It is the intention of the Parliament that this Act is not to affect the operation of a law of a State or of a Territory that makes provision with respect to the collection, holding, use, correction or disclosure of personal information (including such a law relating to credit reporting or the use of information held in connection with credit reporting) and is capable of operating concurrently with this Act.

permitted CP disclosure has the meaning given by sections 21J to 21N.

permitted CRB disclosure has the meaning given by section 20F.

No breach—disclosure to the National Archives of Australia

(3) An act or practice does not breach an Australian Privacy Principle if the act or practice involves the disclosure by an organisation of personal information in a record (as defined in the Archives Act 1983) solely for the purposes of enabling the National Archives of Australia to decide whether to accept, or to arrange, care (as defined in that Act) of the record.

No breach—disclosure to the National Archives of Australia

(3) An act or practice does not breach a registered APP code if the act or practice involves the disclosure by an organisation of personal information in a record (as defined in the Archives Act 1983) solely for the purposes of enabling the National Archives of Australia to decide whether to accept, or to arrange, care (as defined in that Act) of the record.

Disclosure compelled or made with consent

(1A) Despite subsections (1) and (2), a reference in this Act (other than section 8) to an act or to a practice does not include a reference to the act or practice so far as it involves the disclosure of personal information to:

(1B) Despite subsections (1) and (2), a reference in this Act (other than section 8) to an act or to a practice does not include a reference to the act or practice by an agency with an intelligence role or function (within the meaning of the Office of National Intelligence Act 2018) so far as it involves the disclosure of personal information to the Office of National Intelligence.

Note: To avoid doubt, this section does not make exempt for the purposes of paragraph 7(1)(ee) an act or practice of the political representative, contractor, subcontractor or volunteer for a registered political party involving the use or disclosure (by way of sale or otherwise) of personal information in a way not covered by subsection (1), (2), (3) or (4) (as appropriate). The rest of this Act operates normally in relation to that act or practice.

neither the disclosure (if any) by the old partnership, nor the collection (if any) by the new partnership, of the information that was necessary for the new partnership to hold the information immediately after its formation constitutes an interference with the privacy of the individual.

(1) A permitted general situation exists in relation to the collection, use or disclosure by an APP entity of personal information about an individual, or of a government related identifier of an individual, if:

(2) The Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).

Use or disclosure—research etc.

(3) A permitted health situation exists in relation to the use or disclosure by an organisation of health information about an individual if:

Use or disclosure—genetic information

(4) A permitted health situation exists in relation to the use or disclosure by an organisation of genetic information about an individual (the first individual) if:

Disclosure—responsible person for an individual

(5) A permitted health situation exists in relation to the disclosure by an organisation of health information about an individual if:

Prohibition on use or disclosure

Permitted disclosures

(3) Subsection (1) does not apply to the disclosure of credit reporting information about the individual if:

(5) If a credit reporting body discloses credit reporting information under this section, the body must make a written note of that disclosure.

No use or disclosure for the purposes of direct marketing

(6) This section does not apply to the use or disclosure of credit reporting information for the purposes of direct marketing.

Note: Section 20G deals with the use or disclosure of credit reporting information for the purposes of direct marketing.

(1) A disclosure by a credit reporting body of credit reporting information about an individual is a permitted CRB disclosure in relation to the individual if:

Use or disclosure by credit reporting bodies

(3) If the credit reporting body discloses the pre screening assessment under subsection (2), the body must make a written note of that disclosure.

Use or disclosure by recipients

Use or disclosure

(2) Subsection (1) does not apply to the use or disclosure of the de identified information if:

(3) The Commissioner may, by legislative instrument, make rules relating to the use or disclosure by a credit reporting body of de identified information for the purposes of conducting research in relation to credit.

(2) A credit reporting body must take such steps as are reasonable in the circumstances to ensure that the credit reporting information the body uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.

(4) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.

Use or disclosure

(5) If the credit reporting body uses or discloses the information under subsection (4), the body must make a written note of the use or disclosure.

Use or disclosure

(3) However, the credit reporting body may use or disclose the information under this subsection if the use or disclosure of the information is required by or under an Australian law or a court/tribunal order.

(4) If the credit reporting body uses or discloses the information under subsection (3), the body must make a written note of the use or disclosure.

(5) Subdivision E of this Division (other than section 20Q) does not apply in relation to the use or disclosure of the information.

Prohibition on disclosure

Permitted disclosure

(2) Subsection (1) does not apply to the disclosure of credit information about the individual if:

Note: Section 21F limits the disclosure of credit information if there is a ban period for the information.

Written note of disclosure

(6) If a credit provider discloses credit information under this section, the provider must make a written note of that disclosure.

(7) If a credit provider is an APP entity, Australian Privacy Principles 6 and 8 do not apply to the disclosure by the provider of credit information to a credit reporting body.

Prohibition on use or disclosure

Permitted disclosures

(3) Subsection (1) does not apply to the disclosure of credit eligibility information about the individual if:

Note: See section 21NA for additional rules about the disclosure of credit eligibility information under paragraph (3)(b) or (c).

Written note of use or disclosure

(6) If a credit provider uses or discloses credit eligibility information under this section, the provider must make a written note of that use or disclosure.

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(3) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(4) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(5) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(3) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if the disclosure is to a mortgage insurer that has an Australian link for:

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

Note: See section 21NA for additional rules about the disclosure of credit eligibility information under this subsection.

(1) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(2) A disclosure by a credit provider of credit eligibility information about an individual is a permitted CP disclosure in relation to the individual if:

(2) A credit provider must take such steps (if any) as are reasonable in the circumstances to ensure that the credit eligibility information the provider uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.

(4) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.

Prohibition on use or disclosure

Permitted disclosure

(3) Subsection (1) does not apply to the disclosure of the information if the disclosure is required or authorised by or under an Australian law or a court/tribunal order.

Prohibition on use or disclosure

Permitted use or disclosure

(2) Subsection (1) does not apply to the use or disclosure of the information by the body corporate if the body would be permitted to use or disclose the information under section 21G if the body were the credit provider.

Prohibition on use or disclosure

Permitted disclosure

(3) Subsection (1) does not apply to the disclosure of the information if:

Prohibition on use or disclosure

Permitted disclosure

(3) Subsection (1) does not apply to the disclosure of the information if the disclosure is required or authorised by or under an Australian law or a court/tribunal order.

(3) The use or disclosure of personal information about the individual for the purposes of the consultation is taken, for the purposes of this Act, to be a use or disclosure that is authorised by this subsection.

has been, or is required to be, notified under section 75 of the My Health Records Act 2012, this Part does not apply in relation to the access, disclosure or loss.

Access to, or disclosure of, information

the access or disclosure is not, and is taken never to have been:

to take steps to notify the individual of the contents of a statement that relates to the access or disclosure.

For the purposes of this Division, in determining whether a reasonable person would conclude that an access to, or a disclosure of, information:

(4) If the entity has reasonable grounds to believe that the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities, the statement referred to in subparagraph (2)(a)(i) may also set out the identity and contact details of those other entities.

are taken not to be provisions that require or authorise the use or disclosure of information.

(8) If the Commissioner is aware that there are reasonable grounds to believe that the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities, a direction under subsection (1) may also require the statement referred to in paragraph (1)(a) to set out the identity and contact details of those other entities.

are taken not to be provisions that require or authorise the use or disclosure of information.

(2) The Commissioner shall not, except with the consent of the agency, permit the disclosure to another body or person of information contained in a document provided by an agency as part of, or in support of, an application if the agency has informed the Commissioner in writing that the agency claims that the document is an exempt document within the meaning of Part IV of the Freedom of Information Act 1982.

The object of this Part is to make special provision for the collection, use and disclosure of personal information in emergencies and disasters.

secrecy provision means a provision of a law of the Commonwealth (including a provision of this Act), or of a Norfolk Island enactment, that prohibits or regulates the use or disclosure of personal information, whether the provision relates to the use or disclosure of personal information generally or in specified circumstances.

(2) An entity is not liable to any proceedings for contravening a secrecy provision in respect of a use or disclosure of personal information authorised by subsection (1), unless the secrecy provision is a designated secrecy provision (see subsection (7)).

(3) An entity is not liable to any proceedings for contravening a duty of confidence in respect of a disclosure of personal information authorised by subsection (1).

(4) An entity does not breach an Australian Privacy Principle, or a registered APP code that binds the entity, in respect of a collection, use or disclosure of personal information authorised by subsection (1).

(2) Subsection (1) does not apply to the following disclosures:

(3) If a disclosure of personal information is covered by subsection (2), the disclosure is authorised by this section.

(1) Without limiting its effect apart from each of the following subsections of this section, this Part has effect in relation to a collection, use or disclosure as provided by that subsection.

(2) This Part has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure by a corporation.

(3) This Part also has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure taking place in the course of, or in relation to, trade or commerce:

(4) This Part also has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure using a postal, telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution.

(5) This Part also has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure taking place in a Territory.

(6) This Part also has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure taking place in a place acquired by the Commonwealth for public purposes.

(7) This Part also has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure by an agency.

(8) This Part also has the effect it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure for purposes relating to the defence of the Commonwealth.

(9) This Part also has the effect that it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure taking place outside Australia.

(10) This Part also has the effect that it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure:

(11) This Part also has the effect that it would have if its operation in relation to a collection, use or disclosure were expressly confined to a collection, use or disclosure in relation to an emergency of national significance.

(2) A disclosure under subsection (1) at a meeting of the Advisory Committee shall be recorded in the minutes of the meeting.

Approving guidelines for use and disclosure

(2) For the purposes of paragraph 16B(3)(c), the Commissioner may, by notice in the Gazette, approve guidelines that relate to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety.

(3) The Commissioner may give an approval under subsection (2) only if satisfied that the public interest in the use and disclosure of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the Australian Privacy Principles (disregarding subsection 16B(3)).

Approving guidelines for use and disclosure

(2) For the purposes of paragraph 16B(4)(c), the Commissioner may, by legislative instrument, approve guidelines that relate to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates.

(3) Subsection (2) does not apply to the making of regulations for the purposes of Australian Privacy Principle 9.3 that relate to the use or disclosure of a government related identifier by an organisation, or a class of organisations, in particular circumstances if:

Use or disclosure

Note: Australian Privacy Principle 8 sets out requirements for the disclosure of personal information to a person who is not in Australia or an external Territory.

6.2 This subclause applies in relation to the use or disclosure of personal information about an individual if:

6.3 This subclause applies in relation to the disclosure of personal information about an individual by an APP entity that is an agency if:

Written note of use or disclosure

6.5 If an APP entity uses or discloses personal information in accordance with paragraph 6.2(e), the entity must make a written note of the use or disclosure.

6.7 This principle does not apply to the use or disclosure by an organisation of:

7.4 Despite subclause 7.1, an organisation may use or disclose sensitive information about an individual for the purpose of direct marketing if the individual has consented to the use or disclosure of the information for that purpose.

8.2 Subclause 8.1 does not apply to the disclosure of personal information about an individual by an APP entity to the overseas recipient if:

Use or disclosure of government related identifiers

Regulations about adoption, use or disclosure

9.3 This subclause applies in relation to the adoption, use or disclosure by an organisation of a government related identifier of an individual if:

10.2 An APP entity must take such steps (if any) as are reasonable in the circumstances to ensure that the personal information that the entity uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.