7.6 Privacy
The Queensland Government's privacy scheme commenced in September 2001. The Government's policy regulates how personal information is collected, stored, used and disclosed by Queensland Government agencies. It addresses community concerns about any unauthorised use of personal information stored on both paper and electronic databases.
Queensland's privacy policy is implemented by Information Standard No.42 issued under the authority of sections 22(2) and 56(1) of the Financial Management Standard 1997 (external link). The Standard applies to all accountable officers and statutory bodies as defined under the Financial Administration and Audit Act 1977 (external link).
Information Standard No.42 also applies to statutory Government Owned Corporations (GOCs) and their subsidiaries where the shareholding Minister has given notification pursuant to s. 123 of the Government Owned Corporations Act 1993 (external link).
Information Standard No. 42 requires personal information to be managed in accordance with a set of Information Privacy Principles (IPPS) adapted from the Commonwealth Government public sector IPPs contained in the Privacy Act 1988 (external link) (Cth).
It should be noted that the requirement for agencies to comply with the Information Standard and guidelines is administratively based. This means that:
- where conflicting requirements exist any legislative requirements will supercede compliance with the Information Standard; and
- compliance is subject to any existing outsourcing arrangements, contracts and licenses. Any future outsourcing arrangement, contracts and licenses will be expected to comply with Information Standard 42. Where any existing outsourcing arrangements, contracts or licenses contemplated a future privacy regime (for example, where privacy clauses were written into a contract or license in anticipation of a future privacy regime) it may be possible to re-negotiate these terms.
Mandatory Requirements
It is mandatory that statutory bodies and statutory GOCs directed by their shareholding Minister must:
- nominate a privacy contact officer who will be the first point of contact for privacy issues within their own agencies. The privacy contact officer may also, at the discretion of their CEO, be the first point of contact for any privacy complaints made to the agency;
- develop privacy plans to give effect to the information privacy principles (see below), for approval by the CEO of each agency;
- publish privacy plans on their websites;
- implement the privacy plans according to a schedule developed in the privacy plan, subject to any existing contractual obligations, licenses, or other outsourcing arrangements;
- review and update privacy plans annually;
- develop and place on their website a privacy and security statement;
- be responsible for accessing and correcting records; and
- be responsible for a complaint resolution mechanism.
Personal Information
Personal information is any information that would allow a person to be identified. For example, personal information includes an individual's name, age and physical characteristics. It does not include information relating to either a deceased person or information that is publicly available.
Information Privacy Principles
Collection of Personal Information (IPPs 1-3)
Statutory bodies and notified statutory GOCs can only collect personal information directly related to their activities and only by fair means. The collection of this information should not unreasonably intrude upon the privacy of the individual concerned.
In most cases when collecting personal information a statutory body must advise an individual why the information is being collected and to whom the information is normally disclosed.
Reasonable steps are to be taken to ensure that personal information collected is relevant, up-to-date and complete.
Storage and Security (IPPs 4-5)
Statutory bodies and notified statutory GOCs in possession of personal information are to ensure that there are reasonable safeguards to prevent unauthorised access, use or disclosure of the information.
Access and Alteration (IPPs 6-7)
Individuals are entitled to access records containing personal information and to alter those records if they are inaccurate, subject to Queensland laws.
The Freedom of Information Act 1992 (external link) (Qld) allows for access to certain documents and a right of amendment and correction. The rights of access and alteration under Information Standard No.42 are the same as existing rights to access and amend under the Freedom of Information Act 1992 (external link) (Qld).
Accuracy (IPP8)
Reasonable steps are to be taken by statutory bodies and notified statutory GOCs to ensure that any personal information proposed to be used is accurate, up-to-date and complete.
Use and Disclosure (IPPs 9-11)
In general, statutory bodies and notified statutory GOCs must use personal information only for the purpose for which it was collected and disclose personal information only if the individual concerned is aware of, or has consented to that disclosure.
However, statutory bodies and notified statutory GOCs may use or disclose personal information if it is authorised by law or if it is necessary for certain types of law enforcement.
Accessing and amending personal information
Details will be published by statutory bodies and notified statutory GOCs outlining the nature, purpose and class of personal information in their possession and control. To access personal information contact should be made with the agency concerned.
Should any personal information be inaccurate, incomplete, out-of-date or misleading individuals have the right to request an amendment of the information.
Rights to access and amend personal information are the same as those contained in the Freedom of Information Act 1992 (external link) (Qld) and will be processed under that legislation.
Last reviewed: 17 July, 2009
Last updated: 22 July, 2009
^ to top
