1 NPP1 - Collection of personal information

(1) A health agency must not collect personal information unless the information is necessary for 1 or more of its functions or activities.

(2) A health agency must collect personal information only by lawful and fair means and not in an unreasonably intrusive way.

(3) At or before the time or, if that is not practicable, as soon as practicable after, a health agency collects personal information about an individual from the individual, the health agency must take reasonable steps to ensure that the individual is aware of—

(a) the identity of the health agency and how to contact it; and

(b) the fact that he or she is able to gain access to the information; and

(c) the purposes for which the information is collected; and

(d) the entities, or the types of entities, to which the health agency usually discloses information of that kind; and

(e) any law that requires the particular information to be collected; and

(f) the main consequences, if any, for the individual if all or part of the information is not provided.

(4) If it is reasonable and practicable to do so, a health agency must collect personal information about an individual only from that individual.

(5) If a health agency collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is or has been made aware of the matters listed in subsection (3) except to the extent that—

(a) the personal information is collected under NPP 9(1)(e); or

(b) making the individual aware of the matters would pose a serious threat to the life, health, safety or welfare of an individual.

(6) If the information is required under a statutory collection, a health agency is not required to ensure that the individual is or has been made aware of the matters listed in subsection (3).

(7) In this section—

statutory collection means—

(a) a register or other collection of personal information that a health agency is authorised or required to maintain under an Act for monitoring public health issues, including, for example, by identifying morbidity and mortality trends, planning and evaluating health services or facilitating and evaluating treatments; or

(b) personal information collected by a health agency under an Act requiring a person to give information to the health agency.