Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Privacy Amendment (Enhancing Privacy Protection) Bill 2012

Bill home page  

Download WordDownload Word

Download PDFDownload PDF















































(Circulated by authority of the Attorney-General,

the Hon Nicola Roxon MP)



Schedule 1 — Australian Privacy Principles

Item 17 - Subsection 6(1) (after paragraph (c) of the definition of enforcement body)

On page 57, after the sentence: “However, given that it has a range of non-enforcement functions and activities, it will be limited in the collection of sensitive information to its ‘enforcement related activities’.”, insert:

“Examples of DIAC’s existing functions and activities that will be covered by the ‘enforcement related activity’ exceptions in the APPs 3.4, 6.2 and 8.2 include:

-           detecting, preventing, investigating and prosecuting breaches of visa, immigration and citizenship law;

-           identifying and locating unlawful non-citizens and resolving their immigration status, including the removal of unlawful non-citizens from Australia;

-           preventing and reducing irregular migration, people smuggling and trafficking in persons;

-           identifying and assessing claims by non-citizens for protection in Australia, including managing the detention or release into the community of protection claimants;

-           assessing and enforcing compliance with visa and citizenship requirements;

-           identifying and assessing prior to arrival those entitled to lawfully enter Australia;

-           managing the entry and departure of people crossing the Australian border;

-           resolving the identity, health, national security and criminal history status of people applying to enter Australia;

-           collecting and assessing information to assess the identity, character and criminal history of applicants for Australian citizenship; and

-           cooperation with other agencies, including information-sharing, for law enforcement and border security purposes, and the protection of the public revenue.”

Item 20 - Subsection 6(1)

On page 58, after the sentence: “The definition recognises that the limited use and disclosure of personal information for criminal law enforcement purposes is in the public interest when balanced with the interest in protecting an individual’s privacy.”, insert the following new paragraphs:

“The ALRC specifically considered the scope of the existing law enforcement exceptions in NPP 2.1(h) and IPPs 10.1(d) and 11.1(e).  The ALRC considered that the law enforcement exception should not be limited to circumstances in which there is an active involvement of an enforcement body, ie it should be broader than existing investigations.  The ALRC furthered considered that the exception should not be framed in a manner that prejudices the ability of enforcement agencies to initiate investigations.  It noted that the OAIC’s current guidance on the IPPs takes a purposive approach and acknowledges specifically that an agency may need to use and disclose personal information for intelligence-gathering that does not relate to a specific crime. 

The inclusion of ‘surveillance activities, intelligence gathering or monitoring activities’ in the ‘enforcement related activity’ definition is intended to give effect to the ALRC’s views in allowing enforcement bodies to  undertake legitimate activities where there may not be an existing investigation.

The three concepts of ‘surveillance activities, intelligence gathering or monitoring activities’ are distinct activities, although there may be some overlap depending on the circumstances.  Both surveillance and monitoring activities could be either for intelligence purposes or evidence gathering.  Surveillance activities may include optical surveillance of an individual or property where information obtained from that surveillance may lead to an investigation of a criminal offence.  Intelligence gathering covers a wide range of activities and may include the collection of information about an individual to detect whether an offence has occurred, or to determine whether to initiate an investigation into that offence.  It may also include whether the planning for the commission of an offence is taking place, ie pre-offence, which will also include ascertaining the modus operandi and whether there are fellow criminal associates.  Monitoring activities may capture an enforcement body monitoring a person who has presented themselves to that body in compliance with a court order.”

Item 82 - Divisions 2 and 3 of Part III

On page 68, at the end of the last paragraph, insert the following new sentence:

“Moreover, in many instances the act of discussing privacy considerations with the subject of confidential reporting would undermine the success of core operations.”

On page 69, before the first paragraph, insert the following new paragraph:

“It is important that there is certainty about the ability of DFAT or other agencies who seek to use this exception to undertake these activities without breaching the APPs, given that the Australian community expects timely, efficient and reliable consular service, and free flow of information is important to ensure this.”

On page 69, after the sentence: “Similarly, it is necessary for government officials based overseas to report to DFAT in Australia in discharging its consular responsibilities, especially in the event of an overseas crisis where overseas officials are expected to assist Australians.”, insert the following new paragraphs:

“There is a strong public interest in providing clarity on how personal information may be collected, used or disclosed in the context of discharging consular responsibilities, including where the need is urgent during an emergency situation. 

This exception provides the lawful basis for DFAT and other agencies to undertake such activities in discharging consular responsibilities without breaching the APPs.


For readability purposes, it is also important to clearly outline how these activities interact with other APP obligations.  The Government anticipates that the OAIC will develop appropriate guidance on the exceptions relating to diplomatic and consular functions and activities, in consultation with agencies affected by the exceptions.” 

Item 104 - Schedules 1 and 3

Australian Privacy Principle 7 - direct marketing

On page 81, after the sentence: “The intention is to apply more stringent obligations when using personal information of non-existing customer as the individual is less likely to expect their information to be used or disclosed for direct marketing purposes.”, insert the following paragraphs:

“APP 7 is not intended to create an onerous compliance burden on organisations that undertake legitimate direct marketing activities.  It is intended to update the Privacy Act to reflect modern day direct marketing activities of organisations, and the expectations of consumers about the protection of their privacy.  APP 7 will allow consumers to opt out of direct marketing involving the use or disclosure of their personal information, although the point at which they are made aware of the opt-out requirements may differ depending on the relationship between the direct marketer and the individual. 

Organisations engaged in direct marketing to individuals who have an expectation that their personal information will be used or disclosed for that purpose, will be required to provide a simple means for the consumer to opt out.  Depending on the circumstances, this may include where an individual has been notified about the opt-out mechanism at the time they provide their personal information, or sign up to a particular internet site.”