12Australian Privacy Principle 12—access to personal information

#### 12 Australian Privacy Principle 12—access to personal information Access 12.1 If an APP entity holds personal information about an individual, the entity must, on request by the individual, give the individual access to the information. Exception to access—agency 12.2 If: (a) the APP entity is an agency; and (b) the entity is required or authorised to refuse to give the individual access to the personal information by or under: (i) the Freedom of Information Act; or (ii) any other Act of the Commonwealth, or a law in force in an external Territory, that provides for access by persons to documents; then, despite subclause 12.1, the entity is not required to give access to the extent that the entity is required or authorised to refuse to give access. Exception to access—organisation 12.3 If the APP entity is an organisation then, despite subclause 12.1, the entity is not required to give the individual access to the personal information to the extent that: (a) the entity reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or (b) giving access would have an unreasonable impact on the privacy of other individuals; or (c) the request for access is frivolous or vexatious; or (d) the information relates to existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by the process of discovery in those proceedings; or (e) giving access would reveal the intentions of the entity in relation to negotiations with the individual in such a way as to prejudice those negotiations; or (f) giving access would be unlawful; or (g) denying access is required or authorised by or under an Australian law or a court/tribunal order; or (h) both of the following apply: (i) the entity has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the entity’s functions or activities has been, is being or may be engaged in; (ii) giving access would be likely to prejudice the taking of appropriate action in relation to the matter; or (i) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or (j) giving access would reveal evaluative information generated within the entity in connection with a commercially sensitive decision‑making process. Dealing with requests for access 12.4 The APP entity must: (a) respond to the request for access to the personal information: (i) if the entity is an agency—within 30 days after the request is made; or (ii) if the entity is an organisation—within a reasonable period after the request is made; and (b) give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so. Other means of access 12.5 If the APP entity refuses: (a) to give access to the personal information because of subclause 12.2 or 12.3; or (b) to give access in the manner requested by the individual; the entity must take such steps (if any) as are reasonable in the circumstances to give access in a way that meets the needs of the entity and the individual. 12.6 Without limiting subclause 12.5, access may be given through the use of a mutually agreed intermediary. Access charges 12.7 If the APP entity is an agency, the entity must not charge the individual for the making of the request or for giving access to the personal information. 12.8 If: (a) the APP entity is an organisation; and (b) the entity charges the individual for giving access to the personal information; the charge must not be excessive and must not apply to the making of the request. Refusal to give access 12.9 If the APP entity refuses to give access to the personal information because of subclause 12.2 or 12.3, or to give access in the manner requested by the individual, the entity must give the individual a written notice that sets out: (a) the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and (b) the mechanisms available to complain about the refusal; and (c) any other matter prescribed by the regulations. 12.10 If the APP entity refuses to give access to the personal information because of paragraph 12.3(j), the reasons for the refusal may include an explanation for the commercially sensitive decision.