8TPP 8—cross-border disclosure of personal information

8 TPP 8—cross-border disclosure of personal information 8.1 Before a public sector agency discloses personal information about an individual to a person (an overseas recipient)— (a) who is not in Australia or an external territory; and (b) who is not the agency or the individual; the agency must take reasonable steps to ensure that the overseas recipient does not breach the TPPs (other than TPP 1) in relation to the information. Note In certain circumstances, an act done, or a practice engaged in, by an overseas recipient is taken, under s 22, to have been done, or engaged in, by the public sector agency and to be a breach of the TPPs. Schedule 1 Territory privacy principles Part 1.3 Dealing with personal information Section 8 page 56 Information Privacy Act 2014 Effective: 16/12/25 R13 16/12/25 Authorised by the ACT Parliamentary Counsel—also accessible at www.legislation.act.gov.au 8.2 TPP 8.1 does not apply to the disclosure of personal information about an individual by a public sector agency to the overseas recipient if— (a) the agency reasonably believes that— (i) the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the TPPs protect the information; and (ii) there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme; or (b) both of the following apply: (i) the agency expressly informs the individual that if the individual consents to the disclosure of the information, TPP 8.1 will not apply to the disclosure; (ii) after being informed, the individual consents to the disclosure; or (c) the disclosure of the information is required or authorised by or under an Australian law, or a court or tribunal order; or (d) a permitted general situation (other than the situation mentioned in section 19 (1) (d) or (e)) exists in relation to the disclosure of the information by the agency; or (e) the disclosure of the information is required or authorised by or under an international agreement relating to information sharing to which Australia or the Territory is a party; or Territory privacy principles Schedule 1 Dealing with personal information Part 1.3 Section 9 R13 16/12/25 Information Privacy Act 2014 Effective: 16/12/25 page 57 Authorised by the ACT Parliamentary Counsel—also accessible at www.legislation.act.gov.au (f) both of the following apply: (i) the agency reasonably believes that the disclosure of the information is reasonably necessary for 1 or more enforcement-related activities conducted by, or on behalf of, an enforcement body; (ii) the recipient is a body that exercises functions that are similar to those exercised by an enforcement body.