Document ID: chunk:federal_register_of_legislation:C2015C00053:clause:1_12:p1
Version: federal_register_of_legislation:C2015C00053
Segment Type: clause
Provision Reference: sch 1 cl 12 (pt 1/2)
Character Range: 63134–65885

12  Australian Privacy Principle 12—access to personal information

Access
 12.1 If an APP entity holds personal information about an individual, the entity must, on request by the individual, give the individual access to the information.

Exception to access—agency
 12.2 If:
 (a) the APP entity is an agency; and
 (b) the entity is required or authorised to refuse to give the individual access to the personal information by or under:
 (i) the Freedom of Information Act; or
 (ii) any other Act of the Commonwealth, or a Norfolk Island enactment, that provides for access by persons to documents;
then, despite subclause 12.1, the entity is not required to give access to the extent that the entity is required or authorised to refuse to give access.

Exception to access—organisation
 12.3 If the APP entity is an organisation then, despite subclause 12.1, the entity is not required to give the individual access to the personal information to the extent that:
 (a) the entity reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or
 (b) giving access would have an unreasonable impact on the privacy of other individuals; or
 (c) the request for access is frivolous or vexatious; or
 (d) the information relates to existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by the process of discovery in those proceedings; or
 (e) giving access would reveal the intentions of the entity in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
 (f) giving access would be unlawful; or
 (g) denying access is required or authorised by or under an Australian law or a court/tribunal order; or
 (h) both of the following apply:
 (i) the entity has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the entity's functions or activities has been, is being or may be engaged in;
 (ii) giving access would be likely to prejudice the taking of appropriate action in relation to the matter; or
 (i) giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
 (j) giving access would reveal evaluative information generated within the entity in connection with a commercially sensitive decision‑making process.

Dealing with requests for access
 12.4 The APP entity must:
 (a) respond to the request for access to the personal information:
 (i) if the entity is an agency—within 30 days after the request is made; or
 (ii) if the entity is an organisation—within a reasonable period after the request is made; and
 (b) give access to