But if information already held is used or disclosed after commencement of the Privacy Act, then rights of access and correction apply unless

 unreasonable administrative burden or

 cause the organisation unreasonable expense.

(or for small businesses (not health services), applies to information collected after 21 December 2002, no exception like the above).

But if information already held is used But if information already held is used or disclosed after commencement of the Privacy Act, then rights of access and correction apply unless