencies
A law enforcement agency is not subject to QPP 3.6, 5, 6 or 10.1, but only if the law enforcement agency is satisfied on reasonable grounds that noncompliance with the QPP is necessary for—
if the enforcement agency is the Queensland Police Service—the performance of its activities related to the enforcement of laws; or
if the enforcement agency is the Crime and Corruption Commission—the performance of its activities related to the enforcement of laws and its intelligence functions; or
if the enforcement agency is the community safety department—the containment, supervision and rehabilitation of offenders under the Corrective Services Act 2006 and the supervision of prisoners subject to supervision orders or interim supervision orders under the Dangerous Prisoners (Sexual Offenders) Act 2003 ; or
if the enforcement agency is any other law enforcement agency—the performance of its responsibility mentioned in schedule 5 , definition law enforcement agency , paragraph (b) (iv) , including the conduct of proceedings started or about to be started in a court or tribunal in relation to the responsibility.
In this section—
intelligence functions means the functions mentioned in the Crime and Corruption Act 2001 , section 53 .
s 29 amd 2011 No. 45 s 233 ; 2014 No. 21 s 94 (2) sch 2 ; 2023 No. 32 s 25
(sec.29-ssec.1) A law enforcement agency is not subject to QPP 3.6, 5, 6 or 10.1, but only if the law enforcement agency is satisfied on reasonable grounds that noncompliance with the QPP is necessary for— if the enforcement agency is the Queensland Police Service—the performance of its activities related to the enforcement of laws; or if the enforcement agency is the Crime and Corruption Commission—the performance of its activities related to the enforcement of laws and its intelligence functions; or if the enforcement agency is the community safety department—the containment, supervision and rehabilitation of offenders under the Corrective Services Act 2006 and the supervision of prisoners subject to supervision orders or interim supervision orders under the Dangerous Prisoners (Sexual Offenders) Act 2003 ; or if the enforcement agency is any other law enforcement agency—the performance of its responsibility mentioned in schedule 5 , definition law enforcement agency , paragraph (b) (iv) , including the conduct of proceedings started or about to be started in a court or tribunal in relation to the responsibility.
(sec.29-ssec.2) In this section— intelligence functions means the functions mentioned in the Crime and Corruption Act 2001 , section 53 .
(a) if the enforcement agency is the Queensland Police Service—the performance of its activities related to the enforcement of laws; or
(b) if the enforcement agency is the Crime and Corruption Commission—the performance of its activities related to the enforcement of laws and its intelligence functions; or
(c) if the enforcement agency is the community safety department—the containment, supervision and rehabilitation of offenders under the Corrective Services Act 2006 and the supervision of prisoners subject to supervision orders or interim supervision orders under the Dangerous Prisoners (Sexual Offenders) Act 2003 ; or
(d) if the enforcement agency is any other law enforcement agency—the performance of its responsibility mentioned in schedule 5 , definition law enforcement agency , paragraph (b) (iv) , including the conduct of proceedings started or about to be started in a court or tribunal in relation to the responsibility.
ch.2-pt.2
Disclosure of personal information outside Australia
Disclosure of personal information outside Australia
sec.30
Section sec.30
s 30 amd 2011 No. 32 s 332 sch 1 pt 2 (amd 2012 No. 9 s 47 )
om 2023 No. 32 s 26
sec.31
Section sec.31
s 31 amd 2011 No. 32 s 332 sch 1 pt 2 (amd 2012 No. 9 s 47 )
om 2023 No. 32 s 26
sec.32
Section sec.32
s 32 amd 2011 No. 32 s 332 sch 1 pt 2 (amd 2012 No. 9 s 47 )
om 2023 No. 32 s 26
sec.33
Disclosure of personal information outside Australia
sec.33 Disclosure of personal information outside Australia
An agency may disclose an individual’s personal information to an entity outside Australia only if—
the individual agrees to the disclosure; or
the disclosure is authorised or required under a law; or
the agency is satisfied on reasonable grounds that the disclosure is necessary to lessen or prevent a serious threat to the life, health, safety or welfare of an individual, or to public health, safety or welfare; or
2 or more of the following apply—
the agency reasonably believes that the recipient of the personal information is subject to a law, binding scheme or contract that effectively upholds principles for the fair handling of personal information that are substantially similar to the QPPs;
the disclosure is necessary for the performance of the agency’s functions in relation to the individual;
the disclosure is for the benefit of the individual but it is not practicable to seek the agreement of the individual, and if it were practicable to seek the agreement of the individual, the individual would be likely to give the agreement;
the agency has taken reasonable steps to ensure that the personal information it discloses will not be held, used or disclosed by the recipient of the information in a way that is inconsistent with the QPPs.
s 33 amd 2011 No. 32 s 332 sch 1 pt 2 (amd 2012 No. 9 s 47 ); 2023 No. 32 s 28
(a) the individual agrees to the disclosure; or
(b) the disclosure is authorised or required under a law; or
(c) the agency is satisfied on reasonable grounds that the disclosure is necessary to lessen or prevent a serious threat to the life, health, safety or welfare of an individual, or to public health, safety or welfare; or
(d) 2 or more of the following apply— (i) the agency reasonably believes that the recipient of the personal information is subject to a law, binding scheme or contract that effectively upholds principles for the fair handling of personal information that are substantially similar to the QPPs; (ii) the disclosure is necessary for the performance of the agency’s functions in relation to the individual; (iii) the disclosure is for the benefit of the individual but it is not practicable to seek the agreement of the individual, and if it were practicable to seek the agreement of the individual, the individual would be likely to give the agreement; (iv) the agency has taken reasonable steps to ensure that the personal information it discloses will not be held, used or disclosed by the recipient of the information in a way that is inconsistent with the QPPs.
(i) the agency reasonably believes that the recipient of the personal information is subject to a law, binding scheme or contract that effectively upholds principles for the fair handling of personal information that are substantially similar to the QPPs;
(ii) the disclosure is necessary for the performance of the agency’s functions in relation to the individual;
(iii) the disclosure is for the benefit of the individual but it is not practicable to seek the agreement of the individual, and if it were practicable to seek the agreement of the individual, the individual would be likely to give the agreement;
(iv) the agency has taken reasonable steps to ensure that the personal information it discloses will not be held, used or disclosed by the recipient of the information in a way that is inconsistent with the QPPs.
(i) the agency reasonably believes that the recipient of the personal information is subject to a law, binding scheme or contract that effectively upholds principles for the fair handling of personal information that are substantially similar to the QPPs;
(ii) the disclosure is necessary for the performance of the agency’s functions in relation to the individual;
(iii) the disclosure is for the benefit of the individual but it is not practicable to seek the agreement of the individual, and if it were practicable to seek the agreement of the individual, the individual would be likely to give the agreement;
(iv) the agency has taken reasonable steps to ensure that the personal information it discloses will not be held, used or disclosed by the recipient of the information in a way that is inconsistent with the QPPs.
ch.2-pt.3
Compliance with parts 1 and 2 and s 41 by contracted service providers
Compliance with parts 1 and 2 and s 41 by contracted service providers
sec.34
Meaning of service arrangement
sec.34 Meaning of service arrangement
In this Act, a service arrangement is a contract or other arrangement entered into after the commencement of this section under which an entity other than an agency (the contracted service provider ) agrees or otherwise arranges with an agency (the contracting agency ) to provide services.
For subsection (1) —
the services must be for the purposes of the performance of 1 or more of the contracting agency’s functions; and
the services must be provided either—
directly to the contracting agency; or
to another entity on the contracting agency’s behalf; and
the contracted service provider must not be in the capacity of employee of the contracting agency in providing the services.
(sec.34-ssec.1) In this Act, a service arrangement is a contract or other arrangement entered into after the commencement of this section under which an entity other than an agency (the contracted service provider ) agrees or otherwise arranges with an agency (the contracting agency ) to provide services.
(sec.34-ssec.2) For subsection (1) — the services must be for the purposes of the performance of 1 or more of the contracting agency’s functions; and the services must be provided either— directly to the contracting agency; or to another entity on the contracting agency’s behalf; and the contracted service provider must not be in the capacity of employee of the contracting agency in providing the services.
(a) the services must be for the purposes of the performance of 1 or more of the contracting agency’s functions; and
(b) the services must be provided either— (i) directly to the contracting agency; or (ii) to another entity on the contracting agency’s behalf; and
(i) directly to the contracting agency; or
(ii) to another entity on the contracting agency’s behalf; and
(c) the contracted service provider must not be in the capacity of employee of the contracting agency in providing the services.
(i) directly to the contracting agency; or
(ii) to another entity on the contracting agency’s behalf; and
sec.35
Binding a contracted service provider to privacy principle requirements
sec.35 Binding a contracted service provider to privacy principle requirements
An agency entering into a service arrangement must take all reasonable steps to ensure that the contracted service provider is required to comply with parts 1 and 2 and section 41 , as if it were the agency, in relation to the discharge of its obligations under the arrangement.
However, the agency must comply with subsection (1) only if—
the contracted service provider will in any way deal with personal information for the contracting agency; or
the provision of services under the arrangement will involve—
the transfer of personal information to the contracting agency; or
the provision of services to a third party for the contracting agency.
The agency is not required to comply with subsection (1) if—
the contracted service provider is to receive funding from the contracting agency; and
the contracted service provider will not collect personal information for the contracting agency; and
the contracted service provider will not receive any personal information from the contracting agency for the purposes of discharging its obligations; and
the contracted service provider will not be required to give the contracting agency any personal information it collects in discharging its obligations.
Subsections (1) to (3) are not intended to limit what may be provided for in a service arrangement about the contracted service provider’s collection, storage, handling, accessing, amendment, management, transfer, use or disclosure of personal information, whether or not the contracted service provider is a bound contracted service provider.
s 35 amd 2023 No. 32 s 30
(sec.35-ssec.1) An agency entering into a service arrangement must take all reasonable steps to ensure that the contracted service provider is required to comply with parts 1 and 2 and section 41 , as if it were the agency, in relation to the discharge of its obligations under the arrangement.
(sec.35-ssec.2) However, the agency must comply with subsection (1) only if— the contracted service provider will in any way deal with personal information for the contracting agency; or the provision of services under the arrangement will involve— the transfer of personal information to the contracting agency; or the provision of services to a third party for the contracting agency.
(sec.35-ssec.3) The agency is not required to comply with subsection (1) if— the contracted service provider is to receive funding from the contracting agency; and the contracted service provider will not collect personal information for the contracting agency; and the contracted service provider will not receive any personal information from the contracting agency for the purposes of discharging its obligations; and the contracted service provider will not be required to give the contracting agency any personal information it collects in discharging its obligations.
(sec.35-ssec.4) Subsections (1) to (3) are not intended to limit what may be provided for in a service arrangement about the contracted service provider’s collection, storage, handling, accessing, amendment, management, transfer, use or disclosure of personal information, whether or not the contracted service provider is a bound contracted service provider.
(a) the contracted service provider will in any way deal with personal information for the contracting agency; or
(b) the provision of services under the arrangement will involve— (i) the transfer of personal information to the contracting agency; or (ii) the provision of services to a third party for the contracting agency.
(i) the transfer of personal information to the contracting agency; or
(ii) the provision of services to a third party for the contracting agency.
(i) the transfer of personal information to the contracting agency; or
(ii) the provision of services to a third party for the contracting agency.
(a) the contracted service provider is to receive funding from the contracting agency; and
(b) the contracted service provider will not collect personal information for the contracting agency; and
(c) the contracted service provider will not receive any personal information from the contracting agency for the purposes of discharging its obligations; and
(d) the contracted service provider will not be required to give the contracting agency any personal information it collects in discharging its obligations.
sec.36
Bound contracted service provider to comply with privacy principle requirements
sec.36 Bound contracted service provider to comply with privacy principle requirements
A bound contracted service provider under a service arrangement must comply with parts 1 and 2 and section 41 in relation to the discharge of its obligations under the arrangement as if it were the entity that is the contracting agency.
The requirement to comply under subsection (1) continues to apply to the bound contracted service provider in relation to personal information it continues to hold after its obligations under the service arrangement otherwise end.
A bound contracted service provider’s compliance with the privacy principle requirements may be enforced under this Act as if it were an agency.
Subsections (1) to (3) are not intended to prevent a service arrangement from including a requirement for the contracted service provider to comply with all or part of the privacy principles even though this part does not require that the service arrangement include the requirement.
s 36 amd 2023 No. 32 ss 31 , 141 s ch 1 pt 2 amdt 4 (amdt could not be given effect)
(sec.36-ssec.1) A bound contracted service provider under a service arrangement must comply with parts 1 and 2 and section 41 in relation to the discharge of its obligations under the arrangement as if it were the entity that is the contracting agency.
(sec.36-ssec.2) The requirement to comply under subsection (1) continues to apply to the bound contracted service provider in relation to personal information it continues to hold after its obligations under the service arrangement otherwise end.
(sec.36-ssec.3) A bound contracted service provider’s compliance with the privacy principle requirements may be enforced under this Act as if it were an agency.
(sec.36-ssec.4) Subsections (1) to (3) are not intended to prevent a service arrangement from including a requirement for the contracted service provider to comply with all or part of the privacy principles even though this part does not require that the service arrangement include the requirement.
sec.37
Contracting agency to comply with privacy principles if contracted service provider not bound
sec.37 Contracting agency to comply with privacy principles if contracted service provider not bound
This section applies if a contracted service provider under a service arrangement is not a bound contracted service provider because the contracting agency under the service arrangement did not take the steps required of it under section 35 .
The obligations that would attach to the contracted service provider if it were a bound contracted service provider attach instead to the contracting agency under the arrangement.
(sec.37-ssec.1) This section applies if a contracted service provider under a service arrangement is not a bound contracted service provider because the contracting agency under the service arrangement did not take the steps required of it under section 35 .
(sec.37-ssec.2) The obligations that would attach to the contracted service provider if it were a bound contracted service provider attach instead to the contracting agency under the arrangement.
ch.2-pt.5
Provision of information to Ministers
Provision of information to Ministers
sec.38
Personal information relevant to portfolio responsibilities
sec.38 Personal information relevant to portfolio responsibilities
An agency does not contravene the requirement under this Act that it comply with the QPPs only because it gives personal information to a Minister to inform the Minister about matters relevant to the Minister’s responsibilities in relation to the agency.
s 38 amd 2023 No. 32 s 32
ch.2-pt.6
Miscellaneous
Miscellaneous
sec.39
Nature of rights created by pts 1 to 3
sec.39 Nature of rights created by pts 1 to 3
Except as provided for under the procedures set out in this Act, an obligation imposed on an entity under part 1 , 2 or 3 does not—
give rise to any civil cause of action; or
operate to create in any person any legal right enforceable in a court or tribunal.
Subsection (1) does not limit chapter 5 .
(sec.39-ssec.1) Except as provided for under the procedures set out in this Act, an obligation imposed on an entity under part 1 , 2 or 3 does not— give rise to any civil cause of action; or operate to create in any person any legal right enforceable in a court or tribunal.
(sec.39-ssec.2) Subsection (1) does not limit chapter 5 .
(a) give rise to any civil cause of action; or
(b) operate to create in any person any legal right enforceable in a court or tribunal.
ch.3-pt.1
QPP codes
QPP codes
sec.40
QPP codes
sec.40 QPP codes
A QPP code is a written code of practice about information privacy, approved by regulation under section 43 , that states—
how 1 or more of the QPPs are to be applied or complied with; and
the agencies that are bound by the code, or a way of determining the agencies that are bound by the code.
A QPP code may also impose additional requirements to those imposed by a QPP, to the extent the additional requirements are not inconsistent with a QPP.
A QPP code expires on the earlier of the following days—
the day that is 5 years after the day the QPP code is approved under section 43 ;
if the QPP code states an expiry day—the stated day.
s 40 sub 2023 No. 32 s 33
(sec.40-ssec.1) A QPP code is a written code of practice about information privacy, approved by regulation under section 43 , that states— how 1 or more of the QPPs are to be applied or complied with; and the agencies that are bound by the code, or a way of determining the agencies that are bound by the code.
(sec.40-ssec.2) A QPP code may also impose additional requirements to those imposed by a QPP, to the extent the additional requirements are not inconsistent with a QPP.
(sec.40-ssec.3) A QPP code expires on the earlier of the following days— the day that is 5 years after the day the QPP code is approved under section 43 ; if the QPP code states an expiry day—the stated day.
(a) how 1 or more of the QPPs are to be applied or complied with; and
(b) the agencies that are bound by the code, or a way of determining the agencies that are bound by the code.
(a) the day that is 5 years after the day the QPP code is approved under section 43 ;
(b) if the QPP code states an expiry day—the stated day.
sec.41
Agencies must comply with QPP codes
sec.41 Agencies must comply with QPP codes
An agency must not do an act, or engage in a practice, that contravenes a QPP code that is in effect and binds the agency.
s 41 sub 2023 No. 32 s 33
sec.42
Preparing QPP codes
sec.42 Preparing QPP codes
The information commissioner or an agency may prepare a draft QPP code or draft amendment of a QPP code and submit the draft to the Minister for endorsement.
However, before the information commissioner or agency submits the draft code or amendment to the Minister, the commissioner or agency must—
publish the draft on an accessible agency website; and
invite the public to make submissions to the commissioner or agency about the draft within a stated period of at least 20 business days; and
consider any submissions made within the stated period.
An agency must, immediately after publishing a draft QPP code or draft amendment of a QPP code under subsection (2) , notify the information commissioner of the publication.
s 42 amd 2022 No. 34 s 365 sch 3
sub 2023 No. 32 s 33
(sec.42-ssec.1) The information commissioner or an agency may prepare a draft QPP code or draft amendment of a QPP code and submit the draft to the Minister for endorsement.
(sec.42-ssec.2) However, before the information commissioner or agency submits the draft code or amendment to the Minister, the commissioner or agency must— publish the draft on an accessible agency website; and invite the public to make submissions to the commissioner or agency about the draft within a stated period of at least 20 business days; and consider any submissions made within the stated period.
(sec.42-ssec.3) An agency must, immediately after publishing a draft QPP code or draft amendment of a QPP code under subsection (2) , notify the information commissioner of the publication.
(a) publish the draft on an accessible agency website; and
(b) invite the public to make submissions to the commissioner or agency about the draft within a stated period of at least 20 business days; and
(c) consider any submissions made within the stated period.
sec.43
Approval of QPP codes or amendments of QPP codes
sec.43 Approval of QPP codes or amendments of QPP codes
This section applies if a draft QPP code or draft amendment of a QPP code is submitted to the Minister under section 42 .
If the draft is submitted by an agency, the Minister must ask the information commissioner for submissions about the draft.
The Minister must decide to endorse or refuse to endorse the draft, having regard to—
any submissions made by the information commissioner; and
any other relevant matter.
If the Minister endorses the draft, the Minister must recommend to the Governor in Council the making of a regulation approving the QPP code or amended QPP code.
The QPP code or amended QPP code—
does not take effect unless it is approved by regulation; and
takes effect on the day prescribed by regulation for the code or amended code.
The information commissioner must, as soon as practicable after a regulation approving a QPP code or amended QPP code is made, publish the code or amended code on the commissioner’s website.
s 43 amd 2012 No. 6 s 27 sch amdts 2(1)(b), (2)
sub 2023 No. 32 s 33
(sec.43-ssec.1) This section applies if a draft QPP code or draft amendment of a QPP code is submitted to the Minister under section 42 .
(sec.43-ssec.2) If the draft is submitted by an agency, the Minister must ask the information commissioner for submissions about the draft.
(sec.43-ssec.3) The Minister must decide to endorse or refuse to endorse the draft, having regard to— any submissions made by the information commissioner; and any other relevant matter.
(sec.43-ssec.4) If the Minister endorses the draft, the Minister must recommend to the Governor in Council the making of a regulation approving the QPP code or amended QPP code.
(sec.43-ssec.5) The QPP code or amended QPP code— does not take effect unless it is approved by regulation; and takes effect on the day prescribed by regulation for the code or amended code.
(sec.43-ssec.6) The information commissioner must, as soon as practicable after a regulation approving a QPP code or amended QPP code is made, publish the code or amended code on the commissioner’s website.
(a) any submissions made by the information commissioner; and
(b) any other relevant matter.
(a) does not take effect unless it is approved by regulation; and
(b) takes effect on the day prescribed by regulation for the code or amended code.
ch.3-pt.2
Guideline for permitted general situations
Guideline for permitted general situations
sec.44
Preparing guideline
sec.44 Preparing guideline
The information commissioner may—
prepare a draft guideline about the collection, use or disclosure of personal information to assist an entity locate a person who has been reported as missing; and
submit the draft to the Minister for endorsement.
However, before the information commissioner submits the draft guideline to the Minister, the commissioner must—
publish the draft on the commissioner’s website; and
invite the public to make submissions to the commissioner about the draft within a stated period of at least 20 business days; and
consider any submissions made within the stated period.
s 44 amd 2012 No. 6 s 27 sch amdts 2(1)(b), (2)
sub 2023 No. 32 s 33
(sec.44-ssec.1) The information commissioner may— prepare a draft guideline about the collection, use or disclosure of personal information to assist an entity locate a person who has been reported as missing; and submit the draft to the Minister for endorsement.
(sec.44-ssec.2) However, before the information commissioner submits the draft guideline to the Minister, the commissioner must— publish the draft on the commissioner’s website; and invite the public to make submissions to the commissioner about the draft within a stated period of at least 20 business days; and consider any submissions made within the stated period.
(a) prepare a draft guideline about the collection, use or disclosure of personal information to assist an entity locate a person who has been reported as missing; and
(b) submit the draft to the Minister for endorsement.
(a) publish the draft on the commissioner’s website; and
(b) invite the public to make submissions to the commissioner about the draft within a stated period of at least 20 business days; and
(c) consider any submissions made within the stated period.
sec.45
Approval of guideline
sec.45 Approval of guideline
This section applies if a draft guideline is submitted to the Minister under section 44 .
The Minister must decide to endorse or refuse to endorse the draft.
If the Minister endorses the draft, the Minister must recommend to the Governor in Council the making of a regulation approving the guideline.
The guideline—
does not take effect unless it is approved by regulation; and
takes effect on the day prescribed by regulation for the guideline; and
expires 5 years after the day mentioned in paragraph (b) .
The information commissioner must, as soon as practicable after a regulation approving a guideline is made under this section, publish the guideline on the commissioner’s website.
s 45 amd 2017 No. 17 s 118
sub 2023 No. 32 s 33
(sec.45-ssec.1) This section applies if a draft guideline is submitted to the Minister under section 44 .
(sec.45-ssec.2) The Minister must decide to endorse or refuse to endorse the draft.
(sec.45-ssec.3) If the Minister endorses the draft, the Minister must recommend to the Governor in Council the making of a regulation approving the guideline.
(sec.45-ssec.4) The guideline— does not take effect unless it is approved by regulation; and takes effect on the day prescribed by regulation for the guideline; and expires 5 years after the day mentioned in paragraph (b) .
(sec.45-ssec.5) The information commissioner must, as soon as practicable after a regulation approving a guideline is made under this section, publish the guideline on the commissioner’s website.
(a) does not take effect unless it is approved by regulation; and
(b) takes effect on the day prescribed by regulation for the guideline; and
(c) expires 5 years after the day mentioned in paragraph (b) .
ch.3A-pt.1
Preliminary
Preliminary
sec.46
Application of chapter
sec.46 Application of chapter
This chapter applies in relation to personal information, other than personal information in a document to which the privacy principle requirements do not apply, held by an agency.
s 46 sub 2023 No. 32 s 33
sec.47
Meaning of eligible data breach
sec.47 Meaning of eligible data breach
An eligible data breach of an agency is a data breach of the agency that occurs in relation to personal information held by the agency if—
both of the following apply—
the data breach involves unauthorised access to, or unauthorised disclosure of, the personal information;
the access or disclosure is likely to result in serious harm to an individual (an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) ; or
the data breach involves the personal information being lost in circumstances where—
unauthorised access to, or unauthorised disclosure of, the personal information is likely to occur; and
if the unauthorised access to or unauthorised disclosure of the personal information were to occur, it would be likely to result in serious harm to an individual (also an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) .
For subsection (1) (a) (ii) and (b)(ii), the matters are—
the kind of personal information accessed, disclosed or lost; and
the sensitivity of the personal information; and
whether the personal information is protected by 1 or more security measures; and
if the personal information is protected by 1 or more security measures—the likelihood that any of those security measures could be overcome; and
the persons, or the kinds of persons, who have obtained, or who could obtain, the personal information; and
the nature of the harm likely to result from the data breach; and
any other relevant matter.
s 47 sub 2023 No. 32 s 33
(sec.47-ssec.1) An eligible data breach of an agency is a data breach of the agency that occurs in relation to personal information held by the agency if— both of the following apply— the data breach involves unauthorised access to, or unauthorised disclosure of, the personal information; the access or disclosure is likely to result in serious harm to an individual (an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) ; or the data breach involves the personal information being lost in circumstances where— unauthorised access to, or unauthorised disclosure of, the personal information is likely to occur; and if the unauthorised access to or unauthorised disclosure of the personal information were to occur, it would be likely to result in serious harm to an individual (also an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) .
(sec.47-ssec.2) For subsection (1) (a) (ii) and (b)(ii), the matters are— the kind of personal information accessed, disclosed or lost; and the sensitivity of the personal information; and whether the personal information is protected by 1 or more security measures; and if the personal information is protected by 1 or more security measures—the likelihood that any of those security measures could be overcome; and the persons, or the kinds of persons, who have obtained, or who could obtain, the personal information; and the nature of the harm likely to result from the data breach; and any other relevant matter.
(a) both of the following apply— (i) the data breach involves unauthorised access to, or unauthorised disclosure of, the personal information; (ii) the access or disclosure is likely to result in serious harm to an individual (an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) ; or
(i) the data breach involves unauthorised access to, or unauthorised disclosure of, the personal information;
(ii) the access or disclosure is likely to result in serious harm to an individual (an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) ; or
(b) the data breach involves the personal information being lost in circumstances where— (i) unauthorised access to, or unauthorised disclosure of, the personal information is likely to occur; and (ii) if the unauthorised access to or unauthorised disclosure of the personal information were to occur, it would be likely to result in serious harm to an individual (also an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) .
(i) unauthorised access to, or unauthorised disclosure of, the personal information is likely to occur; and
(ii) if the unauthorised access to or unauthorised disclosure of the personal information were to occur, it would be likely to result in serious harm to an individual (also an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) .
(i) the data breach involves unauthorised access to, or unauthorised disclosure of, the personal information;
(ii) the access or disclosure is likely to result in serious harm to an individual (an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) ; or
(i) unauthorised access to, or unauthorised disclosure of, the personal information is likely to occur; and
(ii) if the unauthorised access to or unauthorised disclosure of the personal information were to occur, it would be likely to result in serious harm to an individual (also an affected individual ) to whom the personal information relates, having regard to the matters stated in subsection (2) .
(a) the kind of personal information accessed, disclosed or lost; and
(b) the sensitivity of the personal information; and
(c) whether the personal information is protected by 1 or more security measures; and
(d) if the personal information is protected by 1 or more security measures—the likelihood that any of those security measures could be overcome; and
(e) the persons, or the kinds of persons, who have obtained, or who could obtain, the personal information; and
(f) the nature of the harm likely to result from the data breach; and
(g) any other relevant matter.
ch.3A-pt.2
Assessment of suspected eligible data breaches
Assessment of suspected eligible data breaches
sec.48
Obligations of agencies in relation to data breaches
sec.48 Obligations of agencies in relation to data breaches
This section applies in relation to a data breach of an agency if the agency knows, or reasonably suspects, that the data breach is an eligible data breach of the agency.
The agency must—
immediately, and continue to, take all reasonable steps to—
contain the data breach; and
mitigate the harm caused by the data breach; and
if the agency does not know whether the data breach is an eligible data breach of the agency—assess whether there are reasonable grounds to believe the data breach is an eligible data breach of the agency.
An assessment under subsection (2) (b) must be completed within—
30 days after the suspicion mentioned in subsection (1) was formed; or
if the period mentioned in paragraph (a) is extended under section 49 —the extended period.
If, at any time, the agency becomes aware the data breach may affect another agency, the agency must give a written notice to the other agency of the data breach that includes—
a description of the data breach; and
a description of the kind of personal information the subject of the data breach, without including any personal information in the description.
The agency need not comply with subsections (2) (b) and (3) in relation to the data breach if—
all of the personal information the subject of the data breach is also the subject of a data breach of 1 or more other agencies; and
at least 1 of the other agencies has undertaken to conduct the assessment in relation to the data breach.
s 48 sub 2023 No. 32 s 33
(sec.48-ssec.1) This section applies in relation to a data breach of an agency if the agency knows, or reasonably suspects, that the data breach is an eligible data breach of the agency.
(sec.48-ssec.2) The agency must— immediately, and continue to, take all reasonable steps to— contain the data breach; and mitigate the harm caused by the data breach; and if the agency does not know whether the data breach is an eligible data breach of the agency—assess whether there are reasonable grounds to believe the data breach is an eligible data breach of the agency.
(sec.48-ssec.3) An assessment under subsection (2) (b) must be completed within— 30 days after the suspicion mentioned in subsection (1) was formed; or if the period mentioned in paragraph (a) is extended under section 49 —the extended period.
(sec.48-ssec.4) If, at any time, the agency becomes aware the data breach may affect another agency, the agency must give a written notice to the other agency of the data breach that includes— a description of the data breach; and a description of the kind of personal information the subject of the data breach, without including any personal information in the description.
(sec.48-ssec.5) The agency need not comply with subsections (2) (b) and (3) in relation to the data breach if— all of the personal information the subject of the data breach is also the subject of a data breach of 1 or more other agencies; and at least 1 of the other agencies has undertaken to conduct the assessment in relation to the data breach.
(a) immediately, and continue to, take all reasonable steps to— (i) contain the data breach; and (ii) mitigate the harm caused by the data breach; and
(i) contain the data breach; and
(ii) mitigate the harm caused by the data breach; and
(b) if the agency does not know whether the data breach is an eligible data breach of the agency—assess whether there are reasonable grounds to believe the data breach is an eligible data breach of the agency.
(i) contain the data breach; and
(ii) mitigate the harm caused by the data breach; and
(a) 30 days after the suspicion mentioned in subsection (1) was formed; or
(b) if the period mentioned in paragraph (a) is extended under section 49 —the extended period.
(a) a description of the data breach; and
(b) a description of the kind of personal information the subject of the data breach, without including any personal information in the description.
(a) all of the personal information the subject of the data breach is also the subject of a data breach of 1 or more other agencies; and
(b) at least 1 of the other agencies has undertaken to conduct the assessment in relation to the data breach.
sec.49
Extension of period for assessment by agency
sec.49 Extension of period for assessment by agency
This section applies if an agency required to conduct an assessment under section 48 is satisfied the assessment can not reasonably be completed within the 30 day period mentioned in section 48 (3) (a) .
The agency may extend the period within which the assessment must be completed by no longer than the period reasonably required for the agency to complete the assessment.
If the period is extended under subsection (2) , the agency must, within the 30 day period mentioned in section 48 (3) (a) —
start the assessment; and
give a written notice to the information commissioner stating—
that the assessment has started; and
the period within which the assessment must be completed has been extended under this section; and
the day the extended period ends.
The information commissioner may ask the agency to provide further information or updates about the progress of the assessment.
s 49 sub 2023 No. 32 s 33
(sec.49-ssec.1) This section applies if an agency required to conduct an assessment under section 48 is satisfied the assessment can not reasonably be completed within the 30 day period mentioned in section 48 (3) (a) .
(sec.49-ssec.2) The agency may extend the period within which the assessment must be completed by no longer than the period reasonably required for the agency to complete the assessment.
(sec.49-ssec.3) If the period is extended under subsection (2) , the agency must, within the 30 day period mentioned in section 48 (3) (a) — start the assessment; and give a written notice to the information commissioner stating— that the assessment has started; and the period within which the assessment must be completed has been extended under this section; and the day the extended period ends.
(sec.49-ssec.4) The information commissioner may ask the agency to provide further information or updates about the progress of the assessment.
(a) start the assessment; and
(b) give a written notice to the information commissioner stating— (i) that the assessment has started; and (ii) the period within which the assessment must be completed has been extended under this section; and (iii) the day the extended period ends.
(i) that the assessment has started; and
(ii) the period within which the assessment must be completed has been extended under this section; and
(iii) the day the extended period ends.
(i) that the assessment has started; and
(ii) the period within which the assessment must be completed has been extended under this section; and
(iii) the day the extended period ends.
ch.3A-pt.3
Notifying eligible data breaches
Notifying eligible data breaches
ch.3A-pt.3-div.1
Preliminary
Preliminary
sec.50
Application of part
sec.50 Application of part
This part applies if an agency reasonably believes that there has been an eligible data breach of the agency.
However, division 2 does not apply in relation to the agency to the extent an exemption applies to the agency under division 3 .
s 50 amd 2009 No. 48 s 220
sub 2023 No. 32 s 33
(sec.50-ssec.1) This part applies if an agency reasonably believes that there has been an eligible data breach of the agency.
(sec.50-ssec.2) However, division 2 does not apply in relation to the agency to the extent an exemption applies to the agency under division 3 .
ch.3A-pt.3-div.2
Notification
Notification
sec.51
Agency must give statement about eligible data breach to information commissioner
sec.51 Agency must give statement about eligible data breach to information commissioner
The agency must, as soon as practicable after forming the belief mentioned in section 50 —
prepare a statement that includes the information stated in subsection (2) ; and
give the statement to the information commissioner.
For subsection (1) (a) , the statement must, to the extent it is reasonably practicable, include the following information—
the information that must be included in a notification given under section 53 (2) (a) to (e) , (h) and (i) ;
a description of the kind of personal information the subject of the data breach, without including any personal information in the description;
the agency’s recommendations about the steps individuals should take in response to the data breach;
whether the agency is reporting on behalf of other agencies affected by the same data breach and, if so, the details of the other agencies;
the total number or, if it is not reasonably practicable to work out the total number, an estimate of the total number of each of the following—
the individuals whose personal information has been accessed, disclosed or lost;
affected individuals for the data breach;
either—
the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or
if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number;
whether the individuals notified have been advised about how to make a privacy complaint to the agency under section 166A .
s 51 amd 2009 No. 48 s 221
sub 2023 No. 32 s 33
(sec.51-ssec.1) The agency must, as soon as practicable after forming the belief mentioned in section 50 — prepare a statement that includes the information stated in subsection (2) ; and give the statement to the information commissioner.
(sec.51-ssec.2) For subsection (1) (a) , the statement must, to the extent it is reasonably practicable, include the following information— the information that must be included in a notification given under section 53 (2) (a) to (e) , (h) and (i) ; a description of the kind of personal information the subject of the data breach, without including any personal information in the description; the agency’s recommendations about the steps individuals should take in response to the data breach; whether the agency is reporting on behalf of other agencies affected by the same data breach and, if so, the details of the other agencies; the total number or, if it is not reasonably practicable to work out the total number, an estimate of the total number of each of the following— the individuals whose personal information has been accessed, disclosed or lost; affected individuals for the data breach; either— the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number; whether the individuals notified have been advised about how to make a privacy complaint to the agency under section 166A .
(a) prepare a statement that includes the information stated in subsection (2) ; and
(b) give the statement to the information commissioner.
(a) the information that must be included in a notification given under section 53 (2) (a) to (e) , (h) and (i) ;
(b) a description of the kind of personal information the subject of the data breach, without including any personal information in the description;
(c) the agency’s recommendations about the steps individuals should take in response to the data breach;
(d) whether the agency is reporting on behalf of other agencies affected by the same data breach and, if so, the details of the other agencies;
(e) the total number or, if it is not reasonably practicable to work out the total number, an estimate of the total number of each of the following— (i) the individuals whose personal information has been accessed, disclosed or lost; (ii) affected individuals for the data breach;
(i) the individuals whose personal information has been accessed, disclosed or lost;
(ii) affected individuals for the data breach;
(f) either— (i) the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or (ii) if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number;
(i) the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or
(ii) if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number;
(g) whether the individuals notified have been advised about how to make a privacy complaint to the agency under section 166A .
(i) the individuals whose personal information has been accessed, disclosed or lost;
(ii) affected individuals for the data breach;
(i) the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or
(ii) if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number;
sec.52
Further information to be provided
sec.52 Further information to be provided
This section applies if it is not reasonably practicable to include any information required under section 51 when the statement is given to the information commissioner under that section, including, for example, the total number of individuals mentioned in section 51 (2) (e) or (f) .
The agency must take all reasonable steps to provide the information to the commissioner as soon as practicable after the statement is given.
s 52 sub 2023 No. 32 s 33
(sec.52-ssec.1) This section applies if it is not reasonably practicable to include any information required under section 51 when the statement is given to the information commissioner under that section, including, for example, the total number of individuals mentioned in section 51 (2) (e) or (f) .
(sec.52-ssec.2) The agency must take all reasonable steps to provide the information to the commissioner as soon as practicable after the statement is given.
sec.53
Agencies must notify particular individuals
sec.53 Agencies must notify particular individuals
The agency must, as soon as practicable after the belief mentioned in section 50 is formed—
if it is reasonably practicable to notify each individual whose personal information has been accessed, disclosed or lost—take reasonable steps to notify each individual of the information mentioned in subsection (2) ; or
if paragraph (a) does not apply and it is reasonably practicable to notify each affected individual for the data breach—take reasonable steps to notify each affected individual of the information mentioned in subsection (2) ; or
if paragraphs (a) and (b) do not apply—publish the information mentioned in subsection (2) on an accessible agency website for a period of at least 12 months, other than information that would prejudice the agency’s functions.
A notification under subsection (1) must, to the extent it is reasonably practicable, include the following information—
the name of the agency and, if more than 1 agency was affected by the data breach, the name of each other agency;
the contact details of the agency or a person nominated by the agency for the individual to contact in relation to the data breach;
the date the data breach occurred;
a description of the data breach, including the type of eligible data breach under section 47 ;
information about how the data breach occurred;
for a notification under subsection (1) (a) or (b) —
a description of the personal information the subject of the data breach; and
the agency’s recommendations about the steps the individual should take in response to the data breach;
for a notification under subsection (1) (c) —
a description of the kind of personal information the subject of the data breach, without including any personal information in the description; and
the agency’s recommendations about the steps individuals should take in response to the data breach;
if the data breach involved unauthorised access to or disclosure of personal information—the period during which the access or disclosure was available or made;
the steps the agency has taken or will take to contain the data breach and mitigate the harm caused to individuals by the data breach;
information about how an individual may make a privacy complaint to the agency under section 166A .
The agency must, as soon as practicable after a notice is published under subsection (1) (c) , provide the information commissioner with information about how to access the notice.
The information commissioner must, after receiving the information under subsection (3) , publish on the commissioner’s website information about how to access the notice for a period of at least 12 months.
s 53 amd 2017 No. 17 s 119
sub 2023 No. 32 s 33
(sec.53-ssec.1) The agency must, as soon as practicable after the belief mentioned in section 50 is formed— if it is reasonably practicable to notify each individual whose personal information has been accessed, disclosed or lost—take reasonable steps to notify each individual of the information mentioned in subsection (2) ; or if paragraph (a) does not apply and it is reasonably practicable to notify each affected individual for the data breach—take reasonable steps to notify each affected individual of the information mentioned in subsection (2) ; or if paragraphs (a) and (b) do not apply—publish the information mentioned in subsection (2) on an accessible agency website for a period of at least 12 months, other than information that would prejudice the agency’s functions.
(sec.53-ssec.2) A notification under subsection (1) must, to the extent it is reasonably practicable, include the following information— the name of the agency and, if more than 1 agency was affected by the data breach, the name of each other agency; the contact details of the agency or a person nominated by the agency for the individual to contact in relation to the data breach; the date the data breach occurred; a description of the data breach, including the type of eligible data breach under section 47 ; information about how the data breach occurred; for a notification under subsection (1) (a) or (b) — a description of the personal information the subject of the data breach; and the agency’s recommendations about the steps the individual should take in response to the data breach; for a notification under subsection (1) (c) — a description of the kind of personal information the subject of the data breach, without including any personal information in the description; and the agency’s recommendations about the steps individuals should take in response to the data breach; if the data breach involved unauthorised access to or disclosure of personal information—the period during which the access or disclosure was available or made; the steps the agency has taken or will take to contain the data breach and mitigate the harm caused to individuals by the data breach; information about how an individual may make a privacy complaint to the agency under section 166A .
(sec.53-ssec.3) The agency must, as soon as practicable after a notice is published under subsection (1) (c) , provide the information commissioner with information about how to access the notice.
(sec.53-ssec.4) The information commissioner must, after receiving the information under subsection (3) , publish on the commissioner’s website information about how to access the notice for a period of at least 12 months.
(a) if it is reasonably practicable to notify each individual whose personal information has been accessed, disclosed or lost—take reasonable steps to notify each individual of the information mentioned in subsection (2) ; or
(b) if paragraph (a) does not apply and it is reasonably practicable to notify each affected individual for the data breach—take reasonable steps to notify each affected individual of the information mentioned in subsection (2) ; or
(c) if paragraphs (a) and (b) do not apply—publish the information mentioned in subsection (2) on an accessible agency website for a period of at least 12 months, other than information that would prejudice the agency’s functions.
(a) the name of the agency and, if more than 1 agency was affected by the data breach, the name of each other agency;
(b) the contact details of the agency or a person nominated by the agency for the individual to contact in relation to the data breach;
(c) the date the data breach occurred;
(d) a description of the data breach, including the type of eligible data breach under section 47 ;
(e) information about how the data breach occurred;
(f) for a notification under subsection (1) (a) or (b) — (i) a description of the personal information the subject of the data breach; and (ii) the agency’s recommendations about the steps the individual should take in response to the data breach;
(i) a description of the personal information the subject of the data breach; and
(ii) the agency’s recommendations about the steps the individual should take in response to the data breach;
(g) for a notification under subsection (1) (c) — (i) a description of the kind of personal information the subject of the data breach, without including any personal information in the description; and (ii) the agency’s recommendations about the steps individuals should take in response to the data breach;
(i) a description of the kind of personal information the subject of the data breach, without including any personal information in the description; and
(ii) the agency’s recommendations about the steps individuals should take in response to the data breach;
(h) if the data breach involved unauthorised access to or disclosure of personal information—the period during which the access or disclosure was available or made;
(i) the steps the agency has taken or will take to contain the data breach and mitigate the harm caused to individuals by the data breach;
(j) information about how an individual may make a privacy complaint to the agency under section 166A .
(i) a description of the personal information the subject of the data breach; and
(ii) the agency’s recommendations about the steps the individual should take in response to the data breach;
(i) a description of the kind of personal information the subject of the data breach, without including any personal information in the description; and
(ii) the agency’s recommendations about the steps individuals should take in response to the data breach;
sec.54
Particular agencies may collect, use and disclose relevant personal information for notification
sec.54 Particular agencies may collect, use and disclose relevant personal information for notification
A regulation may prescribe—
an agency (a disclosing agency ) that may, under this section, disclose relevant personal information to another agency; and
an agency (a receiving agency ) that may, under this section, collect and use relevant personal information from a disclosing agency and disclose relevant personal information to the disclosing agency.
A disclosing agency may disclose relevant personal information held by the agency to a receiving agency if the receiving agency is the subject of an eligible data breach.
The receiving agency may collect and use relevant personal information from a disclosing agency, and disclose relevant personal information to the disclosing agency, if it is reasonably necessary for the purpose of confirming—
the name and contact details of a notifiable individual; or
whether a notifiable individual is deceased.
A disclosing agency or receiving agency is not required to comply with a QPP in relation to the disclosure, collection or use of relevant personal information under this section.
For subsection (2) , an eligible data breach includes—
a data breach that an agency reasonably believes is an eligible data breach; and
a suspected data breach of an agency mentioned in section 61 (1) , whether or not the information commissioner has made a recommendation under section 61 (4) .
If a disclosing agency may, under an Act, enter into an arrangement and charge a fee for the provision of personal information kept by the agency under that Act, the agency may do so under that Act in relation to personal information that may be disclosed under this section.
In this section—
identifier , for an individual, means an identifier other than solely the individual’s name, including, for example, a number, that is—
assigned to the individual in relation to the individual’s personal information by an entity for the purpose of uniquely identifying that individual, whether or not it is subsequently used other than in relation to the personal information; or
adopted, used or disclosed in relation to the individual’s personal information by an entity for the purpose of uniquely identifying the individual.
notifiable individual means—
an individual mentioned in section 53 (1) (a) or (b) ; or
an individual the information commissioner recommends should be notified under section 61 (4) .
relevant personal information means the following information about an individual—
the name of the individual;
the contact details of the individual;
the date of birth of the individual;
an identifier for the individual;
if the individual is deceased—the date of the individual’s death.
s 54 sub 2023 No. 32 s 33
(sec.54-ssec.1) A regulation may prescribe— an agency (a disclosing agency ) that may, under this section, disclose relevant personal information to another agency; and an agency (a receiving agency ) that may, under this section, collect and use relevant personal information from a disclosing agency and disclose relevant personal information to the disclosing agency.
(sec.54-ssec.2) A disclosing agency may disclose relevant personal information held by the agency to a receiving agency if the receiving agency is the subject of an eligible data breach.
(sec.54-ssec.3) The receiving agency may collect and use relevant personal information from a disclosing agency, and disclose relevant personal information to the disclosing agency, if it is reasonably necessary for the purpose of confirming— the name and contact details of a notifiable individual; or whether a notifiable individual is deceased.
(sec.54-ssec.4) A disclosing agency or receiving agency is not required to comply with a QPP in relation to the disclosure, collection or use of relevant personal information under this section.
(sec.54-ssec.5) For subsection (2) , an eligible data breach includes— a data breach that an agency reasonably believes is an eligible data breach; and a suspected data breach of an agency mentioned in section 61 (1) , whether or not the information commissioner has made a recommendation under section 61 (4) .
(sec.54-ssec.6) If a disclosing agency may, under an Act, enter into an arrangement and charge a fee for the provision of personal information kept by the agency under that Act, the agency may do so under that Act in relation to personal information that may be disclosed under this section.
(sec.54-ssec.7) In this section— identifier , for an individual, means an identifier other than solely the individual’s name, including, for example, a number, that is— assigned to the individual in relation to the individual’s personal information by an entity for the purpose of uniquely identifying that individual, whether or not it is subsequently used other than in relation to the personal information; or adopted, used or disclosed in relation to the individual’s personal information by an entity for the purpose of uniquely identifying the individual. notifiable individual means— an individual mentioned in section 53 (1) (a) or (b) ; or an individual the information commissioner recommends should be notified under section 61 (4) . relevant personal information means the following information about an individual— the name of the individual; the contact details of the individual; the date of birth of the individual; an identifier for the individual; if the individual is deceased—the date of the individual’s death.
(a) an agency (a disclosing agency ) that may, under this section, disclose relevant personal information to another agency; and
(b) an agency (a receiving agency ) that may, under this section, collect and use relevant personal information from a disclosing agency and disclose relevant personal information to the disclosing agency.
(a) the name and contact details of a notifiable individual; or
(b) whether a notifiable individual is deceased.
(a) a data breach that an agency reasonably believes is an eligible data breach; and
(b) a suspected data breach of an agency mentioned in section 61 (1) , whether or not the information commissioner has made a recommendation under section 61 (4) .
(a) assigned to the individual in relation to the individual’s personal information by an entity for the purpose of uniquely identifying that individual, whether or not it is subsequently used other than in relation to the personal information; or
(b) adopted, used or disclosed in relation to the individual’s personal information by an entity for the purpose of uniquely identifying the individual.
(a) an individual mentioned in section 53 (1) (a) or (b) ; or
(b) an individual the information commissioner recommends should be notified under section 61 (4) .
(a) the name of the individual;
(b) the contact details of the individual;
(c) the date of birth of the individual;
(d) an identifier for the individual;
(e) if the individual is deceased—the date of the individual’s death.
ch.3A-pt.3-div.3
Exemptions
Exemptions
sec.55
Exemption—investigations and proceedings
sec.55 Exemption—investigations and proceedings
An agency need not comply with division 2 to the extent complying with that division is likely to prejudice—
an investigation that could lead to the prosecution of an offence; or
proceedings before a court or tribunal.
s 55 sub 2023 No. 32 s 33
(a) an investigation that could lead to the prosecution of an offence; or
(b) proceedings before a court or tribunal.
sec.56
Exemption—eligible data breach of more than 1 agency
sec.56 Exemption—eligible data breach of more than 1 agency
This section applies if—
an agency is not required to comply with requirements about assessing a data breach under section 48 (2) (b) and (3) because section 48 (5) applies to the agency; and
another agency is required to comply with division 2 in relation to the data breach.
The agency need not comply with division 2 in relation to the data breach.
s 56 sub 2023 No. 32 s 33
(sec.56-ssec.1) This section applies if— an agency is not required to comply with requirements about assessing a data breach under section 48 (2) (b) and (3) because section 48 (5) applies to the agency; and another agency is required to comply with division 2 in relation to the data breach.
(sec.56-ssec.2) The agency need not comply with division 2 in relation to the data breach.
(a) an agency is not required to comply with requirements about assessing a data breach under section 48 (2) (b) and (3) because section 48 (5) applies to the agency; and
(b) another agency is required to comply with division 2 in relation to the data breach.
sec.57
Exemption—agency has taken remedial action
sec.57 Exemption—agency has taken remedial action
This section applies in relation to an eligible data breach of an agency if—
for a data breach involving unauthorised access to, or disclosure of, personal information—
the agency takes action to mitigate the harm caused by the data breach; and
the action is taken before the access or disclosure results in serious harm to any individual; and
as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual; or
for a data breach involving the loss of personal information—
the agency takes action to mitigate the loss; and
the action is taken before there is unauthorised access to, or disclosure of, the personal information; and
as a result of the action taken, there is no unauthorised access to, or disclosure of, the personal information; or
for a data breach involving the loss of personal information—
the agency takes action to mitigate the loss; and
the action is taken after there is unauthorised access to, or unauthorised disclosure of, the personal information but before the access or disclosure results in serious harm to any individual; and
as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual.
The agency need not comply with section 53 in relation to the eligible data breach.
s 57 sub 2023 No. 32 s 33
(sec.57-ssec.1) This section applies in relation to an eligible data breach of an agency if— for a data breach involving unauthorised access to, or disclosure of, personal information— the agency takes action to mitigate the harm caused by the data breach; and the action is taken before the access or disclosure results in serious harm to any individual; and as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual; or for a data breach involving the loss of personal information— the agency takes action to mitigate the loss; and the action is taken before there is unauthorised access to, or disclosure of, the personal information; and as a result of the action taken, there is no unauthorised access to, or disclosure of, the personal information; or for a data breach involving the loss of personal information— the agency takes action to mitigate the loss; and the action is taken after there is unauthorised access to, or unauthorised disclosure of, the personal information but before the access or disclosure results in serious harm to any individual; and as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual.
(sec.57-ssec.2) The agency need not comply with section 53 in relation to the eligible data breach.
(a) for a data breach involving unauthorised access to, or disclosure of, personal information— (i) the agency takes action to mitigate the harm caused by the data breach; and (ii) the action is taken before the access or disclosure results in serious harm to any individual; and (iii) as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual; or
(i) the agency takes action to mitigate the harm caused by the data breach; and
(ii) the action is taken before the access or disclosure results in serious harm to any individual; and
(iii) as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual; or
(b) for a data breach involving the loss of personal information— (i) the agency takes action to mitigate the loss; and (ii) the action is taken before there is unauthorised access to, or disclosure of, the personal information; and (iii) as a result of the action taken, there is no unauthorised access to, or disclosure of, the personal information; or
(i) the agency takes action to mitigate the loss; and
(ii) the action is taken before there is unauthorised access to, or disclosure of, the personal information; and
(iii) as a result of the action taken, there is no unauthorised access to, or disclosure of, the personal information; or
(c) for a data breach involving the loss of personal information— (i) the agency takes action to mitigate the loss; and (ii) the action is taken after there is unauthorised access to, or unauthorised disclosure of, the personal information but before the access or disclosure results in serious harm to any individual; and (iii) as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual.
(i) the agency takes action to mitigate the loss; and
(ii) the action is taken after there is unauthorised access to, or unauthorised disclosure of, the personal information but before the access or disclosure results in serious harm to any individual; and
(iii) as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual.
(i) the agency takes action to mitigate the harm caused by the data breach; and
(ii) the action is taken before the access or disclosure results in serious harm to any individual; and
(iii) as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual; or
(i) the agency takes action to mitigate the loss; and
(ii) the action is taken before there is unauthorised access to, or disclosure of, the personal information; and
(iii) as a result of the action taken, there is no unauthorised access to, or disclosure of, the personal information; or
(i) the agency takes action to mitigate the loss; and
(ii) the action is taken after there is unauthorised access to, or unauthorised disclosure of, the personal information but before the access or disclosure results in serious harm to any individual; and
(iii) as a result of the action taken, the data breach is no longer likely to result in serious harm to any individual.
sec.58
Exemption—inconsistency with confidentiality provision
sec.58 Exemption—inconsistency with confidentiality provision
An agency need not comply with division 2 in relation to an eligible data breach of the agency to the extent the compliance would be inconsistent with a provision of an Act of the Commonwealth or a State that prohibits or regulates the use or disclosure of the information.
s 58 sub 2023 No. 32 s 33
sec.59
Exemption—serious risk of harm to health or safety
sec.59 Exemption—serious risk of harm to health or safety
An agency need not comply with section 53 in relation to an eligible data breach to the extent compliance would create a serious risk of harm to an individual’s health or safety, having regard to, for example—
whether the harm caused by complying with division 2 is greater than the harm of not complying with that division; and
the currency of the information relied on.
If an agency relies on this section, the agency must give a written notice to the information commissioner stating—
the extent to which the agency is exempt from complying with division 2 under this section; and
whether or not the exemption is permanent or temporary; and
if the exemption is temporary—when the agency expects the exemption will stop applying.
s 59 sub 2023 No. 32 s 33
(sec.59-ssec.1) An agency need not comply with section 53 in relation to an eligible data breach to the extent compliance would create a serious risk of harm to an individual’s health or safety, having regard to, for example— whether the harm caused by complying with division 2 is greater than the harm of not complying with that division; and the currency of the information relied on.
(sec.59-ssec.2) If an agency relies on this section, the agency must give a written notice to the information commissioner stating— the extent to which the agency is exempt from complying with division 2 under this section; and whether or not the exemption is permanent or temporary; and if the exemption is temporary—when the agency expects the exemption will stop applying.
(a) whether the harm caused by complying with division 2 is greater than the harm of not complying with that division; and
(b) the currency of the information relied on.
(a) the extent to which the agency is exempt from complying with division 2 under this section; and
(b) whether or not the exemption is permanent or temporary; and
(c) if the exemption is temporary—when the agency expects the exemption will stop applying.
sec.60
Exemption—compromise to cybersecurity
sec.60 Exemption—compromise to cybersecurity
An agency need not comply with section 53 in relation to an eligible data breach if compliance is likely to—
compromise or worsen the agency’s cybersecurity; or
lead to further data breaches of the agency.
The exemption applies only for the period during which a matter mentioned in subsection (1) (a) or (b) continues to apply for the agency in relation to the eligible data breach.
If an agency relies on this section, the agency must give a written notice to the information commissioner stating—
the agency is exempt from complying with division 2 under this section; and
when the agency expects the exemption will stop applying; and
how the agency will review the application of the exemption.
The agency must—
review the application of the exemption each month for the period during which the exemption is relied on; and
give the commissioner a summary of the review as soon as practicable after it is completed.
s 60 sub 2023 No. 32 s 33
(sec.60-ssec.1) An agency need not comply with section 53 in relation to an eligible data breach if compliance is likely to— compromise or worsen the agency’s cybersecurity; or lead to further data breaches of the agency.
(sec.60-ssec.2) The exemption applies only for the period during which a matter mentioned in subsection (1) (a) or (b) continues to apply for the agency in relation to the eligible data breach.
(sec.60-ssec.3) If an agency relies on this section, the agency must give a written notice to the information commissioner stating— the agency is exempt from complying with division 2 under this section; and when the agency expects the exemption will stop applying; and how the agency will review the application of the exemption.
(sec.60-ssec.4) The agency must— review the application of the exemption each month for the period during which the exemption is relied on; and give the commissioner a summary of the review as soon as practicable after it is completed.
(a) compromise or worsen the agency’s cybersecurity; or
(b) lead to further data breaches of the agency.
(a) the agency is exempt from complying with division 2 under this section; and
(b) when the agency expects the exemption will stop applying; and
(c) how the agency will review the application of the exemption.
(a) review the application of the exemption each month for the period during which the exemption is relied on; and
(b) give the commissioner a summary of the review as soon as practicable after it is completed.
ch.3A-pt.4
Role of information commissioner
Role of information commissioner
sec.61
Information commissioner may direct agency to give statement and make recommendations
sec.61 Information commissioner may direct agency to give statement and make recommendations
This section applies if the information commissioner reasonably suspects a data breach of an agency may be an eligible data breach of the agency.
The information commissioner may, after complying with subsections (5) and (6) , direct the agency by written notice to prepare and give to the commissioner a statement providing the following information—
the name and contact details of the agency and, if more than 1 agency was affected by the data breach, the name of each other agency;
a description of the data breach, including the kind of personal information involved in the data breach;
recommendations about the steps an individual who may be affected by the data breach should take in response to the data breach;
any other information related to the data breach requested by the commissioner.
The agency must comply with the direction.
If a direction is given under subsection (2) , the information commissioner may also, after complying with subsections (5) and (6) , recommend to the agency that the agency notify individuals under section 53 as if the agency reasonably believed the data breach were an eligible data breach.
Before giving a direction under subsection (2) or making a recommendation under subsection (4) , the information commissioner must invite the agency to make a submission to the commissioner, within a reasonable period, about the data breach.
Without limiting the matters the information commissioner may consider, in deciding whether to give a direction under subsection (2) or make a recommendation under subsection (4) , the information commissioner must have regard to the following—
any advice given to the information commissioner by a law enforcement agency;
any submission made by the agency under subsection (5) .
s 61 sub 2023 No. 32 s 33
(sec.61-ssec.1) This section applies if the information commissioner reasonably suspects a data breach of an agency may be an eligible data breach of the agency.
(sec.61-ssec.2) The information commissioner may, after complying with subsections (5) and (6) , direct the agency by written notice to prepare and give to the commissioner a statement providing the following information— the name and contact details of the agency and, if more than 1 agency was affected by the data breach, the name of each other agency; a description of the data breach, including the kind of personal information involved in the data breach; recommendations about the steps an individual who may be affected by the data breach should take in response to the data breach; any other information related to the data breach requested by the commissioner.
(sec.61-ssec.3) The agency must comply with the direction.
(sec.61-ssec.4) If a direction is given under subsection (2) , the information commissioner may also, after complying with subsections (5) and (6) , recommend to the agency that the agency notify individuals under section 53 as if the agency reasonably believed the data breach were an eligible data breach.
(sec.61-ssec.5) Before giving a direction under subsection (2) or making a recommendation under subsection (4) , the information commissioner must invite the agency to make a submission to the commissioner, within a reasonable period, about the data breach.
(sec.61-ssec.6) Without limiting the matters the information commissioner may consider, in deciding whether to give a direction under subsection (2) or make a recommendation under subsection (4) , the information commissioner must have regard to the following— any advice given to the information commissioner by a law enforcement agency; any submission made by the agency under subsection (5) .
(a) the name and contact details of the agency and, if more than 1 agency was affected by the data breach, the name of each other agency;
(b) a description of the data breach, including the kind of personal information involved in the data breach;
(c) recommendations about the steps an individual who may be affected by the data breach should take in response to the data breach;
(d) any other information related to the data breach requested by the commissioner.
(a) any advice given to the information commissioner by a law enforcement agency;
(b) any submission made by the agency under subsection (5) .
ch.3A-pt.5
Investigations
Investigations
ch.3A-pt.5-div.1
Authorised officers
Authorised officers
sec.62
Functions
sec.62 Functions
The functions of an authorised officer are to monitor and investigate whether an occasion has arisen for the exercise of the information commissioner’s powers that relate to an agency’s compliance with this chapter.
s 62 sub 2023 No. 32 s 33
sec.63
Appointment
sec.63 Appointment
The information commissioner may, by instrument in writing, appoint an appropriately qualified person as an authorised officer.
s 63 sub 2023 No. 32 s 33
sec.64
Identity cards
sec.64 Identity cards
The information commissioner must issue an identity card to each authorised officer.
The identity card must—
contain a recent photo of the authorised officer; and
contain a copy of the signature of the information commissioner and authorised officer; and
identify the person as an authorised officer under this part; and
state an expiry date for the card.
s 64 sub 2023 No. 32 s 33
(sec.64-ssec.1) The information commissioner must issue an identity card to each authorised officer.
(sec.64-ssec.2) The identity card must— contain a recent photo of the authorised officer; and contain a copy of the signature of the information commissioner and authorised officer; and identify the person as an authorised officer under this part; and state an expiry date for the card.
(a) contain a recent photo of the authorised officer; and
(b) contain a copy of the signature of the information commissioner and authorised officer; and
(c) identify the person as an authorised officer under this part; and
(d) state an expiry date for the card.
sec.65
Production or display of identity card
sec.65 Production or display of identity card
In exercising a power in relation to a person in the person’s presence or by audio visual link, an authorised officer must—
produce the authorised officer’s identity card for the person’s inspection before exercising the power; or
have the identity card displayed so it is clearly visible to the person when exercising the power.
However, if it is not practicable to comply with subsection (1) , the authorised officer must produce the identity card for the person’s inspection at the first reasonable opportunity.
s 65 sub 2023 No. 32 s 33
(sec.65-ssec.1) In exercising a power in relation to a person in the person’s presence or by audio visual link, an authorised officer must— produce the authorised officer’s identity card for the person’s inspection before exercising the power; or have the identity card displayed so it is clearly visible to the person when exercising the power.
(sec.65-ssec.2) However, if it is not practicable to comply with subsection (1) , the authorised officer must produce the identity card for the person’s inspection at the first reasonable opportunity.
(a) produce the authorised officer’s identity card for the person’s inspection before exercising the power; or
(b) have the identity card displayed so it is clearly visible to the person when exercising the power.
sec.66
Return of identity card
sec.66 Return of identity card
If the office of a person as an authorised officer ends, the person must return the person’s identity card to the information commissioner within 15 business days after the office ends unless the person has a reasonable excuse.
Maximum penalty—10 penalty units.
s 66 sub 2023 No. 32 s 33
ch.3A-pt.5-div.2
Entry of places occupied by agencies
Entry of places occupied by agencies
sec.67
General power to enter places occupied by agency
sec.67 General power to enter places occupied by agency
An authorised officer may enter an agency’s place of business, or another place occupied by the agency, if either of the following apply—
the agency has consented to the commissioner’s request for entry made under section 68 ;
the agency has failed to consent to the commissioner’s request for entry made under section 68 , and the entry is made in compliance with the notice given for the entry under section 68 (2) .
s 67 sub 2023 No. 32 s 33
(a) the agency has consented to the commissioner’s request for entry made under section 68 ;
(b) the agency has failed to consent to the commissioner’s request for entry made under section 68 , and the entry is made in compliance with the notice given for the entry under section 68 (2) .
sec.68
Information commissioner must give written notice of entry
sec.68 Information commissioner must give written notice of entry
Before an authorised officer enters a place occupied by an agency under section 67 , the information commissioner must, by written notice, ask the agency to consent to an authorised officer entering the place.
The notice must—
explain the purpose of the entry, including the powers intended to be exercised; and
propose a reasonable date and time for the entry; and
ask for the agency’s principal officer’s written consent to the entry to be given to the information commissioner within a stated reasonable period; and
if the place is the agency’s place of business, state that if the written consent is not given to the commissioner within the stated period, an authorised officer may enter the place on a stated reasonable date and at a stated reasonable time when the place—
is open for carrying on the business; or
is otherwise open for entry.
If the notice is given to an agency, the agency must take all reasonable steps to facilitate entry by an authorised officer on the date and time consented to or stated under subsection (2) (d) .
Maximum penalty—100 penalty units.
For subsection (2) (d) , an agency’s place of business does not include a part of the place where a person resides.
s 68 sub 2023 No. 32 s 33
(sec.68-ssec.1) Before an authorised officer enters a place occupied by an agency under section 67 , the information commissioner must, by written notice, ask the agency to consent to an authorised officer entering the place.
(sec.68-ssec.2) The notice must— explain the purpose of the entry, including the powers intended to be exercised; and propose a reasonable date and time for the entry; and ask for the agency’s principal officer’s written consent to the entry to be given to the information commissioner within a stated reasonable period; and if the place is the agency’s place of business, state that if the written consent is not given to the commissioner within the stated period, an authorised officer may enter the place on a stated reasonable date and at a stated reasonable time when the place— is open for carrying on the business; or is otherwise open for entry.
(sec.68-ssec.3) If the notice is given to an agency, the agency must take all reasonable steps to facilitate entry by an authorised officer on the date and time consented to or stated under subsection (2) (d) . Maximum penalty—100 penalty units.
(sec.68-ssec.4) For subsection (2) (d) , an agency’s place of business does not include a part of the place where a person resides.
(a) explain the purpose of the entry, including the powers intended to be exercised; and
(b) propose a reasonable date and time for the entry; and
(c) ask for the agency’s principal officer’s written consent to the entry to be given to the information commissioner within a stated reasonable period; and
(d) if the place is the agency’s place of business, state that if the written consent is not given to the commissioner within the stated period, an authorised officer may enter the place on a stated reasonable date and at a stated reasonable time when the place— (a) is open for carrying on the business; or (b) is otherwise open for entry.
(a) is open for carrying on the business; or
(b) is otherwise open for entry.
(a) is open for carrying on the business; or
(b) is otherwise open for entry.
ch.3A-pt.5-div.3
Powers of authorised officers
Powers of authorised officers
sec.69
General powers
sec.69 General powers
If an authorised officer enters a place under section 67 , the authorised officer may do the following—
require a person at the place who has the necessary skills or knowledge to demonstrate the data handling systems and practices of the agency that relate to the agency’s compliance with this chapter;
inspect a document that is relevant to the systems, policies and practices of the agency that relate to the agency’s compliance with this chapter;
remain at the place for the time necessary to achieve the purpose of the entry.
Also, if the agency agrees, an authorised officer may exercise a power mentioned in subsection (1) (a) or (b) by audio visual link provided by the agency.
In this section—
audio visual link means facilities that enable reasonably contemporaneous and continuous audio and visual communication between persons at different places and includes videoconferencing.
s 69 amd 2009 No. 48 s 222
sub 2023 No. 32 s 33
(sec.69-ssec.1) If an authorised officer enters a place under section 67 , the authorised officer may do the following— require a person at the place who has the necessary skills or knowledge to demonstrate the data handling systems and practices of the agency that relate to the agency’s compliance with this chapter; inspect a document that is relevant to the systems, policies and practices of the agency that relate to the agency’s compliance with this chapter; remain at the place for the time necessary to achieve the purpose of the entry.
(sec.69-ssec.2) Also, if the agency agrees, an authorised officer may exercise a power mentioned in subsection (1) (a) or (b) by audio visual link provided by the agency.
(sec.69-ssec.3) In this section— audio visual link means facilities that enable reasonably contemporaneous and continuous audio and visual communication between persons at different places and includes videoconferencing.
(a) require a person at the place who has the necessary skills or knowledge to demonstrate the data handling systems and practices of the agency that relate to the agency’s compliance with this chapter;
(b) inspect a document that is relevant to the systems, policies and practices of the agency that relate to the agency’s compliance with this chapter;
(c) remain at the place for the time necessary to achieve the purpose of the entry.
sec.70
Power to require reasonable help
sec.70 Power to require reasonable help
If an authorised officer enters a place occupied by an agency under section 67 , the authorised officer may require a person at the place to give the authorised officer reasonable help to exercise a power under that section, including, for example, to demonstrate data handling systems and practices or produce a document.
When making a requirement under subsection (1) , the authorised officer must give the person an offence warning for the requirement.
In this section—
offence warning , for a requirement made by an authorised officer under subsection (1) , means a warning that, without a reasonable excuse, it is an offence for the person of whom the requirement is made not to comply with the requirement.
s 70 sub 2023 No. 32 s 33
(sec.70-ssec.1) If an authorised officer enters a place occupied by an agency under section 67 , the authorised officer may require a person at the place to give the authorised officer reasonable help to exercise a power under that section, including, for example, to demonstrate data handling systems and practices or produce a document.
(sec.70-ssec.2) When making a requirement under subsection (1) , the authorised officer must give the person an offence warning for the requirement.
(sec.70-ssec.3) In this section— offence warning , for a requirement made by an authorised officer under subsection (1) , means a warning that, without a reasonable excuse, it is an offence for the person of whom the requirement is made not to comply with the requirement.
sec.71
Offence to contravene help requirement
sec.71 Offence to contravene help requirement
A person of whom a requirement is made under section 70 (1) must comply with the requirement unless the person has a reasonable excuse.
Maximum penalty—100 penalty units.
It is a reasonable excuse for an individual not to comply with a requirement under section 70 (1) if complying with the requirement might—
tend to incriminate the individual or expose the individual to a penalty; or
result in the disclosure of information that is the subject of legal professional privilege; or
result in the disclosure of confidential information in contravention of a law.
However, subsection (2) does not apply if a document or information the subject of the help requirement is required to be held or kept by the individual under this Act.
See, however, section 74 .
s 71 sub 2023 No. 32 s 33
(sec.71-ssec.1) A person of whom a requirement is made under section 70 (1) must comply with the requirement unless the person has a reasonable excuse. Maximum penalty—100 penalty units.
(sec.71-ssec.2) It is a reasonable excuse for an individual not to comply with a requirement under section 70 (1) if complying with the requirement might— tend to incriminate the individual or expose the individual to a penalty; or result in the disclosure of information that is the subject of legal professional privilege; or result in the disclosure of confidential information in contravention of a law.
(sec.71-ssec.3) However, subsection (2) does not apply if a document or information the subject of the help requirement is required to be held or kept by the individual under this Act. See, however, section 74 .
(a) tend to incriminate the individual or expose the individual to a penalty; or
(b) result in the disclosure of information that is the subject of legal professional privilege; or
(c) result in the disclosure of confidential information in contravention of a law.
ch.3A-pt.6
Miscellaneous
Miscellaneous
sec.72
Agency must keep register
sec.72 Agency must keep register
An agency must keep a register of eligible data breaches of the agency.
The register must include the following information for each eligible data breach—
a description of the eligible data breach, including the type of data breach under section 47 ;
if a statement is required for the eligible data breach under section 51 —the date the statement is provided;
if further information about the eligible data breach is required to be given to the information commissioner under section 52 —each date the further information is given;
if individuals are notified of the eligible data breach under section 53 (1) (a) or (b) —the individuals notified and the date and method used to notify the individuals;
if the agency relied on an exemption under part 3 , division 3 —the exemption relied on;
details of the steps taken by the agency to—
contain the eligible data breach under section 48 (2) (a) or (4) (a) ; and
mitigate the harm caused by the eligible data breach under section 48 (4) (a) ;
details of the actions taken by the agency to prevent future data breaches of a similar kind occurring.
If it is not practicable to include any or all of the information mentioned in subsection (2) for an eligible data breach at a particular time, the agency must record the information in the register as soon as it is practicable to do so.
s 72 sub 2023 No. 32 s 33
(sec.72-ssec.1) An agency must keep a register of eligible data breaches of the agency.
(sec.72-ssec.2) The register must include the following information for each eligible data breach— a description of the eligible data breach, including the type of data breach under section 47 ; if a statement is required for the eligible data breach under section 51 —the date the statement is provided; if further information about the eligible data breach is required to be given to the information commissioner under section 52 —each date the further information is given; if individuals are notified of the eligible data breach under section 53 (1) (a) or (b) —the individuals notified and the date and method used to notify the individuals; if the agency relied on an exemption under part 3 , division 3 —the exemption relied on; details of the steps taken by the agency to— contain the eligible data breach under section 48 (2) (a) or (4) (a) ; and mitigate the harm caused by the eligible data breach under section 48 (4) (a) ; details of the actions taken by the agency to prevent future data breaches of a similar kind occurring.
(sec.72-ssec.3) If it is not practicable to include any or all of the information mentioned in subsection (2) for an eligible data breach at a particular time, the agency must record the information in the register as soon as it is practicable to do so.
(a) a description of the eligible data breach, including the type of data breach under section 47 ;
(b) if a statement is required for the eligible data breach under section 51 —the date the statement is provided;
(c) if further information about the eligible data breach is required to be given to the information commissioner under section 52 —each date the further information is given;
(d) if individuals are notified of the eligible data breach under section 53 (1) (a) or (b) —the individuals notified and the date and method used to notify the individuals;
(e) if the agency relied on an exemption under part 3 , division 3 —the exemption relied on;
(f) details of the steps taken by the agency to— (i) contain the eligible data breach under section 48 (2) (a) or (4) (a) ; and (ii) mitigate the harm caused by the eligible data breach under section 48 (4) (a) ;
(i) contain the eligible data breach under section 48 (2) (a) or (4) (a) ; and
(ii) mitigate the harm caused by the eligible data breach under section 48 (4) (a) ;
(g) details of the actions taken by the agency to prevent future data breaches of a similar kind occurring.
(i) contain the eligible data breach under section 48 (2) (a) or (4) (a) ; and
(ii) mitigate the harm caused by the eligible data breach under section 48 (4) (a) ;
sec.73
Agency must publish data breach policy
sec.73 Agency must publish data breach policy
An agency must prepare and publish a policy about how it will respond to a data breach, including a suspected eligible data breach, of the agency.
The policy must be published on an accessible agency website.
s 73 sub 2023 No. 32 s 33
(sec.73-ssec.1) An agency must prepare and publish a policy about how it will respond to a data breach, including a suspected eligible data breach, of the agency.
(sec.73-ssec.2) The policy must be published on an accessible agency website.
sec.74
Evidential immunity for individuals complying with particular requirements
sec.74 Evidential immunity for individuals complying with particular requirements
Subsection (2) applies if an individual gives information to an authorised officer under section 69 or 70 (1) .
Evidence of the information, and other evidence directly or indirectly derived from the information, is not admissible against the individual in any proceeding to the extent it tends to incriminate the individual, or expose the individual to a penalty, in the proceeding.
Subsection (2) does not apply to a proceeding about the false or misleading nature of the information or anything in which the false or misleading nature of the information is relevant evidence.
s 74 sub 2023 No. 32 s 33
(sec.74-ssec.1) Subsection (2) applies if an individual gives information to an authorised officer under section 69 or 70 (1) .
(sec.74-ssec.2) Evidence of the information, and other evidence directly or indirectly derived from the information, is not admissible against the individual in any proceeding to the extent it tends to incriminate the individual, or expose the individual to a penalty, in the proceeding.
(sec.74-ssec.3) Subsection (2) does not apply to a proceeding about the false or misleading nature of the information or anything in which the false or misleading nature of the information is relevant evidence.
sec.75
Section sec.75
s 75 om 2023 No. 32 s 33
sec.76
Section sec.76
s 76 om 2023 No. 32 s 33
sec.77
Section sec.77
s 77 om 2023 No. 32 s 33
sec.78
Section sec.78
s 78 om 2023 No. 32 s 33
sec.79
Section sec.79
s 79 om 2023 No. 32 s 33
sec.80
Section sec.80
s 80 om 2023 No. 32 s 33
sec.81
Section sec.81
s 81 om 2023 No. 32 s 33
sec.82
Section sec.82
s 82 om 2023 No. 32 s 33
sec.83
Section sec.83
s 83 om 2023 No. 32 s 33
sec.84
Section sec.84
s 84 om 2023 No. 32 s 33
sec.85
Section sec.85
s 85 om 2023 No. 32 s 33
sec.86
Section sec.86
s 86 om 2023 No. 32 s 33
sec.87
Section sec.87
s 87 om 2023 No. 32 s 33
sec.88
Section sec.88
s 88 amd 2017 No. 17 s 120
om 2023 No. 32 s 33
sec.89
Section sec.89
s 89 amd 2017 No. 17 s 121
om 2023 No. 32 s 33
sec.90
Section sec.90
s 90 amd 2017 No. 17 s 122
om 2023 No. 32 s 33
sec.91
Section sec.91
s 91 om 2023 No. 32 s 33
sec.92
Section sec.92
s 92 om 2023 No. 32 s 33
sec.93
Section sec.93
s 93 om 2023 No. 32 s 33
sec.94
Section sec.94
s 94 amd 2009 No. 48 s 223 ; 2017 No. 17 s 123
om 2023 No. 32 s 33
sec.95
Section sec.95
s 95 amd 2017 No. 17 s 124
om 2023 No. 32 s 33
sec.96
Section sec.96
s 96 om 2023 No. 32 s 33
sec.97
Section sec.97
s 97 om 2023 No. 32 s 33
sec.98
Section sec.98
s 98 om 2023 No. 32 s 33
sec.99
Section sec.99
s 99 om 2023 No. 32 s 33
sec.100
Section sec.100
s 100 om 2023 No. 32 s 33
sec.101
Section sec.101
s 101 om 2023 No. 32 s 33
sec.102
Section sec.102
s 102 om 2023 No. 32 s 33
sec.103
Section sec.103
s 103 om 2023 No. 32 s 33
sec.104
Section sec.104
s 104 om 2023 No. 32 s 33
sec.105
Section sec.105
s 105 om 2023 No. 32 s 33
sec.106
Section sec.106
s 106 om 2023 No. 32 s 33
sec.107
Section sec.107
s 107 om 2023 No. 32 s 33
sec.108
Section sec.108
s 108 om 2023 No. 32 s 33
sec.109
Section sec.109
s 109 om 2023 No. 32 s 33
sec.110
Section sec.110
s 110 om 2023 No. 32 s 33
sec.111
Section sec.111
s 111 om 2023 No. 32 s 33
sec.112
Section sec.112
s 112 om 2023 No. 32 s 33
sec.113
Section sec.113
s 113 om 2023 No. 32 s 33
sec.114
Section sec.114
s 114 om 2023 No. 32 s 33
sec.115
Section sec.115
s 115 amd 2017 No. 17 s 125
om 2023 No. 32 s 33
sec.116
Section sec.116
s 116 om 2023 No. 32 s 33
sec.117
Section sec.117
s 117 om 2023 No. 32 s 33
sec.118
Section sec.118
s 118 om 2023 No. 32 s 33
sec.119
Section sec.119
s 119 om 2023 No. 32 s 33
sec.120
Section sec.120
s 120 amd 2009 No. 48 s 224 (1) (amdt could not be given effect); 2009 No. 48 s 224 (2)–(3)
om 2023 No. 32 s 33
sec.121
Section sec.121
s 121 om 2023 No. 32 s 33
sec.122
Section sec.122
s 122 om 2023 No. 32 s 33
sec.123
Section sec.123
s 123 om 2023 No. 32 s 33
sec.124
Section sec.124
s 124 om 2023 No. 32 s 33
sec.125
Section sec.125
s 125 om 2023 No. 32 s 33
sec.126
Section sec.126
s 126 amd 2011 No. 27 s 264 ; 2011 No. 26 s 189 sch ; 2014 No. 45 s 58 sch 1 pt 2
om 2023 No. 32 s 33
sec.127
Section sec.127
s 127 amd 2013 No. 35 s 85 ; 2017 No. 17 s 126
om 2023 No. 32 s 33
sec.128
Section sec.128
s 128 om 2023 No. 32 s 33
sec.129
Section sec.129
s 129 om 2023 No. 32 s 33
sec.130
Section sec.130
s 130 exp 1 December 2009 (see s 130(5))
sec.131
Section sec.131
s 131 om 2023 No. 32 s 33
sec.132
Section sec.132
s 132 om 2023 No. 32 s 33
sec.133
Section sec.133
s 133 om 2023 No. 32 s 33
ch.4-pt.1
Functions of information commissioner under this Act
Functions of information commissioner under this Act
sec.134
Information commissioner not subject to direction
sec.134 Information commissioner not subject to direction
The information commissioner is not subject to direction by any person about—
the way in which the commissioner’s powers are to be exercised in the performance of a function under section 135 or 136 ; or
the priority to be given to investigations, reviews, audits mentioned in section 135 (1) (b) (iii) and privacy complaints under this Act.
Subsection (1) has effect despite the Public Sector Act 2022 .
s 134 amd 2022 No. 34 s 365 sch 3 ; 2023 No. 32 s 34
(sec.134-ssec.1) The information commissioner is not subject to direction by any person about— the way in which the commissioner’s powers are to be exercised in the performance of a function under section 135 or 136 ; or the priority to be given to investigations, reviews, audits mentioned in section 135 (1) (b) (iii) and privacy complaints under this Act.
(sec.134-ssec.2) Subsection (1) has effect despite the Public Sector Act 2022 .
(a) the way in which the commissioner’s powers are to be exercised in the performance of a function under section 135 or 136 ; or
(b) the priority to be given to investigations, reviews, audits mentioned in section 135 (1) (b) (iii) and privacy complaints under this Act.
sec.135
Performance monitoring, investigation and support functions
sec.135 Performance monitoring, investigation and support functions
The functions of the information commissioner include—
on the commissioner’s own initiative or otherwise—
conducting—
reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or
reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and
investigating an act done or practice engaged in by a relevant entity in relation to personal information, if the commissioner is satisfied on reasonable grounds that the act or practice may contravene the privacy principle requirements or, if the entity is an agency, the entity’s obligations under chapter 3A ; and
leading the improvement of public sector privacy administration in Queensland by taking appropriate action to—
promote understanding of and compliance with this Act; and
provide best practice leadership and advice, including by providing advice and assistance to relevant entities on the interpretation and administration of this Act; and
monitor and audit relevant entities’ compliance with this Act; and
initiate privacy education and training, including education and training programs targeted at particular aspects of privacy administration, and education and training programs to promote greater awareness of the operation of this Act in the community and within the public sector environment; and
comment on any issues relating to the administration of privacy in the public sector environment; and
without limiting subparagraph (v) , identify and comment on legislative and administrative changes that would improve the administration of this Act; and
prepare, or assist in the preparation of, QPP codes; and
assist relevant entities in complying with obligations under QPP codes; and
prepare guidelines for permitted general situations under chapter 3 , part 2 ; and
issuing guidelines under section 138 ; and
supporting complainants for privacy complaints, and all relevant entities to the extent they are subject to the operation of this Act; and
if the commissioner considers it appropriate, reporting to the Speaker on the findings of a reportable matter, including reporting any recommendations to the relevant entity the subject of the reportable matter.
In this section—
reportable matter means—
a review or investigation under subsection (1) (a) ; or
an audit under subsection (1) (b) (iii) .
s 135 amd 2017 No. 17 s 127 ; 2023 No. 32 s 35
(sec.135-ssec.1) The functions of the information commissioner include— on the commissioner’s own initiative or otherwise— conducting— reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and investigating an act done or practice engaged in by a relevant entity in relation to personal information, if the commissioner is satisfied on reasonable grounds that the act or practice may contravene the privacy principle requirements or, if the entity is an agency, the entity’s obligations under chapter 3A ; and leading the improvement of public sector privacy administration in Queensland by taking appropriate action to— promote understanding of and compliance with this Act; and provide best practice leadership and advice, including by providing advice and assistance to relevant entities on the interpretation and administration of this Act; and monitor and audit relevant entities’ compliance with this Act; and initiate privacy education and training, including education and training programs targeted at particular aspects of privacy administration, and education and training programs to promote greater awareness of the operation of this Act in the community and within the public sector environment; and comment on any issues relating to the administration of privacy in the public sector environment; and without limiting subparagraph (v) , identify and comment on legislative and administrative changes that would improve the administration of this Act; and prepare, or assist in the preparation of, QPP codes; and assist relevant entities in complying with obligations under QPP codes; and prepare guidelines for permitted general situations under chapter 3 , part 2 ; and issuing guidelines under section 138 ; and supporting complainants for privacy complaints, and all relevant entities to the extent they are subject to the operation of this Act; and if the commissioner considers it appropriate, reporting to the Speaker on the findings of a reportable matter, including reporting any recommendations to the relevant entity the subject of the reportable matter.
(sec.135-ssec.2) In this section— reportable matter means— a review or investigation under subsection (1) (a) ; or an audit under subsection (1) (b) (iii) .
(a) on the commissioner’s own initiative or otherwise— (i) conducting— (A) reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or (B) reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and (ii) investigating an act done or practice engaged in by a relevant entity in relation to personal information, if the commissioner is satisfied on reasonable grounds that the act or practice may contravene the privacy principle requirements or, if the entity is an agency, the entity’s obligations under chapter 3A ; and
(i) conducting— (A) reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or (B) reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and
(A) reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or
(B) reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and
(ii) investigating an act done or practice engaged in by a relevant entity in relation to personal information, if the commissioner is satisfied on reasonable grounds that the act or practice may contravene the privacy principle requirements or, if the entity is an agency, the entity’s obligations under chapter 3A ; and
(b) leading the improvement of public sector privacy administration in Queensland by taking appropriate action to— (i) promote understanding of and compliance with this Act; and (ii) provide best practice leadership and advice, including by providing advice and assistance to relevant entities on the interpretation and administration of this Act; and (iii) monitor and audit relevant entities’ compliance with this Act; and (iv) initiate privacy education and training, including education and training programs targeted at particular aspects of privacy administration, and education and training programs to promote greater awareness of the operation of this Act in the community and within the public sector environment; and (v) comment on any issues relating to the administration of privacy in the public sector environment; and (vi) without limiting subparagraph (v) , identify and comment on legislative and administrative changes that would improve the administration of this Act; and (vii) prepare, or assist in the preparation of, QPP codes; and (viii) assist relevant entities in complying with obligations under QPP codes; and (ix) prepare guidelines for permitted general situations under chapter 3 , part 2 ; and
(i) promote understanding of and compliance with this Act; and
(ii) provide best practice leadership and advice, including by providing advice and assistance to relevant entities on the interpretation and administration of this Act; and
(iii) monitor and audit relevant entities’ compliance with this Act; and
(iv) initiate privacy education and training, including education and training programs targeted at particular aspects of privacy administration, and education and training programs to promote greater awareness of the operation of this Act in the community and within the public sector environment; and
(v) comment on any issues relating to the administration of privacy in the public sector environment; and
(vi) without limiting subparagraph (v) , identify and comment on legislative and administrative changes that would improve the administration of this Act; and
(vii) prepare, or assist in the preparation of, QPP codes; and
(viii) assist relevant entities in complying with obligations under QPP codes; and
(ix) prepare guidelines for permitted general situations under chapter 3 , part 2 ; and
(c) issuing guidelines under section 138 ; and
(d) supporting complainants for privacy complaints, and all relevant entities to the extent they are subject to the operation of this Act; and
(e) if the commissioner considers it appropriate, reporting to the Speaker on the findings of a reportable matter, including reporting any recommendations to the relevant entity the subject of the reportable matter.
(i) conducting— (A) reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or (B) reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and
(A) reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or
(B) reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and
(ii) investigating an act done or practice engaged in by a relevant entity in relation to personal information, if the commissioner is satisfied on reasonable grounds that the act or practice may contravene the privacy principle requirements or, if the entity is an agency, the entity’s obligations under chapter 3A ; and
(A) reviews of personal information handling practices of relevant entities, including technologies, programs, policies and procedures, to identify privacy related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; or
(B) reviews of acts or practices of agencies in relation to compliance with chapter 3A , including data handling systems and practices, to identify data breach related issues of a systemic nature generally or to identify particular grounds for the issue of compliance notices; and
(i) promote understanding of and compliance with this Act; and
(ii) provide best practice leadership and advice, including by providing advice and assistance to relevant entities on the interpretation and administration of this Act; and
(iii) monitor and audit relevant entities’ compliance with this Act; and
(iv) initiate privacy education and training, including education and training programs targeted at particular aspects of privacy administration, and education and training programs to promote greater awareness of the operation of this Act in the community and within the public sector environment; and
(v) comment on any issues relating to the administration of privacy in the public sector environment; and
(vi) without limiting subparagraph (v) , identify and comment on legislative and administrative changes that would improve the administration of this Act; and
(vii) prepare, or assist in the preparation of, QPP codes; and
(viii) assist relevant entities in complying with obligations under QPP codes; and
(ix) prepare guidelines for permitted general situations under chapter 3 , part 2 ; and
(a) a review or investigation under subsection (1) (a) ; or
(b) an audit under subsection (1) (b) (iii) .
sec.136
Decision-making functions
sec.136 Decision-making functions
The functions of the information commissioner include—
waiving or modifying—
an obligation of a relevant entity to comply with the privacy principle requirements; or
an obligation of an agency to comply with chapter 3A , part 2 or 3 or section 72 or 73 ; and
issuing compliance notices under part 6 ; and
dealing with privacy complaints under chapter 5 .
s 136 amd 2023 No. 32 s 36
(a) waiving or modifying— (i) an obligation of a relevant entity to comply with the privacy principle requirements; or (ii) an obligation of an agency to comply with chapter 3A , part 2 or 3 or section 72 or 73 ; and
(i) an obligation of a relevant entity to comply with the privacy principle requirements; or
(ii) an obligation of an agency to comply with chapter 3A , part 2 or 3 or section 72 or 73 ; and
(b) issuing compliance notices under part 6 ; and
(c) dealing with privacy complaints under chapter 5 .
(i) an obligation of a relevant entity to comply with the privacy principle requirements; or
(ii) an obligation of an agency to comply with chapter 3A , part 2 or 3 or section 72 or 73 ; and
sec.137
Section sec.137
s 137 om 2023 No. 32 s 37
sec.138
Power to issue guidelines
sec.138 Power to issue guidelines
The information commissioner may issue a guideline about any matter relating to the information commissioner’s functions, including, for example, guidelines about—
the interpretation and administration of this Act; and
best practice for relevant entities in relation to information privacy generally; and
the application of the privacy principle requirements, including the factors to be considered in determining whether the QPPs are being complied with.
To remove any doubt, it is declared that—
this section does not limit the information commissioner’s power to make guidelines under the Right to Information Act, section 132 ; and
a guideline issued under that Act may include guidelines relating to the information commissioner’s functions under this Act.
s 138 sub 2023 No. 32 s 38
(sec.138-ssec.1) The information commissioner may issue a guideline about any matter relating to the information commissioner’s functions, including, for example, guidelines about— the interpretation and administration of this Act; and best practice for relevant entities in relation to information privacy generally; and the application of the privacy principle requirements, including the factors to be considered in determining whether the QPPs are being complied with.
(sec.138-ssec.2) To remove any doubt, it is declared that— this section does not limit the information commissioner’s power to make guidelines under the Right to Information Act, section 132 ; and a guideline issued under that Act may include guidelines relating to the information commissioner’s functions under this Act.
(a) the interpretation and administration of this Act; and
(b) best practice for relevant entities in relation to information privacy generally; and
(c) the application of the privacy principle requirements, including the factors to be considered in determining whether the QPPs are being complied with.
(a) this section does not limit the information commissioner’s power to make guidelines under the Right to Information Act, section 132 ; and
(b) a guideline issued under that Act may include guidelines relating to the information commissioner’s functions under this Act.
ch.4-pt.2
Staff of Office of Information Commissioner in relation to this Act
Staff of Office of Information Commissioner in relation to this Act
sec.139
Delegation
sec.139 Delegation
The information commissioner may delegate to a member of the staff of the OIC all or any of the commissioner’s powers under this Act.
sec.140
Staff subject only to direction of information commissioner
sec.140 Staff subject only to direction of information commissioner
The staff of the OIC are not subject to direction by any person, other than the information commissioner or a person authorised by the commissioner, about the performance of the commissioner’s functions under this Act.
Subsection (1) has effect despite the Public Sector Act 2022 .
s 140 amd 2022 No. 34 s 365 sch 3
(sec.140-ssec.1) The staff of the OIC are not subject to direction by any person, other than the information commissioner or a person authorised by the commissioner, about the performance of the commissioner’s functions under this Act.
(sec.140-ssec.2) Subsection (1) has effect despite the Public Sector Act 2022 .
ch.4-pt.3
Privacy Commissioner
Privacy Commissioner
sec.141
The Privacy Commissioner
sec.141 The Privacy Commissioner
There is to be a Privacy Commissioner (the privacy commissioner ).
The privacy commissioner is a member of the staff of the OIC.
(sec.141-ssec.1) There is to be a Privacy Commissioner (the privacy commissioner ).
(sec.141-ssec.2) The privacy commissioner is a member of the staff of the OIC.
sec.142
Role and function of privacy commissioner
sec.142 Role and function of privacy commissioner
The privacy commissioner’s role is that of a deputy to the information commissioner, with particular responsibility for matters relating to the information commissioner’s functions under this Act.
The privacy commissioner’s function is to perform the functions of the information commissioner under this Act to the extent the functions are delegated to the privacy commissioner by the information commissioner.
(sec.142-ssec.1) The privacy commissioner’s role is that of a deputy to the information commissioner, with particular responsibility for matters relating to the information commissioner’s functions under this Act.
(sec.142-ssec.2) The privacy commissioner’s function is to perform the functions of the information commissioner under this Act to the extent the functions are delegated to the privacy commissioner by the information commissioner.
sec.143
Privacy commissioner subject to direction of information commissioner
sec.143 Privacy commissioner subject to direction of information commissioner
The privacy commissioner is subject to the direction of the information commissioner.
More sections below
Source text: opening excerpt
Sourced from Queensland Legislation (legislation.qld.gov.au), CC BY 4.0.
ch.1-pt.1 Introductory
Introductory
sec.1 Short title
sec.1 Short title
This Act may be cited as the Information Privacy Act 2009 .
sec.2 Commencement
sec.2 Commencement
This Act commences on a day to be fixed by proclamation.
sec.3 Object of Act
sec.3 Object of Act
The primary object of this Act is to provide for the fair collection and handling in the public sector environment of personal information.
The Act must be applied and interpreted to further the primary object.
s 3 amd 2023 No. 32 s 8
(sec.3-ssec.1) The primary object of this Act is to provide for the fair collection and handling in the public sector environment of personal information.
(sec.3-ssec.2) The Act must be applied and interpreted to further the primary object.
Section sec.4
s 4 om 2023 No. 32 s 9
Section sec.5
s 5 om 2023 No. 32 s 9
sec.6 Scope of personal information under this Act
sec.6 Scope of personal information under this Act
This Act applies to the collection of personal information, regardless of when it came into existence, and to the storage, handling, accessing, amendment, management, transfer, use and disclosure of personal information regardless of when it was collected.
sec.7 Relationship with other laws regulating personal information
sec.7 Relationship with other laws regulating personal information
This Act is intended to operate subject to the provisions of other Acts regulating—
the collection, storage, handling, accessing, amendment, management, transfer and use of personal information; or
the disclosure, within the meaning of section 23 , of personal information.
Without limiting subsection (1) , the operation of QPPs 6.1 and 6.2(d) and the permitted health situation mentioned in schedule 4 , section 5 do not override any law with respect to assisted and substituted decision-making, including, for example, the Guardianship and Administration Act 2000 and the Powers of Attorney Act 1998 .
s 7 sub 2023 No. 32 s 10
(sec.7-ssec.1) This Act is intended to operate subject to the provisions of other Acts regulating— the collection, storage, handling, accessing, amendment, management, transfer and use of personal information; or the disclosure, within the meaning of section 23 , of personal information.
(sec.7-ssec.2) Without limiting subsection (1) , the operation of QPPs 6.1 and 6.2(d) and the permitted health situation mentioned in schedule 4 , section 5 do not override any law with respect to assisted and substituted decision-making, including, for example, the Guardianship and Administration Act 2000 and the Powers of Attorney Act 1998 .
Sensitive information. A subset of personal information including health information, criminal history, racial or ethnic origin, religious or political beliefs, membership of associations, biometric information, and related categories. Sensitive information attracts heightened protection under QPP 3.
Agency. The entities bound by the Act. Defined to include Queensland Government departments, local governments, hospitals and health services, universities, government-owned corporations and their subsidiaries, and other entities performing government functions.
Contracted service provider. A person who provides services under a contract with an agency and in connection with those services collects, holds, uses or discloses personal information. Under Chapter 2, Part 3, contracted service providers are bound by relevant QPPs as if they were the agency.
Queensland Privacy Principles (QPPs). Thirteen privacy principles set out in Schedule 3 covering the full lifecycle of personal information. The QPPs mirror the structure of the Australian Privacy Principles in the Commonwealth Privacy Act 1988, adapted for the Queensland public sector.
Eligible data breach. Under Chapter 3A, a data breach that meets the statutory threshold: that is, unauthorised access to or disclosure of personal information, or loss of personal information in circumstances where access or disclosure is likely, and which a reasonable person would conclude is likely to result in serious harm to any individuals to whom the information relates.
QPP code. A code approved under Chapter 3, Part 1 that modifies how the QPPs apply to a particular agency or class of agencies. QPP codes may provide alternative privacy protections.
Information Commissioner. The Queensland Information Commissioner, who receives privacy complaints, investigates breaches, and oversees the data breach notification regime.
Who it affects
Queensland public sector agencies including departments, local governments, statutory bodies, hospitals, universities and government-owned corporations, which must comply with all 13 QPPs.
Contracted service providers to agencies, who are bound by the relevant QPPs in performing their contracted functions.
Individuals whose personal information is held by Queensland agencies, who have rights to access (QPP 12) and correction (QPP 13) of their information and may lodge complaints with the Information Commissioner.
Ministers, to whom agencies may be required to provide personal information under Chapter 2, Part 5.
The Information Commissioner, who oversees compliance, receives complaints, and administers the data breach notification regime.
Key obligations
QPP 1 - Transparent management. Agencies must implement practices and systems to ensure QPP compliance and maintain a QPP privacy policy that is available free of charge and in an appropriate form. The policy must identify the kinds of information collected, the purposes for collection, access and correction rights, complaints processes, and whether information is disclosed overseas.
QPP 3 - Collection of solicited personal information. An agency must only collect personal information that is reasonably necessary for its functions. Sensitive information may only be collected with the individual's consent or in specified circumstances. Collection must use lawful and fair means.
QPP 5 - Notification. At or before collection (or as soon as reasonably practicable), an agency must take reasonable steps to notify the individual of the agency's identity, the purposes of collection, any laws authorising collection, the main consequences of non-collection, and the individual's access and correction rights.
QPP 6 - Use and disclosure. Agencies may only use or disclose personal information for the primary purpose of collection or a secondary purpose within the reasonable expectations of the individual, or in a permitted general situation (specified in Schedule 3). Law enforcement exceptions and public interest disclosures are available in defined circumstances.
QPP 8 - Cross-border disclosure. Before disclosing personal information to a person outside Australia, the agency must take reasonable steps to ensure the overseas recipient complies with the QPPs, unless an exception applies.
QPP 11 - Security. Agencies must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. When information is no longer needed, reasonable steps must be taken to destroy or de-identify it.
QPP 12 and 13 - Access and correction. Individuals have rights to access personal information held about them by an agency (QPP 12) and to have incorrect information corrected (QPP 13). These rights may be refused in specified circumstances (for example, where access would pose a serious threat to life or safety, or would prejudice an investigation).
Data breach notification. Under Chapter 3A, if an agency suspects an eligible data breach has occurred, it must assess the situation under Part 2 and, if an eligible data breach is confirmed, notify affected individuals and the Information Commissioner under Part 3. The notification must include specified information about the breach and recommended protective actions.
Powers and discretions
Information Commissioner oversight. The Information Commissioner may receive and investigate complaints about privacy breaches, conduct assessments of agency practices, and oversee compliance with the data breach notification regime under Chapter 3A, Part 4.
Complaint investigation. The Information Commissioner may investigate complaints about privacy breaches by agencies or contracted service providers. Investigation may lead to conciliation, recommendations or referral to QCAT.
QCAT proceedings. Where conciliation fails or is inappropriate, a privacy complaint may be referred to the Queensland Civil and Administrative Tribunal for hearing and determination. QCAT may order the agency to take specified action, pay compensation, or refrain from repetition.
QPP code approval. The Information Commissioner may approve QPP codes under Chapter 3, Part 1, allowing modified privacy arrangements for particular agencies or sectors.
Assessment of agency practices. The Information Commissioner may assess whether an agency's practices comply with the QPPs and make recommendations for improvement.
Penalties and enforcement
The Act's primary enforcement mechanism is the complaints and investigation pathway rather than criminal penalties. However:
Interference with privacy as defined in Chapter 4 (analogous to an "act or practice" breaching the QPPs) entitles the individual to complain to the Information Commissioner.
QCAT orders may include awards of compensation to individuals affected by privacy breaches.
Data breach notification failures under Chapter 3A may be investigated by the Information Commissioner and recommendations made.
False or misleading information in complaints: standard provisions about conduct of proceedings apply.
The Act does not create a direct civil cause of action for breach of a QPP independent of the complaint and QCAT pathway.
Process and timelines
Complaint lodgement. An individual who believes an agency has interfered with their privacy may lodge a complaint with the Information Commissioner. Time limits apply (generally within 12 months of the act or practice complained of, subject to extension).
Assessment and investigation. The Information Commissioner assesses the complaint and may investigate, conciliate, or decline to deal with it in specified circumstances. Investigation timelines are not fixed by statute but must be completed within a reasonable time.
Data breach assessment. Under Chapter 3A, Part 2, when an agency suspects an eligible data breach, it must complete the assessment as expeditiously as possible, and within 30 days of the day the agency first reasonably suspected the breach.
Data breach notification. If an eligible data breach is confirmed, the agency must notify the Information Commissioner and take reasonable steps to notify affected individuals as soon as practicable after the assessment is completed.
QCAT referral. After investigation and conciliation, if the matter is unresolved, the Information Commissioner may refer it to QCAT for hearing. QCAT proceedings follow the QCAT Act 2009 (Qld).
Interactions with other law
Right to Information Act 2009 (Qld). The Information Privacy Act 2009 and the Right to Information Act 2009 are companion statutes administered by the same office (Office of the Information Commissioner). The RTI Act governs access to government documents generally; the IPA governs privacy-specific rights to access and correction of personal information.
Commonwealth Privacy Act 1988 (Cth). The QPP framework is deliberately aligned with the Australian Privacy Principles under the Commonwealth Act. However, the Commonwealth Act applies to private sector "organisations" (broadly defined), while the IPA applies to Queensland public sector agencies. The two regimes complement and in some cases overlap, particularly for contracted service providers.
Health legislation. Health information is classified as sensitive information. The hospital and health services framework under the Hospital and Health Boards Act 2011 and related legislation may impose additional confidentiality obligations on health information that operate alongside the QPPs.
Guardianship and Administration Act 2000 (Qld) and Powers of Attorney Act 1998 (Qld). Section 7(2) expressly provides that the operation of certain QPPs and permitted health situations does not override laws relating to assisted and substituted decision-making.
Criminal law. Disclosure of personal information for law enforcement purposes falls within a permitted general situation under QPP 6.2(e). The interaction between privacy obligations and law enforcement disclosure requirements is governed by that QPP and by specific law enforcement statutes.
Gotchas
Contracted service providers are fully bound. A company engaged by a Queensland agency to process personal information is bound by the relevant QPPs as if it were the agency. Many contracted service providers are unaware of this and do not include QPP-compliant privacy obligations in their own operations. Failure to comply exposes both the contractor and the agency.
Section 39 - no private right of action. Section 39 confirms that the rights created by Chapter 2 (compliance with QPPs) are not enforceable directly as a cause of action at common law or in equity. Enforcement must proceed through the complaint and QCAT pathway. This limits remedies compared to Commonwealth privacy law where the pathway is similar but OAIC has civil penalty powers.
QPP 8 overseas disclosure - duty is on the agency. The obligation to ensure cross-border recipients comply with the QPPs falls on the Queensland agency, not the overseas recipient. Before disclosing personal information overseas, the agency must take reasonable steps to ensure compliance. Cloud computing arrangements where data is stored in servers outside Australia frequently engage this obligation, and many agencies do not adequately assess it.
Data breach notification window is tight. The 30-day assessment period under Chapter 3A is measured from when the agency first reasonably suspected the breach, not from when the breach is confirmed. Agencies that are slow to investigate suspected breaches may find they are already overdue on notification requirements before they have confirmed the nature of the breach.
QPP 6 secondary use without consent. The secondary use and disclosure rules under QPP 6 allow limited re-use of personal information for related purposes. However, agencies sometimes assume that because they collected information for one purpose, they can use it freely for any related purpose. QPP 6 is more restrictive: the secondary purpose must be within the reasonable expectations of the individual or fall within a permitted general situation.
Practical examples
Example 1: Agency data breach notification. A Queensland Health department discovers that a staff member's laptop containing patient names and health information has been stolen. The department must first assess whether this is an eligible data breach under Chapter 3A, Part 2 within 30 days. If the assessment confirms it is an eligible data breach (because a reasonable person would conclude serious harm to individuals is likely), the department must notify the Information Commissioner and take reasonable steps to notify affected individuals.
Example 2: Access request under QPP 12. An individual submits a request to a Queensland agency for access to personal information the agency holds about them. The agency must respond within the time required by its processes and may only refuse access on the grounds specified in QPP 12.3. The individual may complain to the Information Commissioner if access is refused without justification.
Example 3: Contracted call centre. A Queensland government agency engages a private company to operate a call centre that handles citizen inquiries involving personal information. The company is a contracted service provider and is bound by the relevant QPPs when collecting, holding, using and disclosing personal information on the agency's behalf. The agency must ensure its contract includes QPP-compliant obligations.
Example 4: Cross-border cloud storage. A Queensland department migrates its records system to a cloud provider whose servers are located in the United States. The cross-border disclosure provisions under QPP 8 apply. The department must take reasonable steps to ensure the cloud provider complies with the QPPs before the migration occurs.
Example 5: Privacy complaint to QCAT. An individual complains to the Information Commissioner that a local government used their personal information for direct marketing without consent, in breach of QPP 7. The Information Commissioner investigates and conciliation fails. The Commissioner refers the matter to QCAT. QCAT may order the local government to destroy the marketing list, cease the practice, and pay compensation to the individual.
(a) the collection, storage, handling, accessing, amendment, management, transfer and use of personal information; or
(b) the disclosure, within the meaning of section 23 , of personal information.
sec.8 Relationship with other Acts regulating disposal of information
sec.8 Relationship with other Acts regulating disposal of information
This Act does not affect the provisions of other Acts regulating the disposal of information (however described).
s 8 amd 2023 No. 33 s 107 sch 5
Section sec.9
s 9 om 2023 No. 32 s 11
sec.10 Act binds State
sec.10 Act binds State
This Act binds the State.
ch.1-pt.2 Interpretation
Interpretation
sec.11 Definitions
sec.11 Definitions
The dictionary in schedule 5 defines particular words used in this Act.
sec.12 Meaning of personal information
sec.12 Meaning of personal information
Personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable from the information or opinion—
whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.
s 12 sub 2023 No. 32 s 12
(a) whether the information or opinion is true or not; and
(b) whether the information or opinion is recorded in a material form or not.
sec.13 Meaning of held or holds in relation to personal information
sec.13 Meaning of held or holds in relation to personal information
Personal information is held by a relevant entity, or the entity holds personal information, if the personal information is contained in a document in the possession, or under the control, of the relevant entity.
s 13 sub 2023 No. 32 s 12
Section sec.14
s 14 om 2023 No. 32 s 12
sec.15 Meaning of document
sec.15 Meaning of document
In this Act, a document does not include a document to which the privacy principle requirements do not apply.
s 15 sub 2023 No. 32 s 13
sec.16 Meaning of document to which the privacy principle requirements do not apply
sec.16 Meaning of document to which the privacy principle requirements do not apply
In this Act, a document to which the privacy principle requirements do not apply means a document mentioned in schedule 1 .
s 16 sub 2023 No. 32 s 14
Section sec.17
s 17 om 2023 No. 32 s 15
sec.18 Meaning of agency
sec.18 Meaning of agency
In this Act, an agency means—
a Minister; or
a department; or
a local government; or
a public authority.
However, in this Act, agency does not include an excluded entity.
For this Act—
a board, council, committee, subcommittee or other body established by government to help, or to perform functions connected with, an agency is not a separate agency, but is taken to be comprised within the agency; and
a reference to an agency includes a reference to a body that is taken to be comprised within the agency; and
a reference to local government includes a reference to the Wide Bay Water Corporation.
In this section—
excluded entity means—
an entity mentioned in schedule 2 , part 1 ; or
an entity mentioned in schedule 2 , part 2 in relation to the function mentioned in that part.
s 18 amd 2023 No. 32 s 16
(sec.18-ssec.1) In this Act, an agency means— a Minister; or a department; or a local government; or a public authority.
(sec.18-ssec.2) However, in this Act, agency does not include an excluded entity.
(sec.18-ssec.3) For this Act— a board, council, committee, subcommittee or other body established by government to help, or to perform functions connected with, an agency is not a separate agency, but is taken to be comprised within the agency; and a reference to an agency includes a reference to a body that is taken to be comprised within the agency; and a reference to local government includes a reference to the Wide Bay Water Corporation.
(sec.18-ssec.4) In this section— excluded entity means— an entity mentioned in schedule 2 , part 1 ; or an entity mentioned in schedule 2 , part 2 in relation to the function mentioned in that part.
(a) a Minister; or
(b) a department; or
(c) a local government; or
(d) a public authority.
(a) a board, council, committee, subcommittee or other body established by government to help, or to perform functions connected with, an agency is not a separate agency, but is taken to be comprised within the agency; and
(b) a reference to an agency includes a reference to a body that is taken to be comprised within the agency; and
(c) a reference to local government includes a reference to the Wide Bay Water Corporation.
(a) an entity mentioned in schedule 2 , part 1 ; or
(b) an entity mentioned in schedule 2 , part 2 in relation to the function mentioned in that part.
Section sec.19
s 19 om 2023 No. 32 s 17
sec.20 Special provision about application of Act to a Minister
sec.20 Special provision about application of Act to a Minister
If a provision of this Act applies to a Minister, the provision applies only for acts done, or practices engaged in, as the case may be, in the Minister’s capacity as a Minister in relation to the affairs of an agency administered by the Minister.
s 20 amd 2023 No. 32 s 18
sec.21 Meaning of public authority
sec.21 Meaning of public authority
In this Act, public authority means any of the following entities—
Under the Acts Interpretation Act 1954 , schedule 1 —
entity includes a person and an unincorporated body.
an entity—
established for a public purpose by an Act; or
established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
an entity created by the Governor in Council or a Minister;
another entity declared by regulation to be a public authority for this Act, being an entity—
supported directly or indirectly by government funds or other government assistance; or
over which government is in a position to exercise control; or
established under an Act; or
given public functions under an Act;
subject to subsection (4) , a person holding an office established under an Act;
a person holding an appointment—
made by the Governor in Council or Minister otherwise than under an Act; and
declared by regulation to be an appointment the holder of which is a public authority for this Act.
For subsection (1) (c) , an entity may be declared by regulation to be a public authority for this Act in relation to only a part of the entity’s functions.
A prescribed entity is not a public authority in relation to documents received, or created, by it in performing a function other than the public function given under an Act.
A person is not a public authority merely because the person holds—
an office the duties of which are performed as duties of employment as an agency’s officer; or
an office of member of a body; or
an office established under an Act for the purposes of an agency.
In this section—
prescribed entity means an entity that is a public authority only because it is given public functions under an Act and is declared by regulation to be a public authority for this Act.
s 21 amd 2013 No. 39 s 110 (1) sch 3 pt 1 ; 2023 No. 32 s 19
(sec.21-ssec.1) In this Act, public authority means any of the following entities— Under the Acts Interpretation Act 1954 , schedule 1 — entity includes a person and an unincorporated body. an entity— established for a public purpose by an Act; or established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ; an entity created by the Governor in Council or a Minister; another entity declared by regulation to be a public authority for this Act, being an entity— supported directly or indirectly by government funds or other government assistance; or over which government is in a position to exercise control; or established under an Act; or given public functions under an Act; subject to subsection (4) , a person holding an office established under an Act; a person holding an appointment— made by the Governor in Council or Minister otherwise than under an Act; and declared by regulation to be an appointment the holder of which is a public authority for this Act.
(sec.21-ssec.2) For subsection (1) (c) , an entity may be declared by regulation to be a public authority for this Act in relation to only a part of the entity’s functions.
(sec.21-ssec.3) A prescribed entity is not a public authority in relation to documents received, or created, by it in performing a function other than the public function given under an Act.
(sec.21-ssec.4) A person is not a public authority merely because the person holds— an office the duties of which are performed as duties of employment as an agency’s officer; or an office of member of a body; or an office established under an Act for the purposes of an agency.
(sec.21-ssec.5) In this section— prescribed entity means an entity that is a public authority only because it is given public functions under an Act and is declared by regulation to be a public authority for this Act.
(a) an entity— (i) established for a public purpose by an Act; or (ii) established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
(i) established for a public purpose by an Act; or
(ii) established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
(b) an entity created by the Governor in Council or a Minister;
(c) another entity declared by regulation to be a public authority for this Act, being an entity— (i) supported directly or indirectly by government funds or other government assistance; or (ii) over which government is in a position to exercise control; or (iii) established under an Act; or (iv) given public functions under an Act;
(i) supported directly or indirectly by government funds or other government assistance; or
(ii) over which government is in a position to exercise control; or
(iii) established under an Act; or
(iv) given public functions under an Act;
(d) subject to subsection (4) , a person holding an office established under an Act;
(e) a person holding an appointment— (i) made by the Governor in Council or Minister otherwise than under an Act; and (ii) declared by regulation to be an appointment the holder of which is a public authority for this Act.
(i) made by the Governor in Council or Minister otherwise than under an Act; and
(ii) declared by regulation to be an appointment the holder of which is a public authority for this Act.
(i) established for a public purpose by an Act; or
(ii) established by government under an Act for a public purpose, whether or not the public purpose is stated in the Act ;
(i) supported directly or indirectly by government funds or other government assistance; or
(ii) over which government is in a position to exercise control; or
(iii) established under an Act; or
(iv) given public functions under an Act;
(i) made by the Governor in Council or Minister otherwise than under an Act; and
(ii) declared by regulation to be an appointment the holder of which is a public authority for this Act.
(a) an office the duties of which are performed as duties of employment as an agency’s officer; or
(b) an office of member of a body; or
(c) an office established under an Act for the purposes of an agency.
Section sec.22
s 22 om 2023 No. 32 s 141 s ch 1 pt 2
sec.23 What it means to disclose personal information and to use personal information
sec.23 What it means to disclose personal information and to use personal information
An entity (the first entity ) discloses personal information to another entity (the second entity ) if—
the second entity does not know the personal information, and is not in a position to be able to find it out; and
the first entity gives the second entity the personal information, or places it in a position to be able to find it out; and
the first entity ceases to have control over the second entity in relation to who will know the personal information in the future.
An entity uses personal information if it—
manipulates, searches or otherwise deals with the information; or
takes the information into account in the making of a decision; or
transfers the information from a part of the entity having particular functions to a part of the entity having different functions.
Subsection (2) does not limit what actions may be use of the personal information.
However, use of the personal information does not include the action of disclosing the personal information to another entity.
s 23 amd 2023 No. 32 s 20
(sec.23-ssec.1) An entity (the first entity ) discloses personal information to another entity (the second entity ) if— the second entity does not know the personal information, and is not in a position to be able to find it out; and the first
This is an opening excerpt, not the complete document.