Document ID: chunk:federal_register_of_legislation:F2017L01396:body:0:p2
Version: federal_register_of_legislation:F2017L01396
Segment Type: other
Provision Reference: 
Character Range: 2706–5406

and treats personal information as a valuable asset; and

        (d) build community trust and confidence in the personal information handling practices of agencies.

7 Agencies bound by this APP code

       This APP code is binding on all agencies as defined in section 5 of this APP code.

         Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.

8 Application of this APP code to APP 1.2

    For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.

         Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.

         Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.

Part 2—Privacy management and governance

9 Privacy management plan

        (1) An agency must have a privacy management plan.

        (2) A privacy management plan is a document that:

            (a) identifies specific, measurable privacy goals and targets; and

            (b) sets out how an agency will meet its compliance obligations under APP 1.2.

        (3) An agency must measure and document its performance against its privacy management plan at least annually.

10 Privacy Officer

        (1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.

        (2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.

        (3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.

        (4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.

        (5) An agency must ensure that the following Privacy Officer functions are carried out:

            (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information