This Act sets rules for how personal information is collected, used, stored, disclosed and corrected in Tasmania. It applies to public authorities and other "personal information custodians", distinguishes sensitive and health information, limits overseas disclosure, and requires security, openness and access/correction rights. The Ombudsman manages complaints and investigations. Specified bodies and purposes are exempt and the Minister may grant or revoke exemptions, with procedural requirements for notification and record‑keeping.
This Act establishes a statutory framework for the handling of personal information by defined "personal information custodians" in Tasmania by importing a set of Personal Information Protection Principles set out in Schedule 1, and by creating administrative remedies and processes for access, correction and complaint. The mechanics are:
It declares the applicable principles, which collectively govern collection, use and disclosure, data quality, security, openness, access and correction, unique identifiers, anonymity, cross-border disclosure, and special handling of sensitive and health information (Schedule 1, clauses 1-10). See s16 for the statement that the principles in Schedule 1 apply in Tasmania.
It makes compliance with those principles a statutory duty for personal information custodians (s17(1)). A limited transitional carve out allows activity done to perform contracts entered into before the second anniversary of commencement (s17(2)).
It defines who is a personal information custodian (s3): public authorities as defined in the Right to Information Act 2009, any body, organisation or person that has entered into a personal information contract, and prescribed bodies. The statutory definition of personal information is broad and includes recorded information or opinions about an identifiable living person and, for some parts of the Act (Part 3A and Schedule 1, cl.6), extends to deceased persons with rights exercisable by next-of-kin (s3, s3A).
It creates an administrative complaints and investigatory route through the Ombudsman. Complainants must first raise the matter with the relevant custodian and, if unsatisfied, may complain to the Ombudsman (s18). The Ombudsman may assess, investigate, resolve, refer or decline complaints under the Ombudsman Act procedures (ss19-22). Where the Ombudsman finds a contravention, the Ombudsman provides written reasons and may make recommendations, and must give the Minister a copy which the Minister tables in Parliament (s22).
Current sections
Direct links to the current provisions in Personal Information Protection Act 2004.
employee information includes personal information about an individual who is, was or applies to be an employee relating to –
(a) the selection, employment, training, discipline or resignation of the individual; or
(b) the termination of the employment of the individual; or
(c) the terms and conditions of employment of the individual; or
(d) the performance or conduct of the individual in carrying out the duties or functions of employment; or
(e) the suitability of the individual for appointment or for employment held by the individual; or
(f) the hours of employment of the individual; or
(g) the salary or wages of the individual; or
(h) the membership of the individual of a professional association, trade association or trade union; or
(i) the recreation leave, long service leave, sick leave, personal leave, maternity leave, paternity leave or other leave of the individual; or
(j) information that supports employment statistical reporting and personnel planning; or
(k) information in relation to employees as required by law;
employment includes appointment or engagement to an office or position;
health information means –
(a) personal information or opinion about –
(i) the physical, mental or psychological health at any time of an individual; or
(ii) a disability at any time of an individual; or
(iii) an individual's expressed wishes about the future provision of health services to him or her; or
(iv) a health service provided, or to be provided, to an individual; or
(b) other personal information collected to provide, or in providing, a health service; or
(c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or
(d) genetic information about an individual that is or may be predictive of the health at any time of the individual or any of his or her descendants –
other than prescribed information, a prescribed class of information or information contained in a prescribed class of documents;
health service means an activity, other than a prescribed activity, performed in relation to an individual that is intended or claimed by the individual or the person performing it –
(a) to assess, maintain or improve the individual's health; or
(b) to diagnose the individual's illness, injury or disability; or
(c) to treat the individual's illness, injury or disability or suspected illness, injury or disability; or
(d) to dispense on prescription a drug or medical preparation; or
(e) to provide a disability service, palliative care service or aged care service; or
(f) to provide a prescribed service or a prescribed class of service in conjunction with any activity referred to in paragraph (a) , (b) , (c) , (d) or (e) ;
identifier means anything assigned by a personal information custodian to identify an individual for its operations, other than a name or ABN as defined in the A New Tax System (Australian Business Number) Act 1999 of the Commonwealth;
law enforcement agency means any of the following:
(a) a police force or police service of –
(i) the Commonwealth; or
(ii) this State; or
(iii) any other State or a Territory of the Commonwealth; or
(iv) any country;
(b) the Australian Crime Commission;
(c) a commission established or appointed under any Act of this State or any other State or a Territory of the Commonwealth or of the Commonwealth to investigate matters relating to criminal activity generally or of a specified class;
(d) a personal information custodian responsible for the performance of functions relating to –
(i) the prevention, detection, investigation or prosecution of criminal offences or other offences that impose a penalty or sanction; or
(ii) the management of property seized or restrained under a law relating to the confiscation of the proceeds of crime or the enforcement of such a law;
(e) an agency established under the Public Service Act 1999 of the Commonwealth responsible for the performance of functions relating to –
(i) the prevention, detection, investigation or prosecution of criminal offences or other offences that impose a penalty or sanction; or
(ii) the management of property seized or restrained under a law relating to the confiscation of the proceeds of crime or the enforcement of such a law;
(f) a personal information custodian or an individual or body contracted by a personal information custodian responsible for the execution or implementation of an order, decision or determination of a court or tribunal;
(g) a personal information custodian –
(i) responsible for the issue of warrants; or
(ii) that provides correctional services; or
(iii) responsible for decisions relating to the release of persons from custody;
(h) a personal information custodian responsible for the protection of public revenue under any Act;
(i) a personal information custodian responsible for the administration or performance of a function under a law that imposes a penalty or sanction;
Ombudsman means the person appointed and holding office under the Ombudsman Act 1978 ;
personal information means any information or opinion in any recorded format about an individual –
(a) whose identity is apparent or is reasonably ascertainable from the information or opinion; and
(b) who is alive or has not been dead for more than 25 years;
personal information contract means a contract between a personal information custodian and another person (whether a personal information custodian or not) relating to the collection, use or storage of personal information;
Reference to personal information in Part 3A and Schedule 1
3A Reference to personal information in Part 3A and Schedule 1
[Section 3A Inserted by No. 71 of 2009, s. 6, Applied:15 Jul 2010] In Part 3A and clause 6 of Schedule 1 , a reference to personal information of a person includes the personal information of a deceased person, and rights given by this Act in respect of the personal information of a person are, where the person is a deceased person, to be taken to be rights that may be exercised in respect of that personal information by the next-of-kin of that person.
3B
Access to information of a medical or psychiatric nature
3B Access to information of a medical or psychiatric nature
(a) a request is made to a personal information custodian for access to information of a medical or psychiatric nature concerning the person making the request; and
(b) it appears to the personal information custodian that the provision to that person of access to the information might be prejudicial to the physical or mental health or wellbeing of that person –
the personal information custodian may direct that access to the information must not be provided to the person who made the request but must instead be provided to a medical practitioner nominated by that person.
(g) the registry or other office of a court or tribunal in relation to any matter relating to the judicial or quasi-judicial functions of that court or tribunal;
Clause 1 of Schedule 1 does not apply to unsolicited information received by a personal information custodian.
12
Use of basic information
12 Use of basic information
A personal information custodian may use or disclose personal information about an individual for a purpose other than the primary purpose of collection without the individual's consent if –
(f) any person employed in relation to the functions or duties of the Crown Solicitor.
13
Application for exemptions
13 Application for exemptions
(1) A personal information custodian may apply to the Minister for an exemption from compliance with any or all provisions of this Act.
(2) An application is to –
(a) specify the provision or provisions to which the application relates; and
(b) specify the information or class or classes of information to which the application relates; and
(c) specify the personal information custodian or custodians or class or classes of personal information custodians to which the application applies; and
(d) specify the reasons for the exemption; and
(e) specify any public benefit involved; and
(f) specify any relevant law, code of practice or other instrument under which it proposes to operate; and
(g) include any other information the Minister determines.
14
Determination of exemption
14 Determination of exemption
(1) The Minister may determine to –
(a) approve an application if satisfied that the public benefit outweighs to a substantial degree the public benefit from compliance with the personal information protection principles; or
(b) refuse to approve the application if not so satisfied.
(2) The Minister may approve an application subject to any conditions the Minister considers appropriate.
(3) The Minister is to publish the determination and the details of the application in the Gazette.
15
Revocation of exemption
15 Revocation of exemption
(1) The Minister may revoke a determination to approve an application for an exemption –
(a) if satisfied that –
(i) the reasons for granting that exemption no longer apply; or
(2) The Minister is to publish the details of a revocation in the Gazette.
Part 3
Personal Information protection principles
Part 3 Personal Information protection principles
16
Personal information protection principles
16 Personal information protection principles
The personal information protection principles that apply in Tasmania are those specified in Schedule 1 .
17
Compliance with personal information protection principles
17 Compliance with personal information protection principles
(1) A personal information custodian must comply with the personal information protection principles.
(2) Subsection (1) does not apply to anything done by a personal information custodian before the second anniversary of the commencement of this Act that is necessary for the performance of a contract entered into by the personal information custodian before the commencement of this Act.
Part 3A
Amendment of Personal Information
Part 3A Amendment of Personal Information
17A
Person may request amendment of information
17A Person may request amendment of information
[Section 17A Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010] If information of a person is held or used by a personal information custodian, the person can request the amendment of any part of that information if it is incorrect, incomplete, out of date or misleading.
(a) specify the way in which the information is incomplete, incorrect, out of date or misleading; and
(b) if the information is claimed to be out of date, set out the information required to bring it up to date.
17E
Time within which personal information custodian must notify claimant
17E Time within which personal information custodian must notify claimant
[Section 17E Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010] A personal information custodian must take all reasonable steps to enable a person to be notified of a decision on a request made under section 17A as soon as practicable, but in any case not later than 20 working days after the request was received by or on behalf of the personal information custodian.
(1) If, in relation to a request made under section 17A , a decision is made not to amend the information in the way requested, the personal information custodian that received the request must give the applicant written notice of the decision.
(b) state the name and designation of the person who made the decision; and
(c) inform the applicant –
(i) of the applicant's right to make a complaint about the decision; and
(ii) that the Ombudsman is the authority to whom a complaint can be made; and
(iii) of the time within which the complaint must be made.
17G
Requirement for notation
17G Requirement for notation
[Section 17G Inserted by No. 71 of 2009, s. 8, Applied:15 Jul 2010] If a personal information custodian decides to refuse to amend information pursuant to a request made under section 17A , the person who made the request may, at any time, by written notice, require the personal information custodian to add to the information a notation –
(a) specifying the respects in which the information is claimed by the applicant to be incomplete, incorrect, out of date or misleading; and
(b) if the information is claimed to be out of date, setting out the information it is claimed is required to bring it up to date.
(a) that a notation as required by the notice is added to the information; and
(b) that, if the information to which the notation relates is disclosed to a person (including another personal information custodian), there is also furnished to that person a statement –
(i) stating that the person to whom the information relates claims that it is incomplete, incorrect, out of date or misleading, as the case may be; and
(ii) giving particulars of the notation; and
(iii) if the personal information custodian considers it appropriate to do so, giving the reasons why the personal information custodian did not amend the information.
(a) deletes or expunges the information which has been amended; or
(b) destroys the document –
unless the State Archivist agrees.
Part 4
Complaints and Investigations
Part 4 Complaints and Investigations
18
Making of complaints
18 Making of complaints
(1) A person may make a complaint to the Ombudsman in relation to a matter referred to in subsection (2) if the person –
(a) has raised the matter with the relevant personal information custodian; and
(b) is not satisfied with the response from the personal information custodian.
(2) A complaint may be made by a person in relation to the alleged contravention by a personal information custodian of a personal information protection principle that applies to the person.
(3) A complaint may be in writing or verbal, but the Ombudsman may require a verbal complaint to be put in writing.
(4) The Ombudsman may –
(a) require information about a complaint to be provided by the complainant in a particular manner or form; and
(b) require a complaint to be verified by statutory declaration.
(5) [Section 18 Subsection (5) amended by No. 71 of 2009, s. 9, Applied:15 Jul 2010] A complaint, other than a complaint about a decision to refuse a request to amend personal information made in accordance with Part 3A , must be made within 6 months or any further period the Ombudsman may allow from the time the complainant first became aware of the matter which is the subject of the complaint.
(1) If the Ombudsman decides to deal with a complaint, the Ombudsman is to conduct any investigations in relation to the complaint in accordance with Division 3 of Part III of theOmbudsman Act 1978 .
(2) The Ombudsman may conduct an investigation into any general issue or matter under this Act.
22
Procedure on completion of investigation
22 Procedure on completion of investigation
(1) If, on completion of an investigation of a complaint, the Ombudsman is of the opinion that a personal information custodian has contravened a personal information protection principle, the Ombudsman –
(a) is to advise the complainant and the personal information custodian in writing of that opinion and the reasons on which it is based; and
(b) may make any recommendations the Ombudsman considers appropriate in relation to the subject matter of the complaint.
(2) The Ombudsman is to give the Minister a copy of the advice and any recommendations.
(3) The Minister is to table the advice and any recommendations in both Houses of Parliament within 5 sitting days of its receipt.
Part 5
Miscellaneous
Part 5 Miscellaneous
23
Regulations
23 Regulations
The Governor may make regulations for the purpose of this Act.
(1) A personal information custodian must not collect personal information unless the information is necessary for one or more of its functions or activities.
(2) A personal information custodian must collect personal information only by lawful means.
(3) Before collection, during collection or as soon as practicable after collection of personal information about an individual from the individual, the personal information custodian must take any reasonable steps necessary to ensure that the individual is aware of the following:
(a) its identity and how to contact it;
(b) the individual's right of access to the information;
(c) the purposes for which the information is collected;
(d) the intended recipients or class of recipients of the information;
(e) any law that requires the information to be collected;
(f) the main consequences for the individual if all or part of the information is not provided.
(4) If it is reasonable and practicable to do so, a personal information custodian must collect personal information about an individual only from that individual.
(5) If a personal information custodian collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is made aware of the matters referred to in subclause (3) unless doing so would pose a serious threat to the life, safety, health or welfare of any individual.
2. Use and disclosure
(1) A personal information custodian must not use or disclose personal information about an individual for a purpose other than the purpose for which it was collected unless –
(a) both of the following apply:
(i) that purpose is related to the primary purpose and, if the personal information is sensitive information, that information is directly related to the primary purpose;
(ii) the individual would reasonably expect the personal information custodian to use or disclose the information for that purpose; or
(b) the individual has consented to the use or disclosure; or
(c) if the use or disclosure is necessary for research or the compilation or analysis of statistics in the public interest, other than for publication in a form that identifies any particular individual –
(i) it is impracticable for the personal information custodian to seek the individual's consent before the use or disclosure; or
(ii) the personal information custodian reasonably believes that the recipient of the information is not likely to disclose the information; or
(d) the personal information custodian reasonably believes that the use or disclosure is necessary to lessen or prevent –
(i) a serious threat to an individual's life, health, safety or welfare; or
(ii) a serious threat to public health or public safety; or
(e) the personal information custodian has reason to suspect that unlawful activity has been, is being or may be engaged in, and uses or discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities; or
(f) the use or disclosure is required or authorised by or under law; or
(g) the personal information custodian reasonably believes that the use or disclosure is reasonably necessary for any of the following purposes by or on behalf of a law enforcement agency:
(i) the prevention, detection, investigation, prosecution or punishment of criminal offences or breaches of a law imposing a penalty or sanction;
(ii) the enforcement of laws relating to the confiscation of the proceeds of crime;
(iii) the protection of the public revenue;
(iv) the prevention, detection, investigation or remedying of conduct that is in the opinion of the personal information custodian seriously improper conduct;
(v) the preparation for, or conduct of, proceedings before any court or tribunal or implementation of any order of a court or tribunal;
(vi) the investigation of missing persons;
(vii) the investigation of a matter under the Coroners Act 1995 ; or
(h) the Australian Security Intelligence Organisation (ASIO) or the Australian Secret Intelligence Service (ASIS), in connection with its functions, has requested the personal information custodian to disclose the personal information and –
(i) the disclosure is made to an officer or employee of ASIO or ASIS appropriately authorised in writing to receive the disclosure; and
(ii) an officer or employee of ASIO or ASIS so authorised certifies that the disclosure is connected with the performance by ASIO or ASIS of its functions; or
(i) the personal information is to be used as employee information in relation to –
(i) the suitability of the individual for appointment; or
(ii) the suitability of the individual for employment held by the individual; or
(j) the personal information is employee information which is being transferred from one personal information custodian to another personal information custodian for use as employee information relating to the individual; or
(2) If a personal information custodian uses or discloses personal information under subclause (1)(g) , it must make a written note of the use or disclosure.
(3) Subclause (1) applies to personal information collected by a personal information custodian that is a body corporate from a related body corporate as if the primary purpose of that collection were the primary purpose for which the related body corporate collected the information.
(4) A personal information custodian that provides a health service to an individual may disclose health information about the individual to a person who is responsible for the individual if –
(a) the individual is –
(i) physically or legally incapable of giving consent to the disclosure; or
(ii) physically unable to communicate consent to the disclosure; and
(b) the natural person providing the health service for the personal information custodian is satisfied that the disclosure –
(i) is necessary to provide appropriate care or treatment of the individual; or
(ii) is made for compassionate reasons; and
(c) the disclosure is not contrary to any wish –
(i) expressed by the individual before the individual became unable to give or communicate consent; and
(ii) of which the natural person is aware, or of which he or she could reasonably be expected to be aware; and
(d) the disclosure is limited to the extent reasonable and necessary for the purpose mentioned in paragraph (b) .
(5) A person is responsible for an individual if the person –
(a) is a parent of the individual; or
(b) is a child or sibling of the individual and at least 18 years of age; or
(c) is a spouse of the individual; or
(d) is in a personal relationship, within the meaning of the Relationships Act 2003 , with the individual; or
(e) is a relative of the individual, at least 18 years of age and a member of the individual's household; or
(f) is a guardian of the individual; or
(g) is exercising enduring power of attorney granted by the individual that is exercisable in relation to decisions about the individual's health; or
(h) is nominated by the individual to be contacted in case of emergency.
3. Data quality
A personal information custodian must take reasonable steps to ensure that, having regard to the purpose for which the personal information is to be used, the personal information it collects, uses, holds or discloses is accurate, complete, up-to-date and relevant to its functions or activities.
4. Data security
(1) A personal information custodian must take reasonable steps to protect the personal information it holds from misuse, loss, unauthorised access, modification or disclosure.
(2) A personal information custodian must take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for any purpose.
(3) A personal information custodian, the records of which are subject to the Archives Act 1983 , must take the reasonable steps referred to in subclause (2) only with the approval of the State Archivist.
5. Openness
(1) A personal information custodian must clearly set out in a document its policies on its management of personal information.
(2) A personal information custodian must make the document available to anyone who asks for it.
(3) On request by a person, a personal information custodian must take reasonable steps to advise the person, in general terms, of –
(a) the sort of personal information it holds; and
(b) the purposes for which it holds the information; and
(c) how it collects, holds, uses and discloses that information.
(a) may provide that individual with access to his or her personal information on receipt of a written request from the individual for access to his or her personal information; or
(b) if the personal information custodian –
(i) notifies the individual of a decision to refuse a request under paragraph (a) ; or
(ii) does not respond to a request under paragraph (a) within 20 working days –
the personal information custodian, on receipt of a further written request from the individual for access to his or her personal information, must provide the individual with access to his or her personal information as if –
(1) A personal information custodian must not assign a unique identifier to an individual unless it is necessary for it to carry out any of its functions efficiently.
(2) A personal information custodian must not adopt as its own unique identifier of an individual a unique identifier that has been assigned to the individual by another personal information custodian unless –
(a) that adoption is necessary for it to carry out any of its functions efficiently; or
(b) it has obtained the consent of the individual to the use of the unique identifier; or
(c) it is a body, an organisation or an individual adopting the unique identifier created by a personal information custodian in the performance of its obligations to the personal information custodian under a personal information contract.
(3) A personal information custodian must not use or disclose a unique identifier assigned to an individual by another personal information custodian unless –
(a) the use or disclosure is necessary for it to fulfil its obligations to the other personal information custodian; or
(4) A personal information custodian must not require an individual to provide a unique identifier in order to obtain a service unless the provision –
(a) is required or authorised by law; or
(b) is in connection with the purpose, or a directly related purpose, for which the unique identifier was assigned.
8. Anonymity
Wherever it is lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with a personal information custodian.
9. Disclosure of information outside Tasmania
A personal information custodian may disclose personal information about an individual to another person or other body who is outside Tasmania only if –
(a) the personal information custodian reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that has principles for fair handling of the information that are substantially similar to the personal information protection principles; or
(b) the individual consents to the disclosure; or
(c) the disclosure is necessary for –
(i) the performance of a contract between the individual and the personal information custodian; or
(ii) the conclusion or performance of a contract concluded in the interest of the individual between the personal information custodian and a third party; or
(d) the personal information custodian has taken reasonable steps to ensure that the information which it has disclosed is not to be held, used or disclosed by the recipient of the information inconsistently with the personal information protection principles; or
(e) the disclosure is authorised or required by any other law.
10. Sensitive information
(1) A personal information custodian must not collect sensitive information about an individual unless –
(a) the individual has consented; or
(b) the collection is required or permitted by law; or
(c) the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual and the individual to whom the information relates –
(i) is physically or legally incapable of giving consent to the collection; or
(ii) physically cannot communicate consent to the collection; or
(d) the information is collected in the course of the activities of a non-profit personal information custodian that has only racial, ethnic, political, religious, philosophical, professional, trade or trade union aims and –
(i) the information relates solely to the members of that personal information custodian or to individuals who have regular contact with it in connection with its activities; and
(ii) at or before the time of collection, the personal information custodian undertakes to the individual to whom the information relates that it will not disclose the information without the individual's consent; or
(e) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim; or
(2) A personal information custodian may collect sensitive information about an individual if –
(a) either of the following applies:
(i) the collection is necessary for research or the compilation or analysis of statistics in the public interest and any resulting publication does not identify the individual;
(ii) the information relates to an individual's racial or ethnic origin and is collected for the purpose of welfare or educational services funded by government; and
(b) there is no reasonably practicable alternative to collecting the information for a purpose referred to in paragraph (a) ; and
(c) it is impracticable for the personal information custodian to seek the individual's consent to the collection.
(3) A personal information custodian may collect sensitive information that is health information about an individual if –
(a) the information is necessary to provide a health service to the individual; and
(b) the information is collected –
(i) as required by law, other than this Act; or
(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the personal information custodian.
(4) A personal information custodian may collect sensitive information that is health information about an individual if –
(a) the collection is necessary for any of the following purposes:
(i) research relevant to public health or public safety;
(ii) the compilation or analysis of statistics relevant to public health or public safety;
(iii) the management, funding or monitoring of a health service; and
(b) that purpose cannot be served by the collection of information that does not identify the individual or from which the individual's identity cannot reasonably be ascertained; and
(c) it is impracticable for the personal information custodian to seek the individual's consent to the collection; and
(d) the information is collected –
(i) as required by law, other than this Act; or
(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the personal information custodian.
(5) If a personal information custodian collects sensitive information that is health information about an individual in accordance with subclause (4) , it must take reasonable steps to permanently de-identify the information before disclosing it.
(6) [Schedule 1 Amended by No. 37 of 2005, s. 5, Applied:05 Sep 2005] A personal information custodian may collect sensitive information that is health information from an individual about another person without the consent of that other person, or without complying with clause 1(5) , if both the following apply:
(a) the collection is necessary for the provision of any health service provided to the individual;
(b) the information is relevant to the social or family history of the individual.
Source text: opening excerpt
Sourced from Tasmanian Legislation Online (legislation.tas.gov.au), CC BY 4.0.
Part 1 Preliminary
Part 1 Preliminary
1 Short title
1 Short title
This Act may be cited as the Personal Information Protection Act 2004 .
2 Commencement
2 Commencement
This Act commences on a day to be proclaimed.
3 Interpretation
3 Interpretation
In this Act –
basic personal information means the name, residential address, postal address, date of birth and gender of an individual;
complaint means a complaint made under Part 4 ;
employee information includes personal information about an individual who is, was or applies to be an employee relating to –
(a) the selection, employment, training, discipline or resignation of the individual; or
(b) the termination of the employment of the individual; or
(c) the terms and conditions of employment of the individual; or
(d) the performance or conduct of the individual in carrying out the duties or functions of employment; or
(e) the suitability of the individual for appointment or for employment held by the individual; or
(f) the hours of employment of the individual; or
(g) the salary or wages of the individual; or
(h) the membership of the individual of a professional association, trade association or trade union; or
(i) the recreation leave, long service leave, sick leave, personal leave, maternity leave, paternity leave or other leave of the individual; or
(j) information that supports employment statistical reporting and personnel planning; or
(k) information in relation to employees as required by law;
It provides a statutory process for individuals to request amendment of personal information (Part 3A, ss17A-17I), including timeframes (s17E), reasons for refusal (s17F), and mandatory notation where a custodian refuses amendment but the individual requests a notation (ss17G-17H).
It enumerates a number of specific exemptions and limitations: courts and tribunals (s7), public information (s8), law enforcement information subject to particular Schedule 1 clauses (s9), employee information (s10), unsolicited information (s11), and a public-sector limited exception for use of basic personal information by public sector bodies (s12). It also permits disclosure to legal advisers listed in s12A.
It creates a route to seek formal exemptions from the Minister, with application content requirements and public publishing of determinations (ss13-15).
It binds the Crown in right of Tasmania but disclaims Crown criminal liability under the Act (s5). It also recognises that where the Act conflicts with other statutory provisions, the other provision prevails (s4).
It contains governance items: regulation-making power (s23) and administrative assignment to the Minister for Justice and Industrial Relations pending an Administrative Arrangements Order (s24).
Mechanically, enforcement is administrative and remedial rather than penal in the text supplied. The Act does not set out express civil or criminal penalties for breach in the sections supplied; enforcement proceeds by complaints to the Ombudsman and Ministerial and regulatory channels (see ss17, 18-22, 23).
Main concepts
Primary statutory concepts and how they operate:
Personal information and custodianship. "Personal information" is any recorded information or opinion about an individual whose identity is apparent or reasonably ascertainable and who is alive or dead for not more than 25 years (s3). "Personal information custodian" includes public authorities, entities contracting under a "personal information contract", and prescribed bodies (s3). This extends obligations to many private bodies who enter into contracting relationships with custodians.
Personal information protection principles. These are the core regulatory instrument. They are listed in Schedule 1 and include:
Collection: necessity and lawfulness; notice requirements about identity, access rights, purposes, recipients and consequences of non-provision; preference for collecting from the individual when practicable (Schedule 1, cl.1).
Use and disclosure restrictions: limits on secondary uses unless related, consented, necessary for research/statistics, to lessen serious threats, required by law, or for a set of law enforcement or public-protection purposes; requirement to note disclosure where used under law enforcement grounds (Schedule 1, cl.2).
Data quality: reasonable steps to ensure accuracy, completeness, up-to-dateness and relevance (Schedule 1, cl.3).
Data security and destruction: reasonable steps to protect against misuse, loss and unauthorised access, modification or disclosure; requirement to destroy or de-identify if no longer needed except where records are subject to the Archives Act and State Archivist approval is required (Schedule 1, cl.4).
Openness: policy publication and provision on request (Schedule 1, cl.5).
Access and correction: access rights modelled to trigger Right to Information Act assessed disclosure procedures where a custodian refuses or fails to respond within 20 working days (Schedule 1, cl.6).
Unique identifiers: restrictions on assigning or adopting identifiers assigned by other custodians; limited exceptions for operational necessity and contractual obligations (Schedule 1, cl.7).
Anonymity: option of interacting anonymously where lawful and practicable (Schedule 1, cl.8).
Cross-border disclosure: permitted only where recipient subject to substantially similar handling principles, consent, necessity for contract, or reasonable steps taken to ensure recipient will not mishandle the data (Schedule 1, cl.9).
Sensitive information: heightened rules for collection and stricter thresholds for health information (Schedule 1, cl.10).
Access and correction rights. Part 3A adds a standalone statutory right to request amendment if information is incorrect, incomplete, out of date or misleading (s17A). The Act sets form requirements for requests (s17B), options for amendment (alteration or notation) (s17C-17D), timeframes for notification of decision (s17E), required content of refusal notices (s17F), right to require a notation if custodian refuses (s17G-17H), and limitations on deleting or expunging records except with State Archivist agreement (s17I).
Complaints and Ombudsman role. A complaint must normally be raised with the custodian first; then the complainant may go to the Ombudsman if unsatisfied (s18). Time limits apply: six months generally, with Ombudsman discretion to extend, and for amendment refusals the deadline is 20 working days from notice under s17F (s18(5)-(5A)). The Ombudsman has discretion to decline frivolous or trivial complaints (s19(2)), to conduct preliminary assessment and resolve expeditiously (s19 and s19(1A)), to refer matters to other authorities after consultation (s20), and to investigate under Part III Division 3 of the Ombudsman Act (s21). On finding contraventions, the Ombudsman issues opinions and recommendations and gives copies to the Minister, who tables the material (s22).
Exemptions and special categories. Court and tribunal operations are exempt (s7). Public information is outside the Act (s8). Law enforcement information is expressly excluded from several Schedule 1 provisions where a law enforcement agency considers non-compliance reasonably necessary for its functions (s9). Employee information is subject to a narrower set of duties (s10). Unsolicited information escapes Schedule 1 cl.1 (s11). Public sector bodies have an explicit limited right to use and disclose basic personal information between public sector bodies for efficiency where reasonably necessary (s12). Disclosure to certain legal advisers is permitted to obtain legal advice (s12A).
Ministerial exemptions. The Act provides a formal exemption mechanism permitting custodians to apply to the Minister for exemptions from compliance with any or all provisions; the Minister may approve subject to conditions if satisfied that the public benefit from exemption substantially outweighs the benefit of compliance (ss13-15). Determinations and revocations must be published in the Gazette (ss14(3), 15(2)).
These concepts interact across the Act: definitions in s3 capture entities and data; Schedule 1 sets duties with specified carve-outs; Part 3A provides procedural correction rights; Part 4 provides the Ombudsman enforcement architecture; ss4 and 5 set constitutional and inter‑statutory limits.
Who it affects
Who pays, who decides, and who changes behaviour:
Personal information custodians. The primary regulated actors are personal information custodians (s3). This includes:
Public authorities, as defined by the Right to Information Act 2009 (s3). Public authorities are explicitly within the Act and, in respect of certain provisions, the Act incorporates RTI mechanisms (Schedule 1, cl.6 references s13 of the RTI Act).
Any body, organisation or person who has entered into a personal information contract concerning personal information (s3). This brings many private sector actors into scope where they contract with custodians.
Prescribed bodies (s3), which allows the regulations or Minister to designate additional entities.
Individuals whose data is held. Individuals whose identity is apparent or reasonably ascertainable are protected; the Act also, for Part 3A and Schedule 1 cl.6, treats deceased persons’ personal information as subject to rights exercised by next-of-kin (s3A). Individuals can request amendment (s17A) and can complain to the Ombudsman after internal escalation (s18(1)).
Public sector bodies as a subclass. The Act recognises operational differences for public sector bodies: Schedule 1 cl.12 (s12) permits a public authority to use basic personal information for other purposes without consent if reasonably necessary for efficient storage and only disclosed to another public sector body. This changes default consent expectations in intra-public sector data sharing for basic personal information.
Law enforcement agencies. The Act defines law enforcement agency widely in s3 and permits law enforcement information to be excluded from several Schedule 1 obligations where the agency considers non-compliance reasonably necessary for its functions (s9). That gives agencies significant operational discretion.
Employers and employee data controllers. Schedule 1 cl.1(4) and (5) and s10 carve out employee information from certain Schedule 1 provisions. Employers will therefore face fewer constraints for information relating to selection, employment, discipline, performance, wages, leave and similar employment matters (see s3 definition of employee information and s10).
Legal advisers listed at s12A. The Act explicitly permits disclosure to Solicitor-General, Director of Public Prosecutions, State Litigator and Crown Solicitor and their staff for the purpose of obtaining legal advice (s12A). That creates a clear legal-advice channel.
The Crown. The Act binds the Crown in right of Tasmania (s5(1)) but also states that the Crown in any of its capacities is not liable to be prosecuted for an offence under the Act (s5(2)). That affects enforcement outcomes where the Crown is implicated.
Ministers and the Ombudsman. The Minister receives Ombudsman advice and recommendations, tables material in Parliament, and decides on exemption applications and revocations under ss13-15. The Ombudsman assesses and investigates complaints and reports opinions and recommendations (ss18-22). The Ombudsman’s investigatory process is to follow Division 3 of Part III of the Ombudsman Act 1978 (s21(1)).
Third-party recipients outside Tasmania. Custodians that disclose information outside Tasmania must ensure recipients are subject to protections substantially similar to the principles, or rely on consent or contract necessity, or take reasonable steps to ensure the recipient will not handle the data inconsistently with the principles (Schedule 1, cl.9). That affects cross-border vendors and cloud providers.
Behavioural changes imposed by the Act, derived from its mechanics:
Custodians must implement collection limitation and notice processes at point of collection (Schedule 1, cl.1(3)).
Custodians must implement policies, publish them and make them available on request (Schedule 1, cl.5).
Custodians must adopt data security and deletion/de-identification practices, with Archive Act constraints for records of archival interest (Schedule 1, cl.4).
Custodians must create internal processes for access and correction, including required timeframes, forms and notation processes (Part 3A and Schedule 1, cl.6; ss17A-17I).
Custodians that are bodies corporate and have related bodies must treat intra-group transfers as primary purpose aligned, and maintain records of disclosures required under law enforcement grounds (Schedule 1, cl.2(3); cl.2(2)).
Public authorities may engage in intra-governmental sharing of basic information for efficiency in certain cases (s12), requiring governance and controls appropriate to those transfers.
Costs and decision-makers: Day-to-day decisions about collection, secondary use, cross-border transfers, assignment of identifiers and responses to access and correction requests sit with custodians. Ministerial decisions (exemptions) and Ombudsman determinations shape the external enforcement and oversight environment.
Key duties and rights
Statutory duties placed on custodians and statutory rights for individuals, with precise textual anchors:
Duties on custodians
General duty to comply with the personal information protection principles: A personal information custodian must comply with the personal information protection principles (s17(1)). The principles themselves are set out in Schedule 1 (s16).
Collection limitations and notice duties: Do not collect personal information unless necessary for functions or activities and, before or at collection, take reasonable steps to ensure the individual is aware of identity, access rights, purposes, recipients, any law requiring collection, and consequences of not providing information (Schedule 1, cl.1(1)-(3)). Prefer collection from the individual where reasonable and practicable (cl.1(4)). If collecting from someone else, take reasonable steps to notify the individual unless that would pose a serious threat to life, safety, health or welfare (cl.1(5)).
Lawful collection methods: Collection must be by lawful means (cl.1(2)).
Use and disclosure constraints: Do not use or disclose personal information for purposes other than the primary purpose unless a set of limited grounds applies, including related purposes that an individual would expect, consent, research/statistics with privacy protections, serious threats to health or safety, lawful activity related to law enforcement or other listed public interests, or where ASIO/ASIS request and appropriate certification is present (Schedule 1, cl.2(1)).
Record disclosure when used under law enforcement ground: If using or disclosing under Schedule 1 cl.2(1)(g) for law enforcement purposes, make a written note of the use or disclosure (cl.2(2)).
Data quality: Take reasonable steps to keep personal information accurate, complete, up-to-date and relevant for the purposes (cl.3).
Data security and disposal: Take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or disclosure, and to destroy or permanently de-identify information no longer needed, except where Archives Act records require State Archivist approval (cl.4(1)-(3)).
Openness and policies: Set out information management policies in a document, make it available to anyone on request, and advise persons, in general terms, of the kinds of personal information held and purposes for which it is held (cl.5).
Access and correction processes: Provide access to personal information on written request, or if refusing or failing to respond within 20 working days, treat a further written request as if it were an assessed disclosure application under s13 of the Right to Information Act (cl.6(1)(a)-(b)(i)-(v)). Implement amendment procedures under Part 3A (ss17A-17I).
Unique identifiers controls: Do not assign or adopt unique identifiers unnecessarily; constraints on using unique identifiers assigned by other custodians unless necessary, consented, or under contract obligations (cl.7).
Anonymity: Provide option to transact without identifying themselves where lawful and practicable (cl.8).
Cross-border disclosure: Restrict disclosure outside Tasmania unless one of the grounds in cl.9 applies, including recipient being subject to substantially similar law, consent, contract necessity, reasonable steps to ensure recipient will not mishandle the data, or other law authorising the disclosure (cl.9).
Sensitive information: Heightened consent and necessity thresholds for collection of sensitive information (cl.10).
Rights of individuals
Right to be informed at or before collection (Schedule 1, cl.1(3)).
Right to access personal information held by a custodian and to have it amended if incorrect, incomplete, out of date or misleading (Part 3A, s17A; Schedule 1, cl.6).
Specific procedural rights on amendment requests: requests must be in writing and include address for notice and particulars of the alleged deficiency and proposed amendments (s17B); custodians must notify decision to the claimant as soon as practicable and in any case not later than 20 working days (s17E); if refused, reasons, name and designation of decision-maker and information about the right to complain to the Ombudsman must be given (s17F).
Right to require notation when the custodian refuses amendment: the individual may require the custodian to add a notation specifying the respects in which the information is claimed to be incomplete, incorrect, out of date or misleading, and this must be furnished to third parties to whom the information is disclosed together with particulars of the notation (ss17G-17H).
Right to complain to the Ombudsman after internal raising and unsatisfactory response, subject to time limits (s18).
Special rights and duties for specific contexts
For health information and related disclosures, Schedule 1 cl.2(4) permits disclosure to a person responsible for the individual where the individual is physically or legally incapable of giving consent and the clinician is satisfied that disclosure is necessary for care or compassionate reasons, subject to limits (cl.2(4)(a)-(d)). Sensitive health information for research or statistics has additional safeguards in cl.10(2)-(5).
Employers handling employee information are exempt from specific Schedule 1 clauses listed in s10; employers must still observe any remaining applicable Schedule 1 provisions.
Procedural obligations and administrative checks
Where a custodian uses a notation to amend rather than altering data, the notation must specify how the information is defective and, if out of date, the information required to bring it up to date (s17D). Amendments may not delete or expunge original documents, nor destroy documents unless the State Archivist agrees (s17I).
These statutory duties form the operational compliance baseline for custodians. The Act embeds the Right to Information Act mechanisms and requires senior administrative actors (Minister and Ombudsman) to be involved where referrals, exemptions and formal findings occur.
Penalties and enforcement
The Act provides an administrative enforcement model rather than a rule-based penalty regime in the text supplied. Key enforcement features and limits are:
Ombudsman-led administrative enforcement. Complaints are made to the Ombudsman (s18). The Ombudsman may conduct preliminary assessments, may resolve without full investigation if the matter can be expeditiously resolved (s19(1A)), may decline to deal with frivolous or trivial complaints (s19(2)), and may refer complaints to other authorities after consultation (s20). Where the Ombudsman investigates and forms the view that a custodian has contravened a principle, the Ombudsman must advise the complainant and the custodian and may make recommendations (s22(1)(a)-(b)). The Ombudsman must also give the Minister copies of advice and recommendations and the Minister must table them in Parliament (s22(2)-(3)). Investigations are to be conducted in accordance with Division 3 of Part III of the Ombudsman Act 1978 (s21(1)).
No express criminal or civil penalties provided in the supplied text. The Act does not include express monetary fines, civil penalties or criminal offences within the parts and schedule provided. The Crown is explicitly not liable to be prosecuted for an offence under the Act (s5(2)). That combination indicates the text relies primarily on Ombudsman findings, recommendations and public and parliamentary disclosure for compliance inducement rather than fines or court-based remedies within the Act as provided.
Ministerial exemption power but no penalty mechanism tied to exemption breaches specified. The Minister may approve applications for exemptions, subject to conditions and publication (ss13-14). The Minister may revoke approvals (s15). The Act does not set out distinct sanctioning powers besides revocation of exemptions and the Ombudsman’s recommendations.
Procedural compliance is enforceable by complaint-induced action and by making refusal notices subject to Ombudsman review with statutory time limits. For access and correction, the Act links to the Right to Information Act assessed disclosure procedures by treating a further written request, after refusal or failure to respond within 20 working days, as if it were an application for assessed disclosure under s13 of the RTI Act and as if the custodian were subject to that Act (Schedule 1, cl.6(1)(b)(i)-(v)). That imports RTI mechanisms for access disputes where the custodian fails to comply with Schedule 1 cl.6.
Recordkeeping obligations for certain uses. The Act requires a written note when using or disclosing personal information under Schedule 1 cl.2(1)(g) for law enforcement-related purposes (cl.2(2)). Such record obligations can be the basis for Ombudsman inquiries and recommendations.
Practical inference: enforcement therefore occurs as administrative oversight, public reporting to Parliament via the Minister, and rights to complaint and external review by the Ombudsman. The absence of express monetary penalties in the provided text places the Act in the category of administrative privacy legislation backed primarily by independent oversight rather than criminal sanctioning within the text supplied.
How it interacts with other laws
Statutory cross-references and precedence rules:
Other Acts prevail where inconsistent. Section 4 expressly provides that if a provision of this Act is inconsistent with another Act, the other provision prevails and this Act has no effect to the extent of the inconsistency (s4). This gives primacy to specific statutory regimes over this Act where conflicts arise.
Integration with the Right to Information Act 2009. The Act incorporates the concept of "public authority" by reference to the RTI Act (s3). Schedule 1 cl.6 explicitly treats access disputes by importing the assessed disclosure process of the RTI Act: if a custodian refuses access or does not respond within 20 working days, a further written request must be treated as if it were an application for assessed disclosure under s13 of the RTI Act and the custodian were subject to that Act, with references to public authority or Minister mapped to personal information custodian (Schedule 1, cl.6(1)(b)(i)-(v)). This imports RTI decision-making machinery into access disputes under this Act.
Interaction with Archives Act 1983. Schedule 1 cl.4(2)-(3) requires custodians subject to the Archives Act to obtain State Archivist approval before destroying records or permanently de-identifying them, and s17I prevents deletion or destruction of amended documents without State Archivist agreement. The Act thus defers to archivisation rules for records of enduring value.
Interaction with other specific statutes for health and guardianship. The definitions of health information and health service are detailed in s3, and Schedule 1 cl.10 cross-references the Guardianship and Administration Act 1995 and the Mental Health Act 2013 for exceptions where individuals are subject to orders under those statutes (Schedule 1, cl.10(1)(c)(iii)). Schedule 1 cl.2(4)(b)-(c) also requires clinicians to ensure disclosure is not contrary to wishes expressed before incapacity, which intersects with other statutory decision-making frameworks for incapacity.
Interaction with law enforcement and intelligence regimes. The Act defines "law enforcement agency" broadly in s3 and allows law enforcement information to be excluded from specific Schedule 1 provisions where the agency considers non-compliance reasonably necessary for its functions (s9). Schedule 1 cl.2(1)(h) provides for disclosure to ASIO/ASIS when an authorised officer certifies that disclosure is connected to performance of their functions. These provisions create channels for intelligence and law enforcement exceptions and require custodians to apply tests of necessity and to create notes for certain law enforcement uses (cl.2(2)).
Employee information carve-out. Section 10 excludes certain Schedule 1 clauses from application to employee information. The Act’s definition of "employee information" (s3) is detailed and covers many routine employment matters. That interacts with workplace-specific statutory and enterprise obligations for personnel records.
Ministerial exemption mechanism and procedural overlaps. ss13-15 establish a process for the Minister to approve exemptions, conditioned on public benefit tests and publication. When the Minister exercises those powers, the Act’s requirements may be relaxed for specified custodians or classes of information, which may interact with other legal requirements if inconsistency arises (remember s4).
Legal advice channel. Section 12A authorises custodians to disclose personal information to Solicitor-General, Director of Public Prosecutions, State Litigator and Crown Solicitor and their staff for purposes of obtaining legal advice. That interacts with legal professional privilege, prosecutorial confidentiality and internal legal compliance functions.
Regulations and administrative arrangements. The Governor may make regulations for the purpose of the Act (s23). Administration is assigned to the Minister for Justice and Industrial Relations until otherwise ordered under the Administrative Arrangements Act (s24), which creates an administrative overlay for implementation.
Operational consequence: custodians must assess not only compliance with Schedule 1 duties but also how those duties interface with archival obligations, intelligence exceptions, employment law, RTI processes for access disputes, and any other statutory obligations that prevail under s4.
Amendment history
The Act text contains in-line amendment annotations. These are the amendments recorded in the version supplied, with the section(s) they affected and applied dates where shown in the text:
No. 37 of 2005, s.5 (Applied 05 Sep 2005): Amended Schedule 1 cl.10(6) to allow certain collections of health information about a third person by a custodian providing a health service (Schedule 1, cl.10(6) annotation).
No. 71 of 2009, s.5 (Applied 15 Jul 2010): Multiple amendments across the Act, including:
Amendments to the definition provisions in s3, adding or amending definitions including "law enforcement information", "personal information custodian", "public authority", "public information", "sensitive information", and others (s3 annotations).
Insertion of Part 3A and amendments elsewhere noted as being by No. 71 of 2009 (various s17A-17I annotations indicate insertion by No. 71 of 2009).
Amendments to Schedule 1 clauses, noted in cl.6 and other parts as amended by No. 71 of 2009 (Schedule 1 cl.6 annotation).
No. 3 of 2010, Sched. 1 (Applied 15 Jul 2010): Amended s3B(1) and omitted s3B(2) (s3B annotations).
No. 67 of 2009, s.125 (Applied 01 Oct 2010): Amended s7 to add the Integrity Commission to the list of exemptions (s7 annotation showing insertion of (ga)).
No. 29 of 2017, Sched. 1 (Applied 05 Sep 2017): Inserted s12A and s19(1A) allowing disclosure to legal advisers listed and enabling the Ombudsman to resolve some complaints without full investigation (s12A and s19(1A) annotations).
No. 1 of 2016, Sched. 1 (Applied 08 Apr 2016): Amended s20(1) regarding referral powers of the Ombudsman (s20 annotation).
No. 69 of 2013, Sched. 1 (Applied 17 Feb 2014): Amended Schedule 1 cl.10(1)(c)(iii) to include references to guardianship and Mental Health Act orders (Schedule 1 cl.10 annotation).
No. 7 of 2024, s.13, applied 30 Aug 2024: Inserted the State Litigator into the list of law enforcement agencies in s3 (la) and added State Litigator to the exemptions in s7(fa) and employment in s12A (la, fa, fb, da, db annotations; specific sections s3 and s7 show amendments).
No. 71 of 2009, s.9 (Applied 15 Jul 2010): Amended s18(5) to set the complaint time limit and inserted s18(5A) for amendment refusals (s18 annotations).
No. 29 of 2017 (insertion of s12A as above) and various small tweaks in later amendments as annotated.
These in-text amendment annotations show a pattern of incremental legislative adjustments: adding procedural detail for access and correction (Part 3A), clarifying law enforcement and health-related exceptions, embedding RTI cross-references, and adding specific public offices (State Litigator, Integrity Commission) to lists of agencies and exemptions. The applied dates are provided in the notes in the Act text; where dates are included they are set out in the parentheses adjacent to each amendment note.
Note: the Act text itself contains the annotation trail; no external amendment history or explanatory memoranda beyond these inline notes is relied on here.
Litigation history
The Act text supplied contains no judicial decisions or reported litigation. The Act references decision-making procedures under the Ombudsman Act and the Right to Information Act, but it does not list any cases or judicial interpretations in its text. Therefore, based on the supplied statute alone, there is no litigation history to summarise. Any litigation or judicial treatment would need to be identified from external sources not included in the text provided.
Gotchas
Concrete practical traps and implementation risks derived from the text:
Commencement uncertainty and temporal application of some clauses. The Act commences on a day to be proclaimed (s2). Clause 6(1) of Schedule 1 limits the retroactive application of specified Schedule 1 clauses (clauses 1, 7, 8 and 10 apply only to information collected after commencement), while clause 6(2) leaves other clauses applicable to information collected before or after commencement. Custodians must therefore map information by date of collection to determine which obligations apply. This creates operational complexity for legacy datasets.
The Crown is bound but not prosecutable. Section 5 binds the Crown but s5(2) states the Crown is not liable to be prosecuted for an offence under the Act. With no express penalties in the text supplied, this can limit remedy options where the Crown holds or mishandles data.
Law enforcement discretion is broad. Section 9 allows law enforcement agencies to disapply several Schedule 1 provisions for "law enforcement information" where non-compliance is "reasonably necessary" for their functions. This is a subjective standard vested in agencies; custodians designated as law enforcement agencies will likely exercise broad operational discretion and will not be bound by several Schedule 1 rules. Recordkeeping requirements for some law enforcement uses exist (Schedule 1, cl.2(2)), but the statutory carve-out can reduce protections in operational contexts.
Employee information carve-out. Section 10 excludes certain Schedule 1 clauses from application to employee information. Employers should not assume the full Schedule 1 framework applies to employee records; they must identify specifically which obligations remain and ensure workplace processes align with those residual duties and any other applicable employment law.
Access and correction timing and formality. The Act sets procedural time limits and form requirements that create risk if not followed: amendment requests must be in writing and include specified particulars (s17B); custodian decisions must be notified "as soon as practicable" and in any case within 20 working days (s17E). If a custodian fails to respond to an access request within 20 working days, an individual can submit a further written request that is to be treated as an RTI assessed disclosure application (Schedule 1, cl.6(1)(b)(i)-(v)). Custodians must have processes to meet these timelines and to escalate unresolved matters to the RTI mechanism if necessary.
Practical limits on deletion. Section 17I and Schedule 1 cl.4(3) prevent custodians from deleting or destroying records that have been amended without State Archivist agreement where archival rules apply. This constrains the ability to remove or expunge records in correction contexts.
No explicit fines or criminal sanctions in the supplied text. The absence of monetary penalties or criminal offences in the Act text supplied means the primary enforcement pathways are Ombudsman recommendations, Ministerial action on exemptions and RTI processes. Entities seeking certainty about exposure to fines or civil liability will need to check for other statutes or regulations that might create those liabilities.
Cross-border disclosures require legal assessment. Schedule 1 cl.9 requires either the recipient to be subject to substantially similar law, consent, contractual necessity, or reasonable steps to ensure compliance. In practice custodians must undertake legal and contractual due diligence on offshore recipients and vendors, including cloud providers, to satisfy cl.9(a) or (d).
Health and sensitive information complexity. The Act creates multiple carve-outs and rules for health information and other sensitive categories (Schedule 1, cl.10), including specific conditions when sensitive health information can be collected without consent for research or statistical purposes, and the need to de-identify information before disclosure (cl.10(5)). Custodians in health and allied sectors must have clear policies aligned to both the Act and professional confidentiality rules referenced in cl.10(3)-(4).
Ministerial exemption public-interest test. Applications for exemptions under s13 must specify reasons and any public benefit, and the Minister will approve only if satisfied that the public benefit of the exemption substantially outweighs the public benefit of compliance (s14(1)(a)). Applicants should prepare public interest justifications and anticipate public publication of determinations and possible parliamentary scrutiny (s14(3), s15(2)).
Ombudsman complaint time limits. A general complaint must be made within six months from when the complainant first became aware of the matter (s18(5)) unless the Ombudsman allows more time. Complaints about refusal to amend must be made within 20 working days of the notice of decision (s18(5A)). Custodians must preserve records to respond to complaints within these windows.
Interaction with other laws can displace obligations. Because s4 gives primacy to other Acts, custodians must check whether sector-specific statutes impose alternative information-handling obligations that prevail.
These are operationally significant points where procedural missteps, lack of policies, or misunderstandings about exemptions can lead to complaints and Ombudsman inquiries.
How to comply
A practical compliance checklist and recommended implementation steps, grounded in statutory text and procedural obligations:
Identify whether you are a personal information custodian (s3). Map organisational status: public authority under the RTI Act, party to a personal information contract, or a prescribed body. If you are a private entity that contracts with a public authority, you are likely captured under s3(b).
Inventory personal information holdings and map by collection date. Because certain Schedule 1 clauses apply only to information collected after commencement (Schedule 1, cl.6(1)), custodians must classify data as pre- or post-commencement for obligations.
Perform a purpose-needs assessment for collection. Adopt a collection policy that records the functions or activities requiring personal information and ensures collection is necessary (Schedule 1, cl.1(1)). Include processes to prefer direct collection from the individual when reasonable and practicable (cl.1(4)) and to provide the statutory notice items at or before collection (cl.1(3)).
Create notice templates to meet cl.1(3). Notices must communicate identity and contact details, access rights, purposes of collection, intended recipients or recipient classes, any law requiring collection, and main consequences of non-provision (Schedule 1, cl.1(3)).
Classify data sensitivity and implement consent collection protocols. For sensitive and health information, obtain explicit consent where required (Schedule 1, cl.10(1)(a)) and implement the specified exceptions for necessary care, research or legal claims where applicable (cl.10).
Draft and publish a data management policy document complying with cl.5. Make the document available to anyone who asks and prepare accessible summaries to meet cl.5(3).
Implement data quality and retention processes. Adopt procedures to keep data accurate, complete, up-to-date and relevant (cl.3). Define retention and destruction/de-identification policies and ensure compliance with Archives Act constraints where records are subject to archival requirements (cl.4(2)-(3)).
Implement technical and organisational security controls to meet cl.4(1). Document risk assessments and security measures for protection from misuse, loss, unauthorised access, modification or disclosure. Prepare to demonstrate "reasonable steps" in case of complaint.
Set up access and correction workflows aligned to Part 3A and Schedule 1 cl.6. Requirements include:
A written request process for amendment with required particulars and address for notice (s17B).
Decision templates that include reasons, name and designation of decision-maker, and information about the Ombudsman and complaint timeframes in cases of refusal (s17F).
A 20 working day internal decision timeframe for amendment notifications (s17E).
A mechanism to add notation instead of altering records where that is the chosen amendment method (s17C-17D), and to add notations to subsequent disclosures of that information (s17H).
Controls to prevent deletion or destruction of amended records without State Archivist agreement (s17I).
Establish complaint-handling and escalation procedures to meet Ombudsman expectations. Ensure complainants are required to raise matters with the relevant custodian first (s18(1)) and maintain records to support any Ombudsman inquiry. Track time limits for complaints: six months generally (s18(5)) and 20 working days for amendment refusal complaints (s18(5A)).
Create protocols for special disclosures:
Law enforcement and intelligence requests: document legal basis, ensure written notes for law enforcement-related uses under Schedule 1 cl.2(2), and apply s9 where law enforcement information is in scope.
Legal advice channel: ensure procedures for secure disclosure to Solicitor-General, DPP, State Litigator and Crown Solicitor under s12A.
Health-care disclosures to persons responsible for an incapacitated individual: verify the criteria in Schedule 1 cl.2(4) are met and document clinical justifications.
Design policies on unique identifiers and biometrics to satisfy cl.7. Do not assign or adopt unique identifiers unless necessary; obtain consent where adopting an identifier from another custodian unless operational necessity or contractual obligation exists (cl.7(1)-(3)).
For cross-border transfers, perform vendor due diligence and contractual controls to meet Schedule 1 cl.9. Where the recipient is not subject to similar law, obtain informed consent, rely on contractual necessity for a contract with the individual, or take reasonable steps to ensure recipient handling is consistent with the principles. Document these steps.
For employee data, review the scope of s10 and ensure personnel processes are aligned to the narrower set of Schedule 1 obligations that continue to apply.
Prepare exemption application materials if seeking Ministerial relief (ss13-14). The application must specify provisions, classes of information, custodians, reasons, public benefit, relevant laws and codes, and any other Minister-required material (s13(2)). Anticipate publication of the Minister’s determination in the Gazette (s14(3)) and potential revocation (s15).
Train staff and create logs. Train staff on notice requirements, consent for sensitive categories, access/correction procedures, and timelines. Maintain logs of disclosures, especially those made for law enforcement purposes or under Schedule 1 cl.2(1)(g), as the Act requires written notation of those uses (cl.2(2)).
Adopt an incident response plan that includes Ombudsman notification readiness. The Act’s enforcement is Ombudsman-based; prepare to respond to Ombudsman inquiries and to provide copies of investigation responses and relevant policy and operational evidence (s21).
Monitor and review regulatory and statutory changes. Because s4 gives precedence to other laws and the Governor may make regulations (s23), custodians must keep compliance programs current relative to changes in sector law, RTI decisions, Ombudsman guidance and any regulations promulgated under s23.
This compliance path is intended to convert the Act’s duties into operational controls, written procedures and decision records that will support lawful handling and provide documentary evidence when responding to complaints or Ombudsman inquiries.
Section 3BAccess to information of a medical or psychiatric nature
employment includes appointment or engagement to an office or position;
health information means –
(a) personal information or opinion about –
(i) the physical, mental or psychological health at any time of an individual; or
(ii) a disability at any time of an individual; or
(iii) an individual's expressed wishes about the future provision of health services to him or her; or
(iv) a health service provided, or to be provided, to an individual; or
(b) other personal information collected to provide, or in providing, a health service; or
(c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or
(d) genetic information about an individual that is or may be predictive of the health at any time of the individual or any of his or her descendants –
other than prescribed information, a prescribed class of information or information contained in a prescribed class of documents;
health service means an activity, other than a prescribed activity, performed in relation to an individual that is intended or claimed by the individual or the person performing it –
(a) to assess, maintain or improve the individual's health; or
(b) to diagnose the individual's illness, injury or disability; or
(c) to treat the individual's illness, injury or disability or suspected illness, injury or disability; or
(d) to dispense on prescription a drug or medical preparation; or
(e) to provide a disability service, palliative care service or aged care service; or
(f) to provide a prescribed service or a prescribed class of service in conjunction with any activity referred to in paragraph (a) , (b) , (c) , (d) or (e) ;
identifier means anything assigned by a personal information custodian to identify an individual for its operations, other than a name or ABN as defined in the A New Tax System (Australian Business Number) Act 1999 of the Commonwealth;
law enforcement agency means any of the following:
(a) a police force or police service of –
(i) the Commonwealth; or
(ii) this State; or
(iii) any other State or a Territory of the Commonwealth; or
(iv) any country;
(b) the Australian Crime Commission;
(c) a commission established or appointed under any Act of this State or any other State or a Territory of the Commonwealth or of the Commonwealth to investigate matters relating to criminal activity generally or of a specified class;
(d) a personal information custodian responsible for the performance of functions relating to –
(i) the prevention, detection, investigation or prosecution of criminal offences or other offences that impose a penalty or sanction; or
(ii) the management of property seized or restrained under a law relating to the confiscation of the proceeds of crime or the enforcement of such a law;
(e) an agency established under the Public Service Act 1999 of the Commonwealth responsible for the performance of functions relating to –
(i) the prevention, detection, investigation or prosecution of criminal offences or other offences that impose a penalty or sanction; or
(ii) the management of property seized or restrained under a law relating to the confiscation of the proceeds of crime or the enforcement of such a law;
(f) a personal information custodian or an individual or body contracted by a personal information custodian responsible for the execution or implementation of an order, decision or determination of a court or tribunal;
(g) a personal information custodian –
(i) responsible for the issue of warrants; or
(ii) that provides correctional services; or
(iii) responsible for decisions relating to the release of persons from custody;
(h) a personal information custodian responsible for the protection of public revenue under any Act;
(i) a personal information custodian responsible for the administration or performance of a function under a law that imposes a penalty or sanction;
(j) the Attorney-General;
(k) the Solicitor-General appointed and holding office under the Solicitor-General Act 1983 ;
(l) the Director of Public Prosecutions appointed and holding office under the Director of Public Prosecutions Act 1973 ;
(la) [Section 3 Amended by No. 7 of 2024, s. 13, Applied:30 Aug 2024] the State Litigator;
(m) the Ombudsman;
(ma) [Section 3 Amended by No. 42 of 2013, s. 52, Applied:01 Jan 2014] the Anti-Discrimination Commissioner appointed under the Anti-Discrimination Act 1998 ;
(n) a prescribed organisation;
[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010]law enforcement information means information referred to in section 30 of the Right to Information Act 2009 ;
Ombudsman means the person appointed and holding office under the Ombudsman Act 1978 ;
personal information means any information or opinion in any recorded format about an individual –
(a) whose identity is apparent or is reasonably ascertainable from the information or opinion; and
(b) who is alive or has not been dead for more than 25 years;
personal information contract means a contract between a personal information custodian and another person (whether a personal information custodian or not) relating to the collection, use or storage of personal information;
[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010]
[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010]personal information custodian means any of the following:
(a) a public authority;
(b) any body, organisation or person who has entered into a personal information contract relating to personal information;
(c) a prescribed body;
personal information protection principles means the personal information protection principles referred to in section 16 ;
[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010]public authority has the same meaning as in the Right to Information Act 2009 ;
public information means any personal information that is –
(a) contained in a publicly available record or publication; or
(b) taken to be public information under any Act;
[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010]
record means a record in any format;
sensitive information means –
(a) personal information or an opinion relating to personal information about an individual's –
(i) racial or ethnic origin; or
(ii) political opinions; or
(iii) membership of a political association; or
(iv) religious beliefs or affiliations; or
(v) philosophical beliefs; or
(vi) membership of a professional or trade association; or
(vii) membership of a trade union; or
(viii) sexual preferences or practices; or
(ix) criminal record; and
(b) [Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010] health information about an individual;
[Section 3 Amended by No. 71 of 2009, s. 5, Applied:15 Jul 2010]State Archivist has the same meaning as in the Archives Act 1983 .
3A Reference to personal information in Part 3A and Schedule 1
3A Reference to personal information in Part 3A and Schedule 1
[Section 3A Inserted by No. 71 of 2009, s. 6, Applied:15 Jul 2010] In Part 3A and clause 6 of Schedule 1 , a reference to personal information of a person includes the personal information of a deceased person, and rights given by this Act in respect of the personal information of a person are, where the person is a deceased person, to be taken to be rights that may be exercised in respect of that personal information by the next-of-kin of that person.
3B Access to information of a medical or psychiatric nature
3B Access to information of a medical or psychiatric nature
[Section 3B Inserted by No. 71 of 2009, s. 6, Applied:15 Jul 2010]
(1) [Section 3B Subsection (1) amended by No. 3 of 2010, Sched. 1, Applied:15 Jul 2010] If –
(a) a request is made to a personal information custodian for access to information of a medical or psychiatric nature concerning the person making the request; and
(b) it appears to the personal information custodian that the provision to that person of access to the information might be prejudicial to the physical or mental health or wellbeing of that person –
the personal information custodian may direct that access to the information must not be provided to the person who made the request but must instead be provided to a medical practitioner nominated by that person.
If a provision of this Act is inconsistent with a provision made by or under any other Act –
(a) that other provision prevails; and
(b) the provision of this Act has no effect to the extent of the inconsistency.
5 Act binds Crown
5 Act binds Crown
(1) This Act binds the Crown in right of Tasmania and, so far as the legislative power of Parliament permits, in all its other capacities.
(2) The Crown in any of its capacities is not liable to be prosecuted for an offence under this Act.
Part 2 Application and Exemptions
Part 2 Application and Exemptions
Division 1 Application
Division 1 Application
6 Application of personal information protection principles
6 Application of personal information protection principles
(1) Clauses 1 , 7 , 8 and 10 of Schedule 1 apply only in relation to information collected after the commencement of this Act.
(2) Clauses 2 , 3 , 4 , 5 , 6 and 9 of Schedule 1 apply in relation to information collected before or after the commencement of this Act.
Division 2 Exemptions
Division 2 Exemptions
7 Courts and tribunals
7 Courts and tribunals
The following are exempt from the provisions of this Act:
(a) a court or tribunal in the performance or exercise of judicial or quasi-judicial functions or powers;
(b) the holder of a judicial or quasi-judicial office or other office pertaining to a court or tribunal in the capacity of the holder of that office;
(c) the Solicitor-General appointed and holding office under the Solicitor-General Act 1983 ;
(d) any person employed in relation to the functions of the Solicitor-General;
(e) the Director of Public Prosecutions appointed and holding office under the Director of Public Prosecutions Act 1973 ;
(f) any person employed in relation to the functions of the Director of Public Prosecutions;
(fa) [Section 7 Amended by No. 7 of 2024, s. 14, Applied:30 Aug 2024] the State Litigator;
(fb) [Section 7 Amended by No. 7 of 2024, s. 14, Applied:30 Aug 2024] any person employed in relation to the functions of the State Litigator;
(g) the registry or other office of a court or tribunal in relation to any matter relating to the judicial or quasi-judicial functions of that court or tribunal;
(ga) [[Section 7 Amended by No. 67 of 2009, s. 125, Applied:01 Oct 2010]](/view/html/inforce/2010-10-01/act-2009-067#GS12
This is an opening excerpt, not the complete document.