Privacy Act: Most Frequently Asked Questions
The Privacy Act 1988 (Cth) was passed by the Commonwealth Government and applies Australia-wide.
Your rights to privacy are protected in certain situations, but not all. The Privacy Act regulates the handling of individuals’ personal information by certain organisations, which may include their employer.
The Privacy Act only protects the privacy and personal information of individuals.
Many employers have responsibilities under the Privacy Act concerning the personal information of their employees or customers.
The Privacy Act imposes responsibilities on Australian Government agencies and organisations with an annual turnover more than $3 million.
However, some small businesses with an annual turnover under $3 million may also be required to comply with the Privacy Act. This is particularly where the organisations receive, manage or store personal information. Small businesses with responsibilities under the Privacy Act include:
- A private sector health service provider (not part employed by a state or territory), including:
- Private hospitals
- Day surgeries
- A medical practitioner
- A pharmacist
- An allied health professional
- A complementary therapist, such as a naturopath & a chiropractor
- A gym or weight loss clinic
- A childcare centre, a private school, and a private tertiary education institution
- A business selling or purchasing personal information.
- A credit reporting body.
- A contracted service provider for an Australian Government contract.
- An employee association registered or recognised under the Fair Work (Registered Organisations) Act 2009.
- A business that holds accreditation under the Consumer Data Right System.
- A business that has opted-in to the Privacy Act.
- A business that is related to a business that is covered by the Privacy Act.
- A business prescribed by the Privacy Regulation 2013.
The Privacy Act also imposes responsibilities on specified persons who handle certain types of personal information. The information protected is:
- Consumer credit reporting information.
- Tax file numbers.
- Personal information contained on the Personal Property Securities Register.
- Old conviction information under the Commonwealth Spent Convictions Scheme.
- My Health Record information under the My Health Records Act 2012 and individual healthcare identifiers under the Healthcare Identifiers Act 2010.
Only the organisations above have responsibilities under the Privacy Act, meaning that the following bodies do not have responsibilities under the Privacy Act:
- Small businesses (with revenue under $3 million per annum) that do not fall within an exception, as above.
- Individuals acting in their own capacity (i.e. not for an organisation or employer).
- State or territory government agencies and employers, including public hospitals and public universities.
However, most states and territories have their own privacy legislation, particularly for their public health sector. Relevant state privacy legislation includes the following:
| NSW |
|
| QLD |
|
| TAS |
|
| VIC |
|
| WA |
|
The Privacy Act contains 13 Australian Privacy Principles (APP) which covered entities are obliged to follow. These are as follows:
APP 1 requires covered entities to take reasonable steps to have practices, procedures and systems in place to manage personal information. Under APP 1, covered entities are required to have a ‘clearly expressed and up-to-date policy’ about its management of personal information. The privacy policy must be available free of charge and in an appropriate format, typically on the entity’s website.
APP 2 enables individuals to not identify themselves or to use a pseudonym when dealing with an APP entity on a particular matter.
APP 3 prohibits covered entities from collecting personal information unless it is reasonably necessary for one or more of the entity’s functions or activities. Typically, the individual must consent to their information being collected, and must be collected in a lawful and fair manner.
APP 4 covers situations where a covered entity has received personal information without seeking it out themselves. In such circumstances, the entity must determine whether or not the information could have been collected under APP 3 within a reasonable time after receiving it. If they could not have collected the personal information, the entity must destroy the information or ensure it is de-identified.
APP 5 requires that before an entity collects an individual’s personal information, it must notify the individual that their information is being collected. The notification must include the identity and contact details of the entity, and the fact that they collect (or have collected) the information and why.
APP 6 requires that where an entity holds personal information about an individual collected for a particular purpose (the ‘primary purpose’), then it may not use or disclose the information for another purpose (the ‘secondary purpose’). For an example, see the case study below.
APP 7 prohibits covered entities that hold personal information about an individual from using or disclosing the information for direct marketing.
APP 10 requires covered entities to take reasonable steps to ensure the personal information collected is accurate, up-to-date and complete.
APP 11 requires entities holding personal information to take reasonable steps to protect the information from:
- Misuse, interference, or loss; and
- Unauthorised access, modification, or disclosure.
APP 11 also requires entities to destroy or de-identify personal information that is no longer required for any permitted purpose.
APP 12 requires that if a covered entity holds personal information about an individual, the individual must be able to access the information upon request.
APP 13 requires that if a covered entity holds information about an individual, it must correct the information held if either the information is inaccurate or the individual requests the entity to correct the information.
If an organisation breaches any of the privacy principles in how they collect, hold, or use personal information, affected individuals can make a complaint to the Information Commissioner under section 36(1) of the Privacy Act. The Information Commissioner will then investigate the complaint and determine whether the complaint should be substantiated or dismissed.
Private sector employers are not required to comply with the Privacy Act when handling employee records, provided it is directly related to your current or former employment relationship. This means you cannot rely on the Privacy Act to ask your employer for access to your employee records. However, you can rely on the Privacy Act to access your records if they are being handled for a purpose that is not directly related to the employment relationship.
Nevertheless, you can request access to your employee record under workplace laws. Under section 535 of the Fair Work Act 2009, your employer must keep private and confidential employee records for seven years. Regulation 3.42 of the Fair Work Regulations 2009 subsequently permit employees to inspect and copy their employment record. If an employee requests access to their record, the employer must make the record available for inspection and copying.
If you are an employee of an Australian government agency, your employer will have to comply with the Privacy Act in handling your employment records. Additionally, you can rely on the Privacy Act to access the personal information in your employee record.
Workplace Monitoring & Surveillance
The Privacy Act does not cover workplace surveillance. However, there are national, state or territory laws protecting workplace surveillance, such as in relation to recording telephone calls. However, if the monitoring or surveillance is not directly related to your employment, then the Australian Privacy Principles in the Privacy Act may apply.
It is common practice for employers to have surveillance cameras to monitor staff activities. Generally, employers are also allowed to monitor staff email and internet if they inform you about the monitoring.
Photos and Videos
Photos and videos in which you are reasonably identifiable are personal information for the purposes of the Privacy Act. However, your rights depend on the situation – particularly if the conduct is by an individual in their personal capacity or by one of the covered entities, which could include your employer.
If a colleague took a photo or video of you without your permission, the Privacy Act does not apply, as individuals acting in a private capacity are not covered. However, there may be relevant state or territory legislation that protects you from being photographed without your consent.
However, if your employer uses photos and videos of you without your permission, such as by posting it online, you may be protected if your employer is a covered entity with obligations under the Privacy Act, as listed above. Either way, the first step in such a situation would be to request that your employer remove the image, and only take further action if your employer has unreasonably refused.
It should also be noted that the Privacy Act does not apply to media organisations that may have taken your photo or video without your consent, provided that the image is being used for journalistic purposes. However, complaints about media use of your image can be directed to the Australian Press Council or the Australian Communications and Media Authority.
Social Media
Social media is accessed by individuals in their private capacity, rather than organisations, and thus, it is unlikely that an employer would owe you privacy rights in relation to accessing what you have posted on social media. For example, if a colleague accesses your social media account and takes screenshots of your posts, this is not a breach of privacy, as they are acting in a personal capacity.
Nevertheless, when you post on social media, the information becomes public, including any photos or videos you may have posted. Even if you use privacy settings, your information is still online and effectively still public. For example, your followers or friends may republish or distribute your information or images. Thus, it is important to be careful when using social media.
Even though the Privacy Act does not apply, if your information has been mishandled or you have been harassed on social media, including by a colleague, you can pursue your matter through other avenues. This includes the Office of the Australian Information Commissioner (OAIC) or the Office of the eSafety Commissioner.
Use and Disclosure of Personal Information
The Privacy Act allows entities to use or disclose your personal information, but only for the reason they collected it (the ‘primary purpose’), which can include for direct marketing activities.
However, entities cannot use or disclose your personal information for any other reason (a ‘secondary purpose’) unless an exception applies. These exceptions include:
- You have consented to your personal information being used or disclosed for a secondary purpose.
- Use or disclosure is considered to be reasonably necessary for enforcement related activities carried out by (or on behalf of) an enforcement body.
- A secondary purpose is required or authorised under Australian law, or a court or tribunal order.
Use vs Disclosure
‘Use’ of personal information refers to when the entity is internally handling your personal information. This includes where the entity accesses or reads your personal information, makes a decision based on your personal information, or moves your information to another department of the entity. Even where it is an individual employee that has accessed your personal information as part of their work responsibilities, it will be deemed that the entity accessed your personal information.
‘Disclosure’ of personal information refers to where the information has been shared with other individuals or entities.
Personal Information vs Sensitive Information
It should also be noted that there are two types of information that is protected by the Privacy Act – personal information and sensitive information.
Personal information refers to any information that could identify a living individual. What constitutes personal information may vary case-by-case, but typically includes information such as:
- Name
- Signature
- Address
- Credit information
- Employee record information
- Photographs
- Internet protocol (IP) addresses
- Voice print and facial recognition biometrics
- Location information from a mobile device
Sensitive information is a type of personal information and is generally more highly protected than other personal information. Sensitive information particularly refers to information about an individual’s:
- Racial or ethnic origin
- Political opinions or associations
- Religious or philosophical beliefs
- Trade union membership or associations
- Sexual orientation or practices
- Criminal record
- Health or genetic information
- Some biometric information
Criminal Record
Information about your criminal record is considered ‘sensitive information’ under the Privacy Act.
Spent, pardoned or quashed convictions have a right to non-disclosure and individuals are not required to tell other individuals or entities about them. Individuals and agencies are not legally allowed to disclose information about a spent, pardoned or quashed conviction, unless an exception applies or you consent to its disclosure. One particular exception is where your suitability to work with children is being assessed. In such circumstances, your spent conviction could likely be lawfully disclosed.
In relation to your employment, this means that unless an exception applies (or you consent), your employer cannot use or disclose information about your spent conviction.
The COVID-19 pandemic was unprecedented and thus is not specifically referred to in the Privacy Act. However, the Office of the Australian Information Commissioner (OAIC) has stated that employers are generally able to collect and handle health information from employees (and visitors) in relation to the COVID-19 pandemic. Employers covered by the Privacy Act are still required to follow the same obligations in collecting and handling personal information of employees, though information such as whether an employee has been exposed to a case of COVID-19 or recently travelled overseas or interstate, may be considered an exemption similar to handling employee records. Even so, employers should make sure they only collect enough information as is reasonably necessary to mitigate COVID-19 risks, and nothing further, as this may otherwise be in breach of the Privacy Act.
What can employees do if their privacy has been breached?
Under s 36(1) of the Privacy Act, individuals can make a complaint to the Information Commissioner about an act or practice that may be an interference with the individual’s privacy. The individual must specify who they allege interfered with their privacy (the ‘respondent’).
After investigating a complaint, under s 52(1) of the Privacy Act, the Commissioner can either dismiss the complaint or find it substantiated. If the Commissioner finds the complaint has been substantiated, the Commissioner can make a determination that including at least one of the following declarations:
- The respondent engaged in conduct constituting interference with the privacy of an individual and must not repeat or continue such conduct;
- The respondent must take specified steps within a specified period to ensure such conduct is not repeated or continued;
- The respondent must perform any reasonable act or course of conduct to redress any loss or damage suffered by the individual;
- It would be inappropriate for any further action to be taken in the matter.
‘VI’ and CSIRO (Privacy) [2020] AICmr 44 (19 August 2020)
An employee of CSIRO made a complaint to the Information Commissioner under s 36(1) of the Privacy Act because their personal information was circulated to other employees. Because CSIRO is a Commonwealth entity, it is required to comply with the Privacy Act and was the respondent in this case.
The Facts
The complainant submitted a workers’ compensation claim with Comcare. The claim included a statement prepared by the complainant contained personal information, particularly in relation to the complainant’s health. The statement also alleged that certain other employees had contributed to the psychological injury. CSIRO circulated the complainant’s statement to six employees, one of whom (Ms A) then raised a formal grievance about the complainant’s statement, attaching the statement to her grievance. CSIRO then arranged for an external investigator to investigate Ms A’s grievance, and in doing so, disclosed the complainant’s statement containing his personal information.
The Complaint
The complainant made his complaint to the Information Commissioner arguing that it was a breach of the Privacy Act for Ms A to attach his statement for the purposes of her grievance. The complainant sought compensation and a written apology for the breach.
The Decision
APP 6
The Information Commissioner found that Australian Privacy Principle 6 (APP 6) had been breached, as CSIRO held personal information collected for a particular purpose (i.e. the complainant’s workers’ compensation claim), which was then used or disclosed for a secondary purpose (i.e. to substantiate Ms A’s grievance). Even though Ms A is an individual, and her conduct would not ordinarily be covered by the Privacy Act. However, the Information Commissioner found that Ms A was not acting in a private capacity when she used the personal information in the statement for her grievance, as she ‘emailed the grievance from her work computer, using her work email and during work hours on a business day’, and the context in which Ms A raised the grievance was in a ‘workplace context’.
The Information Commissioner found that APP 6 was also breached in disclosing the complainant’s statement, containing his personal information, to an external investigator. At paragraph 48 of the decision, the Information Commissioner noted what CSIRO could have done instead so APP 6 was not breached:
“Consideration of other options is relevant in determining reasonable necessity. A range of other options could have been pursued by the respondent in lieu of investigating the grievance once raised. For example, Ms A could have been counselled about her grievance, including being given an assessment as to whether it was open to her to use the statement for her grievance and advised about the respondent’s obligations under the Privacy Act. It was also open to the respondent to seek the consent of the complainant to the use of the statement for the secondary purpose. Another option may have been to await the finalisation of the workers’ compensation claim processes before determining what action, if any, may be appropriate.”
APP 11
Australian Privacy Principle 11 (APP 11) requires that a covered entity must take reasonable steps to protect personal information it holds from being misused. CSIRO held the complainant’s personal information in his workers’ compensation statement.
The Information Commissioner did not find that APP 11 was breached from the internal circulation of the complainant’s statement, finding instead that reasonable steps were taken to protect the information and it was used for the primary purpose of managing a workers’ compensation claim.
However, the Information Commissioner did find that APP 11 was breached in respect of the use and disclose of the complainant’s personal information for the secondary purpose of Ms A’s grievance. The Information Commissioner stated that CSIRO had not taken reasonable steps to protect the information, as they could have told Ms A that the statement was only to be used for the primary purpose of the workers’ compensation claim, and for no secondary purposes.
The Outcome
The Information Commissioner declared that the respondent was required to provide a written apology to the complainant and take steps to ensure the conduct was not repeated or continued.