NSW LAW REFORM COMMISSION Report 123 Privacy principles August 2009 R123 Privacy principles © New South Wales Law Reform Commission, Sydney, 2009 Copyright permissions This publication may be copied, distributed, displayed, downloaded and otherwise freely dealt with for any personal or non-commercial purpose, on condition that proper acknowledgment is included on all uses. However, you must obtain permission from the NSW Law Reform Commission if you wish to: charge others for access to the publication (other than at cost); include all or part of the publication in advertising or a product for sale; or modify the publication. Disclaimer While this publication has been formulated with due care, the NSW Law Reform Commission does not warrant or represent that it is free from errors or omission, or that it is exhaustive. This publication deals with the law at the time it was first published and may not necessarily represent the current law. Readers are responsible for making their own assessment of this publication and should verify all relevant representations, statements and information with their own professional advisers. Other publication formats The NSW Law Reform Commission is committed to meeting fully its obligations under State and Commonwealth anti-discrimination legislation to ensure that people with disabilities have full and equal access to our services. This publication is available in alternative formats. If you require assistance, please contact the Commission (details on back cover). Cataloguing-in-publication Cataloguing-in-publication data is available from the National Library of Australia. ISSN 1030-0244 (Report) ISBN 978-0-7347-2638-4 (pbk) ii NSW Law Reform Commission Contents Letter to the Attorney General To the Hon John Hatzistergos Attorney General for New South Wales Dear Attorney Privacy principles We make this Report pursuant to the reference to this Commission received 11 April 2006. The Hon James Wood AO QC Chairperson August 2009 NSW Law Reform Commission iii R123 Privacy principles iv NSW Law Reform Commission Contents Table of Contents Terms of Reference ...................................................................................................... x Participants ...................................................................................................................xi Abbreviations used in this report..................................................................................xii List of recommendations .............................................................................................xiii MODEL UNIFIED PRIVACY PRINCIPLES (UPPs).....................................................xix Introduction....................................................................................................................... 1 BACKGROUND TO THIS REPORT ............................................................................. 2 WHAT ARE PRIVACY PRINCIPLES? .......................................................................... 3 ALRC’S APPROACH TO REVIEW OF PRIVACY......................................................... 4 National uniformity................................................................................................... 4 Application to public sector/private sector................................................................ 6 Exemptions .............................................................................................................. 6 PURPOSE OF THIS REPORT...................................................................................... 7 Particular limitations................................................................................................. 9 1. UPP1: Anonymity and pseudonymity ....................................................................... 13 INTRODUCTION......................................................................................................... 14 What do anonymity and pseudonymity mean? ...................................................... 14 Limitations.............................................................................................................. 15 Anonymity as a starting point ................................................................................. 16 Precedents............................................................................................................. 17 Technologies: threat and opportunities .................................................................. 17 THE ALRC’S RECOMMENDATION ........................................................................... 19 The current Commonwealth law............................................................................. 19 Extension of the anonymity principle to agencies .................................................. 19 Pseudonymity......................................................................................................... 20 Content and application ......................................................................................... 22 THE CURRENT LAW IN NSW.................................................................................... 27 SUBMISSIONS ........................................................................................................... 27 THE COMMISSION’S CONCLUSIONS ...................................................................... 28 2. UPP 2: Collection........................................................................................................ 31 INTRODUCTION......................................................................................................... 32 PURPOSES OF COLLECTION .................................................................................. 33 The ALRC’s recommendation ................................................................................ 33 The current law in NSW ......................................................................................... 34 The Commission’s conclusions.............................................................................. 35 MEANS AND MANNER OF COLLECTION ................................................................ 37 COLLECTION FROM THE INDIVIDUAL CONCERNED ............................................ 38 The ALRC’s recommendations .............................................................................. 38 The current law in NSW ......................................................................................... 40 Submissions........................................................................................................... 41 The Commission’s conclusions.............................................................................. 42 UNSOLICITED PERSONAL INFORMATION.............................................................. 44 The ALRC’s recommendations .............................................................................. 45 NSW Law Reform Commission v R123 Privacy principles The law in NSW ..................................................................................................... 47 Submissions........................................................................................................... 51 The Commission’s conclusions.............................................................................. 52 SENSITIVE INFORMATION ....................................................................................... 53 Current law............................................................................................................. 54 Regulating the collection of sensitive information .................................................. 56 3. UPP 3: Notification...................................................................................................... 71 INTRODUCTION......................................................................................................... 72 A SEPARATE PRINCIPLE.......................................................................................... 73 NATURE AND TIMING ............................................................................................... 74 Notification as a means of ensuring awareness..................................................... 74 Timing.................................................................................................................... 76 Reasonable steps include no steps........................................................................ 77 EXEMPTIONS............................................................................................................. 79 The law in NSW ..................................................................................................... 81 The Commission’s conclusion................................................................................ 82 COLLECTION OF PERSONAL INFORMATION FROM A THIRD PARTY................. 84 The law in NSW ..................................................................................................... 85 Submissions........................................................................................................... 86 The Commission’s conclusion................................................................................ 87 CONTENT OF NOTIFICATION................................................................................... 87 The fact and circumstances of collection ............................................................... 88 Collector’s identity, individual’s rights, and consequences of not providing