Introduction

25.1 Research conducted in 2001 on behalf of the Office of the Privacy Commissioner (OPC) indicated that Australians were worried about the use of personal information for a purpose other than the original purpose for which it was collected. Of 1,524 people interviewed, 68% stated that this was a concern to them, 41% stated it was a great concern and 23% recorded little or no concern.[1] Similarly, 37% of complaints to the OPC under the National Privacy Principles (NPPs) in the financial year ending 30 June 2007 related to the use or disclosure of personal information.[2] This represented the largest single category of complaint.

25.2 The Information Privacy Principles (IPPs) and NPPs adopt a prescriptive approach to regulating the use and disclosure of personal information. The use provisions in the IPPs and NPPs, and the disclosure provisions in the NPPs, prohibit the use and disclosure of personal information for a purpose other than the purpose for which the information was collected. This general prohibition is subject to an exhaustive list of exceptions.

25.3 This chapter considers whether the use and disclosure provisions in the IPPs and NPPs should be consolidated into a single use and disclosure principle in the model Unified Privacy Principles (UPPs). It also considers the limited circumstances in which agencies and organisations should be permitted to use and disclose personal information for a purpose other than the original purpose of collection. Finally, the chapter addresses the issue of whether agencies and organisations should be required to record their use and disclosure of personal information for a purpose other than the purpose of collection.

[1] Roy Morgan Research, Privacy and the Community [prepared for Office of the Federal Privacy Commissioner] (2001), 25.

[2] See Office of the Privacy Commissioner, Complaints and Enquiries Statistics to End of June 2007 <www.privacy.gov.au/about/complaints/index.html> at 14 May 2008.