Annotation of disputed information

29.133 Where the correctness of personal information is the subject of dispute, the IPPs and the NPPs provide individuals with the right to have the information annotated.

29.134 The IPPs and NPPs, however, deal with this issue slightly differently. IPP 7 states that, in the event that there is a disagreement about correction, the record-keeper should ‘attach’ to the record, on request, any statement provided by the individual of the correction sought. On the other hand, NPP 6 requires the organisation, on request, to ‘associate’ with the information a statement that it is not accurate, complete or up-to-date. This raises the question of which approach is more appropriate. Should the obligation to annotate disputed information require an agency or organisation to attach a statement of the correction sought to the relevant record, or to ‘associate’ with the record the views of the individual concerned? For example, the Annotated National Privacy Principles state:

It may be appropriate not to attach a statement where, for example, the relevant personal information is held in electronic format in template documents that have no capacity for attachments or where the statement is very lengthy.[150]

Submissions and consultations

29.135 In DP 72, the ALRC expressed the preliminary view that the wording in NPP 6.6 (‘associate’) was preferable to the wording in IPP 7 (‘attach’) because it was more technology neutral. The ALRC was of the view that the use of the word ‘associate’ was more likely to achieve the main objective of the provision—namely, to ensure that the opinion of an individual about the correctness of his or her personal information is easily accessible when the organisation seeks to use or disclose the information.[151]

29.136 Optus supported the ALRC’s view that the wording ‘associate’ was preferable, noting that the word ‘attach’ was technology specific and ‘would be insupportable by virtue of the operation of some business systems’.[152] Privacy advocates also supported the suggestion that an organisation should associate with disputed information a statement claiming that the information is not correct, subject to the general requirement that any notes made about disputed information are apparent to subsequent users.[153]

ALRC’s view

29.137 Agencies and organisations should be required to ‘associate’ with the record a statement of the correction, deletion or addition sought. This record should be associated in such a way that it is apparent to subsequent users. The ALRC considers this requirement to be inherent to the meaning of ‘associate’. Currently, the OPC’s Information Sheet 4—Access and Correction advises that:

An organisation would ordinarily need to associate the individual’s statement about the disputed information in such a way that whenever the information is handled in the future it will be easy to see that the individual is not satisfied that this particular part of the personal information is accurate, complete or up-to-date.[154]

29.138 In previous stages of this Inquiry, the ALRC considered the respective benefits of the word ‘associate’ only in the context of organisations. The policy reasons for adopting the word ‘associate’—in particular, the term’s technological neutrality—apply equally, however, to agencies and organisations. Accordingly, it is appropriate for this terminology also to apply to agencies.

Recommendation 29-6 The ‘Access and Correction’ principle should provide that an agency or organisation must, in the following circumstances, if requested to do so by the individual concerned, take reasonable steps to associate with the record a statement of the correction sought:

(a) if the agency or organisation that holds personal information is not willing to correct personal information in accordance with a request by the individual concerned; and

(b) where the personal information is held by an agency, no decision or recommendation to the effect that the record should be amended wholly or partly in accordance with that request has been made under the applicable provisions of a law of the Commonwealth.

[150] See J Douglas-Stewart, Annotated National Privacy Principles (2005), [2–4810].

[151]Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), [26.27]. As a result of the ALRC’s approach to the reform of access and correction in DP 72, this view was raised only in the context of organisations.

[152]Optus, Submission PR 532, 21 December 2007.

[153]Australian Privacy Foundation, Submission PR 553, 2 January 2008; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[154]Office of the Federal Privacy Commissioner, Access and Correction, Information Sheet 4 (2001).