Section Australian Privacy Principle 8—cross‑bor - Privacy (Market and Social Research) Code 2014 - Australian Privacy Principle 8—cross‑border disclosure of personal information (as customised for the purposes of this Code) | Zoe
Australian Privacy Principle 8—cross‑borAustralian Privacy Principle 8—cross‑border disclosure of personal information (as customised for the purposes of this Code)
Start here
Get a plain-English read of Australian Privacy Principle 8—cross‑bor
Turn the raw legal text into a practical explanation grounded in Privacy (Market and Social Research) Code 2014.
Australian Privacy Principle 8—cross‑border disclosure of personal information (as customised for the purposes of this Code)
8.1 Before a Research Organisation discloses identifiable research information about an individual to a person (the overseas recipient):
(a) who is not in Australia or an external Territory, and
(b) who is not the Research Organisation itself or the individual,
the Research Organisation must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.
Note: In certain circumstances, an act done, or a practice engaged in, by the overseas recipient is taken, under section 16C, to have been done, or engaged in, by the APP entity and to be a breach of the Australian Privacy Principles.
8.2 Subclause 8.1 does not apply to the disclosure of identifiable research information about an individual by a Research Organisation to the overseas recipient if:
(a) the Research Organisation reasonably believes that:
(i) the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the information; and
(ii) there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme; or
(b) both of the following apply:
(i) the Research Organisation expressly informs the individual that if he or she consents to the disclosure of the information, subclause 8.1 will not apply to the disclosure;
(ii) after being so informed, the individual consents to the disclosure; or
(c) the disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or
(d) a permitted general situation (other than the situation referred to in item 4 or 5 of the table in subsection 16A(1)) exists in relation to the disclosure of the information by the Research Organisation.
Exceptions (e) and (f) are not applicable (agencies only)
Note: For permitted general situation, see section 16A.
Australian Privacy Principle 9: Adoption, use or disclosure of government related identifiers (as customised for the purposes of this Code)
Adoption of government related identifiers
9.1 A Research Organisation must not adopt a government related identifier of an individual as its own identifier of the individual unless:
(a) the adoption of the government related identifier is required or authorised by or under an Australian law or a court/tribunal order; or
(b) subclause 9.3 applies in relation to the adoption.
Note: An act or practice of an agency may be treated as an act or practice of an organisation, see section 7A.
Use or disclosure of government related identifiers
9.2 A Research Organisation must not use or disclose a government related identifier of an individual unless:
(a) the use or disclosure of the identifier is reasonably necessary for the organisation to verify the identity of the individual for the purposes of the organisation’s activities or functions; or
(b) the use or disclosure of the identifier is reasonably necessary for the organisation to fulfil its obligations to an agency or a State or Territory authority; or
(c) the use or disclosure of the identifier is required or authorised by or under an Australian law or a court/tribunal order; or
(d) a permitted general situation (other than the situation referred to in item 4 or 5 of the table in subsection 16A(1)) exists in relation to the use or disclosure of the identifier; or
(e) the organisation reasonably believes that the use or disclosure of the identifier is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
(f) subclause 9.3 applies in relation to the use or disclosure.
Note 1: An act or practice of an agency may be treated as an act or practice of an organisation, see section 7A.
Note 2: For permitted general situation, see section 16A.
Regulations about adoption, use or disclosure
9.3 This subclause applies in relation to the adoption, use or disclosure by a Research organisation of a government related identifier of an individual if:
(a) the identifier is prescribed by the regulations; and
(b) the Research Organisation is prescribed by the regulations, or is included in a class of organisations prescribed by the regulations; and
(c) the adoption, use or disclosure occurs in the circumstances prescribed by the regulations.
Note: There are prerequisites that must be satisfied before the matters mentioned in this subclause are prescribed, see subsections 100(2) and (3).
Integrity of personal information
Australian Privacy Principle 10: Quality of personal information (as customised for the purposes of this Code)
10.1 A Research Organisation must take such steps (if any) as are reasonable in the circumstances to ensure that the identifiable research information that the Research Organisation collects is accurate, up‑to‑date and complete.
10.2 A Research Organisation must take such steps (if any) as are reasonable in the circumstances to ensure that the identifiable research information that the Research Organisation uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up‑to‑date, complete and relevant.
Australian Privacy Principle 11: Security of personal information (as customised for the purposes of this Code)
11.1 If a Research Organisation holds identifiable research information, the Research Organisation must take such steps as are reasonable in the circumstances to protect the information:
(a) from misuse, interference and loss; and
(b) from unauthorised access, modification or disclosure.
11.2 If:
(a) a Research Organisation holds identifiable research information about an individual; and
(b) the Research Organisation no longer needs the information for any purpose for which the information may be used or disclosed by the Research Organisation under this Code; and
(c) the information is not contained in a Commonwealth record; and
(d) the Research Organisation is not required by or under an Australian law, or a court/tribunal order, to retain the information;
the Research Organisation must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de‑identified.
Additional Requirement: retention and disposal
11.3 A Research Organisation must retain identifiable research information only while the details of the identity of the individual whom the information is about continue to be necessary for research purposes. The information must be destroyed or de-identified once these purposes have been achieved. Where identifiable research information has been returned to a third party (in accordance with APP6) any copies, including archived copies, must be destroyed or de-identified.
11.4 If a Research Organisation wishes to de-identify identifiable research information that exists in a physical form that makes de-identification impracticable (e.g. on paper), the information must be moved to another medium, de-identified, and the physical records then destroyed.
11.5 Where it is necessary to retain identifiable research information, identifying (contact) details must, if practicable, be stored separately from other information (research status and research data), with measures in place (e.g. by the use of an encrypted intervening variable) to ensure the identity of the individuals cannot be readily revealed from the other information.
11.6 A Research Organisation must take reasonable steps to ensure that any identifiable research information that it discloses:
(a) will only be retained, used or disclosed by the recipient of the information in a manner that is consistent with this Code;
(b) will be protected by the recipient from misuse, interference and loss and from unauthorised access, modification, use and disclosure; and
(c) will only be used or disclosed by the recipient for a specified limited purpose and will be destroyed or de-identified once this purpose has been achieved. Where identifiable research information has been returned by the recipient to a third party (in accordance with APP6) any copies, including archived copies, must by destroyed or de-identified.
11.7 A Research Organisation may disclose de-identified information freely, provided that there is no reasonable likelihood that the disclosed information could be used to identify one or more of the individuals who participated in the research, such as where the pattern of answers could reveal their identity.
Access to, and correction of, personal information
Australian Privacy Principle 12: Access to personal information (as customised for the purposes of this Code)
Access
12.1 If a Research Organisation holds identifiable research information about an individual, the Research Organisation must, on request by the individual, give the individual access to the information.
12.2 Not applicable (agencies only)
Exception to access
12.3 Despite subclause 12.1, entity Research Organisation is not required to give the individual access to the identifiable research information to the extent that:
(a) the Research Organisation reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or
(b) giving access would have an unreasonable impact on the privacy of other individuals; or
(c) the request for access is frivolous or vexatious; or
(d) the information relates to existing or anticipated legal proceedings between the Research Organisation and the individual, and would not be accessible by the process of discovery in those proceedings; or
(e) giving access would reveal the intentions of the Research Organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
(f) giving access would be unlawful; or
(g) denying access is required or authorised by or under an Australian law or a court/tribunal order; or
(h) both of the following apply:
(i) the Research Organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the Research Organisation’s functions or activities has been, is being or may be engaged in;
(ii) giving access would be likely to prejudice the taking of appropriate action in relation to the matter; or
(i) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
(j) giving access would reveal evaluative information generated within the Research Organisation in connection with a commercially sensitive decision‑making process.
Dealing with requests for access
12.4 The Research Organisation must:
(a) respond to the request for access to the identifiable research information within a reasonable period after the request is made; and
(b) give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.
Other means of access
12.5 If the Research Organisation refuses:
(a) to give access to the personal information because of subclause 12.3; or
(b) to give access in the manner requested by the individual;
the Research Organisation must take such steps (if any) as are reasonable in the circumstances to give access in a way that meets the needs of the Research Organisation and the individual.
12.6 Without limiting subclause 12.5, access may be given through the use of a mutually agreed intermediary.
Access charges
12.7 Not applicable (agencies only).
12.8 If the Research Organisation charges the individual for giving access to the identifiable research information the charge must not be excessive and must not apply to the making of the request.
Refusal to give access
12.9 If the Research Organisation refuses to give access to the identifiable research information because of subclause 12.3, or to give access in the manner requested by the individual, the Research Organisation must give the individual a written notice that sets out:
(a) the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and
(b) the mechanisms available to complain about the refusal; and
(c) any other matter prescribed by the regulations.
12.10 If the Research Organisation refuses to give access to the personal information because of paragraph 12.3(j), the reasons for the refusal may include an explanation for the commercially sensitive decision.
Australian Privacy Principle 13—correction of personal information (as customised for the purposes of this Code)
Correction
13.1 If:
(a) a Research Organisation holds identifiable research information about an individual; and
(b) either:
(i) the Research Organisation is satisfied that, having regard to a purpose for which the information is held, the information is inaccurate, out‑of‑date, incomplete, irrelevant or misleading; or
(ii) the individual requests the entity to correct the information;
the Research Organisation must take such steps (if any) as are reasonable in the circumstances to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up‑to‑date, complete, relevant and not misleading.
Notification of correction to third parties
13.2 If:
(a) the Research Organisation corrects personal information about an individual that the Research Organisation previously disclosed to another APP entity; and
(b) the individual requests the Research Organisation to notify the other APP entity of the correction;
the Research Organisation must take such steps (if any) as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.
Refusal to correct information
13.3 If the Research Organisation refuses to correct the identifiable research information as requested by the individual, the Research Organisation must give the individual a written notice that sets out:
(a) the reasons for the refusal except to the extent that it would be unreasonable to do so; and
(b) the mechanisms available to complain about the refusal; and
(c) any other matter prescribed by the regulations.
Request to associate a statement
13.4 If:
(a) the Research Organisation refuses to correct the identifiable research information as requested by the individual; and
(b) the individual requests the Research Organisation to associate with the information a statement that the information is inaccurate, out‑of‑date, incomplete, irrelevant or misleading;
the Research Organisation must take such steps as are reasonable in the circumstances to associate the statement in such a way that will make the statement apparent to users of the information.
Dealing with requests
13.5 If a request is made under subclause 13.1 or 13.4, the Research Organisation:
(a) must respond to the request within a reasonable period after the request is made; and
(b) must not charge the individual for the making of the request, for correcting the personal information or for associating the statement with the personal information (as the case may be).
Additional requirement: destruction or de-identification on request
13.6 A Research Organisation must accept and act on requests for identifiable research information to be destroyed or de-identified, except in the following circumstances:
(a) the request is frivolous or vexatious; or
(b) destruction, deletion or de-identification would have an unreasonable impact upon the privacy of other individuals; or
(c) the organisation reasonably believes that destroying, deleting or de-identifying the information would pose a serious threat to the life, health or safety of any individual or to public health or public safety; or
(d) destroying, deleting or de-identifying the information would reveal the intentions of the research organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
(e) destroying, deleting or de-identifying the information would be unlawful; or
(f) retaining the identifiable information is required or authorised by or under an Australian law or a court/tribunal order; or
(g) the Research Organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the organisation’s functions or activities has been, is being or may be engaged in; and destroying, deleting or de-identifying the information would be likely to prejudice the taking of appropriate action in relation to the matter; or
(h) destroying, deleting or de-identifying the information, would be likely to prejudice one or more enforcement related activities conducted by or on behalf of an enforcement body; or
(i) where the Research Organisation is contractually obliged to retain the identifiable research information.
F. GOVERNANCE
Code Administrator
The Code Administrator for this Code is AMSRO. In practice, this Code is administered by the AMSRO Secretariat, under direction of the AMSRO Board.
AMSRO will fund the administration of this Code in such manner as the AMSRO Board considers appropriate, having regard to the resource requirements necessary for the effective execution of those tasks described in subclause F c.
Tasks of the Code Administrator
c. In administering this Code, the AMSRO Secretariat will perform the following tasks:
maintain an accurate and up to date online list of AMSRO members, which doubles as a public register of research organisations which are bound by this Code.
commission periodic reviews of this Code in accordance with Part G.
produce a written response to a report resulting from an independent code review;
consider the need for any variation of this Code, and make any consequent applications;
monitor and report on compliance with this Code (see Part H),
Make available on the AMSRO website the following:
(a) information about this Code;
(b) a copy of the most current version of this Code;
(c) contact details for the Code Administrator;
(d) information about making complaints in relation to matters contained in this Code;
(e) the annual report on the operation of this Code required under Part H
(f) a link to the website of the Commissioner;
(g) any other information that the Code Administrator considers relevant to the efficient functioning of this Code.
vii. perform such other tasks as the AMSRO Board considers necessary or desirable for the effective operation of this Code, including but not limited to the establishment and management of a formal complaints handling process relating to alleged breaches of this Code.
viii. In relation to tasks a.ii-v, the Administrator will be assisted and advised by AMSRO’s Privacy Compliance Committee
d. AMSRO has established a Privacy Compliance Committee, comprising an independent chair, at least two industry representatives and one consumer representative, which meets at least twice a year.
e. The Privacy Compliance Committee terms of reference include the following functions relevant to this Code:
“To make recommendations on matters including, but not limited to:
The Code Reviewer’s recommendations concerning streamlining industry Guidelines to clarify how they work in conjunction with the Code;
The Code Reviewer’s recommendations concerning implementing an explicit privacy component into industry quality audits;
…
Industry awareness/education regarding privacy issues, including information sheets, FAQs and best practice;
…
Systemic issues arising from privacy complaints.”
f. The Privacy Compliance Committee will advise the Code Administrator about the timing and conduct of the periodic independent review of this Code under Part G.
g. The Privacy Compliance Committee may be required by the Code Administrator to participate in any formal complaints handling process that might be established by the Code Administrator relating to addressing alleged breaches of this Code.
G. REVIEW
Independent Code Review
This Code is subject to periodic independent review by a reviewer to be appointed by the AMSRO Board for each review.
The purpose of Code reviews is to ensure that this Code is meeting its objectives and remains effective and relevant.
There will be a review of this Code at least every five years, but the Code Administrator may commission a review at any time, for example if regular monitoring indicates a lack of compliance with this code or if the Code Administrator becomes aware of systemic issues that would justify a review.
The terms of reference for each review will be drawn up by the Code Administrator in consultation with the Privacy Compliance Committee.
Each review will be funded by AMSRO in such manner as the AMSRO Board considers appropriate, having regard to the resource requirements necessary for the effective execution of the review.
Reports of the independent code review will include recommendations for any amendments to this Code that are considered necessary or desirable for the effective operation of this Code.
Consultation
g. In conducting an independent review, the Code Administrator will notify the Commissioner of the review; and the Independent Code Reviewer will seek the views of the Commissioner, government agencies, industry representatives (including the Australian Market and Social Research Society (AMSRS)), consumer representatives, the general public and other persons or bodies as appropriate in Australia and internationally; regarding the operation of this Code and in relation to suitable revisions and amendments.
Reporting following an Independent Code Review
h. The report of the Independent Code Reviewer shall be made publicly available online and shall outline the issues raised by the review and the findings of the review.
i. The report shall be accompanied by a response from the Code Administrator, outlining the actions taken, or that will be taken, by the Code Administrator and/or the research organisations bound by this Code to address issues identified by the review.
Variation of the Code
j. Following a recommendation of an Independent Code Review, or for any other reason, the Code Administrator may apply to the Commissioner for variation of the Code.
k. Any such application would follow the process set out in the Act and guidance issued by the Commissioner.
H. MONITORING AND REPORTING
Research Organisations must report annually, by 31 August, to the Code Administrator, on the number, nature and outcomes of any complaints received about Breaches of this Code.
Research Organisations must report systemic issues or serious and repeated breaches of this Code to the Commissioner as soon as they become aware of them.
The Code Administrator will monitor compliance by research organisations with this Code and will investigate serious and repeated breaches and systemic issues about code compliance.
The Code Administrator will publish an Annual Report on the operation of this Code and make it available both to the Commissioner and publicly, including online. The Annual Report will include a summary of complaints handled by Research Organisations and reported to the Code Administrator under clause H (a).
The Code Administrator will report systemic issues or serious and repeated breaches of this Code to the Commissioner as soon as it becomes aware of them.
Improper conduct
f. If a Research Organisation subject to this Code acts in a manner that, in the AMSRO Board’s opinion, constitutes seriously improper conduct in relation to this Code, (and the research practices defined herein that breach the Articles of Association), then the AMSRO Board shall direct the Code Administrator to notify the research organisation of the conduct.
g. Within 7 business days of receipt of notification by the Code Administrator of an opinion by the AMSRO Board concerning seriously improper conduct by the Research Organisation the Research Organisation must:
take all reasonable steps to rectify the seriously improper conduct; and
notify the Code Administrator of the steps taken to rectify the seriously improper conduct.
h. If the Research Organisation fails to adequately comply with clause g. above then the AMSRO Board will issue a final notice requiring the Research Organisation to rectify the seriously improper conduct within 7 business days.
i. Where the AMSRO Board is satisfied that seriously improper conduct has occurred in relation to this Code, AMSRO may take such remedial action against the Research Organisation as is permitted under its Rules of Association and/or terms of membership, as varied from time to time, including suspension or expulsion.
j. These misconduct provisions operate independently of the complaint provisions of the Privacy Act and the enforcement role of the Commissioner.