Note: This lets the Commissioner take action overseas to investigate complaints and lets the ancillary provisions of Part V operate in that context.

Commissioner means the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010.

Commissioner of Police means the Commissioner of Police appointed under the Australian Federal Police Act 1979.

Integrity Commissioner has the same meaning as in the Law Enforcement Integrity Commissioner Act 2006.

representative complaint means a complaint where the persons on whose behalf the complaint was made include persons other than the complainant, but does not include a complaint that the Commissioner has determined should no longer be continued as a representative complaint.

Note: The annual turnover for a financial year of a business carried on by an entity that does not carry on another business will often be similar to the total of the instalment income the entity notifies to the Commissioner of Taxation for the 4 quarters in the year (or for the year, if the entity pays tax in annual instalments).

(2) A small business operator may make a choice in writing given to the Commissioner to be treated as an organisation.

Note: A small business operator may revoke such a choice by writing given to the Commissioner. See subsection 33(3) of the Acts Interpretation Act 1901.

(3) If the Commissioner is satisfied that a small business operator has made the choice to be treated as an organisation, the Commissioner must enter in a register of operators who have made such a choice:

(4) If a small business operator revokes a choice to be treated as an organisation, the Commissioner must remove from the register the material relating to the operator.

(5) The Commissioner may decide the form of the register and how it is to be kept.

(6) The Commissioner must make the register available to the public in the way that the Commissioner determines. However, the Commissioner must not make available to the public in the register information other than that described in subsection (3).

(2) Except so far as the contrary intention appears, a reference in this Act (other than section 8) to an act or to a practice includes, in the application of this Act otherwise than in respect of the Australian Privacy Principles, a registered APP code and the performance of the Commissioner’s functions in relation to the principles and such a code, a reference to an act done, or a practice engaged in, as the case may be, by an agency specified in Part I of Schedule 2 to the Freedom of Information Act 1982 or in Division 1 of Part II of that Schedule other than:

(2) The Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).

The Commissioner must, by legislative instrument, issue rules concerning the collection, storage, use and security of tax file number information.

Note: Other Acts may provide that the note must not be made (see for example the Australian Crime Commission Act 2002 and the Law Enforcement Integrity Commissioner Act 2006).

Commissioner may make rules

(3) The Commissioner may, by legislative instrument, make rules relating to the use or disclosure by a credit reporting body of de identified information for the purposes of conducting research in relation to credit.

Notification of Commissioner

(2) The credit reporting body must, as soon as practicable, notify in writing the Commissioner of the matter referred to in paragraph (1)(a) or (b) of this section.

(6) The Commissioner may, by legislative instrument, direct the credit reporting body to destroy the information, or ensure that the information is de identified, by a specified day.

(7) If the Commissioner gives a direction under subsection (6) to the credit reporting body, the body must comply with the direction.

Note: A complaint about a breach of section 20R or 20T, or a provision of the registered CR code that relates to that section, may be made to the Commissioner under Part V.

Note: A complaint about a breach of section 21T or 21V, or a provision of the registered CR code that relates to that section, may be made to the Commissioner under Part V.

Division 2 deals with codes of practice about information privacy, called APP codes. APP code developers or the Commissioner may develop APP codes, which:

If the Commissioner includes an APP code on the Codes Register, an APP entity bound by the code must not breach it. A breach of a registered APP code is an interference with the privacy of an individual.

Division 3 deals with a code of practice about credit reporting, called a CR code. CR code developers or the Commissioner may develop a CR code, which:

If the Commissioner includes a CR code on the Codes Register, an entity bound by the code must not breach it. A breach of the registered CR code is an interference with the privacy of an individual.

At the Commissioner’s request

(2) The Commissioner may, in writing, request an APP code developer to develop an APP code, and apply to the Commissioner for the code to be registered, if the Commissioner is satisfied it is in the public interest for the code to be developed.

(6) Despite paragraph (5)(a), the Commissioner must not require an APP code to cover an act or practice that is exempt within the meaning of subsection 7B(1), (2) or (3). However, the APP code that is developed by the APP code developer may cover such an act or practice.

(7) The Commissioner must make a copy of the request publicly available as soon as practicable after the request is made.

(1) If an APP code developer develops an APP code, the developer may apply to the Commissioner for registration of the code.

(4) The APP code developer may vary the APP code at any time before the Commissioner registers the code, but only with the consent of the Commissioner.

(1) This section applies if the Commissioner made a request under subsection 26E(2) and either:

(2) The Commissioner may develop an APP code if the Commissioner is satisfied that it is in public interest to develop the code. However, despite subsection 26C(3)(b), the APP code must not cover an act or practice that is exempt within the meaning of subsection 7B(1), (2) or (3).

(3) Before registering the APP code under section 26H, the Commissioner must:

the Commissioner may register the code by including it on the Codes Register.

(2) In deciding whether to register the APP code, the Commissioner may:

(3) If the Commissioner decides not to register an APP code developed by an APP code developer, the Commissioner must give written notice of the decision to the developer, including reasons for the decision.

(1) The Commissioner may, in writing, approve a variation of a registered APP code:

(3) If the Commissioner varies a registered APP code on his or her own initiative, then, despite subsection 26C(3)(b), the variation must not deal with an act or practice that is exempt within the meaning of subsection 7B(1), (2) or (3).

(4) Before deciding whether to approve a variation, the Commissioner must:

(5) In deciding whether to approve a variation, the Commissioner may consider the matters specified in any relevant guidelines made under section 26V.

(6) If the Commissioner approves a variation of a registered APP code (the original code), the Commissioner must:

(7) If the Commissioner approves a variation, the variation comes into effect on the day specified in the approval, which must not be before the day on which the APP code, as varied, is included on the Codes Register.

(1) The Commissioner may remove a registered APP code from the Codes Register:

(3) Before deciding whether to remove the registered APP code, the Commissioner must:

(4) In deciding whether to remove the registered APP code, the Commissioner may consider the matters specified in any relevant guidelines made under section 26V.

(1) The Commissioner may, in writing, request a CR code developer to develop a CR code and apply to the Commissioner for the code to be registered.

(5) The Commissioner must make a copy of the request publicly available as soon as practicable after the request is made.

(1) If a CR code developer develops a CR code, the developer may apply to the Commissioner for registration of the code.

(4) The CR code developer may vary the CR code at any time before the Commissioner registers the code, but only with the consent of the Commissioner.

(1) The Commissioner may develop a CR code if the Commissioner made a request under section 26P and either:

(2) Before registering the CR code under section 26S, the Commissioner must:

the Commissioner may register the code by including it on the Codes Register.

(2) In deciding whether to register the CR code, the Commissioner may:

(3) If the Commissioner decides not to register a CR code developed by a CR code developer, the Commissioner must give written notice of the decision to the developer, including reasons for the decision.

(4) The Commissioner must ensure that there is one, and only one, registered CR code at all times after this Part commences.

(1) The Commissioner may, in writing, approve a variation of the registered CR code:

(3) Before deciding whether to approve a variation, the Commissioner must:

(4) In deciding whether to approve a variation, the Commissioner may consider the matters specified in any relevant guidelines made under section 26V.

(5) If the Commissioner approves a variation of the registered CR code (the original code), the Commissioner must:

(6) If the Commissioner approves a variation, the variation comes into effect on the day specified in the approval, which must not be before the day on which the CR code, as varied, is included on the Codes Register.

(1) The Commissioner must keep a register (the Codes Register) which includes:

(2) Despite subsection (1), the Commissioner is not required to include on the Codes Register:

(3) The Commissioner must make the Codes Register available on the Commissioner’s website.

(4) The Commissioner may charge fees for providing copies of, or extracts from, the Codes Register.

(1) The Commissioner may make written guidelines:

(2) The Commissioner may make written guidelines about matters the Commissioner may consider in deciding whether:

(3) The Commissioner may publish any such guidelines on the Commissioner’s website.

(1) The Commissioner may review the operation of a registered APP code.

Note: The review may inform a decision by the Commissioner to approve a variation of a registered APP code or to remove a registered APP code from the Codes Register.

(2) The Commissioner may review the operation of the registered CR code.

Note: The review may inform a decision by the Commissioner to approve a variation of the registered CR code.

(1) If the Commissioner:

the Commissioner may, by written notice given to the entity:

(2) The Commissioner’s power in paragraph (1)(d) may only be used to extend the time for compliance with subsection 26WL(2) to the end of a period that the Commissioner is satisfied is reasonable in the circumstances.

(3) The Commissioner must not make a declaration under subsection (1) unless the Commissioner is satisfied that it is reasonable in the circumstances to do so, having regard to the following:

(4) Paragraph (3)(b) does not limit the advice to which the Commissioner may have regard.

(5) The Commissioner may give a notice of a declaration to an entity under subsection (1):

(7) If an entity applies to the Commissioner under paragraph (5)(b):

the Commissioner is taken not to have refused the application.

(9) If an entity applies to the Commissioner under paragraph (5)(b) for a declaration that, to any extent, relates to an eligible data breach of the entity, sections 26WK and 26WL do not apply in relation to:

until the Commissioner makes a decision in response to the application for the declaration.

(11) If notice of a paragraph (1)(d) declaration has been given to an entity, the Commissioner may, by written notice given to the entity, extend the period specified in the declaration.

(1) If the Commissioner is aware that there are reasonable grounds to believe that there has been an eligible data breach of an entity, the Commissioner may, by written notice given to the entity, direct the entity to:

(3) Before giving a direction to an entity under subsection (1), the Commissioner must invite the entity to make a submission to the Commissioner in relation to the direction within the period specified in the invitation.

(5) A direction under subsection (1) may also require the statement referred to in paragraph (1)(a) to set out specified information that relates to the eligible data breach that the Commissioner has reasonable grounds to believe has happened.

(6) In deciding whether to give a direction to an entity under subsection (1), the Commissioner must have regard to the following:

(7) Paragraph (6)(a) does not limit the advice to which the Commissioner may have regard.

(8) If the Commissioner is aware that there are reasonable grounds to believe that the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities, a direction under subsection (1) may also require the statement referred to in paragraph (1)(a) to set out the identity and contact details of those other entities.

(1) The Commissioner has the following functions:

(2) The Commissioner has power to do all things necessary or convenient to be done for, or in connection with, the performance of the Commissioner’s functions.

(3) Without limiting subsection (2), the Commissioner may establish a panel of persons with expertise in relation to a particular matter to assist the Commissioner in performing any of the Commissioner’s functions.

(1) The following are the guidance related functions of the Commissioner:

(2) The Commissioner may publish the guidelines referred to in paragraphs (1)(a) and (b) in such manner as the Commissioner considers appropriate.

(1) The following are the monitoring related functions of the Commissioner:

(2) The following are also the monitoring related functions of the Commissioner:

(3) The functions referred to in paragraphs (2)(a) and (b) may be performed by the Commissioner:

(1) The following are the advice related functions of the Commissioner:

(2) The functions referred to in paragraphs (1)(a), (c) and (d) may be performed by the Commissioner on request or on the Commissioner’s own initiative.

(3) The Commissioner may perform the function referred to in paragraph (1)(b) whenever the Commissioners think it is necessary to do so.

The Commissioner must have due regard to the objects of this Act in performing the Commissioner’s functions, and exercising the Commissioner’s powers, conferred by this Act.

(1) Where the Commissioner has investigated an act or practice without a complaint having been made under section 36, the Commissioner may report to the Minister about the act or practice, and shall do so:

(2) Where the Commissioner reports under subsection (1) about an act done in accordance with a practice, the Commissioner shall also report to the Minister about the practice.

(3) Where, after an investigation of an act or practice of an agency, file number recipient, credit reporting body or credit provider that is an interference with the privacy of an individual under subsection 13(1), (2) or (4), the Commissioner is required by virtue of paragraph (1)(b) of this section to report to the Minister about the act or practice, the Commissioner:

(4) Where, at the end of 60 days after a copy of a report about an act or practice of an agency, file number recipient, credit reporting body or credit provider was served under subsection (3), the Commissioner:

the Commissioner shall give to the Minister a further report that:

(1) Where the Commissioner has examined a proposed enactment under paragraph 28A(2)(a), subsections (2) and (3) of this section have effect.

(2) If the Commissioner thinks that the proposed enactment would require or authorise acts or practices of an entity that would be interferences with the privacy of individuals, the Commissioner shall:

(3) Otherwise, the Commissioner may report to the Minister about the proposed enactment, and shall do so if so directed by the Minister.

(4) Where the Commissioner is of the belief that it is in the public interest that the proposed enactment should be the subject of a further report, the Commissioner may give to the Minister a further report setting out the Commissioner’s reasons for so doing.

(1) If the Commissioner has:

the Commissioner may report to the Minister about the activity or assessment, and must do so if so directed by the Minister.

(2) Where the Commissioner is of the belief that it is in the public interest that the activity or assessment should be the subject of a further report, the Commissioner may give to the Minister a further report setting out the Commissioner’s reasons for so doing.

(1) In setting out findings, opinions and reasons in a report to be given under section 30, 31 or 32, the Commissioner may exclude a matter if the Commissioner considers it desirable to do so having regard to the obligations of the Commissioner under subsections (2) and (3).

(2) In deciding under subsection (1) whether or not to exclude matter from a report, the Commissioner shall have regard to the need to prevent:

(3) The Commissioner shall try to achieve an appropriate balance between meeting the need referred to in subsection (2) and the desirability of ensuring that interested persons are sufficiently informed of the results of the Commissioner’s investigation, examination or monitoring.

(4) Where the Commissioner excludes a matter from a report, he or she shall give to the Minister a report setting out the excluded matter and his or her reasons for excluding the matter.

(1) The Commissioner may conduct an assessment of the following matters:

(2) The Commissioner may conduct the assessment in such manner as the Commissioner considers fit.

the Commissioner may, in writing, direct the agency to give the Commissioner, within a specified period, a privacy impact assessment about the activity or function.

(6) If an agency does not comply with a direction under subsection (1), the Commissioner must advise both of the following of the failure:

(1) The Commissioner shall not, in connection with the performance of the Commissioner’s functions, give to a person information as to the existence or non existence of a document where information as to the existence or non existence of that document would, if included in a document of an agency, cause the last mentioned document to be:

(2) The Commissioner shall not, in connection with the performance of the Commissioner’s functions, give to a person information:

the Commissioner may direct the agency to add to the document an appropriate notation setting out particulars of the amendments of the document that the Commissioner thinks should be made.

(1) The Commissioner may, by written notice, recognise an external dispute resolution scheme:

(2) In considering whether to recognise an external dispute resolution scheme, the Commissioner must take the following matters into account:

(3) The Commissioner may:

An individual may complain to the Commissioner about an act or practice that may be an interference with the privacy of the individual. If a complaint is made, the Commissioner is required to investigate the act or practice except in certain circumstances.

The Commissioner may also, on his or her own initiative, investigate an act or practice that may be an interference with the privacy of an individual or a breach of Australian Privacy Principle 1.

The Commissioner has a range powers relating to the conduct of investigations including powers:

After an investigation, the Commissioner may make a determination in relation to the investigation. An entity to which a determination relates must comply with certain declarations included in the determination. Court proceedings may be commenced to enforce a determination.

(1) An individual may complain to the Commissioner about an act or practice that may be an interference with the privacy of the individual.

(1) The Commissioner may, on application by the respondent or on his or her own initiative, determine that a complaint should no longer continue as a representative complaint.

(2) The Commissioner may only make such a determination if the Commissioner is satisfied that it is in the interests of justice to do so for any of the following reasons:

(3) If the Commissioner makes such a determination:

(1) The Commissioner may, on application by a class member, replace the complainant with another class member, where it appears to the Commissioner that the complainant is not able adequately to represent the interests of the class members.

(2) A class member may, by notice in writing to the Commissioner, withdraw from a representative complaint:

(3) The Commissioner may at any stage direct that notice of any matter be given to a class member or class members.

If the Commissioner is satisfied that a complaint could be dealt with as a representative complaint if the class of persons on whose behalf the complaint is lodged is increased, reduced or otherwise altered, the Commissioner may amend the complaint so that the complaint can be dealt with as a representative complaint.

(1) Subject to subsection (1A), the Commissioner shall investigate an act or practice if:

(1A) The Commissioner must not investigate a complaint if the complainant did not complain to the respondent before making the complaint to the Commissioner under section 36. However, the Commissioner may decide to investigate the complaint if he or she considers that it was not appropriate for the complainant to complain to the respondent.

(2) The Commissioner may, on the Commissioner’s own initiative, investigate an act or practice if:

the Commissioner must make a reasonable attempt to conciliate the complaint.

(2) Subsection (1) does not apply if the Commissioner has decided under section 41 or 50 not to investigate, or not to investigate further, the act or practice.

(3) If the Commissioner is satisfied that there is no reasonable likelihood that the complaint will be resolved by conciliation, the Commissioner must, in writing, notify the complainant and respondent of that matter.

(4) If a notification is given under subsection (3), the Commissioner may decide not to investigate, or not to investigate further, the act or practice.

(5) Evidence of anything said or done in the course of the conciliation is not admissible in any hearing before the Commissioner, or in any legal proceedings, relating to complaint or the act or practice unless:

(1) The Commissioner may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under section 36 if the Commissioner is satisfied that:

(1A) The Commissioner must not investigate, or investigate further, an act or practice about which a complaint has been made under section 36 if the Commissioner is satisfied that the complainant has withdrawn the complaint.

(2) The Commissioner may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under section 36 if the Commissioner is satisfied that the complainant has complained to the respondent about the act or practice and either:

(3) The Commissioner may defer the investigation or further investigation of an act or practice about which a complaint has been made under section 36 if:

(1) Where a complaint has been made to the Commissioner, the Commissioner may, for the purpose of determining:

(2) The Commissioner may make inquiries of any person for the purpose of determining whether to investigate an act or practice under subsection 40(2).

(1) Before commencing an investigation of a matter to which a complaint relates, the Commissioner shall inform the respondent that the matter is to be investigated.

(1AA) Before commencing an investigation of an act or practice of a person or entity under subsection 40(2), the Commissioner must inform the person or entity that the act or practice is to be investigated.

(1A) Before starting to investigate an act done, or practice engaged in, by a contracted service provider for the purpose of providing (directly or indirectly) a service to an agency under a Commonwealth contract, the Commissioner must also inform the agency that the act or practice is to be investigated.

(2) An investigation under this Division shall be conducted in such manner as the Commissioner thinks fit.

(3) The Commissioner may, for the purposes of an investigation, obtain information from such persons, and make such inquiries, as he or she thinks fit.

(4) The Commissioner may make a determination under section 52 in relation to an investigation under this Division without holding a hearing, if:

(7) Where, in connection with an investigation of a matter under this Division, the Commissioner proposes to hold a hearing, or proposes to make a requirement of a person under section 44, the Commissioner shall, if he or she has not previously informed the responsible Minister (if any) that the matter is being investigated, inform that Minister accordingly.

(8) The Commissioner may, either before or after the completion of an investigation under this Division, discuss any matter that is relevant to the investigation with a Minister concerned with the matter.

(8A) Subsection (8) does not allow the Commissioner to discuss a matter relevant to an investigation of a breach of the Australian Privacy Principles or a registered APP code with a Minister, unless the investigation is of an act done, or practice engaged in:

(9) Where the Commissioner forms the opinion, either before or after completing an investigation under this Division, that there is evidence that an officer of an agency has been guilty of a breach of duty or of misconduct and that the evidence is, in all the circumstances, of sufficient force to justify the Commissioner doing so, the Commissioner shall bring the evidence to the notice of:

(1) An interested party in relation to an investigation under this Division may, in writing, request that the Commissioner hold a hearing before the Commissioner makes a determination under section 52 in relation to the investigation.

(2) If an interested party makes request under subsection (1), the Commissioner must:

(1) If the Commissioner has reason to believe that a person has information or a document relevant to an investigation under this Division, the Commissioner may give to the person a written notice requiring the person:

(2) A notice given by the Commissioner under subsection (1) shall state:

(2A) If documents are produced to the Commissioner in accordance with a requirement under subsection (1), the Commissioner:

(3) If the Commissioner has reason to believe that a person has information relevant to an investigation under this Division, the Commissioner may give to the person a written notice requiring the person to attend before the Commissioner at a time and place specified in the notice to answer questions relevant to the investigation.

(1) The Commissioner may administer an oath or affirmation to a person required under section 44 to attend before the Commissioner and may examine such a person on oath or affirmation.

(1) For the purposes of performing the Commissioner’s functions in relation to a complaint, the Commissioner may, by written notice, direct:

to attend, at a time and place specified in the notice, a conference presided over by the Commissioner.

(4) The Commissioner may, in a notice given to a person under subsection (1), require the person to produce such documents at the conference as are specified in the notice.

(1) The Commissioner may require a person attending a conference under this Division to produce a document.

(2) A conference under this Division shall be held in private and shall be conducted in such manner as the Commissioner thinks fit.

(4) Except with the consent of the Commissioner:

(1) Where the Commissioner decides not to investigate, or not to investigate further, a matter to which a complaint relates, the Commissioner shall, as soon as practicable and in such manner as the Commissioner thinks fit, inform the complainant and the respondent of the decision and of the reasons for the decision.

(2) If the Commissioner decides not to investigate (at all or further) an act done, or practice engaged in, by a contracted service provider for the purpose of providing (directly or indirectly) a service to an agency under a Commonwealth contract, the Commissioner must also inform the agency of the decision.

(1) Where, in the course of an investigation under section 40, the Commissioner forms the opinion that a tax file number offence, a healthcare identifier offence, an AML/CTF verification offence or a credit reporting offence may have been committed, the Commissioner shall:

(2) If, after having been informed of the Commissioner’s opinion under paragraph (1)(a), the Commissioner of Police or the Director of Public Prosecutions, as the case may be, decides that the matter will not be, or will no longer be, the subject of proceedings for an offence, he or she shall give a written notice to that effect to the Commissioner.

(3) Upon receiving such a notice the Commissioner may continue the investigation discontinued under paragraph (1)(c).

(1) If, in the course of an investigation under section 40, the Commissioner forms the opinion that subsection 172(3) of the Personal Property Securities Act 2009 (civil penalty for searching otherwise than for authorised purposes) may have been contravened, the Commissioner must:

(2) The Registrar of Personal Property Securities must notify the Commissioner in writing if, after having been informed of the Commissioner’s opinion under paragraph (1)(a), the Registrar decides:

(3) Upon receiving a notice under subsection (2), the Commissioner may continue an investigation discontinued under paragraph (1)(c).

(2) Where, before the Commissioner commences, or after the Commissioner has commenced, to investigate a matter to which a complaint relates, the Commissioner forms the opinion that:

and that that matter could be more conveniently or effectively dealt with by the alternative complaint body, the Commissioner may decide not to investigate the matter, or not to investigate the matter further, as the case may be, and, if the Commissioner so decides, he or she shall:

(1) This section lets the Commissioner substitute an agency for an organisation as respondent to a complaint if:

(2) The Commissioner may amend the complaint to specify as a respondent to the complaint the agency or its principal executive, instead of the organisation.

Note 2: The Commissioner may determine under section 53B that the determination applies in relation to an agency if the organisation has not complied with the determination.

(3) Before amending the complaint, the Commissioner must:

(4) If the Commissioner amends the complaint after starting to investigate it, the Commissioner is taken to have satisfied subsection 43(1A) in relation to the agency.

Where the Commissioner becomes aware that a matter being investigated by the Commissioner is, or is related to, a matter that is under investigation by the Auditor General, the Commissioner shall not, unless the Commissioner and Auditor General agree to the contrary, continue to investigate the matter until the investigation by the Auditor General has been completed.

(1) After investigating a complaint, the Commissioner may:

(1A) After investigating an act or practice of a person or entity under subsection 40(2), the Commissioner may make a determination that includes one or more of the following:

(1AA) The steps specified by the Commissioner under subparagraph (1)(b)(ia) or paragraph (1A)(b) must be reasonable and appropriate.

(1B) A determination of the Commissioner under subsection (1) or (1A) is not binding or conclusive between any of the parties to the determination.

(2) The Commissioner shall, in a determination, state any findings of fact upon which the determination is based.

(3) In a determination under paragraph (1)(a) or (b) (other than a determination made on a representative complaint), the Commissioner may include a declaration that the complainant is entitled to a specified amount to reimburse the complainant for expenses reasonably incurred by the complainant in connection with the making of the complaint and the investigation of the complaint.

(3A) A determination under paragraph (1)(b) or subsection (1A) may include any order that the Commissioner considers necessary or appropriate.

(4) A determination by the Commissioner under subparagraph (1)(b)(iii) on a representative complaint:

(5) If the Commissioner makes a determination under subparagraph (1)(b)(iii) on a representative complaint, the Commissioner may give such directions (if any) as he or she thinks just in relation to:

(1) If the Commissioner makes a determination that applies in relation to a contracted service provider for a Commonwealth contract, the Commissioner:

(2) The Commissioner may give an agency a recommendation only after consulting the agency.

(3) An agency that receives a recommendation from the Commissioner must tell the Commissioner in writing of any action the agency proposes to take in relation to the recommendation. The agency must do so within 60 days of receiving the recommendation.

(2) The Commissioner may determine in writing that the determination under section 52 instead applies in relation to a specified agency to which services were or were to be provided under the contract. The determination has effect according to its terms for the purposes of section 60.

(3) Before making a determination, the Commissioner must give the agency:

(6) Despite subsection (5), the court may receive any of the following as evidence in proceedings about a determination made by the Commissioner under section 52:

(1) The Commissioner may issue a written certificate setting out the findings of fact upon which the Commissioner based his or her determination that:

(3) In any proceedings under section 55A, a certificate under subsection (1) of this section is prima facie evidence of the facts found by the Commissioner and set out in the certificate. However, the certificate is not prima facie evidence of a finding that:

Neither the Commissioner nor a person acting under his or her direction or authority is liable to an action, suit or proceeding in relation to an act done or omitted to be done in good faith in the exercise or purported exercise of any power or authority conferred by this Act.

(3) A person shall not furnish information or make a statement to the Commissioner knowing that it is false or misleading in a material particular.

(6) The Commissioner may recommend to the Director of Public Prosecutions that an individual who has been, or is to be, required under this Act to give information or produce a document be given an undertaking under subsection (5).

(9) The Commissioner may recommend to the Attorney General of a State that an individual who has been, or is to be, required under this Act to give information or produce a document be given an undertaking under subsection (8).

(1) Subject to subsection (3), for the purposes of the performance by the Commissioner of his or her functions under this Act, a person authorised by the Commissioner in writing for the purposes of this section may, at any reasonable time of the day, enter premises occupied by an agency, an organisation, a file number recipient, a credit reporting body or a credit provider and inspect any documents that are kept at those premises and that are relevant to the performance of those functions, other than documents in respect of which the Attorney General has furnished a certificate under subsection 70(1) or (2).

(1A) The Commissioner may authorise a person only while the person is a member of the staff assisting the Commissioner.

(4) If, on an application made by a person authorised by the Commissioner under subsection (1), a Magistrate is satisfied, by information on oath, that it is reasonably necessary, for the purposes of the performance by the Commissioner of his or her functions under this Act, that the person be empowered to enter the premises, the Magistrate may issue a warrant authorising the person, with such assistance as the person thinks necessary, to enter the premises, if necessary by force, for the purpose of exercising those powers.

(1) The Commissioner must issue to a person authorised for the purposes of section 68 an identity card in the form approved by the Commissioner. The identity card must contain a recent photograph of the authorised person.

(2) As soon as practicable after the person ceases to be authorised, he or she must return the identity card to the Commissioner.

(1) Where the Attorney General furnishes to the Commissioner a certificate certifying that the giving to the Commissioner of information concerning a specified matter (including the giving of information in answer to a question), or the production to the Commissioner of a specified document or other record, would be contrary to the public interest because it would:

the Commissioner is not entitled to require a person to give any information concerning the matter or to produce the document or other record.

(2) Without limiting the operation of subsection (1), where the Attorney General furnishes to the Commissioner a certificate certifying that the giving to the Commissioner of information as to the existence or non existence of information concerning a specified matter (including the giving of information in answer to a question) or as to the existence or non existence of any document or other record required to be produced to the Commissioner would be contrary to the public interest:

the Commissioner is not entitled, pursuant to this Act, to require a person to give any information as to the existence or non existence of information concerning that matter or as to the existence of that document or other record.

For the purposes of this Part, a person is interested in an application made under section 73 if, and only if, the Commissioner is of the opinion that the person has a real and substantial interest in the application.

(2) Subject to this Division, if the Commissioner is satisfied that:

the Commissioner may, by legislative instrument, make a determination to that effect.

(4) The Commissioner may, by legislative instrument, make a determination that no APP entity is taken to contravene section 15 or 26A if, while that determination is in force, an APP entity does an act, or engages in a practice, that is the subject of a determination under subsection (2) in relation to that entity or any other APP entity.

the Commissioner may, in writing, dismiss the application.

(4) Where the Commissioner makes a determination under section 72 on an application made by virtue of subsection (2), that section has effect, in relation to each of the agencies on whose behalf the application was made as if the determination had been made on an application by that agency.

(1) Subject to subsection (2), the Commissioner shall publish, in such manner as he or she thinks fit, notice of:

(2) The Commissioner shall not, except with the consent of the agency, permit the disclosure to another body or person of information contained in a document provided by an agency as part of, or in support of, an application if the agency has informed the Commissioner in writing that the agency claims that the document is an exempt document within the meaning of Part IV of the Freedom of Information Act 1982.

(1) The Commissioner shall prepare a draft of his or her proposed determination in relation to the application unless the Commissioner dismisses the application under subsection 73(1A).

(2) If the applicant is an agency, the Commissioner must send to the agency, and to each other person (if any) who is interested in the application, a written invitation to notify the Commissioner, within the period specified in the invitation, whether or not the agency or other person wishes the Commissioner to hold a conference about the draft determination.

(2A) If the applicant is an organisation, the Commissioner must:

(1) If an agency, organisation or person notifies the Commissioner, within the period specified in an invitation sent to the agency, organisation or person, that the agency, organisation or person wishes a conference to be held about the draft determination, the Commissioner shall hold such a conference.

(2) The Commissioner shall fix a day, time and place for the holding of the conference.

(4) The Commissioner shall give notice of the day, time and place of the conference to the agency or organisation and to each person to whom an invitation was sent.

(2) At the conference, a person to whom an invitation was sent, or any other person who is interested in the application and whose presence at the conference is considered by the Commissioner to be appropriate, is entitled to attend and participate personally or, in the case of a body corporate, to be represented by a person who is, or persons each of whom is, a director, officer or employee of the body corporate.

(3) The Commissioner may exclude from the conference a person who:

The Commissioner shall, after complying with this Part in relation to the application, make:

(1) The Commissioner shall, in making a determination, take account of all matters raised at the conference.

(2) The Commissioner shall, in making a determination, take account of all submissions about the application that have been made, whether at a conference or not, by the agency, organisation or any other person.

(1) This section applies if the Commissioner is satisfied that:

(2) The Commissioner may, by legislative instrument, make a determination that he or she is satisfied of the matters set out in subsection (1). The Commissioner may do so:

(3) The Commissioner must specify in the determination a period of up to 12 months during which the determination is in force (subject to subsection 80D(2)).

(3) The Commissioner may, by legislative instrument, make a determination that no APP entity is taken to contravene section 15 or 26A if, while that determination is in force, an APP entity does an act, or engages in a practice, that is the subject of a temporary public interest determination in relation to that entity or another APP entity.

(1) The fact that the Commissioner has made a determination under this Division about an act or practice does not prevent the Commissioner from dealing under Division 1 with an application made under section 73 in relation to that act or practice.

(1) The Commissioner must keep a register of determinations made under Division 1 or 2.

(2) The Commissioner may decide the form of the register and how it is to be kept.

(3) The Commissioner must make the register available to the public in the way that the Commissioner determines.

(4) The Commissioner may charge fees for:

(2) For the purposes of Part 4 of the Regulatory Powers Act, the Commissioner is an authorised applicant in relation to the civil penalty provisions of this Act.

(2) For the purposes of Part 6 of the Regulatory Powers Act, the Commissioner is an authorised person in relation to the provisions mentioned in subsection (1).

Enforceable undertaking may be published on the Commissioner’s website

(4) The Commissioner may publish an undertaking given in relation to the provision on the Commissioner’s website.

(3) A member other than the Commissioner and Privacy Commissioner (within the meaning of that Act):

(5) The Commissioner shall be convenor of the Committee.

(1) The CEO of the National Health and Medical Research Council may, with the approval of the Commissioner, issue guidelines for the protection of privacy by agencies in the conduct of medical research.

(2) The Commissioner shall not approve the issue of guidelines unless he or she is satisfied that the public interest in the promotion of research of the kind to which the guidelines relate outweighs to a substantial degree the public interest in maintaining adherence to the Australian Privacy Principles.

(1) This section allows the Commissioner to approve for the purposes of the Australian Privacy Principles guidelines that are issued by the CEO of the National Health and Medical Research Council or a prescribed authority.

(2) For the purposes of paragraph 16B(3)(c), the Commissioner may, by notice in the Gazette, approve guidelines that relate to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety.

(3) The Commissioner may give an approval under subsection (2) only if satisfied that the public interest in the use and disclosure of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the Australian Privacy Principles (disregarding subsection 16B(3)).

(4) For the purposes of subparagraph 16B(2)(d)(iii), the Commissioner may, by notice in the Gazette, approve guidelines that relate to the collection of health information for the purposes of:

(5) The Commissioner may give an approval under subsection (4) only if satisfied that the public interest in the collection of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the Australian Privacy Principles (disregarding subsection 16B(2)).

(6) The Commissioner may, by notice in the Gazette, revoke an approval of guidelines under this section if he or she is no longer satisfied of the matter that he or she had to be satisfied of to approve the guidelines.

(1) This section allows the Commissioner to approve for the purposes of the Australian Privacy Principles guidelines that are issued by the National Health and Medical Research Council.

(2) For the purposes of paragraph 16B(4)(c), the Commissioner may, by legislative instrument, approve guidelines that relate to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates.

(1) An application may be made to the Administrative Appeals Tribunal for review of the following decisions of the Commissioner: