Agencies1 are required to comply with the Information Privacy Principles (IPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act).
Under IPP 10, an agency can only use personal information2 for the reason it was collected, unless one of the exceptions in IPP 10(1) applies. IPP 10(1)(e) allows an agency to use personal information for a purpose directly related to the purpose for which it was collected.
(1) An agency having control of a document containing personal information that was obtained for a particular purpose must not use the information for another purpose unless—
(e) the other purpose is directly related to the purpose for which the information was obtained.
Examples for paragraph (e)—
1 An agency collects personal information for staff administration purposes. A new system of staff administration is introduced into the agency, with much greater functionality. Under this paragraph, it would be appropriate to transfer the personal information into the new system
2 An agency uses personal information, obtained for the purposes of operating core services, for the purposes of planning and delivering improvements to the core services.
Information collected for a specific purpose
Agencies must only collect personal information if they need it for a lawful purpose related to their functions. This means most personal information held by an agency will have been collected for a specific purpose.
If the information was collected directly from the individual, this purpose will have been set out in a collection notice. Where it was acquired in another way, agencies will need to determine the original purpose for which it was collected. This could involve considering, for example:
- the information itself
- the entity the information was acquired from
- what the agency did with the personal information after it acquired it; and
- any legislation, policies, plans or schemes underpinning its acquisition and/or original use.
Use for a directly related purpose
IPP 10(1)(e) allows an agency to use personal information for a secondary purpose directly related to the information's primary purpose. Before it can do so, the agency needs to establish that the secondary purpose is sufficiently related to the primary purpose to be considered 'directly related'.
To be directly related to the primary purpose, the secondary purpose must be connected to or associated with the primary purpose or arise in the context of the primary purpose. There must be a close relationship between the primary and the secondary purpose.
A directly related purpose can be sufficiently associated with the original purpose even if it is not strictly necessary to achieve that purpose. If the secondary purpose is administrative, it must be one that people would reasonably expect to be associated with the original purpose.
The secondary use of personal information will be directly related to the purpose for which that information was obtained where an agency uses information:
- obtained for the purpose of operating a program for the purpose of monitoring, evaluating, auditing or managing that program
- obtained for the purpose of investigating complaints for the purpose of conducting follow up surveys and reporting survey results to Parliamentary Committees
- collected when an individual agreed to pay the agency a fee for performing a service to recover the unpaid fee.
- 1 In this guideline, agency includes Ministers and bound contracted service providers to the agency, but does not include health agencies as health agencies must comply with the National Privacy Principles.
- 2 Any information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
Current as at: September 19, 2019