/

/

Part SCHEDULE 1 - Personal Informat - Personal Information Protection Act 2004 - SCHEDULE 1 - Personal Information Protection Principles | Zoe

TASIn ForceAct

Personal Information Protection Act 2004

SCHEDULE 1 - Personal InformatSCHEDULE 1 - Personal Information Protection Principles

Start here

Get a plain-English read of SCHEDULE 1 - Personal Informat

Turn the raw legal text into a practical explanation grounded in Personal Information Protection Act 2004.

Ask Zoe about this section View in full context

SCHEDULE 1 - Personal Informat SCHEDULE 1 - Personal Information Protection Principles

Sections 6 , 9 , 10 , 11 and 16

1. Collection

(1) A personal information custodian must not collect personal information unless the information is necessary for one or more of its functions or activities.

(2) A personal information custodian must collect personal information only by lawful means.

(3) Before collection, during collection or as soon as practicable after collection of personal information about an individual from the individual, the personal information custodian must take any reasonable steps necessary to ensure that the individual is aware of the following:

(a) its identity and how to contact it;

(b) the individual's right of access to the information;

(c) the purposes for which the information is collected;

(d) the intended recipients or class of recipients of the information;

(e) any law that requires the information to be collected;

(f) the main consequences for the individual if all or part of the information is not provided.

(4) If it is reasonable and practicable to do so, a personal information custodian must collect personal information about an individual only from that individual.

(5) If a personal information custodian collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is made aware of the matters referred to in subclause (3) unless doing so would pose a serious threat to the life, safety, health or welfare of any individual.

2. Use and disclosure

(1) A personal information custodian must not use or disclose personal information about an individual for a purpose other than the purpose for which it was collected unless –

(a) both of the following apply:

(i) that purpose is related to the primary purpose and, if the personal information is sensitive information, that information is directly related to the primary purpose;

(ii) the individual would reasonably expect the personal information custodian to use or disclose the information for that purpose; or

(b) the individual has consented to the use or disclosure; or

(c) if the use or disclosure is necessary for research or the compilation or analysis of statistics in the public interest, other than for publication in a form that identifies any particular individual –

(i) it is impracticable for the personal information custodian to seek the individual's consent before the use or disclosure; or

(ii) the personal information custodian reasonably believes that the recipient of the information is not likely to disclose the information; or

(d) the personal information custodian reasonably believes that the use or disclosure is necessary to lessen or prevent –

(i) a serious threat to an individual's life, health, safety or welfare; or

(ii) a serious threat to public health or public safety; or

(e) the personal information custodian has reason to suspect that unlawful activity has been, is being or may be engaged in, and uses or discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities; or

(f) the use or disclosure is required or authorised by or under law; or

(g) the personal information custodian reasonably believes that the use or disclosure is reasonably necessary for any of the following purposes by or on behalf of a law enforcement agency:

(i) the prevention, detection, investigation, prosecution or punishment of criminal offences or breaches of a law imposing a penalty or sanction;

(ii) the enforcement of laws relating to the confiscation of the proceeds of crime;

(iii) the protection of the public revenue;

(iv) the prevention, detection, investigation or remedying of conduct that is in the opinion of the personal information custodian seriously improper conduct;

(v) the preparation for, or conduct of, proceedings before any court or tribunal or implementation of any order of a court or tribunal;

(vi) the investigation of missing persons;

(vii) the investigation of a matter under the Coroners Act 1995 ; or

(h) the Australian Security Intelligence Organisation (ASIO) or the Australian Secret Intelligence Service (ASIS), in connection with its functions, has requested the personal information custodian to disclose the personal information and –

(i) the disclosure is made to an officer or employee of ASIO or ASIS appropriately authorised in writing to receive the disclosure; and

(ii) an officer or employee of ASIO or ASIS so authorised certifies that the disclosure is connected with the performance by ASIO or ASIS of its functions; or

(i) the personal information is to be used as employee information in relation to –

(i) the suitability of the individual for appointment; or

(ii) the suitability of the individual for employment held by the individual; or

(j) the personal information is employee information which is being transferred from one personal information custodian to another personal information custodian for use as employee information relating to the individual; or

(k) subclause (4) or section 12 applies.

10. Sensitive information

(1) A personal information custodian must not collect sensitive information about an individual unless –

(a) the individual has consented; or

(b) the collection is required or permitted by law; or

(c) the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual and the individual to whom the information relates –

(i) is physically or legally incapable of giving consent to the collection; or

(ii) physically cannot communicate consent to the collection; or

(iii) [Schedule 1 Amended by No. 69 of 2013, Sched. 1, Applied:17 Feb 2014] is subject to a guardianship order under the Guardianship and Administration Act 1995 or an assessment order or treatment order under the Mental Health Act 2013 ; or

(d) the information is collected in the course of the activities of a non-profit personal information custodian that has only racial, ethnic, political, religious, philosophical, professional, trade or trade union aims and –

(i) the information relates solely to the members of that personal information custodian or to individuals who have regular contact with it in connection with its activities; and

(ii) at or before the time of collection, the personal information custodian undertakes to the individual to whom the information relates that it will not disclose the information without the individual's consent; or

(e) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim; or

(f) subclause (2) , (3) , (4) or (6) applies.

(2) A personal information custodian may collect sensitive information about an individual if –

(a) either of the following applies:

(i) the collection is necessary for research or the compilation or analysis of statistics in the public interest and any resulting publication does not identify the individual;

(ii) the information relates to an individual's racial or ethnic origin and is collected for the purpose of welfare or educational services funded by government; and

(b) there is no reasonably practicable alternative to collecting the information for a purpose referred to in paragraph (a) ; and

(c) it is impracticable for the personal information custodian to seek the individual's consent to the collection.

(3) A personal information custodian may collect sensitive information that is health information about an individual if –

(a) the information is necessary to provide a health service to the individual; and

(b) the information is collected –

(i) as required by law, other than this Act; or

(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the personal information custodian.

(4) A personal information custodian may collect sensitive information that is health information about an individual if –

(a) the collection is necessary for any of the following purposes:

(i) research relevant to public health or public safety;

(ii) the compilation or analysis of statistics relevant to public health or public safety;

(iii) the management, funding or monitoring of a health service; and

(b) that purpose cannot be served by the collection of information that does not identify the individual or from which the individual's identity cannot reasonably be ascertained; and

(c) it is impracticable for the personal information custodian to seek the individual's consent to the collection; and

(d) the information is collected –

(i) as required by law, other than this Act; or

(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the personal information custodian.

(5) If a personal information custodian collects sensitive information that is health information about an individual in accordance with subclause (4) , it must take reasonable steps to permanently de-identify the information before disclosing it.

(6) [Schedule 1 Amended by No. 37 of 2005, s. 5, Applied:05 Sep 2005] A personal information custodian may collect sensitive information that is health information from an individual about another person without the consent of that other person, or without complying with clause 1(5) , if both the following apply:

(a) the collection is necessary for the provision of any health service provided to the individual;

(b) the information is relevant to the social or family history of the individual.