Prevention of misuse and loss of personal information
28.15 A central component of data security is protecting personal information from misuse and loss. The importance of measures to protect personal information from misuse and loss recently was illustrated in the United Kingdom, when Her Majesty’s Revenue and Customs lost in the post the personal information of 25 million Britons, including their dates of …
Publications
Read moreDisclosure of personal information to third parties
Background28.41 Unlike NPP 4, IPP 4 expressly obliges a record-keeper to take reasonable steps to prevent unauthorised use or disclosure of personal information contained in a record where the record is given ‘to a person in connection with the provision of a service to the record-keeper’.[45] In addition, s 95B of the Privacy Act requires …
Publications
Read moreInformation destruction and retention requirements
Background28.53 Sometimes privacy law requires an agency or organisation that has collected personal information to destroy, delete or de-identify that information after a set period of time or in certain circumstances. This requirement may arise where, for example, an organisation has collected personal information for the specific purpose of identifying an individual. When the identification …
Publications
Read moreTowards a single data security principle
28.7 As noted above, agencies and organisations are subject to data security requirements under the IPPs and NPPs respectively. These principles, however, differ in two main respects. First, agencies are obliged to take steps to prevent the unauthorised use or disclosure of personal information that has been disclosed to a third party in connection with …
Publications
Read moreScope of the ‘Data Quality’ principle
Background27.11 The scope of the data quality requirements set out in the IPPs and the NPPs varies in a number of respects. First, the application of the IPPs and the NPPs to information outside the possession or control of an agency or organisation differs. Pursuant to NPP 3, organisations must take steps to ensure the …
Publications
Read moreCurrent coverage by IPPs and NPPs
26.9 The current rules in the Privacy Act on direct marketing differ between agencies and organisations. The Information Privacy Principles (IPPs) do not contain any provisions dealing explicitly with direct marketing by agencies. In contrast, the National Privacy Principles (NPPs) deal with the issue of direct marketing by organisations as part of the use and …
Publications
Read moreContent of the ‘Direct Marketing’ principle
26.66 This part of this chapter considers the content of the ‘Direct Marketing’ principle. First, the distinction between existing customers and prospective customers is considered. Secondly, the ‘opt-out’ model is discussed. The extent to which specific provision should be made for children and young people in the ‘Direct Marketing’ principle is then addressed, and the …
Publications
Read moreLogging use and disclosure
25.169 In DP 72, the ALRC considered whether agencies or organisations should be required to record their use or disclosure of personal information when this occurs for a purpose other than the primary purpose of collection. In ALRC 22, the ALRC did not recommend that record-keepers be obliged to keep a log of all uses …
Publications
Read moreA single ‘Use and Disclosure’ principle
25.11 As noted above, the IPPs contain separate ‘use’ and ‘disclosure’ principles. In contrast, the NPPs, and the Organisation for Economic Co-operation and Development’s Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) (OECD Guidelines), deal with use and disclosure in a single privacy principle.[6] 25.12 In assessing the merits of …
Publications
Read moreCircumstances in which use and disclosure is permitted
25.29 Compared to some other principles in the Privacy Act, the principles relating to use and disclosure in each of the IPPs and NPPs adopt a prescriptive approach. They do not contain an overriding qualifier, such as permitting use or disclosure where it is ‘reasonable’ in the circumstances.[30] 25.30 The use and disclosure of personal …
Publications
Read more