sec.35Binding a contracted service provider to privacy principle requirements

### sec.35 Binding a contracted service provider to privacy principle requirements An agency entering into a service arrangement must take all reasonable steps to ensure that the contracted service provider is required to comply with parts 1 and 2 and section 41 , as if it were the agency, in relation to the discharge of its obligations under the arrangement. However, the agency must comply with subsection (1) only if— the contracted service provider will in any way deal with personal information for the contracting agency; or the provision of services under the arrangement will involve— the transfer of personal information to the contracting agency; or the provision of services to a third party for the contracting agency. The agency is not required to comply with subsection (1) if— the contracted service provider is to receive funding from the contracting agency; and the contracted service provider will not collect personal information for the contracting agency; and the contracted service provider will not receive any personal information from the contracting agency for the purposes of discharging its obligations; and the contracted service provider will not be required to give the contracting agency any personal information it collects in discharging its obligations. Subsections (1) to (3) are not intended to limit what may be provided for in a service arrangement about the contracted service provider’s collection, storage, handling, accessing, amendment, management, transfer, use or disclosure of personal information, whether or not the contracted service provider is a bound contracted service provider. s 35 amd 2023 No. 32 s 30 (sec.35-ssec.1) An agency entering into a service arrangement must take all reasonable steps to ensure that the contracted service provider is required to comply with parts 1 and 2 and section 41 , as if it were the agency, in relation to the discharge of its obligations under the arrangement. (sec.35-ssec.2) However, the agency must comply with subsection (1) only if— the contracted service provider will in any way deal with personal information for the contracting agency; or the provision of services under the arrangement will involve— the transfer of personal information to the contracting agency; or the provision of services to a third party for the contracting agency. (sec.35-ssec.3) The agency is not required to comply with subsection (1) if— the contracted service provider is to receive funding from the contracting agency; and the contracted service provider will not collect personal information for the contracting agency; and the contracted service provider will not receive any personal information from the contracting agency for the purposes of discharging its obligations; and the contracted service provider will not be required to give the contracting agency any personal information it collects in discharging its obligations. (sec.35-ssec.4) Subsections (1) to (3) are not intended to limit what may be provided for in a service arrangement about the contracted service provider’s collection, storage, handling, accessing, amendment, management, transfer, use or disclosure of personal information, whether or not the contracted service provider is a bound contracted service provider. - (a) the contracted service provider will in any way deal with personal information for the contracting agency; or - (b) the provision of services under the arrangement will involve— (i) the transfer of personal information to the contracting agency; or (ii) the provision of services to a third party for the contracting agency. - (i) the transfer of personal information to the contracting agency; or - (ii) the provision of services to a third party for the contracting agency. - (i) the transfer of personal information to the contracting agency; or - (ii) the provision of services to a third party for the contracting agency. - (a) the contracted service provider is to receive funding from the contracting agency; and - (b) the contracted service provider will not collect personal information for the contracting agency; and - (c) the contracted service provider will not receive any personal information from the contracting agency for the purposes of discharging its obligations; and - (d) the contracted service provider will not be required to give the contracting agency any personal information it collects in discharging its obligations.