16.08.2010
30.146 The tenth principle in the model UPPs should be called ‘Identifiers’. It may be summarised as follows.
UPP 10. Identifiers (only applicable to organisations)
10.1 An organisation must not adopt as its own identifier of an individual an identifier of the individual that has been assigned by:
(a) an agency;
(b) an agent of an agency acting in its capacity as agent;
(c) a contracted service provider for a Commonwealth contract acting in its capacity as contracted service provider for that contract; or
(d) an Australian state or territory agency.
10.2 Where an identifier has been ‘assigned’ within the meaning of UPP 10.1 an organisation must not use or disclose the identifier unless:
(a) the use or disclosure is necessary for the organisation to fulfil its obligations to the agency that assigned the identifier;
(b) one or more of UPP 5.1(c) to (f) apply to the use or disclosure; or
(c) the identifier is genetic information and the use or disclosure would be permitted by the new Privacy (Health Information) Regulations.
10.3 UPP 10.1 and 10.2 do not apply to the adoption, use or disclosure by a prescribed organisation of a prescribed identifier in prescribed circumstances, set out in regulations made after the Minister is satisfied that the adoption, use or disclosure is for the benefit of the individual concerned.
10.4 The term ‘identifier’, for the purposes of UPP 10, includes a number, symbol or biometric information that is collected for the purpose of automated biometric identification or verification that:
(a) uniquely identifies or verifies the identity of an individual for the purpose of an agency’s operations; or
(b) is determined to be an identifier by the Privacy Commissioner.
However, an individual’s name or ABN, as defined in the A New Tax System (Australian Business Number) Act 1999 (Cth), is not an ‘identifier’.
Note: A determination referred to in the ‘Identifiers’ principle is a legislative instrument for the purposes of section 5 of the Legislative Instruments Act 2003 (Cth).