Non-health agencies - Use for a directly related purpose

Agencies¹ are required to comply with the Information Privacy Principles (IPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act).  

Under IPP 10, an agency can only use personal information² for the reason it was collected, unless one of the exceptions in IPP 10(1) applies.  IPP 10(1)(e) allows an agency to use personal information for a purpose directly related to the purpose for which it was collected.

IPP 10(1)(e)

(1) An agency having control of a document containing personal information that was obtained for a particular purpose must not use the information for another purpose unless—

(e) the other purpose is directly related to the purpose for which the information was obtained.

Examples for paragraph (e)—

1 An agency collects personal information for staff administration purposes. A new system of staff administration is introduced into the agency, with much greater functionality. Under this paragraph, it would be appropriate to transfer the personal information into the new system

2 An agency uses personal information, obtained for the purposes of operating core services, for the purposes of planning and delivering improvements to the core services.

Information collected for a specific purpose

Agencies must only collect personal information if they need it for a lawful purpose related to their functions. This means most personal information held by an agency will have been collected for a specific purpose.

If the information was collected directly from the individual, this purpose will have been set out in a collection notice[1]. Where it was acquired in another way, agencies will need to determine the original purpose for which it was collected. This could involve considering, for example:

• the information itself
• the entity the information was acquired from
• what the agency did with the personal information after it acquired it; and
• any legislation, policies, plans or schemes underpinning its acquisition and/or original use.

Use for a directly related purpose

IPP 10(1)(e) allows an agency to use personal information for a secondary purpose directly related to the information's primary purpose.  Before it can do so, the agency needs to establish that the secondary purpose is sufficiently related to the primary purpose to be considered 'directly related'.

To be directly related to the primary purpose, the secondary purpose must be connected to or associated with the primary purpose or arise in the context of the primary purpose. There must be a close relationship between the primary and the secondary purpose.

A directly related purpose can be sufficiently associated with the original purpose even if it is not strictly necessary to achieve that purpose. If the secondary purpose is administrative, it must be one that people would reasonably expect to be associated with the original purpose.