Privacy Code of Practice (General) 2003 Part 1 Preliminary 1 Name of Code This Code is the Privacy Code of Practice (General) 2003. 2 Operation of Code This Code modifies the application of the information protection principles and public register provisions of the Act. 3 Limitations Nothing in this Code: (a) (Repealed) (b) affects a disclosure that is otherwise permitted by law (including, but not limited to, a disclosure made pursuant to the State Records Act 1998 or the Government Information (Public Access) Act 2009), or (c) prevents an agency from disclosing personal information with the consent of the individual to whom the information relates. 4 Definitions (1) In this Code: agency means a public sector agency. information protection principles means the principles set out in Division 1 of Part 2 of the Act. public register provisions means the provisions of Part 6 of the Act. the Act means the Privacy and Personal Information Protection Act 1998. Note— The Act and the Interpretation Act 1987 contain definitions and other provisions that affect the interpretation and application of this Code. (2) Notes included in this Code do not form part of this Code. Part 2 Inter-agency transfers of personal information 5 Application of Part This Part applies to the exchange of personal information between the agencies specified in Schedule 1. 6 Permitted transfers of personal information The information protection principles are modified to the extent necessary to permit the transfer between the agencies, of the personal information, and for the purposes, described in Schedule 1. Part 3 Public registers 7 Application of Part This Part applies to the disclosure of personal information contained in public registers. 8 Modification of Part 6 of the Act (1) Part 6 of the Act is modified to the extent necessary to permit a disclosure referred to in subclause (2). (2) An agency specified in Column 2 of Schedule 2 that is responsible for keeping a public register (or that part of a register) described in Column 1 may, subject to any conditions set out in Column 1, disclose personal information kept in the register (or part of the register) without being satisfied that the information is to be used for a purpose relating to the purpose of the register or the Act under which the register is kept. Part 4 Human services 9 Definition In this Part: human services agency means a public sector agency that provides any one or more of the following types of services to the public: (a) welfare services, (b) health services, (c) mental health services, (d) disability services, (e) drug and alcohol treatment services, (f) housing and support services, (g) education services. 10 Collection, use and disclosure of personal information by human services agencies (1) In this clause: allied agency means an agency (other than a public sector agency) that is wholly or partly funded by a human services agency and that is approved in writing by the head of that human services agency as an allied agency for the purposes of this clause. senior officer means a senior member of staff of a human services agency who has been nominated in writing for the purposes of this clause by the head of that agency. substantial adverse impact includes, but is not limited to, serious physical or mental harm, significant loss of benefits or other income, imprisonment, loss of housing or the loss of a carer. (2) Despite the information protection principles, a human services agency may collect and use personal information about an individual, and may disclose personal information about the individual to another human services agency or an allied agency, if the collection, use or disclosure is in accordance with a written authorisation given by a senior officer of the agency. (3) An authorisation under subclause (2) must specify: (a) the period (maximum 12 months) for which the authorisation has effect, and (b) the classes of personal information to which the authorisation is to apply (the specified information), and (c) the human services agencies or allied agencies (if any) to whom the specified information may be disclosed (the specified agencies). (4) A senior officer may give an authorisation under subclause (2) only if the officer is satisfied that: (a) the individual to whom the specified information relates is a person to whom services are provided or proposed to be provided by a human services agency or an allied agency, and (b) the individual (or a person authorised by or under the Act or any other law to give consent on the individual's behalf) has failed to consent to the agency collecting or using the specified information, or disclosing the specified information to the specified agencies, and (c) there are reasonable grounds to believe that there is a risk of substantial adverse impact on the individual or some other person if collection or use of the specified information, or disclosure of the specified information to the specified agencies, does not occur, and (d) the collection or use of the specified information, or disclosure of the specified information to the specified agencies, is likely to assist in developing or giving effect to a case management plan or service delivery plan that relates to the individual, and (e) reasonable steps have been taken to ensure that the individual has been notified by the agency of each of the following: (i) the specified information, (ii) the specified agencies, (iii) the period for which the authorisation is proposed to be sought to have effect. Note— Notification under this paragraph would normally be in writing. However, other notification methods may be more appropriate in the case of certain clients. For example, if the client is illiterate. 11 Collection of personal information from and about third parties (1) A human services agency is not required to comply with section 9 of the Act if it is unreasonable or impracticable in the circumstances to do so. (2) A human services agency is not required to comply with section 9 or 10 of the Act if: (a) the personal information collected is about an individual other than a relevant client of the agency, and (b) the personal information is collected from any of the following: (i) a relevant client, (ii) a non-government organisation engaged by the agency to provide services for or to it, (iii) another human services agency, and (c) the personal information is reasonably relevant and reasonably necessary to enable the agency to provide services to a relevant client. (3) In this clause: relevant client of a human services agency means an individual to whom the agency is providing welfare services, health services or mental health services. Part 5 Correctional services 12 Definitions (1) In this Part: correctional centre and correctional complex have the same meanings as in the Crimes (Administration of Sentences) Act 1999. Department means the Department of Justice and Attorney General. NSW Police Force has the same meaning as in the Police Act 1990. offender means a person who is one or more of the following: (a) an offender within the meaning of section 3 (1) or 107 of the Crimes (Administration of Sentences) Act 1999, (b) a person in custody within the meaning of section 249 of the Crimes (Administration of Sentences) Act 1999, (c) a person who is the subject of a parole order within the meaning of the Crimes (Administration of Sentences) Act 1999, (d) a person who is the subject of an intensive correction order, a community correction order, a conditional release order (with or without conviction), an intervention program order, a non-association order or a place restriction order within the meaning of the Crimes (Sentencing Procedure) Act 1999 that is in force, (e) a person who has been granted bail and in respect of whom a court has sought a pre-sentence report from the Department. provide services and programs to an offender includes the preparation of a case plan for the offender and any assessment of the offender's suitability for, or conduct in, a program. staff member means a member of staff of the Department and includes: (a) a person working under contract, and (b) an Official Visitor appointed under section 228 of the Crimes (Administration of Sentences) Act 1999, and (c) a minister of religion or other spiritual advisor appointed to a correctional centre pursuant to a regulation made under section 79 (x1) of the Crimes (Administration of Sentences) Act 1999. transitional centre has the same meaning as in the Crimes (Administration of Sentences) Act 1999. victim means a victim of crime within the meaning of section 5 of the Victims Rights Act 1996. (2) For the purposes of this Part, the following services or programs provided to an offender are taken to be provided by the Department: (a) a service or program provided on behalf of the Department, (b) a service or program provided because of a requirement placed on the offender by a court or any of the following bodies within the meaning of the Crimes (Administration of Sentences) Act 1999: (i) the Parole Authority, (ii) the Review Council, (iii) the Probation and Parole Service. 13 Collection from a person other than the individual The Department is not required to comply with section 9 of the Act in relation to personal information collected by the Department in any of the following circumstances: (a) the information is collected from the NSW Police Force or the Australian Crime Commission and is about: (i) a criminal charge or criminal conviction against a staff member (including the making of an apprehended violence order against the staff member) that may affect the staff member's suitability for employment, or (ii) an application for, or the making of, an apprehended violence order against an offender, (b) the information is about an offender and collection from a person other than the offender is reasonably necessary to enable the Department: (i) to protect the safety, welfare or well-being of the offender, or (ii) to supervise the offender effectively, or (iii) to provide services and programs to the offender effectively, (c) the collection is reasonably necessary to enable the Department: (i) to maintain the security or good order of a correctional complex, correctional centre or transitional centre, or (ii) to verify information about an individual supplied to it by the individual, or (iii) to organise a conference or mediation between an offender and a victim of that offender, or (iv) to compile statistical data, but only if it is impractical to collect the information directly from the individual to whom it relates and the information is not information of a kind referred to in section 19 (1) of the Act, or (v) to investigate an allegation of misconduct against a staff member. 14 Collection and use of personal information and information about personal information held by the Department (1) The Department is not required to comply with section 10, 11 (b), 13 or 17 of the Act if non-compliance is reasonably necessary to enable the Department to do one or more of the following: (a) to protect the safety, welfare or well-being of a person, (b) to supervise an offender effectively, (c) to provide services and programs to an offender effectively, (d) to maintain the security or good order of a correctional complex, correctional centre or transitional centre, (e) to exercise properly the Department's complaint handling or investigative functions, (f) to carry out disciplinary or other proceedings before a court or tribunal, (g) to prepare a comprehensive report to a court, tribunal or other relevant statutory body. (2) The Department is not required to comply with section 10, 13 or 17 of the Act if non-compliance is reasonably necessary to enable the Department to prevent the disclosure of: (a) intelligence information provided by an investigative agency or law enforcement agency, or (b) the identity of an informant or a victim, or (c) the existence of a surveillance operation. (3) The Department is not required to comply with section 17 of the Act if non-compliance is reasonably necessary to enable the Department to organise a conference or mediation between an offender and a victim of that offender. 15 Alteration of personal information The Department is not required to comply with section 15 of the Act in relation to personal information if: (a) the information has been obtained in the course of an investigation, and (b) the person who is the subject of the information seeks to have the information amended during the investigation, and (c) amending the information at that time will detrimentally affect (or prevent the proper exercise of) the Department's complaint handling functions or any of its investigative functions, and (d) the information will be amended as soon as practicable after the conclusion of the investigation. 16 Disclosure of personal information The Department is not required to comply with section 18 or 19 (1) of the Act if non-compliance is reasonably necessary to enable the Department to do one or more of the following: (a) to protect the safety, welfare or well-being of a person, (b) to provide services and programs to an offender effectively, (c) to permit one or more of the following to exercise its functions properly in relation to an offender: (i) the Department of Family and Community Services, (ii) the Ministry of Health, (iii) the Justice Health and Forensic Mental Health Network, Note— This does not permit the Department to disclose health information as health information is regulated by the Health Records and Information Privacy Act 2002. (d) to disclose personal information to a person for the purposes of an investigation, but only if the disclosure is made to a person: (i) to verify the information, or (ii) to obtain professional or technical advice about the information. Part 6 Community care 17 Interpretation (1) In this Part and in Schedule 3: authorised employee of a community care agency means: (a) if the agency is a Government Department (or part of a Government Department)—an employee of the Department appointed by the Secretary of the Department, or (b) if the agency is the Civil and Administrative Tribunal—a member of staff of the Tribunal appointed by the President of the Tribunal. community care agency means any of the following: (a) the Department of Family and Community Services (including any office or branch of the Department or any Public Service executive agency that is related to the Department for the purposes of the Government Sector Employment Act 2013), (b) Juvenile Justice in the Department of Justice, (c) the Civil and Administrative Tribunal. personal information custodian, of an individual, means any of the following: (a) the individual's guardian (within the meaning of the Guardianship Act 1987), (b) the individual's attorney (within the meaning of the Powers of Attorney Act 2003), (c) the spouse of the individual, if the relationship between the individual and the spouse is close and continuing, (d) a person who has the care of the individual (within the meaning of the Guardianship Act 1987), (e) a close friend or relative of the individual (within the meaning of the Guardianship Act 1987). spouse means: (a) the person to whom a person is legally married (including the husband or wife of a person), or (b) a de facto partner, but where more than one person would so qualify as a spouse, means only the last person so to qualify. Note— "De facto partner" is defined in section 21C of the Interpretation Act 1987. (2) If any personal information that relates to an individual has been collected by a community care agency for any purpose related to the provision of services to the individual, that information is, for the purposes of Schedule 3, taken to have been collected also for the following purposes: (a) to ensure the provision of appropriate services to an individual (whether by the community care agency or another body or person), (b) to ascertain the appropriate priority or placement of the individual in a service, (c) to prevent harm to the individual or others, (d) to ensure compliance with the occupational health and safety laws by the agency. 18 Modification of certain information protection principles The information protection principles are modified in their application to community care agencies as set out in Schedule 3. Part 7 Registry of Births, Deaths and Marriages 19 Collection, use and disclosure for document validation services (1) Despite the information protection principles, the Registry of Births, Deaths and Marriages may collect, use or disclose personal information for the verification (by way of a validation service) of personal information contained in a proof of identity document issued by the Registrar of Births, Deaths and Marriages if: (a) the document has been presented to a government or non-government agency or organisation authorised to use the validation service, and (b) the collection, use or disclosure is in accordance with any applicable operating protocols of the validation service. (2) In this clause: validation service means: (a) the CertValid certificate validation service operated by the Registry of Births, Deaths and Marriages, or (b) the National Document Verification Service managed by the Commonwealth Attorney-General's Department. 20, 21 (Repealed) Part 8 Domestic Violence Intervention Court Model 22 Definitions In this Part: domestic relationship has the same meaning as in the Crimes (Domestic and Personal Violence) Act 2007. domestic violence offence has the same meaning as in the Crimes (Domestic and Personal Violence) Act 2007. person who has been charged with an offence has the same meaning as it has in the Law Enforcement (Powers and Responsibilities) Act 2002. scheme—see clause 23. victim of domestic violence means a person who has been, or who is alleged to have been, the victim of a domestic violence offence. 23 The scheme (1) In this Part: scheme means the scheme known as the Domestic Violence Intervention Court Model. (2) The objects of the scheme are as follows: (a) to ensure the safety of victims of domestic violence and persons in domestic relationships with those victims, (b) to ensure that persons who have been charged with domestic violence offences are dealt with appropriately, (c) to prevent persons who commit domestic violence offences from re-offending, (d) to improve the coordination of services to victims of domestic violence and persons in domestic relationships with those victims, (e) to ensure domestic violence matters are effectively managed throughout the criminal justice process. 24 Persons to whom Part applies This Part applies to the following persons: (a) a person who has been charged with a domestic violence offence by a police officer in the Campbelltown, Macquarie Fields or Wagga Wagga Local Area Command within the NSW Police Force, (b) a person against whom proceedings for a domestic violence offence have been commenced in (or moved or adjourned to) the Local Court at Campbelltown, Junee, Temora or Wagga Wagga, (c) a victim of domestic violence in respect of an offence referred to in paragraph (a) or (b), (d) a person in a domestic relationship with a victim referred to in paragraph (c). 25 Non-compliance with certain information protection principles A public sector agency that participates in the scheme is not required to comply with section 8 (1), 9, 10, 11, 13, 15, 17, 18 or 19 (1) of the Privacy and Personal Information Protection Act 1998 in respect of the collection, use or disclosure of, or any dealings with, personal information about a person to which this Part applies, if that collection, use, disclosure or dealing is: (a) for the purposes of the scheme, and (b) done in accordance with the privacy procedures for the scheme that are approved by the Minister from time to time. 26 Access to personal information by victims A public sector agency that participates in the scheme is not required to comply with section 14 of the Privacy and Personal Information Protection Act 1998 in respect of personal information about a person to which this Part applies that is held for the purposes of the scheme, unless the person is a victim of domestic violence. Schedule 1 Permitted transfers of personal information (Clause 6) 1 Verification of vehicle ownership details by Sheriff (1) Agencies exchanging personal information Roads and Traffic Authority, Department of Justice and Attorney General. (2) Type of personal information Vehicle registered operator details. (3) Purpose for which information is exchanged To permit the Sheriff to verify vehicle registered operator details in connection with the proposed or actual seizure of a vehicle. 2 Environmental offences involving vehicles (1) Agencies exchanging personal information Roads and Traffic Authority, Environment Protection Authority. (2) Type of personal information Vehicle registered operator details. (3) Purpose for which information is exchanged To permit the Environment Protection Authority to contact the operator of a vehicle when it has received a report about an environmental offence concerning the vehicle. Schedule 2 Modification of Part 6 of the Act (Clause 8) Column 1 Column 2 Public register Agency responsible for keeping the register 1 The record maintained under section 58 of the Contaminated Land Management Act 1997, however, this exception does not extend to the name of an individual who is the occupier, owner or polluter of a contaminated site or the address of such an individual if the individual does not reside at a contaminated site. Environment Protection Authority 2 The registers listed in regulation 15.1 of the Road Transport Reform (Dangerous Goods) Regulations 1997 of the Commonwealth that apply in New South Wales as the Road Transport Reform (Dangerous Goods) (New South Wales) Regulations under the Road and Rail Transport (Dangerous Goods) Act 1997, however, this exception does not extend to information relating to the medical condition or the driving history of an individual. Environment Protection Authority 3 The Credit Register for the tradeable emission scheme known as the Hunter River Salinity Trading Scheme, made publicly available by the EPA through the Internet, comprising the name and contact details of a member of the Scheme or an employee or agent of that member and the member's business facilities, credit holdings and trading history. Environment Protection Authority 4 The information made publicly available by the EPA through the Internet concerning the Waste Reduction Grants Program paid from the Waste Fund set up under section 19 of the Waste Avoidance and Resource Recovery Act 2001 comprising the name and contact details of the person awarded the grant, or an employee or agent of that person, the amount of the grant, the grant number and the details of the project for which the grant was given. Environment Protection Authority 5 The information made publicly available by the EPA through the Internet concerning grants made under the Stormwater Trust Grants Scheme administered by the EPA comprising the name and contact details of the person offered the grant, or an employee or agent of that person, the amount of the grant, the grant number and the details of the project for which the grant was offered. Environment Protection Authority 6 The public register kept under Part 9.5 of the Protection of the Environment Operations Act 1997. Environment Protection Authority 7–18 (Repealed) Schedule 3 Modification of information protection principles applying to community care agencies (Clause 18) 1 Section 9: Collection of personal information (1) Despite section 9 of the Act, a community care agency may, if the individual to whom personal information relates lacks the capacity to provide the information and the information is being collected for the primary purpose of providing services to the individual: (a) collect the information from any of the following persons: (i) the individual's guardian (within the meaning of the Guardianship Act 1987), (ii) the individual's attorney (within the meaning of the Powers of Attorney Act 2003), (iii) the spouse of the individual, if the relationship between the individual and the spouse is close and continuing, (iv) a person who provides domestic services or support for the individual, or who arranges for domestic services or support to be provided to the individual, (v) a person who has the care of the individual (within the meaning of the Guardianship Act 1987), (vi) a close friend or relative of the individual (within the meaning of the Guardianship Act 1987), and (b) if the information cannot be collected from a person referred to in paragraph (a), collect the information from another person. (2) A community care agency is not required to comply with section 9 of the Act or subclause (1) if it is unreasonable or impracticable in the circumstances to do so. 2 Section 10: Requirements when collecting personal information If the individual to whom personal information relates lacks the capacity to understand the matters listed in section 10 of the Act, the community care agency must, instead of complying with that section: (a) make a record of those matters in its files and ensure that the record is readily accessible by: (i) if the individual regains capacity, the individual, or (ii) any personal information custodian of the individual, or (iii) the agency itself, and (b) inform a personal information custodian of the individual of those matters. 3 Section 14: Access to personal information held by agencies Without limiting section 14 of the Act, if a community care agency holds personal information that relates to an individual who lacks capacity to understand that personal information or the purpose for which it was collected (or is to be used), the agency must, at the request of a personal information custodian of the individual and without excessive delay or expense, provide that custodian with access to the information. 4 Section 15: Alteration of personal information (1) Without limiting section 15 of the Act, if a community care agency holds personal information that relates to an individual who lacks capacity to understand that personal information or the purpose for which it was collected (or is to be used), the agency must, at the request of a personal information custodian of the individual, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a community care agency is not prepared to amend personal information in accordance with a request by an individual's personal information custodian, the agency must, if so requested by the custodian, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this clause, the individual to whom the information relates and the individual's personal information custodian is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the agency. 5 Section 16: Agency must check accuracy of personal information before use Without limiting section 16 of the Act, for the purposes of that section, reasonable steps to ensure information is relevant, accurate, up to date, complete and not misleading include: (a) making inquiries of the individual concerned, or (b) in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used), making inquiries of a relevant personal information custodian of the individual. 6 Section 17: Limits on use of personal information (1) Despite section 17 of the Act, a community care agency that holds personal information that relates to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may use the information for a purpose other than that for which it was collected if: (a) a personal information custodian of the individual has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. (2) Despite section 17 of the Act and subclause (1) (a), a community care agency that holds personal information in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may use the information for a purpose other than that for which it was collected without the consent of a personal information custodian of the individual, if: (a) no personal information custodian of the individual exists or can be found, and (b) an employee of the community care agency (who is authorised by the head of that agency to act for individuals who have no personal information custodian) consents to that use of the information on the grounds that the use is in the best interests of the individual, and (c) the community care agency records details of that use of the information in its files and ensures that the record is readily accessible by: (i) if the individual regains capacity, the individual, or (ii) if the individual gains a personal information custodian, the personal information custodian, or (iii) the agency itself. 7 Section 18: Limits on disclosure of personal information (1) Despite section 18 of the Act, a community care agency that holds personal information that relates to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may disclose the information to a person other than the individual to whom the information relates, or another body (whether or not such other person or body is a public sector agency), if: (a) the disclosure is directly related to the purpose for which the information was collected, or (b) a personal information custodian of the individual has consented to the disclosure of the information for that other purpose, or (c) the disclosure is made to a personal information custodian of the individual. (2) Despite subclause (1) (b), a community care agency that holds personal information in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may disclose the information to a person (other than the individual to whom the information relates) or other body without the consent of a personal information custodian of the individual, if: (a) no personal information custodian of the individual exists or can be found, and (b) an employee of the community care agency (who is authorised by the head of that agency to act for individuals who have no personal information custodian) consents to the disclosure on the grounds that the disclosure is in the best interests of the individual, and (c) the community care agency records details of the disclosure in its files and ensures that the record is readily accessible by: (i) if the individual regains capacity, the individual, or (ii) if the individual gains a personal information custodian, the personal information custodian, or (iii) the agency itself. (3) If personal information is disclosed in accordance with this clause to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 8 Section 19: Special restrictions on disclosure of personal information Despite section 19 of the Act, a community care agency may disclose personal information of an individual who lacks capacity to understand the personal information relating to the individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities if: (a) a personal information custodian of the individual has consented to the disclosure of the information, or (b) the agency believes on reasonable grounds the disclosure of the personal information is necessary to give effect to the purpose for which the personal information was collected. Example— If, in collecting personal information about an individual for the purpose of providing services, a community care agency collected the information that the individual was a member of a religious group with strict dietary rules, the agency may disclose that information to a person providing such services where it is necessary, ie where a service provider is preparing food for the individual. 9 Involvement of individual to whom personal information relates A community care agency must, when exercising a function under a provision of this Schedule that requires the consent of a personal information custodian of an individual, take such steps as are reasonably practicable to involve the individual in the provision of that consent.