sch.3-sec.4QPP 4—dealing with unsolicited personal information

### sch.3-sec.4 QPP 4—dealing with unsolicited personal information If— an agency receives personal information; and the agency did not solicit the information; the agency must, within a reasonable period after receiving the information, decide whether or not the agency could have collected the information under QPP 3 if the agency had solicited the information. The agency may use or disclose the personal information for the purposes of making the decision under QPP 4.1. If— the agency decides the agency could not have collected the personal information; and the information is not contained in a public record; the agency must, as soon as practicable but only if it is lawful and reasonable to do so, destroy the information or ensure that the information is de-identified. If QPP 4.3 does not apply in relation to the personal information, QPPs 5 to 13 apply in relation to the information as if the agency had collected the information under QPP 3. sch 3 s 4 sub 2023 No. 32 s 74 (sch.3-sec.4-ssec.4.1) If— an agency receives personal information; and the agency did not solicit the information; the agency must, within a reasonable period after receiving the information, decide whether or not the agency could have collected the information under QPP 3 if the agency had solicited the information. (sch.3-sec.4-ssec.4.2) The agency may use or disclose the personal information for the purposes of making the decision under QPP 4.1. (sch.3-sec.4-ssec.4.3) If— the agency decides the agency could not have collected the personal information; and the information is not contained in a public record; the agency must, as soon as practicable but only if it is lawful and reasonable to do so, destroy the information or ensure that the information is de-identified. (sch.3-sec.4-ssec.4.4) If QPP 4.3 does not apply in relation to the personal information, QPPs 5 to 13 apply in relation to the information as if the agency had collected the information under QPP 3. - (a) an agency receives personal information; and - (b) the agency did not solicit the information; - (a) the agency decides the agency could not have collected the personal information; and - (b) the information is not contained in a public record;