Agencies are required to comply with the Information Privacy Principles (IPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act).
IPP 10 provides that personal information may only be used for the purpose for which it was obtained and not for any other purpose, unless one of the exceptions applies.
One of the exceptions to IPP 10 is that the use to which the agency is going to put the information is directly related to the use for which it was collected.
Use for a directly related purpose – IPP 10(1)(e)
(1) An agency having control of a document containing personal information that was obtained for a particular purpose must not use the information for another purpose unless—
(e) the other purpose is directly related to the purpose for which the information was obtained.
Examples for paragraph (e)—
1 An agency collects personal information for staff administration purposes. A new system of staff administration is introduced into the agency, with much greater functionality. Under this paragraph, it would be appropriate to transfer the personal information into the new system
2 An agency uses personal information, obtained for the purposes of operating core services, for the purposes of planning and delivering improvements to the core services.
An agency should always have a specific purpose in mind when collecting personal information. This purpose forms the basis of the collection notice under IPP 2, and assists in determining if there is a secondary related purpose for which it can be used.
Where an organisation collects personal information indirectly, from someone other than the individual concerned, a guide to determining the primary purpose of its collection can be to examine what the organisation did with the information after it was first received.
Personal information may be used under IPP 10(1)(e) for a secondary purpose if it is directly related to the primary purpose. The onus lies on the agency to establish that the secondary purpose is sufficiently related to the primary purpose to satisfy the 'directly related' requirement under IPP 10(1)(e).
The contemplated secondary purpose must be connected to or associated with the primary purpose, or arise in the context of the primary purpose. There must be a close relationship between the purpose of the use and the purpose for which the personal information was obtained.
A 'directly related purpose' is one which is closely associated with the original purpose, even if it is not strictly necessary to achieve that purpose. If the related purpose is administrative, it must be one that people would reasonably expect to be associated with the original purpose.
Some examples where the secondary use of personal information is directly related to the purpose for which that information is obtained are where:
- an agency uses information obtained for the purpose of operating a program for the purpose of monitoring, evaluating, auditing or managing that program
- an agency uses information obtained for the purpose of investigating complaints for the purpose of conducting follow up surveys and reporting survey results to Parliamentary Committees
- secondary use of personal information to a debt collector where the person incurred a fee for a service performed and the debt collector is recovering it on behalf of the agency. This is to be distinguished from the selling of a debt to a debt collection agency who then recovers it for themselves.
Current as at: June 19, 2013