Privacy Amendment (Private Sector) Act 2000
• The Privacy Act regulates the way private sector organisations collect, use and store individuals Personal
• Information and Sensitive Information. The amended legislation is based on 10 National Privacy Principles.
• To ensure compliance with the Privacy Act, registered NationalComplaints members must accept National Complaints National Privacy Principles. These Principles will also apply to Non-Australian members.
From this point all references to MEMBER shall be referred to as ORIGINATOR.
National Privacy Principles:
The Privacy Act sets out 10 National Privacy Principles regulating the collection, use, disclosure and handling of personal information. Detailed below are the requirements under the Principles that NATIONALCOMPLAINTS will comply. Originators are required to familiarise themselves with these requirements so that their collection, use, disclosure and handling of personal information would not cause NATIONALCOMPLAINTS to be in breach of the legal requirements.
Principle 1
• Information can be collected by lawful and fair means if it is necessary for a legitimate function or activity.
• When collecting information, an individual must be advised of the following:
• NationalComplaints identity and its contact details......NATIONALCOMPLAINTS website is clear in its intent and can be contacted through contact us menu.
• Originators have access to the information......NATIONALCOMPLAINTS allows all registered persons to access their own information and allows correction to personal details. The general public has access to selected information for their personal information but cannot identify the originator of that information.
• The purpose for which the information is being collected......The NATIONALCOMPLAINTS website collects information for Businesses and General public to enable complaint resolution and decision purposes for product and service selection.
• To whom the information is usually disclosed......Personal information can only be disclosed by the originator where there is a request for resolution by a defendant wishing to pursue resolution, this can only be achieved through agreement with the originator and can only be achieved through a secure NATIONALCOMPLAINTS service.
• Whether the information is required by law and, if so, which law......Not applicable
• Identify the main consequences of not providing the information. Information must not be collected in an intrusive way and, where reasonable and practicable to do so, personal information about an individual MUST ONLY BE COLLECTED from that individual. ...... All information collected by NATIONALCOMPLAINTS is derived from the originator.
Principle 2
As a general rule, NATIONALCOMPLAINTS must not use or disclose personal information about an individual for a secondary purpose, that is for a purpose other than the original, or primary, purpose of collection.
However, NATIONALCOMPLAINTS may use personal information for a secondary purpose if:
• The secondary purpose is related to the primary purpose and the individual reasonably expects the use or disclosure of the information for the secondary purpose. In the case of sensitive information, the secondary purpose must be directly related to the primary purpose. ......NATIONALCOMPLAINTS requests permission for email addresses only to be used for communication between NATIONALCOMPLAINTS Complainants and Defendants and other relevant parties who may be able to assist either party.
• The individual has consented to the use or disclosure......NATIONALCOMPLAINTS requires acceptance of this Policy at time of registration.
• The use of the information (not including sensitive information) is for the purpose of direct marketing and:
• It is impracticable to seek the individuals consent before the particular use,......NATIONALCOMPLAINTS requires acceptance of this Policy at registration time.
• There is no fee to remove the individual from the mailing list, if requested,......NATIONALCOMPLAINTS allows editing of their profile to opt out.
• The individual has not requested that he/she not receive direct marketing communications,......NATIONALCOMPLAINTS request the option at registration.
• Direct marketing communications clearly advise the individual that he/she may elect not to receive further direct marketing communications, and......NATIONALCOMPLAINTS allows editing of their profile to opt out.
• Each written or electronic direct marketing communication sets out NationalComplaints business electronic contact details......NATIONALCOMPLAINTS allows editing of their profile to opt out.
• NATIONALCOMPLAINTS reasonably suspects unlawful activity and wishes to disclose personal information as part of investigations, or in reporting concerns to relevant persons or authorities......NATIONALCOMPLAINTS must comply with reasonable lawful requests for disclosure.
• The disclosure is required or authorised by law......NATIONALCOMPLAINTS must comply with reasonable lawful requests for disclosure.
• NATIONALCOMPLAINTS reasonably believes that the use or disclosure of the information is necessary for an enforcement body to carry out its tasks, for example, when investigating criminal activity or when preparing for or conducting court proceedings.......NATIONALCOMPLAINTS must comply with reasonable lawful requests for disclosure.
• Note: When disclosing information to an enforcement body, a written note of the use or disclosure must be
• Recorded......NATIONALCOMPLAINTS records the order against the registered individuals electronic record.
Principle 3
NATIONALCOMPLAINTS must take reasonable steps to ensure that the personal information collected, used or disclosed is:
• Accurate– NATIONALCOMPLAINTS requires affirmation that the information is true and reasonably describes complaint situations.
• Up to date......NATIONALCOMPLAINTS requires affirmation that the information is true and reasonably describes complaint situations.
• Complete......NATIONALCOMPLAINTS requires affirmation that the information is true and reasonably describes complaint situations.
Principle 4
Reasonable steps are to be taken to ensure that the individuals personal information is not:
• Misused ......NATIONALCOMPLAINTS requests at registration time what is allowed usage of the supplied information.
• Lost – NATIONALCOMPLAINTS has a managed Database system that backs up data on a regular basis in electronic form.
• Accessed, modified or disclosed by unauthorised personnel......Personal data and their records are uniquely identified and password protected.
• NATIONALCOMPLAINTS must take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed. NATIONALCOMPLAINTS archive inactive registrations each 5 years.
Principle 5
NATIONALCOMPLAINTS must make available to the public, a document clearly setting out its policies on the management of personal information. On request by a person, NATIONALCOMPLAINTS must let the person know, generally:
• What sort of personal information is held......as per the registration process.
• For what purpose personal information is held......Clearly set out in the Home Page and registration process.
• How the information is collected, held, used and disclosed......NATIONALCOMPLAINTS maintains secure Internet and database management systems and servers.
Principle 6
Information held about an individual, can be accessed by the individual on request, except when:
• The request has an unreasonable impact upon the privacy of other individuals......Registered complainants are given the option to respond to defendant requests and only through the NATIONALCOMPLAINTS electronic messaging.
• The request is frivolous or vexatious......Registered complainants are given the option to respond to defendant requests and only through the NATIONALCOMPLAINTS electronic messaging.
• The information relates to an existing legal dispute resolution proceeding between NATIONALCOMPLAINTS and the individual and the information would not be accessible by discovery* in those proceedings.......Registered complainants are given the option to respond to defendant requests and only through the NATIONALCOMPLAINTS electronic messaging service.
• *Discovery is a legal term meaning that participants in legal proceedings can seek details or copies of
• each others records.
• The request reveals NationalComplaints intentions relating to negotiations with the individual in a way that would prejudice those negotiations......NATIONALCOMPLAINTS has no influence in any legal proceeding between Complainant and Defendant.
• Providing access would be unlawful......NATIONALCOMPLAINTS only allows the personal details of the originator to be accessed by the originator and the NATIONALCOMPLAINTS Administrator.
• Denying access is specifically required by law......NA
• The request prejudices an investigation of possible unlawful activity......NATIONALCOMPLAINTS will comply with Lawful Orders for access.
• Providing access may prejudice an enforcement body carrying out its tasks, for example, when investigating criminal activity or when preparing for or conducting court proceedings......NATIONALCOMPLAINTS will comply with Lawful Orders for access.
• A law enforcement agency has asked NATIONALCOMPLAINTS not to provide access because disclosure would harm national security......NATIONALCOMPLAINTS will comply with Lawful Orders for access.
• Access reveals evaluative information generated in connection with a commercially sensitive decision making process. In this case, an explanation for the decision should be given to the individual rather than direct access to the information......NATIONALCOMPLAINTS allows only the originator to respond to resolution requests and lawful requests.
• NATIONALCOMPLAINTS is required to correct inaccurate, incomplete or out of date personal information in current records if requested by the individual. ......NATIONALCOMPLAINTS allows originators to append records.
Principle 7
NATIONALCOMPLAINTS must not adopt as its own identifier, an identifier of an individual that has been assigned by a government organisation or agency. ...... NATIONALCOMPLAINTS generates a unique identifier and applies password protection for each registered individual.
Note: An identifier is a number or alpha/numeric code assigned to an individual by an organisation, for example a Tax File Number or pension card number. It is used to identify the individual within that government organisation. An individuals name or Australian Business Number (ABN) are not considered as identifiers.
Principle 8
Wherever it is lawful and practical, individuals have the option of not identifying themselves when entering into transactions. ......Registered complainants are given the option to respond to defendant requests and only through the NATIONALCOMPLAINTS electronic messaging service.
Principle 9
Other than within NATIONALCOMPLAINTS or to the individual concerned, personal information can only be disclosed out of Australia to someone if:
• NATIONALCOMPLAINTS believes that the recipient is bound by the rules similar to those applying in Australia for the fair handling of information......NATIONALCOMPLAINTS does not display personal identifying information, exceptions are only made by a complainants agreement.
• The individual concerned provides consent to the disclosure......NATIONALCOMPLAINTS requires acceptance of this Policy at registration time.
The disclosure is:
• For the performance of a contract between a defendant to a complaint and the individual complainant.
• For the performance of a contract between NATIONALCOMPLAINTS and a third party for the individuals benefit.
• The disclosure is for the benefit of the individual concerned whose consent cannot be obtained and if it could be, it is likely to be given......NATIONALCOMPLAINTS requires acceptance of this Policy at registration time.
• NATIONALCOMPLAINTS has taken reasonable steps to make sure the information will be collected, used or disclosed in a way similar to the National Privacy Principles.......NATIONALCOMPLAINTS requires acceptance of this Policy at registration time.
Note: Notwithstanding NPP9, NATIONALCOMPLAINTS must ensure that it has the customers consent (express or implied) before disclosing information to ensure that the Originator duty of confidentiality is complied with.
Principle 10
Sensitive information can only be collected where there is legitimate purpose and:
• The individual has consented......NATIONALCOMPLAINTS requires affirmation that the information is true and reasonably describes complaint situations.
• The collection is authorised by law......NATIONALCOMPLAINTS requires that no personal identifying information is collected in a complaint that is not a branded name or public domain knowledge.
• The collection is necessary to establish, exercise or defend a legal claim......NATIONALCOMPLAINTS must comply with reasonable lawful requests for disclosure.
• Note: A small business with an annual turnover of $3 million or less is not regulated by the Australian Privacy Act unless it:
• is related to a business (that is, its holding company or any subsidiary company) that has an annual turnover of greater than $3 million;......NA
• Provides a health service and holds health information other than in an employee record;......NA
• Discloses personal information about another individual to anyone else for benefit, service or advantage (unless it does so with the consent of the individual concerned or is required or authorised to do so under legislation);......NA
• Provides a benefit, service or advantage to collect personal information about another individual from anyone else (unless it does so with the consent of the individual concerned or is required or authorised to do so under legislation);......NA
• Is a contracted service provider for a Commonwealth contract (even if it is not a party to the contract);......NA as NATIONALCOMPLAINTS is completely independent.
• Is prescribed by regulation; or......NA
• Opts in to the legislation. ......NA
• If the Originator belongs to an organisation regulated by the Privacy Act, or the Originator is not qualified as a small business as explained above, the Originator must comply with the NPP requirements in his/her own collection, use, disclosure and handling of personal information.......NA