The Code’s primary conceptual mechanism is targeted modification of statutory privacy obligations. It does not attempt wholesale repeal. The operative instrument is a set of exemptions, qualifications and procedural requirements that alter how the IPPs and Part 6 public register rules apply in specific circumstances.

Key concepts defined within the Code text:

• Agency and the Act: Clause 4 defines agency as a public sector agency and confirms that “the Act” means the Privacy and Personal Information Protection Act 1998. The Code’s modifications are therefore explicitly tethered to public sector actors and that parent statute.
• Information protection principles: The IPPs are the principles in Division 1 of Part 2 of the Act; the Code modifies their application (clauses 2 and 6).
• Public register provisions: The provisions of Part 6 of the Act are the target for Schedule 2 modifications permitting disclosure from certain registers without the usual purpose-satisfaction requirement (clauses 2 and 8).
• Human services agency: Part 4 defines this by service type (welfare, health, mental health, disability, drug and alcohol treatment, housing/support, education) and constructs a mechanism to authorise sharing via written senior officer authorisations and allied agencies (clause 9 and clause 10).
• Allied agency and senior officer: Clause 10 defines allied agency as a non-public agency that is wholly or partly funded by a human services agency and approved in writing by the head, and senior officer as a nominated senior member of staff authorised to give written authorisations.
• Community care agency, personal information custodian and authorised employee: Schedule 3 and clause 17 (Part 6) set out the community care regime, including who qualifies as a personal information custodian (guardian, attorney, spouse, carer, close friend/relative) and how authorised employees can act when no custodian can be found.
• Department/Department of Justice and Attorney General: In Part 5 the Department is the Department of Justice and Attorney General and is given particular exemptions and permitted practices in the correctional context (clause 12 and clauses 13-16).

The Code relies on three structural devices:

1. Modification by exception: it expressly states where particular IPP sections do not have to be complied with if conditions are met (for example, Part 8 clause 25 exempts participating agencies from multiple IPP sections for Domestic Violence Intervention Court Model activities that are for the scheme and follow Minister-approved privacy procedures).
2. Authorisation and delegation: certain uses/disclosures require a written authorisation by a named senior officer or consent by a personal information custodian; for community care, authorised employees may act in limited circumstances if no custodian exists (clause 10; Schedule 3).
3. Procedural safeguards: the Code imposes specific requirements such as maximum authorisation periods (12 months), notification steps to individuals, record-keeping when agencies act without a custodian, and rights of access for personal information custodians and victims (clause 10(3); Schedule 3 clauses 2-4; Part 8 clause 26).

The Code frequently cross-references other legislation. Clause 3 preserves disclosures permitted by law including other NSW statutes. Schedule 3 draws on Guardianship Act 1987 and Powers of Attorney Act 2003 for defining personal information custodians. The Code also notes that health information is regulated by the Health Records and Information Privacy Act 2002 and thus certain disclosure permissions do not extend to health information (Part 5 clause 16 note). These cross-references delimit the scope of the Code’s technical permissions.

As a conceptual point, the Code centralises discretionary decisions about privacy trade-offs within agency hierarchies: senior officers, heads of agencies and the Minister are repeatedly the decision-makers empowered to approve allied agencies, privacy procedures and authorised actors. The Code therefore replaces a one-size-fits-all IPP application with a rule-plus-discretion model where procedural boxes must be ticked for exceptions to apply.

The Code’s coverage is intentionally targeted and the text identifies the affected actors precisely. The primary affected parties are public sector agencies, specified non-government allied agencies, individuals whose personal information is held by those agencies, and particular user groups such as victims of domestic violence, offenders, clients of human services and community care recipients.

Public sector agencies: The Code applies to “an agency” as defined in clause 4. That umbrella term is then narrowed across Parts and Schedules to named agencies:

• Agencies listed in Schedule 1: Roads and Traffic Authority (RTA), Department of Justice and Attorney General, and Environment Protection Authority (Schedule 1 items 1-2). Those agencies may exchange specified personal information for specified purposes, because the IPPs are modified to permit such exchanges (clause 6).
• Agencies responsible for particular public registers listed in Schedule 2, notably the Environment Protection Authority for various registers including contaminated land records and EPA grant outputs (clause 8, Schedule 2).
• Human services agencies as defined in clause 9, a category that captures public sector agencies providing welfare, health, mental health, disability, drug and alcohol treatment, housing and support, or education services. The Code authorises written senior officer authorisations for collection, use and disclosure between human services agencies and allied agencies (clause 10).
• The Department of Justice and Attorney General and related correctional bodies are subject to Part 5 exceptions for correctional operations (clause 12 and clauses 13-16).
• Community care agencies listed within clause 17 and Schedule 3, specifically the Department of Family and Community Services, Juvenile Justice in Department of Justice, and the Civil and Administrative Tribunal, are subject to bespoke IPP modifications for dealing with individuals who lack capacity (clause 17 and Schedule 3).
• The Registry of Births, Deaths and Marriages is authorised to use personal information for specified document validation services, in accordance with operating protocols (clause 19).

Non-government actors: Allied agencies are non-public bodies that are wholly or partly funded by a human services agency and approved in writing by the human services agency head (clause 10). These allied agencies gain access to personal information under human services authorisations. The Code also contemplates disclosure to “a person or other body” under community care arrangements and correctional disclosures in limited circumstances (Schedule 3 clause 7, Part 5 clause 16).

Individuals affected: The Code repeatedly focuses on individuals receiving services from human services or community care agencies, offenders and persons subject to correctional supervision, persons charged with domestic violence offences and victims. The Code modifies IPPs specifically to allow collection, use and disclosure for service delivery, safety and case management where consent is absent or capacity is lacking (clauses 10, 11; Schedule 3). It defines who may act on an individual’s behalf: guardians, attorneys, spouses (with caveats), carers and close friends or relatives as personal information custodians (Schedule 3 clause 17(1) and Schedule 3 clause 1).

Decision-makers and approvers: The Code identifies who must decide internal exceptions:

• Heads of agencies approve allied agencies in writing and appoint senior officers (clause 10).
• Senior officers provide written authorisations limited to 12 months for collection, use and disclosure within human services (clause 10(2)-(3)).
• Agency heads or authorised employees may consent or act for individuals with no personal information custodian in community care settings, subject to written records (Schedule 3 clauses 6(2)(b)-(c)).
• The Minister approves privacy procedures for the Domestic Violence Intervention Court Model; participating agencies are exempted from certain IPPs when acting under those procedures (Part 8 clause 25).

Who pays and who bears behavioural change: The Code shifts some compliance load onto agencies: they must maintain written authorisations, nomination of senior officers, notification records to clients, approval processes for allied agencies, and record-keeping when acting without custodians. Individuals lose some control over certain categories of personal information in the enumerated contexts, while victims of domestic violence retain access rights under clause 26. Non-government allied agencies and contractors become recipients of personal information in some cases, which changes contractual confidentiality disciplines and operational exposure.

The Code substitutes or modifies duties and rights established by the Act in defined circumstances. The substance of duties created or altered by the Code is spread through Parts 2-8 and Schedule 3; below is a distilled, clause-referenced list of the most material obligations and entitlements.

Duties imposed on agencies

• Duty to operate within written authorisations: Human services agencies may rely on a written authorisation given by a senior officer to collect, use or disclose specified personal information to specified agencies for up to 12 months (clause 10(2)-(3)). The authorisation must specify the period, classes of information and the specified recipient agencies (clause 10(3)(a)-(c)).
• Duty to ensure authorisation conditions are met: A senior officer may only authorise if satisfied the individual is a person receiving services, that consent has been withheld or cannot be given, there are reasonable grounds of risk of substantial adverse impact if information is not used/disclosed, the use/disclosure is likely to assist case management, and reasonable notification steps have been taken (clause 10(4)(a)-(e)).
• Duty to nominate senior officers and approve allied agencies: Heads of human services agencies must nominate senior officers in writing and approve allied agencies in writing if they are to receive information under clause 10 (clause 10 definitions).
• Duty to record and make accessible details where no custodian exists: Community care agencies must record details of uses or disclosures made without a personal information custodian, ensuring those records are accessible to the individual if they regain capacity, any subsequent custodian, and the agency (Schedule 3 clauses 6(2)(c), 7(2)(c)).
• Duty to provide access to custodians: Schedule 3 clause 3 requires community care agencies to provide a personal information custodian with access to the individual’s information without excessive delay or expense.
• Duty to make amendments and notify recipients: Schedule 3 clause 4 requires community care agencies to make appropriate amendments at the request of a personal information custodian, attach requested statements if not amending, and, where practical, notify recipients of amendments.

Rights afforded to individuals and custodians

• Right to be notified: Clause 10(4)(e) requires reasonable steps to notify the individual of the specified information, specified agencies and period for which authorisation is sought. The Code acknowledges that notification may be by means other than writing where appropriate.
• Right of access for custodians and victims: Schedule 3 clause 3 requires agencies to provide custodians access to personal information for individuals lacking capacity. Part 8 clause 26 preserves access rights for victims of domestic violence to personal information held for the scheme.
• Right to correction and attachment of statements: Schedule 3 clause 4 entitles a custodian to request amendments and, if refused, to have a statement of the amendment attached and for recipients to be notified if practical.

Limits and exceptions

• Maximum authorisation period: Human services senior officer authorisations are limited to a maximum of 12 months (clause 10(3)(a)).
• Purpose-limited disclosures notwithstanding: Schedule 2 modifies Part 6 to allow certain public registers to disclose personal information without the usual purpose requirement, subject to conditions specified in Column 1 of Schedule 2 (clause 8). Those entries explicitly limit the scope of permitted disclosures; for example Schedule 2 item 1 excludes a private individual’s name or address if they do not reside at a contaminated site.
• Health information carve-out: Part 5 clause 16 contains an express note that the Department’s permission to disclose does not permit disclosure of health information, which remains regulated by the Health Records and Information Privacy Act 2002.

Procedural constraints and safeguards

• Notification requirement: Clause 10(4)(e) places an obligation to take reasonable steps to notify the individual of the authorisation parameters.
• Record keeping for no-custodian decisions: Schedule 3 clauses 6(2)(c) and 7(2)(c) require recording details of such uses or disclosures and ensuring records are accessible to the individual when capacity is regained or to a future custodian.
• Limits on secondary use by recipient agencies: Schedule 3 clause 7(3) requires a recipient public sector agency not to use or disclose personal information for a purpose other than that for which it was given.

Who decides

• Senior officers (human services): decide whether to grant a written authorisation (clause 10(2)-(4)).
• Heads of agencies: approve allied agencies in writing and appoint senior officers (clause 10 definitions), and authorise employees to act for individuals with no custodian (Schedule 3 clause 6(2)(b)).
• Minister: approves privacy procedures for the Domestic Violence Intervention Court Model; agencies operating under those procedures may be exempted from many IPPs (Part 8 clause 25).

The Code therefore creates a structured set of duties heavily focused on authorisation, notification, record-keeping and limited access and correction rights for custodians. The rights and duties are asymmetric: agencies gain discretion to act without consent in defined circumstances but must meet procedural safeguards spelled out in the Code to do so.

The Code text itself does not create new penalty provisions or a separate enforcement regime distinct from the Act. Clause 2 states that this Code modifies the application of the information protection principles and public register provisions of the Act; it does not, within its own language, specify civil or criminal penalties for non-compliance with the Code’s clauses.

Implications from the text:

• Enforcement remains a function of the Act and existing mechanisms: because the Code operates by modifying how the Act’s IPPs and Part 6 apply, any enforcement consequences for failing to comply with applicable IPPs (as modified) would follow the enforcement pathways provided in the Act. The Code contains procedural obligations (for example, record-keeping and notification) but does not itself attach fines or criminal sanctions within its clauses.
• Internal administrative remedies and obligations: the Code imposes internal decision-making and record-keeping duties on agencies (for instance, the requirement that senior officers be nominated in writing and that records of no-custodian uses be kept and be accessible). Failure to meet these procedural steps would, in practice, expose agencies to scrutiny under the Act; the precise sanctions or oversight steps for such agency conduct are not set out in the Code text.

Practical enforcement points drawn from the instrument:

• Evidence trail matters: the Code emphasises written authorisations, approvals and records (clause 10(3); Schedule 3 clauses 6(2)(c) and 7(2)(c)). That creates an administrative record that regulators or an oversight body could review to determine whether an agency acted within the Code’s limited permissions. Agencies that fail to keep the required records would have weaker defences if their conduct were questioned under the Act’s enforcement processes.
• Ministerial oversight for certain schemes: the Domestic Violence Intervention Court Model requires privacy procedures approved by the Minister (Part 8 clause 25). This channel gives the Minister a gatekeeping role, and compliance with those approved procedures will likely be central to any enforcement assessment of participant agencies’ conduct within the scheme.
• Limits from other statutes: clause 3 preserves disclosures otherwise permitted by law and references other Acts, such as the State Records Act and the Government Information (Public Access) Act. Where those regimes provide oversight, review or appeal pathways, affected persons might seek remedies under those statutes rather than under the Code itself.

Absent from the text

• The Code does not list enforcement authorities, penalty amounts, administrative fines or criminal sanctions specific to breaches of the Code. It does not create private cause-of-action language within its clauses. For precise enforcement consequences, practitioners must consult the parent Act and associated oversight or enforcement provisions outside of this Code instrument, because the Code’s role is to modify the application of IPPs and public register provisions rather than to create its own enforcement machinery.

In sum, the Code shifts compliance obligations and creates procedural duties whose breaches would be assessed under the Act’s enforcement framework and any overlapping regimes. Agencies should therefore treat the written authorisation, approval and record-keeping obligations in the Code as compliance-critical, because those steps create the evidentiary basis for demonstrating lawful use of the Code’s exceptions under the broader statutory regime.

The Code is expressly drafted to operate within an ecosystem of overlapping statutory regimes. It both defers to and references other legislation, and it contains carve-outs that are explicitly limited by external statutes.

Explicit preservations and cross-references

• Clause 3 preserves disclosures otherwise permitted by law and names the State Records Act 1998 and the Government Information (Public Access) Act 2009 as examples. The clause therefore acknowledges that disclosures authorised under those Acts remain available regardless of the Code.
• Clause 4’s note directs readers to the Act and the Interpretation Act 1987 for definitions and interpretative rules that affect the Code’s operation. That indicates the Code is not self-contained on definitions and statutory interpretation.
• Part 5 clause 16 contains a specific note that the Department’s power to disclose information does not permit disclosure of health information because health information is regulated by the Health Records and Information Privacy Act 2002. This is an express limitation on the Code’s private sector or departmental powers: where another Act regulates a category of information, that regime continues to apply.

Dependency on other statutes for definitions and roles

• Schedule 3 borrows and relies on definitions and statutory instruments from other Acts. For example, Schedule 3’s personal information custodian concept references the Guardianship Act 1987 and the Powers of Attorney Act 2003. The Code therefore builds on externally defined legal statuses rather than recreating them.
• Part 5 clause 12 defines certain terms by reference to the Crimes (Administration of Sentences) Act 1999 and the Crimes (Sentencing Procedure) Act 1999. Those references tie the correctional provisions of the Code to the criminal sentencing and corrections framework, aligning the Code’s privacy modifications with pre-existing offender-management legal categories.

Limits where other statutes impose stricter controls

• Where another statute imposes specific privacy or secrecy obligations, the Code defers to that statute. The express example is health information, which remains regulated under the Health Records and Information Privacy Act 2002 (Part 5 clause 16 note). That suggests agencies must check the full statutory landscape before relying on Code exemptions.
• Clause 3 repeats that nothing in the Code affects disclosures otherwise permitted by law, including disclosures made pursuant to the State Records Act or Government Information (Public Access) Act. That means the Code neither curtails nor expands rights created under those Acts; it leaves them intact.

Interaction with administrative processes and approvals

• The Domestic Violence Intervention Court Model requires privacy procedures approved by the Minister (Part 8 clause 25). This creates an intersection between the Code and executive decision-making: ministerial approval of privacy procedures is a prerequisite for the IPP exemptions to apply.
• Human services authorisations require written approvals by senior officers nominated in writing by the head of the human services agency (clause 10 definitions). Those internal administrative actions create a chain of authority that must be consistent with the agencies’ obligations under other relevant statutes.

Contractual and third-party implications

• The Code expressly contemplates disclosure to allied agencies, which are non-public bodies that are wholly or partly funded by human services agencies and approved in writing (clause 10). Those disclosures will interact with procurement contracts, service agreements, confidentiality clauses and potentially privacy obligations imposed by other regimes. The Code itself does not set out contract law consequences, but it changes the factual context for contractual confidentiality and compliance obligations when a non-public allied agency receives personal information under a written authorisation.

In practical terms, the Code is not a stand-alone privacy regime. It is a set of targeted modifications to the Act that must be read with the parent Act and with other specific statutes that regulate categories of information or define legal roles. Agencies and practitioners must map the Code’s exceptions onto overlapping statutory regimes such as the Health Records and Information Privacy Act 2002, the State Records Act 1998 and relevant criminal and guardianship legislation to ensure a lawful composite approach.

The Code text includes inline amendment annotations for several clauses, parts and schedules. Those annotations identify the statutory instruments or years in which particular insertions, substitutions or repeals occurred. The Code itself is presented as a living instrument that has been updated across multiple years. The following is a clause-referenced summary of the amendment markers present in the provided text.

Early structure and foundational changes

• Clause 4 (Definitions) carries an amendment note: Am 2005 No 98, Sch 2.47. That indicates definitions were amended in 2005 under that schedule.
• Clause 3 (Limitations) shows amendments: cl 3 was amended by 2005 (328), Sch 1 [1]; 2009 No 54, Sch 2.35. This signals modifications to the limitations clause in those years.

Part insertions and subsequent amendments

• Part 4 (Human services) is marked as inserted in 2005: pt 4: Ins 2005 (328), Sch 1 [2]. Clause 9 and clause 10 are both marked Ins 2005 (328), Sch 1 [2]. Clause 11 also bears Ins 2005 and a later substantive change: Subst 2015 No 69, Sch 2.2 [1]. That indicates the human services part was introduced in 2005 and had at least one substantive substitution in 2015.
• Part 5 (Correctional services) was inserted in 2006: pt 5, hdg: Ins 2006 (579), Sch 1. The Part and multiple clauses show amendment notes: clause 12 inserted 2006 (579), Sch 1 and further amendments in 2007 No 27, Sch 4.24 [1]; 2010 (235), Sch 1 [2]; 2017 No 53, Sch 4.24. Clause 13 and 14 show amendment notes from 2007, 2010 and 2016, indicating iterative adjustments.
• Part 6 (Community care) was inserted 2006 and substantially amended in later years. The heading notes: Ins 2006 (580), Sch 1 [1]. Clause 17 shows multiple amendment notes across 2010, 2015, 2016 and 2018. Clause 18 was inserted in 2006 and amended in 2015.

Registry and Domestic Violence scheme

• Part 7 (Registry of Births, Deaths and Marriages) was inserted in 2009 (Ins 2009 (638), Sch 1) and later substituted in 2017 (Subst 2017 (696), Sch 1). Clause 19 (document validation services) carries those insertion and substitution notes.
• Part 8 (Domestic Violence Intervention Court Model) clauses 22-26 were inserted in 2010: Ins 2010 (235), Sch 1 [5].

Schedules

• Schedule 1 (Permitted transfers) carries a single amending note: sch 1: Am 2010 (235), Sch 1 [6].
• Schedule 2 (Modification to Part 6) includes amendment notes across 2004, 2005, 2006, 2009 and 2010: sch 2: Am 26.3.2004; 2005 (754), Sch 1; 2006 No 59, Sch 7.15; 2009 No 61, Sch 4.9; 2010 No 34, Sch 2.39. Several rows in Schedule 2 are later repealed (rows 7-18 show Repealed).
• Schedule 3 (Community care modifications) shows insertion in 2006 and subsequent amendments in 2010, 2012 and 2015: sch 3, hdg: Ins 2006 (580), Sch 1 [2]. Sch 3: Ins 2006 (580), Sch 1 [2]. Am 2010 (235), Sch 1 [7]; 2012 No 7, Sch 2.4; 2015 No 69, Sch 2.2 [8]-[12].

Interpretation of the amendment notes

• The annotations specify the amending instruments by year and schedule identifiers. They indicate the Code has been iteratively adapted to respond to operational needs in human services, correctional services, community care and document verification functions.
• Several clauses have been both inserted and later substituted, reflecting changes in policy or operational detail (for example Schedule 3 substantial amendments in 2015).
• The presence of repealed rows in Schedule 2 shows that some public register exceptions were removed or consolidated over time.

For practitioners, the amendment markers in the Code text serve two practical functions: they indicate which parts are more recent and therefore likely to reflect current administrative practice, and they flag provisions that have been controversial or required refinement. For full legislative history reconciliation, practitioners must consult the formal amending instruments cited in the notes; the Code’s inline notes provide pointers but do not reproduce the amending legislation itself.

The Code text supplied does not record or cite any judicial decisions or administrative determinations that interpret the Code. There are no case names, reported decisions or summaries of litigation within the instrument. Practically this means:

• The instrument, as presented, contains no litigational history that could be relied on to show how courts or tribunals have applied or construed its clauses.
• Any judicial interpretation would come from decisions under the parent Act or from proceedings that cross-apply other legislation; those decisions are not embedded in this Code text.

Consequences for research and practice

• Because the Code itself records no litigation, practitioners cannot rely on textual annotations within the Code to explain how its exceptions have been judicially read. To obtain binding interpretive guidance, one must search authoritative case law that addresses either the interpretation of the Act with reference to the Code or administrative review decisions that apply the Code in context. The Code does not supply that material.
• The absence of litigation references in the instrument does not imply the Code has not been the subject of litigation; it only means such decisions are not cited in this text. Practitioners should therefore query court databases, tribunal decisions and administrative determinations that relate to the Act and to the sectors covered by the Code (human services, corrections, community care, registry validation services, and the Domestic Violence Intervention Court Model).

Where judges or tribunals have considered similar privacy-modifying instruments, the persuasive or binding weight of those decisions depends on whether the decision interprets the Act in a way that incorporates the Code, or whether a decision interprets the Code itself in a judicial review or statutory interpretation context. The Code text, however, does not document any such cases.

Recommendation for practitioners seeking litigation context

• Search for decisions that reference the Privacy and Personal Information Protection Act 1998 together with the specific Code clauses (for example, searches for "Privacy Code of Practice (General) 2003" and "senior officer authorisation" or Schedule 3 community care provisions).
• Review administrative review tribunals and oversight body determinations, especially where disputes concern access, correction, or the exercise of discretion under the Code’s authorisation pathways.
• Where matters concern overlapping regimes (such as health records or public access under the Government Information (Public Access) Act), check case law under those statutes for cross-reference to the Code’s exceptions.

In short, this Code does not itself carry a litigation appendix. Practitioners must look beyond the instrument to case law and administrative decisions for interpretive guidance and precedent.

The Code contains several practical traps for agencies and third parties that rely on its exceptions. Below are specific clause-based pitfalls and operational blind spots that practitioners should watch for.

1. Centralised discretion with time limits

• Human services authorisations must be given by a senior officer nominated by the head of agency and are limited to a maximum of 12 months (clause 10(2)-(3)(a)). Agencies that treat authorisations as indefinite or allow non-nominated staff to authorise transfers risk acting outside the Code. Ensure senior officers are nominated in writing and that renewals are tracked.

2. Notification requirement is mandatory but flexible

• Clause 10(4)(e) requires reasonable steps to notify the individual of the specified information, specified agencies and the proposed authorisation period. The Code’s note accepts non-written notification methods for clients with literacy or other barriers. Agencies must document the notification steps taken; absence of a record undermines reliance on the clause.

3. Allied agencies are non-public but funded

• Allied agencies are defined as non-public bodies wholly or partly funded by a human services agency and approved in writing by the head (clause 10). That means private or not-for-profit providers can gain authorised access. Contracts should be reviewed to ensure providers understand the Code’s constraints and record-keeping obligations.

4. Community care custodian definitions can produce competing claims

• Schedule 3 defines a personal information custodian broadly (guardian, attorney, spouse if close and continuing, carer, close friend or relative). Where multiple people could qualify (for example an attorney and a spouse), practical disputes may arise. Note the spouse definition limits to the last person who so qualified (Schedule 3 clause 17(1) and definition of spouse in clause 17). Agencies should create verification processes for custodian status.

5. Acting without a custodian requires authorisation and recording

• Schedule 3 allows an authorised employee to consent to use or disclosure where no custodian exists, but only if the employee is authorised by the head and the agency records details and ensures records are accessible to the individual if they regain capacity (Schedule 3 clauses 6(2)(b)-(c) and 7(2)(b)-(c)). Failure to have written delegation or to maintain records undermines lawful use/disclosure.

6. Health information remains separately regulated

• Part 5 clause 16 expressly notes that disclosures permitted to the Department do not permit disclosure of health information, which is regulated by the Health Records and Information Privacy Act 2002. Do not assume the Code authorises health data release in corrections contexts.

7. Schedule 2 public register exceptions contain internal limits

• Schedule 2 item 1 permits disclosure from the contaminated land record but explicitly excludes the name or address of an individual occupier, owner or polluter if they do not reside at the contaminated site. Practitioners must read Column 1 conditions carefully; a broad reading of “public register” can be curtailed by item-specific exceptions.

8. Domestic Violence Intervention Court Model exemptions hinge on Minister-approved privacy procedures

• Part 8 clause 25 exempts participating agencies from multiple IPPs only where collection, use or disclosure is for the scheme and is done in accordance with privacy procedures approved by the Minister. The exemption does not automatically apply; it depends on approved procedures being in place, and agencies must ensure they operate within those procedures.

9. Access rights preserved for particular classes

• Part 8 clause 26 removes the general exemption from section 14 for victims of domestic violence: participating agencies are not required to comply with section 14 in respect of scheme-held information unless the person is a victim. That preserves victims’ access while allowing restricted access for others. Be careful to treat victims differently from charged persons when processing access requests.

10. Record accessibility expectations

• Several clauses require that certain records be readily accessible by the individual if they regain capacity, by any subsequent personal information custodian, or by the agency itself (Schedule 3 clauses 2, 6(2)(c), 7(2)(c)). This creates an ongoing obligation to maintain accessible audit trails; failure to do so is a compliance risk.

11. Ambiguities about “reasonable” and “substantial adverse impact”

• Clause 10 uses terms like “reasonable grounds” and “substantial adverse impact” without prescriptive metrics. These are context-sensitive standards that invite interpretation and potential challenge, so agencies should adopt internal criteria and decision records to justify how they assessed risk.

12. Split responsibilities across statutes

• Because clause 3 preserves other statutory disclosure powers, agencies must map when to rely on the Code and when to rely on other Acts such as the State Records Act or Government Information (Public Access) Act. Confusing the regimes could lead to unlawful disclosure or unnecessary refusal.

Operationally, the principal gotchas are administrative: failure to nominate and document senior officers, to keep explicit written authorisations with a 12-month limit, to record notification steps and to maintain accessible records when acting without custodians. Contracting allied agencies and training authorised employees are routine compliance steps that, if omitted, multiply legal and reputational risk.

Compliance under this Code requires a combination of governance design, record-keeping, staff delegations, operational protocols and contract adjustments. Below is a practical, clause-referenced compliance checklist for agencies and for allied organisations that receive personal information under the Code.

1. Legal mapping and scope assessment

• Identify which parts of the Code apply to your agency: human services (Part 4 clauses 9-11), correctional services (Part 5 clauses 12-16), community care (Part 6 clause 17 and Schedule 3), registry functions (Part 7 clause 19), and Domestic Violence Intervention Court Model participants (Part 8 clauses 22-26). Check Schedule 1 and Schedule 2 for agency-specific provisions and public register exceptions (clauses 5-8; Schedules 1-2).

2. Governance and delegations

• Appoint and document heads of agency authorisations, nominate senior officers in writing where required, and keep the nominations current (clause 10 definitions). For community care, appoint authorised employees in writing and specify the scope of their authorisation to act for individuals with no custodian (Schedule 3 clauses 6(2)(b) and 7(2)(b)).
• Ensure the head of agency approves allied agencies in writing before any transfer to them occurs (clause 10 definitions).

3. Authorisation workflows and time limits

• Implement a written authorisation template for senior officers that specifies: the period (no more than 12 months), classes of personal information, and the specified agencies to whom disclosure may be made (clause 10(3)(a)-(c)). Include mandatory fields to document the senior officer’s satisfaction with the clause 10(4)(a)-(d) criteria.

4. Notification and informed steps

• Create a standardised process to take reasonable steps to notify individuals when seeking authorisation under clause 10(4)(e). Record the notification method used and reasons for non-written notification where applicable (for example, where a client is illiterate). Maintain notification logs that can be produced for audit or review.

5. Record-keeping, audit trails and accessibility

• For any use or disclosure made without a personal information custodian, maintain contemporaneous records sufficient to meet Schedule 3 clause 6(2)(c) and clause 7(2)(c) obligations: who authorised the use, why no custodian exists, the decision rationale that the use was in the best interests of the individual, and the record’s accessibility arrangements for the individual and future custodians.
• Maintain paper and electronic records with retrieval protocols so records are “readily accessible” to the individual upon regaining capacity, to any subsequent custodian, and to the agency (Schedule 3 clause 2(b), clause 6(2)(c)).

6. Access and correction processes for custodians and victims

• Implement a pathway for personal information custodians to request access and amendments under Schedule 3 clauses 3 and 4, including turnaround times and the mechanism to attach a custodian’s statement if amendments are refused. Ensure procedures distinguish victims (who retain access to scheme-held information under Part 8 clause 26) from other classes.

7. Training and decision support

• Train senior officers, authorised employees and front-line staff on the Code’s thresholds for “reasonable grounds” and “substantial adverse impact” (clause 10(4)(c)), and on the record-keeping and notification steps that must follow from any decision to proceed without consent.
• Provide decision templates and checklists that capture required satisfaction points under clause 10(4)(a)-(e) and Schedule 3 clauses 6 and 7.

8. Contracts and allied agency management

• Update contracts with allied agencies to reflect their obligations when receiving personal information under the Code. Include clauses requiring allied agencies to use the information only for the specified purposes, and to comply with record-keeping and confidentiality rules compatible with Schedule 3 clause 7(3) and clause 10.
• Verify that allied agencies understand they are receiving information under statutory authorisation and that their use is limited to the specified purposes.

9. Privacy procedures for schemes

• If participating in the Domestic Violence Intervention Court Model, ensure your agency operates strictly under privacy procedures approved by the Minister. Do not assume the IPP exemptions apply without such approved procedures (Part 8 clause 25). Maintain copies of the approved procedures and staff training records demonstrating adherence.

10. Public register disclosures and limits

• When publishing or disclosing information from public registers listed in Schedule 2, check Column 1 conditions carefully. For instance, do not publish the name or address of an individual occupier/owner/polluter who does not reside at a contaminated site where Schedule 2 item 1 excludes that information.
• Maintain a legal review step before releasing register information that might fall within excluded categories.

11. Health information caution in corrections

• In correctional contexts, do not treat the Code as authorising disclosure of health information. Part 5 clause 16 explicitly excludes health information from its disclosure permissions. Cross-check with the Health Records and Information Privacy Act 2002.

12. Review, audit and compliance reporting

• Conduct periodic internal audits of Code-based authorisations, allied-agency disclosures and record-keeping. Use audit outputs to identify systemic errors such as expired authorisations or missing notification records.
• Maintain a compliance register of authorisations with expiry dates to ensure no authorisation exceeds the 12-month maximum (clause 10(3)(a)).

13. Decision reasoning and defensibility

• Because terms such as “reasonable grounds” and “substantial adverse impact” are fact-sensitive, document the factual basis for each authorisation decisively. Treat the Code’s procedural steps as evidentiary essentials for demonstrating lawful reliance on the exceptions.

14. Cross-statutory checks

• Before relying on a Code exception, check whether another Act imposes stricter rules (for example health data, public access regimes, or State Records obligations) as clause 3 and Part 5 clause 16 require.

In short, compliance under this Code is primarily administrative discipline: explicit written authorisations, time-limited delegations, documented notification steps, accessible record-keeping, and amplified training and contractual clarity for allied agencies. Agencies should create templates, approval workflows and audit routines keyed to the specific clause requirements set out above.