accessing the information, ramifications of failure by the Commission to collect the information and whether the information is required under Australian law or a tribunal/court order. Dealing with personal information APP6 – Use and disclosure of personal information Only use the personal information collected for its primary purpose unless the individual has consented to the use or disclosure for a secondary purpose, or if the exceptions apply in APP6.2 or 6.3. These exceptions include whether the individual would reasonably expect the Commission to use the information for the secondary purpose and where disclosure is required by the Commission to use or disclose the information for a secondary purpose which is directly related to the primary purpose. The Commission uses personal information only for the purpose for which it has been collected. Yes APP7 – Direct Marketing Do not use or disclose personal information for the purpose of direct marketing. The Commission does not engage in direct marketing activities. N/A APP8 – Cross-border disclosure of personal information Before the Commission discloses personal information about an individual to an overseas recipient, it must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs, other than APP1, in relation to the information. The Commission undertakes its due diligence by assessing risks associated with sending personal information overseas prior to doing so. Yes
APP9 – Adoption, use and disclosure of government related identifier Do not adopt, use or disclose government related identifiers. This APP applies to non-government entities only. N/A Integrity of personal information – Quality of personal information Take such steps (if any) as are reasonable in the circumstances to ensure personal information that is collected, used or disclosed is accurate, current, complete and relevant. The Commission undertakes steps that are reasonable to ensure personal information required for the purposes of its administrative functions is accurate, current, complete and relevant. Yes APP11 – Security of personal information Take such steps as are reasonable in the circumstances to ensure that personal information is protected from misuse, interference, loss and from unauthorised access, modification or disclosure. The Commission must also take reasonable steps to destroy or deidentify personal information if it is no longer needed for any purpose for which it may be used or disclosed, so long as the information is not contained in another Commonwealth record and the Commission is not required under an Australian law to retain it. All Commission information, regardless of whether it is personal information, is stored in the Electronic Document and Records Management System (EDRMS) provided by Department of Health. The Commission receives regular assurances from Health IT that its IT environment, including the EDRMS, is secure. Yes Access to, and correction of, personal information APP12 – Access to personal information Give an individual access to their personal information upon request of that individual. The Commission can refuse to give access to the information under the Freedom of Information Act 1982 or any other Commonwealth Act, to the extent that the Commission is required or authorised to refuse access. The Commission The Commission provides an individual access to their personal information upon request. The Commission’s Privacy Policy includes contact details for the Commission’s Privacy Champion and Privacy Officers in the event Yes