What do the new provisions mean for the Personal Information I already hold?
A common question raised by the Privacy Act amendments is what do I need to do in regard to personal information I already hold. Do I need to comply with the new and tighter provisions of APP 8, for example, if I want to disclose information I’ve already collected overseas?
A recent article in the Privacy Law Bulletin by Clara Nguyen gives some good advice. The most important take away is that neither the Amendment Act nor the regulations proposed under that Act provide relief from notice obligations where there is an existing client relationship, or relief from new restrictions on the use and disclosure (e.g. APPs 6 and 8) for information already collected.
This means you do need to consider how the new APPs will affect information you already hold (as well as the personal information you are going to collect and use/disclose post 12 March 2014). In particular you may need to think about:
· Whether you need to give a new collection notice containing the additional information now required by APP 5 – where you have an on-going relationship with the individual
· Whether you need to get informed consent for the purposes of new APP 8.2(b) – where you are going to rely on that exemption to the offshoring rules.
It’s probably a good idea to start this process now, to make sure you’re in good shape by 12 March 2014.
Clara Nguyen HWL EBSWORTH LAWYERS, “Privacy reform — what to do with existing customers and clients?” (2013) 10(2) PRIVLB 25