State and territory authorities

38.19 State and territory authorities are not agencies or organisations for the purposes of the Privacy Act.[25] Accordingly, they are exempt from the operation of the Act unless they are brought into the regime by regulation.[26] Generally, state and territory authorities are people or bodies that are part of a state or territory public sector, such as state and territory ministers and government departments; local governments; and bodies and tribunals established for public purposes under state and territory laws.[27]

38.20 State and territory bodies that are incorporated companies, societies or associations, however, are considered ‘organisations’ for the purposes of the Act.[28] They can be prescribed out of the coverage of the Act, but only upon the request of the relevant state or territory and only after the Minister responsible for administering the Privacy Act has considered a number of issues outlined in the Act.[29]

38.21 Some state and territory authorities are required by other federal legislation to comply with the Privacy Act. For example, public and private sector higher education providers are required by the Higher Education Support Act 2003 (Cth) to comply with the Information Privacy Principles (IPPs) when handling the personal information of students obtained for the provision of financial assistance to students.[30]

38.22 The Revised Explanatory Memorandum to the Privacy Amendment (Private Sector) Bill 2000 (Cth) states that the reason for the exemption of state and territory authorities from the Privacy Act was that the acts and practices of state and territory public sector agencies were for the states and territories to regulate.[31]

38.23 From 21 December 2001 to 31 January 2005, 16% of all the complaints about the National Privacy Principles (NPPs) closed by the OPC because they were outside its jurisdiction concerned the exemption for state and local governments.[32] In 2004–05, the OPC received 2,469 enquiries concerning exemptions, of which 32% related to state or local government bodies not covered by the Privacy Act.[33]

[25] Privacy Act 1988 (Cth) ss 6(1), 6C.

[26] Ibid s 6F.

[27] Ibid s 6C(3); Office of the Privacy Commissioner, Coverage of and Exemptions from the Private Sector Provisions (Updated with Minor Amendments 27 November 2007), Information Sheet 12 (2001), 2.

[28]Privacy Act 1988 (Cth) s 6C(1), (3)(c)(i).

[29] Ibid s 6C(4); Office of the Privacy Commissioner, Coverage of and Exemptions from the Private Sector Provisions (Updated with Minor Amendments 27 November 2007), Information Sheet 12 (2001), 2.

[30]Higher Education Support Act 2003 (Cth) s 19.60.

[31] Revised Explanatory Memorandum, Privacy Amendment (Private Sector) Bill 2000 (Cth), [73].

[32] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 328.

[33] Office of the Privacy Commissioner, The Operation of the Privacy Act Annual Report: 1 July 2004–30 June 2005 (2005), 38. No statistics on the number of inquiries concerning exempt state and local bodies were reported for 2005–06 or 2006–07: see Office of the Privacy Commissioner, The Operation of the Privacy Act Annual Report: 1 July 2005–30 June 2006 (2006); Office of the Victorian Privacy Commissioner, Annual Report 2006–07 (2007).