Information Privacy Act 2009

• Queensland public sector agencies including departments, local governments, statutory bodies, hospitals, universities and government-owned corporations, which must comply with all 13 QPPs.
• Contracted service providers to agencies, who are bound by the relevant QPPs in performing their contracted functions.
• Individuals whose personal information is held by Queensland agencies, who have rights to access (QPP 12) and correction (QPP 13) of their information and may lodge complaints with the Information Commissioner.
• Ministers, to whom agencies may be required to provide personal information under Chapter 2, Part 5.
• The Information Commissioner, who oversees compliance, receives complaints, and administers the data breach notification regime.

QPP 1 - Transparent management. Agencies must implement practices and systems to ensure QPP compliance and maintain a QPP privacy policy that is available free of charge and in an appropriate form. The policy must identify the kinds of information collected, the purposes for collection, access and correction rights, complaints processes, and whether information is disclosed overseas.

QPP 3 - Collection of solicited personal information. An agency must only collect personal information that is reasonably necessary for its functions. Sensitive information may only be collected with the individual's consent or in specified circumstances. Collection must use lawful and fair means.

QPP 5 - Notification. At or before collection (or as soon as reasonably practicable), an agency must take reasonable steps to notify the individual of the agency's identity, the purposes of collection, any laws authorising collection, the main consequences of non-collection, and the individual's access and correction rights.

QPP 6 - Use and disclosure. Agencies may only use or disclose personal information for the primary purpose of collection or a secondary purpose within the reasonable expectations of the individual, or in a permitted general situation (specified in Schedule 3). Law enforcement exceptions and public interest disclosures are available in defined circumstances.

QPP 8 - Cross-border disclosure. Before disclosing personal information to a person outside Australia, the agency must take reasonable steps to ensure the overseas recipient complies with the QPPs, unless an exception applies.

QPP 11 - Security. Agencies must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. When information is no longer needed, reasonable steps must be taken to destroy or de-identify it.

QPP 12 and 13 - Access and correction. Individuals have rights to access personal information held about them by an agency (QPP 12) and to have incorrect information corrected (QPP 13). These rights may be refused in specified circumstances (for example, where access would pose a serious threat to life or safety, or would prejudice an investigation).

Data breach notification. Under Chapter 3A, if an agency suspects an eligible data breach has occurred, it must assess the situation under Part 2 and, if an eligible data breach is confirmed, notify affected individuals and the Information Commissioner under Part 3. The notification must include specified information about the breach and recommended protective actions.

Information Commissioner oversight. The Information Commissioner may receive and investigate complaints about privacy breaches, conduct assessments of agency practices, and oversee compliance with the data breach notification regime under Chapter 3A, Part 4.

Complaint investigation. The Information Commissioner may investigate complaints about privacy breaches by agencies or contracted service providers. Investigation may lead to conciliation, recommendations or referral to QCAT.

QCAT proceedings. Where conciliation fails or is inappropriate, a privacy complaint may be referred to the Queensland Civil and Administrative Tribunal for hearing and determination. QCAT may order the agency to take specified action, pay compensation, or refrain from repetition.

QPP code approval. The Information Commissioner may approve QPP codes under Chapter 3, Part 1, allowing modified privacy arrangements for particular agencies or sectors.

Assessment of agency practices. The Information Commissioner may assess whether an agency's practices comply with the QPPs and make recommendations for improvement.

The Act's primary enforcement mechanism is the complaints and investigation pathway rather than criminal penalties. However:

• Interference with privacy as defined in Chapter 4 (analogous to an "act or practice" breaching the QPPs) entitles the individual to complain to the Information Commissioner.
• QCAT orders may include awards of compensation to individuals affected by privacy breaches.
• Data breach notification failures under Chapter 3A may be investigated by the Information Commissioner and recommendations made.
• False or misleading information in complaints: standard provisions about conduct of proceedings apply.

The Act does not create a direct civil cause of action for breach of a QPP independent of the complaint and QCAT pathway.

Complaint lodgement. An individual who believes an agency has interfered with their privacy may lodge a complaint with the Information Commissioner. Time limits apply (generally within 12 months of the act or practice complained of, subject to extension).

Assessment and investigation. The Information Commissioner assesses the complaint and may investigate, conciliate, or decline to deal with it in specified circumstances. Investigation timelines are not fixed by statute but must be completed within a reasonable time.

Data breach assessment. Under Chapter 3A, Part 2, when an agency suspects an eligible data breach, it must complete the assessment as expeditiously as possible, and within 30 days of the day the agency first reasonably suspected the breach.

Data breach notification. If an eligible data breach is confirmed, the agency must notify the Information Commissioner and take reasonable steps to notify affected individuals as soon as practicable after the assessment is completed.

QCAT referral. After investigation and conciliation, if the matter is unresolved, the Information Commissioner may refer it to QCAT for hearing. QCAT proceedings follow the QCAT Act 2009 (Qld).

Right to Information Act 2009 (Qld). The Information Privacy Act 2009 and the Right to Information Act 2009 are companion statutes administered by the same office (Office of the Information Commissioner). The RTI Act governs access to government documents generally; the IPA governs privacy-specific rights to access and correction of personal information.

Commonwealth Privacy Act 1988 (Cth). The QPP framework is deliberately aligned with the Australian Privacy Principles under the Commonwealth Act. However, the Commonwealth Act applies to private sector "organisations" (broadly defined), while the IPA applies to Queensland public sector agencies. The two regimes complement and in some cases overlap, particularly for contracted service providers.

Health legislation. Health information is classified as sensitive information. The hospital and health services framework under the Hospital and Health Boards Act 2011 and related legislation may impose additional confidentiality obligations on health information that operate alongside the QPPs.

Guardianship and Administration Act 2000 (Qld) and Powers of Attorney Act 1998 (Qld). Section 7(2) expressly provides that the operation of certain QPPs and permitted health situations does not override laws relating to assisted and substituted decision-making.

Criminal law. Disclosure of personal information for law enforcement purposes falls within a permitted general situation under QPP 6.2(e). The interaction between privacy obligations and law enforcement disclosure requirements is governed by that QPP and by specific law enforcement statutes.

Contracted service providers are fully bound. A company engaged by a Queensland agency to process personal information is bound by the relevant QPPs as if it were the agency. Many contracted service providers are unaware of this and do not include QPP-compliant privacy obligations in their own operations. Failure to comply exposes both the contractor and the agency.

Section 39 - no private right of action. Section 39 confirms that the rights created by Chapter 2 (compliance with QPPs) are not enforceable directly as a cause of action at common law or in equity. Enforcement must proceed through the complaint and QCAT pathway. This limits remedies compared to Commonwealth privacy law where the pathway is similar but OAIC has civil penalty powers.

QPP 8 overseas disclosure - duty is on the agency. The obligation to ensure cross-border recipients comply with the QPPs falls on the Queensland agency, not the overseas recipient. Before disclosing personal information overseas, the agency must take reasonable steps to ensure compliance. Cloud computing arrangements where data is stored in servers outside Australia frequently engage this obligation, and many agencies do not adequately assess it.

Data breach notification window is tight. The 30-day assessment period under Chapter 3A is measured from when the agency first reasonably suspected the breach, not from when the breach is confirmed. Agencies that are slow to investigate suspected breaches may find they are already overdue on notification requirements before they have confirmed the nature of the breach.

QPP 6 secondary use without consent. The secondary use and disclosure rules under QPP 6 allow limited re-use of personal information for related purposes. However, agencies sometimes assume that because they collected information for one purpose, they can use it freely for any related purpose. QPP 6 is more restrictive: the secondary purpose must be within the reasonable expectations of the individual or fall within a permitted general situation.

Example 1: Agency data breach notification. A Queensland Health department discovers that a staff member's laptop containing patient names and health information has been stolen. The department must first assess whether this is an eligible data breach under Chapter 3A, Part 2 within 30 days. If the assessment confirms it is an eligible data breach (because a reasonable person would conclude serious harm to individuals is likely), the department must notify the Information Commissioner and take reasonable steps to notify affected individuals.

Example 2: Access request under QPP 12. An individual submits a request to a Queensland agency for access to personal information the agency holds about them. The agency must respond within the time required by its processes and may only refuse access on the grounds specified in QPP 12.3. The individual may complain to the Information Commissioner if access is refused without justification.

Example 3: Contracted call centre. A Queensland government agency engages a private company to operate a call centre that handles citizen inquiries involving personal information. The company is a contracted service provider and is bound by the relevant QPPs when collecting, holding, using and disclosing personal information on the agency's behalf. The agency must ensure its contract includes QPP-compliant obligations.

Example 4: Cross-border cloud storage. A Queensland department migrates its records system to a cloud provider whose servers are located in the United States. The cross-border disclosure provisions under QPP 8 apply. The department must take reasonable steps to ensure the cloud provider complies with the QPPs before the migration occurs.

Example 5: Privacy complaint to QCAT. An individual complains to the Information Commissioner that a local government used their personal information for direct marketing without consent, in breach of QPP 7. The Information Commissioner investigates and conciliation fails. The Commissioner refers the matter to QCAT. QCAT may order the local government to destroy the marketing list, cease the practice, and pay compensation to the individual.