Whenever an agency collects personal information1 from an individual, Information Privacy Principle (IPP) 2 in the Information Privacy Act 2009 (Qld) (IP Act) requires that the agency takes all reasonable steps to make the individual generally aware of certain information.
For the purposes of this guideline, this information will be referred to as a 'collection notice'. This guideline explains when a collection notice is necessary, what a collection notice needs to contain, and how a collection notice may be communicated.
When do I need to provide a collection notice?
IPP 2 applies only where you are collecting personal information directly from the individual it is about, and where the information will be included in a document or a generally available publication.
The obligations in IPP 2 do not arise if you are collecting personal information from a third party, where you have received unsolicited information2 or where personal information is collected verbally and is never recorded in a document.3
What do I need to include in a collection notice?
You must take all reasonable steps to make an individual generally aware of:
- why the information is being collected
- details of any law that allows or requires the collection; and
- any entity to whom it is the agency's usual practice to give the information, and (if known) anyone who they will in turn give it to.
Purpose of collection
The purpose needs to be clearly stated and should be more specific than a general reference to a broad function. The aim is to provide enough information for a person to understand why the information is being collected and/or what it will be used for.
Providing information about who the individual’s personal information is usually provided to will enable your agency to satisfy the disclosure exemption in IPP 11(1)(a).
How much detail you provide will depend on the circumstances. If, for example the information is collected through the use of a form and the purpose of the collection is straightforward and simple, then the title of the form may be sufficient to inform the person of the purpose. Alternatively, a more detailed notice may be needed where the information being collected will be used for more than one purpose.
Legal authority for the collection
An agency is not prevented from collecting personal information in the absence of any legal authority or requirement to do so.
However, if there is a law that requires or authorises the collection of personal information, then you must tell the individual of this fact and include details about that law in the collection notice.
Include only those laws that create an explicit authority or obligation for your agency to collect personal information4, rather than legislation that broadly details the nature and extent of your agency’s responsibilities and powers.
If it is your agency’s usual practice to pass any of the personal information being collected to a third party, then you must include details about this disclosure in the collection notice. This includes (if known by your agency), any details of any entity to whom the information will be passed in turn.
Generally, it is an agency’s usual practice to disclose personal information if there is a standing arrangement to provide that information, or the agency regularly discloses the information in order to meet a legislative obligation. It is not an agency’s usual practice to disclose information if it gives the information in response to irregular requests or in exceptional cases.
If your agency collects personal information with the intention of publishing or disseminating it, eg online or in a document which will be available to the public, this should be made clear to an individual at the time of collection.
How can I can give a collection notice?
The IP Act does not set out how a collection notice is to be communicated. Some practical examples include:
- A written notice which is readily accessible on the agency’s website, included on the forms which are used by the agency to collect information, sent with introductory correspondence, and/or made available through signage.
- Included in a verbal notice which is made available as a recorded option for incoming telephone calls. or set out in a script which is read out to individuals by staff.
Ideally, a collection notice will be automatically incorporated into the collection process, eg included on the collection form. If a verbal collection notice is given, you may wish to make a written record of the fact that a collection notice was communicated to the individual5.
When should I give a collection notice?
If practicable, you should provide the collection notice before, or at the same time as, the information is collected. Otherwise, IPP 2 provides that the agency may provide the individual with a collection notice as soon as practicable after the personal information is collected.
Whether providing the collection notice before or at the time of collection is practicable or not can be determined by considering the nature of the information being collected and the circumstances surrounding the collection.6
For example, circumstances where it may be impracticable to provide a collection notice before or at the time of collection include where there is an urgency to the collection, or where it may endanger an employee.
However, an agency is required to take all reasonable7 steps to give an individual a collection notice. Even if it is not practicable to do so before the collection, you should still consider if a collection notice could be provided after the fact in these circumstances.
Are there any circumstances in which a collection notice is not required?
IPP 2(5) sets out that an agency is not required to provide a collection notice to an individual if the personal information is collected in the context of delivering an emergency service.
Under section 29 of the IP Act, a law enforcement agency is exempt from the obligation to give a collection notice if they are satisfied on reasonable grounds that non-compliance is necessary in order to achieve or carry out its enforcement functions.
It is not enough for an agency to simply show that it has a law enforcement function. The agency must be satisfied on reasonable grounds that noncompliance with IPP 2 is necessary in order to achieve or carry out the enforcement function in question.
Is there a standard collection notice I can use?
Just as one size of clothing does not fit all, so too does a collection notice need to be tailored to fit each particular collection. Unclear or generic collection notices can be a source of dissatisfaction for the individual concerned.
Consider the following examples:
|The personal information collected on this form will be used for the purposes of delivering our functions and activities.||The collection notice does not provide sufficient detail for an individual to understand how their information will be used.|
|The Ministry of Silly Walks is collecting your personal information for the purpose of providing you with training. The collection of this information is authorised under the Ministry Walks Act 2015.||The Ministry Walks Act establishes the Ministry of Silly Walks and its responsibilities and powers. Unless there are specific provisions in this Act that authorise the Ministry to collect certain personal information it is not necessary to reference this Act in the collection notice.|
|We are collecting your personal information for the purpose of registering your licence to operate a food business. We are required to do this under section 555A of the Norovirus Act 2002.|
Your information may be provided to other Councils and to Queensland State Government as required.
|The collection notice is clear about why the information is being collected and the legislative authority for the collection. |
However there is insufficient detail for an individual to identify the third parties to whom their personal information will be disclosed. It also appears that the information will be provided upon request rather than that it is the usual practice of the Council to pass on this information.
|We will use the personal information you have provided to assess whether you are eligible to become a registered assessor of when workplace fridges require cleaning. We are authorised to collect this information under section 17BB of the Biohazard Act 1983. |
If your application is successful, we will pass details of your registration to the Department of Hazardous Waste.
|This collection notice ticks all the boxes. |
It provides sufficient information for a person to understand the purpose for which their personal information will be used.
Specific reference to the legislative authority for the collection is provided and it clearly identifies the entities to whom the personal information will be disclosed.
- 1 Personal information is defined in section 12 of the IP Act. It is a broad definition that encompasses any information about an individual who can be identified directly from the information, or whose identity can be reasonably ascertained by reference to other information.
- 2 If an agency provides a way for people to send it specific information and/or invites them to do so then information provided in response is not unsolicited information. An example of unsolicited information is where an agency receives a resume and they have not advertised an open position that the individual is specifically applying for.
- 3 The Acts Interpretation Act 1954 (Qld) defines documents to include paper or other material with writing or meaningful marks, symbols or figures on it, and any disc, tape or other article from which images, writing or messages can be produced.
- 4 For example, section 47 of the Animal Management (Cats and Dogs) Act 2008 (Qld) which specifically states what personal information must be collected when an individual applies to register a dog in the relevant local government’s area.
- 5 For example, it may be necessary to keep a record that a verbal collection notice was communicated if your agency intends to rely on IPP 11(1)(a) to disclose the personal information.
- 6 For a detailed discussion on the meaning of ‘practicable’ see Key privacy concepts – practicable and impracticable.
7 See Key privacy concepts – ‘reasonable’ for more information.
Current as at: June 5, 2017