Basic guide to IPPs 5-7 - Access and amendment

Openness

Although agencies¹ are not required to record in detail every item of personal information they store, Information Privacy Principle (IPP) 5 requires that an agency must take reasonable steps to ensure that an individual can ascertain:

• whether an agency has control of any documents containing personal information
• the type of personal information that is contained in the documents
• the main purposes for which the personal information is used; and
• how an individual may go about accessing a document that contains their personal information.

Under the Right to Information Act 2009 (Qld) (RTI Act) an agency is required to maintain a publication scheme. This document details the types of information the agency collects, and whether or not such information is made available to the public.

An agency's own privacy policy is an ideal method of ensuring that the agency is compliant with the IPPs, and should be readily available either on their website or in hard copy form upon request. The privacy policy should cover areas including:

• how to make a complaint to the agency
• how to access information held by the agency; and
• what factors an agency must consider prior to releasing information.

Access

There are two separate ways an individual may request to access their personal information:

• by formally applying for access under chapter 3 of the Information Privacy Act 2009 (Qld) (IP Act)²; or
• by simply requesting it for administrative release through IPP 6.

Under chapter 3 an individual can apply to access their personal information by making an application in the approved form, as provided for under section 43 of the IP Act. However, an individual may ask for access under IPP 6, and the agency may process the request administratively through the agency's stated procedure.

An agency may not be bound under IPP 6 to provide individuals with access to documents containing their personal information just because they requested it. An agency has discretion not to provide documents if:

• the agency is authorised under an access law to refuse to provide access to the individual; or
• the requested document is expressly excluded from the operation of an access law.

Amendment

IPP 7 relates to the amendment of personal information, and requires an agency to take all reasonable steps to assure the quality and accuracy of personal information prior to using it. Similar to accessing personal information, there are two separate ways of amending personal information:

• by formally applying for amendment through chapter 3 of the IP Act¹; or
• simply requesting amendment through IPP 7.

Chapter 3 of the IP Act also provides the formal mechanism of amending an individual’s personal information, with IPP 7 authorising amendment to personal information through an administrative scheme. If an application to amend personal information under chapter 3 is refused by an agency, this does not necessarily mean that a breach of IPP 7 has occurred.

When an agency receives a request to amend personal information, the agency may or may not consider whether it is required to amend the personal information in the way the individual requested. This may include situations where the personal information is not being actively used but is still held by the agency. In this case, the agency must make a notation setting out the individual's claims in relation to the information.