Although agencies1 are not required to record in detail every item of personal information they store, Information Privacy Principle (IPP) 5 requires that an agency must take reasonable steps to ensure that an individual can ascertain:
- whether an agency has control of any documents containing personal information
- the type of personal information that is contained in the documents
- the main purposes for which the personal information is used; and
- how an individual may go about accessing a document that contains their personal information.
Under the Right to Information Act 2009 (Qld) (RTI Act) an agency is required to maintain a publication scheme. This document details the types of information the agency collects, and whether or not such information is made available to the public.
- how to make a complaint to the agency
- how to access information held by the agency; and
- what factors an agency must consider prior to releasing information.
There are two separate ways an individual may request to access their personal information:
- by formally applying for access under chapter 3 of the Information Privacy Act 2009 (Qld) (IP Act)2; or
- by simply requesting it for administrative release through IPP 6.
Under chapter 3 an individual can apply to access their personal information by making an application in the approved form, as provided for under section 43 of the IP Act. However, an individual may ask for access under IPP 6, and the agency may process the request administratively through the agency's stated procedure.
An agency may not be bound under IPP 6 to provide individuals with access to documents containing their personal information just because they requested it. An agency has discretion not to provide documents if:
- the agency is authorised under an access law to refuse to provide access to the individual; or
- the requested document is expressly excluded from the operation of an access law.
IPP 7 relates to the amendment of personal information, and requires an agency to take all reasonable steps to assure the quality and accuracy of personal information prior to using it. Similar to accessing personal information, there are two separate ways of amending personal information:
- by formally applying for amendment through chapter 3 of the IP Act1; or
- simply requesting amendment through IPP 7.
Chapter 3 of the IP Act also provides the formal mechanism of amending an individual’s personal information, with IPP 7 authorising amendment to personal information through an administrative scheme. If an application to amend personal information under chapter 3 is refused by an agency, this does not necessarily mean that a breach of IPP 7 has occurred.
When an agency receives a request to amend personal information, the agency may or may not consider whether it is required to amend the personal information in the way the individual requested. This may include situations where the personal information is not being actively used but is still held by the agency. In this case, the agency must make a notation setting out the individual's claims in relation to the information.
- 1 In this Guideline references to an 'agency' also include Ministers and bound contracted service providers, unless otherwise specified. [up]
- 2 Formal applications may not be made to bound contracted service providers as they are not required to comply with chapter 3 of the IP Act or the RTI Act. [up]
- 3 Formal applications may not be made to bound contracted service providers as they are not required to comply with chapter 3 of the IP Act or the RTI Act. [up]
Current as at: January 5, 2012