|
Privacy Code of Practice (General) 2003 [2003-273]  Status Information Currency of version Provisions in force Does not include amendments by: Authorisation:
This version of the legislation is compiled and maintained in
a database of legislation by the Parliamentary Counsel's Office
and published on the NSW legislation website, and is certified
as the form of that legislation that is correct under section
45C of the Interpretation Act 1987. Contents Part 1 Preliminary 1 Name of Code 2 Operation of Code 3 Limitations 4 Definitions Part 2 Inter-agency transfers of personal information 5 Application of Part 6 Permitted transfers of personal information Part 3 Public registers 7 Application of Part 8 Modification of Part 6 of the Act Part 4 Human services 9 Definition 10 Collection, use and disclosure of personal information by human services agencies 11 Collection of personal information from third parties Part 5 Corrective Services 12 Definitions 13 Collection from a person other than the individual 14 Collection and use of personal information and information about personal information held by the Department 15 Alteration of personal information 16 Disclosure of personal information Part 6 Ageing, disability and home care services 17 Interpretation 18 Modification of certain information protection principles Schedule 1 Permitted transfers of personal information Schedule 2 Modification of Part 6 of the Act Schedule 3 Modification of information protection principles applying to ageing, disability and home care service agencies Historical notes
This Code is the Privacy Code of Practice (General) 2003. This Code modifies the application of the information protection principles and public register provisions of the Act. Nothing in this Code:(a) (Repealed)(b) affects a disclosure that is otherwise permitted by law (including, but not limited to, a disclosure made pursuant to the State Records Act 1998 or the Freedom of Information Act 1989), or(c) prevents an agency from disclosing personal information with the consent of the individual to whom the information relates. (1) In this Code: Part 2 Inter-agency transfers of personal information This Part applies to the exchange of personal information between the agencies specified in Schedule 1. 6 Permitted transfers of personal information The information protection principles are modified to the extent necessary to permit the transfer between the agencies, of the personal information, and for the purposes, described in Schedule 1. This Part applies to the disclosure of personal information contained in public registers. 8 Modification of Part 6 of the Act (1) Part 6 of the Act is modified to the extent necessary to permit a disclosure referred to in subclause (2).(2) An agency specified in Column 2 of Schedule 2 that is responsible for keeping a public register (or that part of a register) described in Column 1 may, subject to any conditions set out in Column 1, disclose personal information kept in the register (or part of the register) without being satisfied that the information is to be used for a purpose relating to the purpose of the register or the Act under which the register is kept. In this Part: 10 Collection, use and disclosure of personal information by human services agencies (1) In this clause: 11 Collection of personal information from third parties A human services agency is not required to comply with section 9 of the Act if it is unreasonable or impracticable in the circumstances to do so. (1) In this Part: 13 Collection from a person other than the individual The Department is not required to comply with section 9 of the Act in relation to personal information collected by the Department in any of the following circumstances:(a) the information is collected from the NSW Police Force or the CrimTrac Agency and is about:(i) a criminal charge or criminal conviction against a staff member (including the making of an apprehended violence order against the staff member) that may affect the staff member’s suitability for employment, or(ii) an application for, or the making of, an apprehended violence order against an offender,(b) the information is about an offender and collection from a person other than the offender is reasonably necessary to enable the Department:(i) to protect the safety, welfare or well-being of the offender, or(ii) to supervise the offender effectively, or(iii) to provide services and programs to the offender effectively,(c) the collection is reasonably necessary to enable the Department:(i) to maintain the security or good order of a correctional complex, correctional centre or transitional centre, or(ii) to verify information about an individual supplied to it by the individual, or(iii) to organise a conference or mediation between an offender and a victim of that offender, or(iv) to compile statistical data, but only if it is impractical to collect the information directly from the individual to whom it relates and the information is not information of a kind referred to in section 19 (1) of the Act, or(v) to investigate an allegation of misconduct against a staff member. 14 Collection and use of personal information and information about personal information held by the Department (1) The Department is not required to comply with section 10, 11 (b), 13 or 17 of the Act if non-compliance is reasonably necessary to enable the Department to do one or more of the following:(a) to protect the safety, welfare or well-being of a person,(b) to supervise an offender effectively,(c) to provide services and programs to an offender effectively,(d) to maintain the security or good order of a correctional complex, correctional centre or transitional centre,(e) to exercise properly the Department’s complaint handling or investigative functions,(f) to carry out disciplinary or other proceedings before a court or tribunal,(g) to prepare a comprehensive report to a court, tribunal or other relevant statutory body.(2) The Department is not required to comply with section 10, 13 or 17 of the Act if non-compliance is reasonably necessary to enable the Department to prevent the disclosure of:(a) intelligence information provided by an investigative agency or law enforcement agency, or(b) the identity of an informant or a victim, or(c) the existence of a surveillance operation.(3) The Department is not required to comply with section 17 of the Act if non-compliance is reasonably necessary to enable the Department to organise a conference or mediation between an offender and a victim of that offender. 15 Alteration of personal information The Department is not required to comply with section 15 of the Act in relation to personal information if:(a) the information has been obtained in the course of an investigation, and(b) the person who is the subject of the information seeks to have the information amended during the investigation, and(c) amending the information at that time will detrimentally affect (or prevent the proper exercise of) the Department’s complaint handling functions or any of its investigative functions, and(d) the information will be amended as soon as practicable after the conclusion of the investigation. 16 Disclosure of personal information The Department is not required to comply with section 18 or 19 (1) of the Act if non-compliance is reasonably necessary to enable the Department to do one or more of the following:(a) to protect the safety, welfare or well-being of a person,(b) to provide services and programs to an offender effectively,(c) to permit one or more of the following to exercise its functions properly in relation to an offender:(i) the Department of Community Services,(ii) the Department of Health,(iii) Justice Health,Note. This does not permit the Department to disclose health information as health information is regulated by the Health Records and Information Privacy Act 2002.(d) to disclose personal information to a person for the purposes of an investigation, but only if the disclosure is made to a person:(i) to verify the information, or(ii) to obtain professional or technical advice about the information. Part 6 Ageing, disability and home care services (1) In this Part and in Schedule 3: 18 Modification of certain information protection principles The information protection principles are modified in their application to ADHC agencies as set out in Schedule 3. Schedule 1 Permitted transfers of personal information (Clause 6) 1 Verification of vehicle ownership details by Sheriff (1) Agencies exchanging personal information 2 Environmental offences involving vehicles (1) Agencies exchanging personal information Schedule 2 Modification of Part 6 of the Act (Clause 8)
Schedule 3 Modification of information protection principles applying to ageing, disability and home care service agencies (Clause 18) 1 Section 9: Collection of personal information (1) Despite section 9 of the Act, an ADHC agency may, if the individual to whom personal information relates lacks the capacity to provide the information and the information is being collected for the primary purpose of providing ageing, disability or home care services to the individual:(a) collect the information from any of the following persons:(i) the individual’s guardian (within the meaning of the Guardianship Act 1987),(ii) the individual’s attorney (within the meaning of the Powers of Attorney Act 2003),(iii) the spouse of the individual, if the relationship between the individual and the spouse is close and continuing,(iv) a person who provides domestic services or support for the individual, or who arranges for domestic services or support to be provided to the individual,(v) a person who has the care of the individual (within the meaning of the Guardianship Act 1987),(vi) a close friend or relative of the individual (within the meaning of the Guardianship Act 1987), and(b) if the information cannot be collected from a person referred to in paragraph (a), collect the information from another person.(2) An ADHC agency is not required to comply with section 9 of the Act or subclause (1) if it is unreasonable or impracticable in the circumstances to do so. 2 Section 10: Requirements when collecting personal information If the individual to whom personal information relates lacks the capacity to understand the matters listed in section 10 of the Act, the ADHC agency must instead of complying with that section make a record of those matters in its files and must ensure that the record is readily accessible by:(a) if the individual regains capacity, the individual, or(b) any personal information custodian of the individual, or(c) the agency itself. 3 Section 14: Access to personal information held by agencies Without limiting section 14 of the Act, if an ADHC agency holds personal information that relates to an individual who lacks capacity to understand that personal information or the purpose for which it was collected (or is to be used), the agency must, at the request of a personal information custodian of the individual and without excessive delay or expense, provide that custodian with access to the information. 4 Section 15: Alteration of personal information (1) Without limiting section 15 of the Act, if an ADHC agency holds personal information that relates to an individual who lacks capacity to understand that personal information or the purpose for which it was collected (or is to be used), the agency must, at the request of a personal information custodian of the individual, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information:(a) is accurate, and(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.(2) If an ADHC agency is not prepared to amend personal information in accordance with a request by an individual’s personal information custodian, the agency must, if so requested by the custodian, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.(3) If personal information is amended in accordance with this clause, the individual to whom the information relates and the individual’s personal information custodian is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the agency. 5 Section 16: Agency must check accuracy of personal information before use Without limiting section 16 of the Act, for the purposes of that section, reasonable steps to ensure information is relevant, accurate, up to date, complete and not misleading include:(a) making inquiries of the individual concerned, or(b) in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used), making inquiries of a relevant personal information custodian of the individual. 6 Section 17: Limits on use of personal information (1) Despite section 17 of the Act, an ADHC agency that holds personal information that relates to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may use the information for a purpose other than that for which it was collected if:(a) a personal information custodian of the individual has consented to the use of the information for that other purpose, or(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.(2) Despite section 17 of the Act and subclause (1) (a), an ADHC agency that holds personal information in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may use the information for a purpose other than that for which it was collected without the consent of a personal information custodian of the individual, if:(a) no personal information custodian of the individual exists or can be found, and(b) an officer of the Department of Ageing, Disability or Home Care appointed by the Director-General of that Department to act for individuals who have no personal information custodian consents to that use of the information on the grounds that the disclosure is in the best interests of the individual, and(c) the ADHC agency records details of that use of the information in its files and ensures that the record is readily accessible by:(i) if the individual regains capacity, the individual, or(ii) if the individual gains a personal information custodian, the personal information custodian, or(iii) the agency itself. 7 Section 18: Limits on disclosure of personal information (1) Despite section 18 of the Act, an ADHC agency that holds personal information that relates to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may disclose the information to a person other than the individual to whom the information relates, or another body (whether or not such other person or body is a public sector agency), if:(a) the disclosure is directly related to the purpose for which the information was collected, or(b) a personal information custodian of the individual has consented to the disclosure of the information for that other purpose, or(c) the disclosure is made to a personal information custodian of the individual.(2) Despite subclause (1) (b), an ADHC agency that holds personal information in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may disclose the information to a person (other than the individual to whom the information relates) or other body without the consent of a personal information custodian of the individual, if:(a) no personal information custodian of the individual exists or can be found, and(b) an officer of the Department of Ageing, Disability or Home Care appointed by the Director-General of that Department to act for individuals who have no personal information custodian consents to the disclosure on the grounds that the disclosure is in the best interests of the individual, and(c) the ADHC agency records details of the disclosure in its files and ensures that the record is readily accessible by:(i) if the individual regains capacity, the individual, or(ii) if the individual gains a personal information custodian, the personal information custodian, or(iii) the agency itself.(3) If personal information is disclosed in accordance with this clause to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 8 Section 19: Special restrictions on disclosure of personal information Despite section 19 of the Act, an ADHC agency may disclose personal information of an individual who lacks capacity to understand the personal information relating to the individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities if:(a) a personal information custodian of the individual has consented to the disclosure of the information, or(b) the agency believes on reasonable grounds the disclosure of the personal information is necessary to give effect to the purpose for which the personal information was collected.Example. If, in collecting personal information about an individual for the purpose of providing ageing, disability or home care services, an ADHC agency collected the information that the individual was a member of a religious group with strict dietary rules, the agency may disclose that information to a person providing such services where it is necessary, ie where a service provider is preparing food for the individual.
The following abbreviations are used in the Historical notes:
Table of amending instruments Privacy Code
of Practice (General) 2003 published in Gazette No 83 of
9.5.2003, p 4669 and amended as follows:
Table of amendments
|