Document ID: chunk:federal_register_of_legislation:C2024C00830:section:9:p1
Version: federal_register_of_legislation:C2024C00830
Segment Type: section
Provision Reference: s 9 (pt 1/2)
Character Range: 30290–33015

9  General privacy obligations of parties to participation agreement
 (1) Each party to a participation agreement must:
 (a) be subject to the Privacy Act 1988; or
 (b) be subject to a privacy law that:
 (i) is a law of a State or Territory; and
 (ii) is prescribed by the rules for the purposes of this subparagraph; or
 (c) agree in the agreement to comply with the Australian Privacy Principles, with any modifications of subclauses 7.8 and 12.2 of those principles (about laws of the Commonwealth) specified in the agreement, as if the party were an APP entity; or
 (d) be a government authority prescribed by the rules for the purposes of this paragraph; or
 (e) if the agreement deals only with the requesting of DVSs by, and provision of DVSs to, an authority of New Zealand or a person or body operating in New Zealand—be an authority, person or body subject to the Privacy Act 2020 of New Zealand.
Note: A DVS is the only identity verification service available to a party to an agreement described in paragraph (e).
 (2) A participation agreement must provide for:
 (a) privacy impact assessments of requesting identity verification services; and
 (b) the obtaining of an individual's express consent to the collection, use and disclosure, for the purposes of requesting identity verification services, of identification information that relates to the individual included in such a request, unless:
 (i) the request is made by or on behalf of a government authority; and
 (ii) collection, use and disclosure of that information for the purposes of protecting a shielded person, or someone else associated with a shielded person, are implicit in functions conferred by law on the authority; and
 (c) the provision, to an individual from whom such express consent is being sought, of information about matters described in subsection (3); and
 (d) each party to have arrangements for dealing with complaints by individuals whose identification information is held by the party; and
 (e) each party to the agreement (except the Department) to report to the Department on breaches of security that relate to the party and are relevant to a matter dealt with in the agreement; and
 (f) the Department to inform the Information Commissioner of a breach of security that:
 (i) is reported to the Department under a provision of the agreement covered by paragraph (e); and
 (ii) is a data breach that is reasonably likely to result in serious harm to an individual whose identification information is involved in the breach; and
 (g) the Department to notify each party to the agreement that is relevant to, or impacted by, a data breach of which the Information Commissioner is informed under paragraph (f); and
 (h) each