Note: Section 187LA of the Telecommunications (Interception and Access) Act 1979 extends the meaning of personal information to cover information kept under Part 5 1A of that Act.

(f) Commonwealth records as defined by subsection 3(1) of the Archives Act 1983 that are in the open access period for the purposes of that Act; or

(fa) records (as defined in the Archives Act 1983) in the care (as defined in that Act) of the National Archives of Australia in relation to which the Archives has entered into arrangements with a person other than a Commonwealth institution (as defined in that Act) providing for the extent to which the Archives or other persons are to have access to the records; or

Note 1: Under section 187LA of the Telecommunications (Interception and Access) Act 1979, service providers are, in relation to their activities relating to retained data, treated as organisations for the purposes of this Act.

(1) An access seeker in relation to credit reporting information, or credit eligibility information, about an individual is:

12B

Note: In 2012, the text of the Covenant and Convention in the Australian Treaty Series was accessible through the Australian Treaties Library on the AustLII website (www.austlii.edu.au).

20B

(f) how an individual may access credit reporting information about the individual that is held by the body and seek the correction of such information;

20Q

(b) from unauthorised access, modification or disclosure.

20Q

(ii) from unauthorised access, modification or disclosure; and

20R

Access

20R

(1) If a credit reporting body holds credit reporting information about an individual, the body must, on request by an access seeker in relation to the information, give the access seeker access to the information.

20R

Exceptions to access

20R

(2) Despite subsection (1), the credit reporting body is not required to give the access seeker access to the credit reporting information to the extent that:

20R

(a) giving access would be unlawful; or

20R

(b) denying access is required or authorised by or under an Australian law or a court/tribunal order; or

20R

(c) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

20R

Dealing with requests for access

20R

Means of access

20R

(4) If the credit reporting body gives access to the credit reporting information, the access must be given in the manner set out in the registered CR code.

20R

Access charges

20R

(5) If a request under subsection (1) in relation to the individual has not been made to the credit reporting body in the previous 12 months, the body must not charge the access seeker for the making of the request or for giving access to the information.

20R

(6) If subsection (5) does not apply, any charge by the credit reporting body for giving access to the information must not be excessive and must not apply to the making of the request.

20R

Refusal to give access

20R

(7) If the credit reporting body refuses to give access to the information because of subsection (2), the body must give the access seeker a written notice that:

20R

(b) states that, if the access seeker is not satisfied with the response to the request, the access seeker may:

20R

(i) access a recognised external dispute resolution scheme of which the body is a member; or

20U

(i) access a recognised external dispute resolution scheme of which the body is a member; or

21B

(e) how an individual may access credit eligibility information about the individual that is held by the provider;

21C

(a) that the policy (the credit reporting policy) of the provider that is referred to in subsection 21B(3) contains information about how an individual may access the credit eligibility information about the individual that is held by the provider;

21S

(b) from unauthorised access, modification or disclosure.

21T

Access

21T

(1) If a credit provider holds credit eligibility information about an individual, the provider must, on request by an access seeker in relation to the information, give the access seeker access to the information.

21T

Exceptions to access

21T

(2) Despite subsection (1), the credit provider is not required to give the access seeker access to the credit eligibility information to the extent that:

21T

(a) giving access would be unlawful; or

21T

(b) denying access is required or authorised by or under an Australian law or a court/tribunal order; or

21T

(c) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

21T

Dealing with requests for access

21T

Means of access

21T

(4) If the credit provider gives access to the credit eligibility information, the access must be given in the manner set out in the registered CR code.

21T

Access charges

21T

(5) If the credit provider is an agency, the provider must not charge the access seeker for the making of the request or for giving access to the information.

21T

(6) If a credit provider is an organisation or small business operator, any charge by the provider for giving access to the information must not be excessive and must not apply to the making of the request.

21T

Refusal to give access

21T

(7) If the provider refuses to give access to the information because of subsection (2), the provider must give the access seeker a written notice that:

21T

(b) states that, if the access seeker is not satisfied with the response to the request, the access seeker may:

21T

(i) access a recognised external dispute resolution scheme of which the provider is a member; or

21W

(i) access a recognised external dispute resolution scheme of which the provider is a member; or

22A

(c) how an individual may access regulated information about the individual that is held by the recipient and seek the correction of such information;

22B

(a) that the policy (the credit reporting policy) of the recipient that is referred to in subsection 22A(3) contains information about how an individual may access the regulated information about the individual that is held by the recipient, and seek the correction of such information;

23B

(i) access a recognised external dispute resolution scheme of which the respondent is a member; or

(ii) an access seeker for the information.

(b) an access seeker for the information.

24A

(ii) an access seeker for the information.

24A

(b) an access seeker for the information.

26WA

(a) there is unauthorised access to, unauthorised disclosure of, or loss of, personal information held by an entity; and

26WA

(b) the access, disclosure or loss is likely to result in serious harm to any of the individuals to whom the information relates.

26WD

(a) an unauthorised access to information; or

26WD

has been, or is required to be, notified under section 75 of the My Health Records Act 2012, this Part does not apply in relation to the access, disclosure or loss.

26WE

(i) there is unauthorised access to, or unauthorised disclosure of, the information;

26WE

(ii) a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates; or

26WE

(i) unauthorised access to, or unauthorised disclosure of, the information is likely to occur; and

26WE

(ii) assuming that unauthorised access to, or unauthorised disclosure of, the information were to occur, a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates;

26WE

(c) the access or disclosure covered by paragraph (a), or the loss covered by paragraph (b), is an eligible data breach of the APP entity, credit reporting body, credit provider or file number recipient, as the case may be; and

26WF

Access to, or disclosure of, information

26WF

(a) an access to, or disclosure of, information is covered by paragraph 26WE(2)(a); and

26WF

(b) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, takes action in relation to the access or disclosure; and

26WF

(c) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, does so before the access or disclosure results in serious harm to any of the individuals to whom the information relates; and

26WF

(d) as a result of the action, a reasonable person would conclude that the access or disclosure would not be likely to result in serious harm to any of those individuals;

26WF

the access or disclosure is not, and is taken never to have been:

26WF

(a) an access to, or disclosure of, information is covered by paragraph 26WE(2)(a); and

26WF

(b) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, takes action in relation to the access or disclosure; and

26WF

(c) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, does so before the access or disclosure results in serious harm to a particular individual to whom the information relates; and

26WF

(d) as a result of the action, a reasonable person would conclude that the access or disclosure would not be likely to result in serious harm to the individual;

26WF

to take steps to notify the individual of the contents of a statement that relates to the access or disclosure.

26WF

(c) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, does so before there is unauthorised access to, or unauthorised disclosure of, the information; and

26WF

(d) as a result of the action, there is no unauthorised access to, or unauthorised disclosure of, the information;

26WF

(i) after there is unauthorised access to, or unauthorised disclosure of, the information; and

26WF

(ii) before the access or disclosure results in serious harm to any of the individuals to whom the information relates; and

26WF

(d) as a result of the action, a reasonable person would conclude that the access or disclosure would not be likely to result in serious harm to any of those individuals;

26WF

(i) after there is unauthorised access to, or unauthorised disclosure of, the information; and

26WF

(ii) before the access or disclosure results in serious harm to a particular individual to whom the information relates; and

26WF

(d) as a result of the action, a reasonable person would conclude that the access or disclosure would not be likely to result in serious harm to the individual;

26WG

For the purposes of this Division, in determining whether a reasonable person would conclude that an access to, or a disclosure of, information:

26WJ

(b) the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities;

26WK

(4) If the entity has reasonable grounds to believe that the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities, the statement referred to in subparagraph (2)(a)(i) may also set out the identity and contact details of those other entities.

26WM

(b) the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities;

26WN

(e) if the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities—such an eligible data breach of those other entities.

26WQ

(ii) if the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities—such an eligible data breach of those other entities; or

26WQ

(b) if the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities—such an eligible data breach of those other entities;

26WQ

(a) the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities; and

26WR

(8) If the Commissioner is aware that there are reasonable grounds to believe that the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities, a direction under subsection (1) may also require the statement referred to in paragraph (1)(a) to set out the identity and contact details of those other entities.

(a) an application made under subsection 55(1) of the Freedom of Information Act 1982 for review of a decision under that Act refusing access to a document has been finally determined or otherwise disposed of;

(f) the Commissioner has, as a result of the complaint, recommended under subsection 30(3) of this Act that the agency amend the document, or amend a part of the document, to which the applicant has been refused access; and

35A

(a) the accessibility of the scheme;

(a) section 20R, 20T, 21T or 21V (which are about access to, and correction of, credit reporting information etc.); or

(d) how an individual may access personal information about the individual that is held by the entity and seek the correction of such information;

(g) that the APP privacy policy of the APP entity contains information about how the individual may access the personal information about the individual that is held by the entity and seek the correction of such information;

(ii) there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme; or

(b) from unauthorised access, modification or disclosure.

Access

12.1 If an APP entity holds personal information about an individual, the entity must, on request by the individual, give the individual access to the information.

Exception to access—agency

(b) the entity is required or authorised to refuse to give the individual access to the personal information by or under:

(ii) any other Act of the Commonwealth, or a Norfolk Island enactment, that provides for access by persons to documents;

then, despite subclause 12.1, the entity is not required to give access to the extent that the entity is required or authorised to refuse to give access.

Exception to access—organisation

12.3 If the APP entity is an organisation then, despite subclause 12.1, the entity is not required to give the individual access to the personal information to the extent that:

(a) the entity reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or

(b) giving access would have an unreasonable impact on the privacy of other individuals; or

(d) the information relates to existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by the process of discovery in those proceedings; or

(e) giving access would reveal the intentions of the entity in relation to negotiations with the individual in such a way as to prejudice those negotiations; or

(f) giving access would be unlawful; or

(g) denying access is required or authorised by or under an Australian law or a court/tribunal order; or

(ii) giving access would be likely to prejudice the taking of appropriate action in relation to the matter; or

(i) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or

(j) giving access would reveal evaluative information generated within the entity in connection with a commercially sensitive decision making process.

Dealing with requests for access

(a) respond to the request for access to the personal information:

(b) give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.

Other means of access

(a) to give access to the personal information because of subclause 12.2 or 12.3; or

(b) to give access in the manner requested by the individual;

the entity must take such steps (if any) as are reasonable in the circumstances to give access in a way that meets the needs of the entity and the individual.

12.6 Without limiting subclause 12.5, access may be given through the use of a mutually agreed intermediary.

Access charges

12.7 If the APP entity is an agency, the entity must not charge the individual for the making of the request or for giving access to the personal information.

(b) the entity charges the individual for giving access to the personal information;

Refusal to give access

12.9 If the APP entity refuses to give access to the personal information because of subclause 12.2 or 12.3, or to give access in the manner requested by the individual, the entity must give the individual a written notice that sets out:

12.10 If the APP entity refuses to give access to the personal information because of paragraph 12.3(j), the reasons for the refusal may include an explanation for the commercially sensitive decision.

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities

Key Capabilities