What agencies must not do with your personal information (IPP 8 – 11) and the transfer of personal information overseas

There are rules which govern the use, disclosure and transfer of personal information by agencies (and bound contracted service providers). The basic rules are:

• Before using personal information, agencies should check it is accurate, complete and up-to-date (IPP 8).
• If the agency holds a range of information about an individual, the agency should only use those parts of the information required for a particular purpose (IPP 9).
• Agencies should generally only use personal information for the purpose it was collected (IPP 10).
• Agencies should generally not give personal information to anyone outside the agency (IPP 11).
• Personal information must not be transferred outside of Australia except in limited circumstances. This commonly applies where an agency posts personal information online, for example, on its website.