Australia-Privacy Act 1988
An Act to make provision to protect the privacy of individuals, and for related purposes
WHEREAS Australia is a party to the International Covenant on Civil and Political Rights, the English text of which is set out in Schedule 2 to the Human Rights and Equal Opportunity Commission Act 1986:
AND WHEREAS, by that Covenant, Australia has undertaken to adopt such legislative measures as may be necessary to give effect to the right of persons not to be subjected to arbitrary or unlawful interference with their privacy, family, home or correspondence:
AND WHEREAS Australia is a member of the Organisation for Economic Co-operation and Development:
AND WHEREAS the Council of that Organisation has recommended that member countries take into account in their domestic legislation the principles concerning the protection of privacy and individual liberties set forth in Guidelines annexed to the recommendation:
AND WHEREAS Australia has informed that Organisation that it will participate in the recommendation concerning those Guidelines:
BE IT THEREFORE ENACTED by the Queen, and the Senate and the House of Representatives of the Commonwealth of Australia, as follows:
Part I-Preliminary
1 Short title
This Act may be cited as the Privacy Act 1988.
2 Commencement
This Act commences on a day to be fixed by Proclamation.
3 Saving of certain State and Territory laws
It is the intention of the Parliament that this Act is not to affect the operation of a law of a State or of a Territory that makes provision with respect to the collection, holding, use, correction, disclosure or transfer of personal information (including such a law relating to credit reporting or the use of information held in connection with credit reporting) and is capable of operating concurrently with this Act.
Note: Such a law can have effect for the purposes of the provisions of the National Privacy Principles that regulate the handling of personal information by organisations by reference to the effect of other laws.
3A Application of the Criminal Code
Chapter 2 of the Criminal Code (except Part 2.5) applies to all offences against this Act.
Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility.
4 Act to bind the Crown
(1) This Act binds the Crown in right of the Commonwealth, of each of the States, of the Australian Capital Territory, of the Northern Territory and of Norfolk Island.
(2) Nothing in this Act renders the Crown in right of the Commonwealth, of a State, of the Australian Capital Territory, of the Northern Territory or of Norfolk Island liable to be prosecuted for an offence.
(3) Nothing in this Act shall be taken to have the effect of making the Crown in right of a State, of the Australian Capital Territory, of the Northern Territory or of Norfolk Island an agency for the purposes of this Act.
5 Interpretation of Information Privacy Principles
For the purposes of the interpretation of the Information Privacy Principles, each Information Privacy Principle shall be treated as if it were a section of this Act.
5A Extension to external Territories
This Act extends to all external Territories.
5B Extra-territorial operation of Act
Application to overseas acts and practices of organisations
(1) This Act (except Divisions 4 and 5 of Part III and Part IIIA) and approved privacy codes extend to an act done, or practice engaged in, outside Australia and the external Territories by an organization if:
(a) subject to subsection (1A), the act or practice relates to personal information about an Australian citizen or a person whose continued presence in Australia is not subject to a limitation as to time imposed by law; and
(b) the requirements of subsection (2) or (3) are met.
Note: The act or practice overseas will not breach a National Privacy Principle or approved privacy code or be an interference with the privacy of an individual if the act or practice is required by an applicable foreign law. See sections 6A, 6B and 13A.
(1A) Paragraph (1)(a) does not apply in relation to National Privacy Principle.
Note: Because of subsection (1A), the extra-territorial application of National Privacy Principle 9 is not limited by the citizenship etc. requirement of paragraph (1)(a).
Organisational link with Australia
(2) The organisation must be:
(a) an Australian citizen; or
(b) a person whose continued presence in Australia is not subject to a limitation as to time imposed by law; or
(c) a partnership formed in Australia or an external Territory; or
(d) a trust created in Australia or an external Territory; or
(e) a body corporate incorporated in Australia or an external Territory; or
(f) an unincorporated association that has its central management and control in Australia or an external Territory.
Other link with Australia
(3) All of the following conditions must be met:
(a) the organisation is not described in subsection (2);
(b) the organisation carries on business in Australia or an external Territory;
(c) the personal information was collected or held by the organisation in Australia or an external Territory, either before or at the time of the act or practice.
(4) Part V of this Act has extra-territorial operation so far as that Part relates to complaints and investigation concerning acts and practices to which this Act extends because of subsection (1).
Note: This lets the Commissioner take action overseas to investigate complaints and lets the ancillary provisions of Part V operate in that context.
Part II-Interpretation
6 Interpretation
(1) In this Act, unless the contrary intention appears:
ACC means the Australian Crime Commission.
ACT enactment has the same meaning as enactment has in the Australian Capital Territory (Self-Government) Act 1988.
agency means:
(a) a Minister; or
(b) a Department; or
(c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a Commonwealth enactment, not being:
(i) an incorporated company, society or association; or
(ii) an organisation within the meaning of the Conciliation and Arbitration Act 1904 or a branch of such an organisation; or
(d) a body established or appointed by the Governor-General, or by a Minister, otherwise than by or under a Commonwealth enactment; or
(e) a person holding or performing the duties of an office established by or under, or an appointment made under, a Commonwealth enactment, other than a person who, by virtue of holding that office, is the Secretary of a Department; or
(f) a person holding or performing the duties of an appointment, being an appointment made by the Governor-General, or by a Minister, otherwise than under a Commonwealth enactment; or
(g) a federal court; or
(h) the Australian Federal Police; or
(i) an eligible case manager; or
(j) the nominated AGHS company; or
(k) an eligible hearing service provider.
annual turnover of a business has the meaning given by section 6DA.
approved privacy code means:
(a) a privacy code approved by the Commissioner under section 18BB; or
(b) a privacy code approved by the Commissioner under section 18BB with variations approved by the Commissioner under section 18BD.
bank means:
(a) the Reserve Bank of Australia; or
(b) a body corporate that is an ADI (authorised deposit-taking institution) for the purposes of the Banking Act 1959; or
(c) a person who carries on State banking within the meaning of paragraph 51(xiii) of the Constitution.
Board of the ACC means the Board of the Australian Crime Commission established under section 7B of the Australian Crime Commission Act 2002.
breach an approved privacy code has the meaning given by section 6B.
breach an Information Privacy Principle has a meaning affected by subsection 6(2).
breach a National Privacy Principle has the meaning given by section 6A.
class member, in relation to a representative complaint, means any of the persons on whose behalf the complaint was lodged, but does not include a person who has withdrawn under section 38B.
code complaint means a complaint about an act or practice that, if established, would be an interference with the privacy of the complainant because it breached an approved privacy code.
Code of Conduct means the Code of Conduct issued under section 18A.
commercial credit means a loan sought or obtained by a person, other than a loan of a kind referred to in the definition of credit in this subsection.
Commissioner means the Privacy Commissioner.
Commissioner of Police means the Commissioner of Police appointed under the Australian Federal Police Act 1979.
Commonwealth contract means a contract, to which the Commonwealth or an agency is or was a party, under which services are to be, or were to be, provided to an agency.
Note: See also subsection (9) about provision of services to an agency.<–>
