Australian Privacy Principle 5—notificatAustralian Privacy Principle 5—notification of the collection of personal information (as customised for the purposes of this Code)
Start here
Get a plain-English read of Australian Privacy Principle 5—notificat
Turn the raw legal text into a practical explanation grounded in Privacy (Market and Social Research) Code 2014.
Australian Privacy Principle 5—notification of the collection of personal information (as customised for the purposes of this Code)
5.1 At or before the time or, if that is not practicable, as soon as practicable after, a Research Organisation collects identifiable research information about an individual, the organisation must take such steps (if any) as are reasonable in the circumstances:
(a) to notify the individual of such matters referred to in subclause 5.2 as are reasonable in the circumstances; or
(b) to otherwise ensure that the individual is aware of any such matters.
5.2 The matters for the purposes of subclause 5.1 are as follows:
(a) the identity and contact details of the Research Organisation;
(b) if:
(i) the Research Organisation collects the identifiable research information from someone other than the individual; or
(ii) the individual may not be aware that the Research Organisation has collected the identifiable research information;
the fact that the Research Organisation so collects, or has collected, the identifiable research information and the circumstances of that collection;
(c) not applicable;
(d) the purposes for which the Research Organisation collects the identifiable research information;
(e) the main consequences (if any) for the individual if all or some of the identifiable research information is not collected by the Research Organisation;
(f) any other APP entity, body or person, or the types of any other APP entities, bodies or persons, to which the Research Organisation usually discloses identifiable research information of the kind collected by the Research Organisation;
(g) that the research information privacy policy of the Research Organisation contains information about how the individual may access the identifiable research information about the individual that is held by the entity and seek the correction of such information;
(h) that the research information privacy policy of the Research Organisation contains information about how the individual may complain about a breach of this Code, and how the entity will deal with such a complaint;
(i) whether the Research Organisation is likely to disclose the identifiable research information to overseas recipients;
(j) if the Research Organisation is likely to disclose the identifiable research information to overseas recipients - the countries in which such recipients are likely to be located if it is practicable to specify those countries in the notification or to otherwise make the individual aware of them.
Additional requirement: matters of which respondents should be made aware - sources of information and identity of client
5.3 Research Organisations must disclose the source of the research sample (e.g. customer information, information collected by researchers, publicly available lists such as a telephone directory or electoral roll, random digit dialling, door knocking), no later than the end of the collection of information, except where the Research Organisation and client have reasonable grounds to decide that there are genuine research concerns or where there is another compelling reason not to do so (e.g. it may expose one of the parties to legal action).
Section Australian Privacy Principle 5—notificat - Privacy (Market and Social Research) Code 2014 - Australian Privacy Principle 5—notification of the collection of personal information (as customised for the purposes of this Code) | Zoe
5.4 Research Organisations must disclose the identity of the client, unprompted, no later than the end of the collection of information, except where the Research Organisation and client have reasonable grounds to decide that there are genuine research concerns or where there is another compelling reason not to do so (e.g. it may expose one of the parties to legal action).
Dealing with personal information
Australian Privacy Principle 6: Use or disclosure of personal information (as customised for the purposes of this Code)
Use or disclosure
6.1 If a Research Organisation holds identifiable research information about an individual that was collected for a particular purpose (the primary purpose), the Organisation must not use or disclose the information for another purpose (the secondary purpose) unless:
(a) the individual has consented, or
(b) the use or disclosure of the information is required or authorised by or under an Australian law or court/tribunal order;
(c) it is unreasonable or impracticable to obtain the individual’s consent to the use or disclosure; and the Research Organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.
(d) the Research Organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the Organisation’s functions or activities has been, is being or may be engaged in; and the Organisation reasonably believes that the collection, use or disclosure is necessary in order for the Organisation to take appropriate action in relation to the matter.
(e) the Research Organisation reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf, of an enforcement body
Note: Australian Privacy Principle 8 sets out requirements for the disclosure of personal information to a person who is not in Australia or an external Territory.
6.2 Not applicable other than the exceptions now in 6.1(b)–(e)
Additional requirement: research use and disclosure
Re-use of identifiable research information for subsequent research
6.2A A Research Organisation may use identifiable research information for a research purpose provided that:
(a) if re-contact of an individual who initially declined to participate is involved, the Research Organisation and client have genuine research concerns that warrant such re-contact; and
(b) if re-contact of an individual who has participated in a research exercise is involved:
(i) the individual was informed of this likelihood at the time the information was collected, except where the research and client organisations have reasonable grounds to decide that there are genuine research concerns that justify not so notifying; or
(ii) any individual who, at the time of collection, indicated a wish not to be re-contacted for research purposes is excluded unless the research and client organisations have reasonable grounds to decide that there are genuine research concerns that warrant the individual’s inclusion.
Disclosure of personal information for research
6.2B A Research Organisation may disclose identifiable research information provided that:
(a) the disclosure is necessary for a research purpose; and
(b) only that part of the information considered necessary for this research purpose is disclosed; and
(c) if this research purpose could be achieved using de-identified information, the information is de-identified before being disclosed \[APP 6.4\]; and
(d) where the recipient is the client, the consent of all individuals who could be identifiable has been obtained, except where the personal information being disclosed to the client concerns individuals’ research status. In this case:
(i) the Research Organisation should take reasonable steps to ensure that the information concerning individuals’ research status cannot be linked to individuals’ research data about those individuals; and
(ii) the Research Organisation should obtain the client’s agreement to restrict use of the information concerning individuals’ research status only for the specific purpose of regulating the frequency of contacts of individuals in the client’s subsequent research.
6.3 Not applicable (agencies only)
6.4 If subsection 16B(2) applies in relation to the collection of the identifiable research information by the Research Organisation, it must take such steps as are reasonable in the circumstances to ensure that the information is de‑identified before the Organisation discloses it in accordance with subclause 6.1 or 6.2.
Written note of use or disclosure
6.5 If a Research Organisation uses or discloses identifiable research information in accordance with paragraph 6.1(e), the Organisation must make a written note of the use or disclosure.
Related bodies corporate
6.6 If a Research Organisation is a body corporate; and it collects identifiable research information from a related body corporate; this principle applies as if the Research Organisation’s primary purpose for the collection of the information were the primary purpose for which the related body corporate collected the information.
Exceptions
6.7 This principle does not apply to the use or disclosure by a Research Organisation of:
(a) identifiable research information for the purpose of direct marketing; or
(b) government related identifiers.
Australian Privacy Principle 7: Direct marketing (as customised for the purposes of this Code)
7.1 If a Research Organisations holds identifiable research information about an individual, the Research Organisations must not use or disclose the information for the purpose of direct marketing.