Legislation - Information Privacy Act 2009: Information Privacy Act 2009 (Qld)

To provide for the fair collection and handling of personal information in the public sector environment, and allow for an individual’s right to access and request to amend personal information under the government control (unless it is contrary to the public interest to give access or to allow the information to be amended).

It is not intended to prevent access or amendment of an individual’s personal information.

There is some exempt information that this Act does not apply to. Access to exempt information needs to be applied for via the Right to Information Act.

Applies to the disclosure of, and collection of all personal information, including storage, handling, accessing, amendment, management, transfer, use and disclosure – regardless of when it was collected.

Documents to which the privacy principles do not apply

• Any document arising out of a controlled operation or activity under the PPRA 2000 or Crime and Corrupion Act 2001
• Any document arising out of a complaint or investigation of corruption under the Public Service Administration Act 1990 or the Crime and Corruption Act 2001
• Any document contained in a public interest discolure, or information that has been collected for a public interest disclosure
• Any document arising out of a commission of inquiry
• Any generally available publication
• Any document kept in a public library for the purposes of study, reference or exhibition
• Any document considered a public record

An individual’s right to access and amendment

If an individual’s personal information is stored by an agency or the Minister, the individual has the right to be given access to their personal information, and update the data if it is inaccurate, incomplete, out of date or misleading.

An approved form application must be provided by the applicant.

The application does not include application for access to metadata, unless expressly stated.

The Department of Health will deal with applications for access/amendment to personal information.

If the application is for data that is more than just personal information, a RTI needs to be applied for.

‘Personal information’ – information or opinion, including info or an opinion forming part of a database (whether true or not) about an individual whose identity is APPARENT, or can reasonably be ascertained, from the information or opinion.

You are disclosing personal information if you:

• give it to another person/agency if the person/agency when the agency does not know it is ‘personal information’ or is not in a position to find out
• place/store the information in a position where another person/agency can find it
• Give to another person/agency and you are no longer in control of the information

Using personal information is defined as:

• when personal information is manipulated, searched or otherwise used
• when personal information is taken into account when making a decision
• when personal information is transferred to another person/agency with a different function to the one where the personal information was originally intended.

Control of a document

• If the person/entity has the information/document in its possession or ‘owns’ and controls the data.

Personal information can be transferred outside Australia if

• The individual agrees to the transfer
• It is authorised or required under law
• The agency is reasonably satisfied that the transfer is necessary for the personal or public health safety and welfare
• The agency has taken reasonable steps to ensure the information it transfers will not be held, used or disclosed in a way that is inconsistent with the IPPs or the NPPs.

Contract agencies

If we enter into a service agreement with a contracted agency we must ensure that the contracted agency will deal with the personal information according to the IPPs and NPPs.