Document ID: chunk:federal_register_of_legislation:C2025C00055:section:33d
Version: federal_register_of_legislation:C2025C00055
Segment Type: section
Provision Reference: s 33D
Character Range: 378481–380021

33D  Commissioner may direct an agency to give a privacy impact assessment
 (1) If:
 (a) an agency proposes to engage in an activity or function involving the handling of personal information about individuals; and
 (b) the Commissioner considers that the activity or function might have a significant impact on the privacy of individuals;
the Commissioner may, in writing, direct the agency to give the Commissioner, within a specified period, a privacy impact assessment about the activity or function.
 (2) A direction under subsection (1) is not a legislative instrument.

Privacy impact assessment
 (3) A privacy impact assessment is a written assessment of an activity or function that:
 (a) identifies the impact that the activity or function might have on the privacy of individuals; and
 (b) sets out recommendations for managing, minimising or eliminating that impact.
 (4) Subsection (3) does not limit the matters that the privacy impact assessment may deal with.
 (5) A privacy impact assessment is not a legislative instrument.

Failure to comply with a direction
 (6) If an agency does not comply with a direction under subsection (1), the Commissioner must advise both of the following of the failure:
 (a) the Minister;
 (b) if another Minister is responsible for the agency—that other Minister.

Review
 (7) Before the fifth anniversary of the commencement of this section, the Minister must cause a review to be undertaken of whether this section should apply in relation to organisations.

Division 3B—Public inquiries