Page 183 - DCAP309_INFORMATION_SECURITY_AND_PRIVACY

Unit 12: Security Metrics and Privacy

12.9.2 IPP 2: Use and Disclosure Notes

Use and reveal personal information simply for the main purpose for which it was composed or
a related reason the person would sensible expect. Use for some particular secondary purposes
without approval is permitted. Or else, ask for consent.
To resolve how personal information can next be used and who it can be revealed to requires an
understanding of the chief purpose that the information is composed for. If the needs of IPP 1:
Collection have been fulfilled, the main purpose should be apparent and should have been conversed
to the person at the time of compilation.

This principle positions limits on the use of personal information for secondary reasons. Simply,
use for an unconnected secondary purpose or one that the person could not expect should only
happen with the person’s approval or if a strong public interest needs it. This principle includes
the following:

1. An agency must not utilize or reveal personal information about an individual for a
reason (the secondary reason) other than the main purpose for collecting it, unless one or
more of the following apply:

(a) If the information is receptive information - the secondary reason is directly
connected to the primary reason; and the individual would reasonably anticipate
the organization to use or reveal the information for the secondary purpose.
(b) If the information is not receptive information, the secondary reason is related to
the main purpose and the individual would reasonably anticipate the organization
to use or reveal the information for the secondary reason.
(c) The individual approval to the use or revelation of the information.

(d) An agency sensibly believes that the use or revelation is necessary to lessen or
prevent a serious and imminent threat to the individual’s or another individual’s
life, health or safety; or a serious danger to public health or public safety.

(e) An agency has motive to suspect that unlawful activity has been, is being or may be
occupied in and uses or reveals the information as a necessary part of its investigation
of the matter or in reporting its issues to relevant persons or authorities.
(f) The use or revelation is needed or authorized by law.
(g) An agency sensibly believes that the use or disclosure is sensibly necessary for one
or more of the following by or on behalf of a law enforcement agency:
(i) preventing, detecting, investigating, prosecuting or punishing an offence or a
breach of a prescribed law.
(ii) enforcing a law relating to the confiscation of proceeds of crime.
(iii) protecting public revenue.
(iv) preventing, detecting, investigating or remedying seriously improper conduct
or prescribed conduct.
(v) preparing for or conducting events before a court or tribunal or implementing
the orders of a court or tribunal.
(h) The Australian Security Intelligence Organisation (ASIO) has demanded the agency
to reveal the information, the disclosure is made to an officer or employee of ASIO.

(i) Authorised by the Director-General of ASIO to obtain the information and an officer
or employee of ASIO authorized by the Director-General of ASIO to do so has

LOVELY PROFESSIONAL UNIVERSITY 177