13BRelated bodies corporate

#### 13B Related bodies corporate Acts or practices that are not interferences with privacy (1) Despite subsection 13(1), each of the following acts or practices of an organisation that is a body corporate is not an interference with the privacy of an individual: (a) the collection of personal information (other than sensitive information) about the individual by the body corporate from a related body corporate; (b) the disclosure of personal information (other than sensitive information) about the individual by the body corporate to a related body corporate. > Note: Subsection (1) lets related bodies corporate share personal information. However, in using or holding the information, they must comply with the Australian Privacy Principles and a registered APP code that binds them. For example, there is an interference with privacy if: (a) a body corporate uses personal information it has collected from a related body corporate; and (b) the use breaches Australian Privacy Principle 6 (noting that the collecting body’s primary purpose of collection will be taken to be the same as that of the related body). (1A) However, paragraph (1)(a) does not apply to the collection by a body corporate of personal information (other than sensitive information) from: (a) a related body corporate that is not an organisation; or (b) a related body corporate whose disclosure of the information to the body corporate is an exempt act or exempt practice for the purposes of paragraph 7(1)(ee); or (c) a related body corporate whose disclosure of the information to the body corporate is not an interference with privacy because of section 13D. > Note: The effect of subsection (1A) is that a body corporate’s failure to comply with the Australian Privacy Principles, or a registered APP code that binds the body, in collecting personal information about an individual from a related body corporate covered by that subsection is an interference with the privacy of the individual. Relationship with subsection 13(3) (2) Subsection (1) does not prevent an act or practice of an organisation from being an interference with the privacy of an individual under subsection 13(3).