Historical version for 31 December 2009 to 18 May 2010 (accessed 2 April 2025 at 8:50)
Legislation on this site is usually updated within 3 working days after a change to the legislation.
The provisions displayed in this version of the legislation have all commenced.
This version of the legislation is compiled and maintained in a database of legislation by the Parliamentary Counsel's Office and published on the NSW legislation website, and is certified as the form of that legislation that is correct under section 45C of the Interpretation Act 1987.
File last modified 23 April 2010
This Code is the Privacy Code of Practice (General) 2003.
This Code modifies the application of the information protection principles and public register provisions of the Act.
Nothing in this Code:(a) (Repealed)(b) affects a disclosure that is otherwise permitted by law (including, but not limited to, a disclosure made pursuant to the State Records Act 1998 or the Freedom of Information Act 1989), or(c) prevents an agency from disclosing personal information with the consent of the individual to whom the information relates.
(1) In this Code:agency means a public sector agency.information protection principles means the principles set out in Division 1 of Part 2 of the Act.public register provisions means the provisions of Part 6 of the Act.the Act means the Privacy and Personal Information Protection Act 1998.(2) Notes included in this Code do not form part of this Code.
This Part applies to the exchange of personal information between the agencies specified in Schedule 1.
The information protection principles are modified to the extent necessary to permit the transfer between the agencies, of the personal information, and for the purposes, described in Schedule 1.
This Part applies to the disclosure of personal information contained in public registers.
(1) Part 6 of the Act is modified to the extent necessary to permit a disclosure referred to in subclause (2).(2) An agency specified in Column 2 of Schedule 2 that is responsible for keeping a public register (or that part of a register) described in Column 1 may, subject to any conditions set out in Column 1, disclose personal information kept in the register (or part of the register) without being satisfied that the information is to be used for a purpose relating to the purpose of the register or the Act under which the register is kept.
In this Part:human services agency means a public sector agency that provides any one or more of the following types of services to the public:(a) welfare services,(b) health services,(c) mental health services,(d) disability services,(e) drug and alcohol treatment services,(f) housing and support services,(g) education services.
(1) In this clause:allied agency means an agency (other than a public sector agency) that is wholly or partly funded by a human services agency and that is approved in writing by the head of that human services agency as an allied agency for the purposes of this clause.senior officer means a senior member of staff of a human services agency who has been nominated in writing for the purposes of this clause by the head of that agency.substantial adverse impact includes, but is not limited to, serious physical or mental harm, significant loss of benefits or other income, imprisonment, loss of housing or the loss of a carer.(2) Despite the information protection principles, a human services agency may collect and use personal information about an individual, and may disclose personal information about the individual to another human services agency or an allied agency, if the collection, use or disclosure is in accordance with a written authorisation given by a senior officer of the agency.(3) An authorisation under subclause (2) must specify:(a) the period (maximum 12 months) for which the authorisation has effect, and(b) the classes of personal information to which the authorisation is to apply (the specified information), and(c) the human services agencies or allied agencies (if any) to whom the specified information may be disclosed (the specified agencies).(4) A senior officer may give an authorisation under subclause (2) only if the officer is satisfied that:(a) the individual to whom the specified information relates is a person to whom services are provided or proposed to be provided by a human services agency or an allied agency, and(b) the individual (or a person authorised by or under the Act or any other law to give consent on the individual’s behalf) has failed to consent to the agency collecting or using the specified information, or disclosing the specified information to the specified agencies, and(c) there are reasonable grounds to believe that there is a risk of substantial adverse impact on the individual or some other person if collection or use of the specified information, or disclosure of the specified information to the specified agencies, does not occur, and(d) the collection or use of the specified information, or disclosure of the specified information to the specified agencies, is likely to assist in developing or giving effect to a case management plan or service delivery plan that relates to the individual, and(e) reasonable steps have been taken to ensure that the individual has been notified by the agency of each of the following:(i) the specified information,(ii) the specified agencies,(iii) the period for which the authorisation is proposed to be sought to have effect.Note—Notification under this paragraph would normally be in writing. However, other notification methods may be more appropriate in the case of certain clients. For example, if the client is illiterate.
A human services agency is not required to comply with section 9 of the Act if it is unreasonable or impracticable in the circumstances to do so.
(1) In this Part:correctional centre and correctional complex have the same meanings as in the Crimes (Administration of Sentences) Act 1999.Department means the Department of Corrective Services.NSW Police Force has the same meaning as in the Police Act 1990.offender means a person who is one or more of the following:(a) an offender within the meaning of section 3 (1) or 107 of the Crimes (Administration of Sentences) Act 1999,(b) a person in custody within the meaning of section 249 of the Crimes (Administration of Sentences) Act 1999,(c) a person who is the subject of a parole order within the meaning of the Crimes (Administration of Sentences) Act 1999,(d) a person who is the subject of an intervention program order, a non-association order, a place restriction order or a good behaviour bond within the meaning of the Crimes (Sentencing Procedure) Act 1999 that is in force,(e) a person who has been granted bail and in respect of whom a court has sought a pre-sentence report from the Department.provide services and programs to an offender includes the preparation of a case plan for the offender and any assessment of the offender’s suitability for, or conduct in, a program.staff member means a member of staff of the Department and includes:(a) a person working under contract, and(b) an Official Visitor appointed under section 228 of the Crimes (Administration of Sentences) Act 1999, and(c) a minister of religion or other spiritual advisor appointed to a correctional centre pursuant to a regulation made under section 79 (x1) of the Crimes (Administration of Sentences) Act 1999.transitional centre has the same meaning as in the Crimes (Administration of Sentences) Act 1999.victim means a victim of crime within the meaning of section 5 of the Victims Rights Act 1996.(2) For the purposes of this Part, the following services or programs provided to an offender are taken to be provided by the Department:(a) a service or program provided on behalf of the Department,(b) a service or program provided because of a requirement placed on the offender by a court or any of the following bodies within the meaning of the Crimes (Administration of Sentences) Act 1999:(i) the Parole Authority,(ii) the Review Council,(iii) the Probation and Parole Service.
The Department is not required to comply with section 9 of the Act in relation to personal information collected by the Department in any of the following circumstances:(a) the information is collected from the NSW Police Force or the CrimTrac Agency and is about:(i) a criminal charge or criminal conviction against a staff member (including the making of an apprehended violence order against the staff member) that may affect the staff member’s suitability for employment, or(ii) an application for, or the making of, an apprehended violence order against an offender,(b) the information is about an offender and collection from a person other than the offender is reasonably necessary to enable the Department:(i) to protect the safety, welfare or well-being of the offender, or(ii) to supervise the offender effectively, or(iii) to provide services and programs to the offender effectively,(c) the collection is reasonably necessary to enable the Department:(i) to maintain the security or good order of a correctional complex, correctional centre or transitional centre, or(ii) to verify information about an individual supplied to it by the individual, or(iii) to organise a conference or mediation between an offender and a victim of that offender, or(iv) to compile statistical data, but only if it is impractical to collect the information directly from the individual to whom it relates and the information is not information of a kind referred to in section 19 (1) of the Act, or(v) to investigate an allegation of misconduct against a staff member.
(1) The Department is not required to comply with section 10, 11 (b), 13 or 17 of the Act if non-compliance is reasonably necessary to enable the Department to do one or more of the following:(a) to protect the safety, welfare or well-being of a person,(b) to supervise an offender effectively,(c) to provide services and programs to an offender effectively,(d) to maintain the security or good order of a correctional complex, correctional centre or transitional centre,(e) to exercise properly the Department’s complaint handling or investigative functions,(f) to carry out disciplinary or other proceedings before a court or tribunal,(g) to prepare a comprehensive report to a court, tribunal or other relevant statutory body.(2) The Department is not required to comply with section 10, 13 or 17 of the Act if non-compliance is reasonably necessary to enable the Department to prevent the disclosure of:(a) intelligence information provided by an investigative agency or law enforcement agency, or(b) the identity of an informant or a victim, or(c) the existence of a surveillance operation.(3) The Department is not required to comply with section 17 of the Act if non-compliance is reasonably necessary to enable the Department to organise a conference or mediation between an offender and a victim of that offender.
The Department is not required to comply with section 15 of the Act in relation to personal information if:(a) the information has been obtained in the course of an investigation, and(b) the person who is the subject of the information seeks to have the information amended during the investigation, and(c) amending the information at that time will detrimentally affect (or prevent the proper exercise of) the Department’s complaint handling functions or any of its investigative functions, and(d) the information will be amended as soon as practicable after the conclusion of the investigation.
The Department is not required to comply with section 18 or 19 (1) of the Act if non-compliance is reasonably necessary to enable the Department to do one or more of the following:(a) to protect the safety, welfare or well-being of a person,(b) to provide services and programs to an offender effectively,(c) to permit one or more of the following to exercise its functions properly in relation to an offender:(i) the Department of Community Services,(ii) the Department of Health,(iii) Justice Health,Note—This does not permit the Department to disclose health information as health information is regulated by the Health Records and Information Privacy Act 2002.(d) to disclose personal information to a person for the purposes of an investigation, but only if the disclosure is made to a person:(i) to verify the information, or(ii) to obtain professional or technical advice about the information.
(1) In this Part and in Schedule 3:ageing, disability or home care service agency or ADHC agency means any of the following agencies:(a) the Department of Ageing, Disability and Home Care,(b) the Home Care Service of New South Wales constituted under the Home Care Service Act 1988,(c) the Disability Council of New South Wales constituted under the Community Welfare Act 1987.personal information custodian, of an individual, means any of the following:(a) the individual’s guardian (within the meaning of the Guardianship Act 1987),(b) the individual’s attorney (within the meaning of the Powers of Attorney Act 2003),(c) the spouse of the individual, if the relationship between the individual and the spouse is close and continuing,(d) a person who has the care of the individual (within the meaning of the Guardianship Act 1987),(e) a close friend or relative of the individual (within the meaning of the Guardianship Act 1987).spouse means:(a) a husband or wife, orbut where more than one person would so qualify as a spouse, means only the last person so to qualify.(b) the other party to a de facto relationship within the meaning of the Property (Relationships) Act 1984,(2) If any personal information that relates to an individual has been collected by an ADHC agency for any purpose related to the provision of ageing, disability or home care services to the individual, that information is, for the purposes of Schedule 3, taken to have been collected also for the following purposes:(a) to ensure the provision of appropriate services to an individual (whether by the ADHC agency or another body or person),(b) to ascertain the appropriate priority or placement of the individual in a service,(c) to prevent harm to the individual or others,(d) to ensure compliance with the occupational health and safety laws by the agency.
The information protection principles are modified in their application to ADHC agencies as set out in Schedule 3.
(1) In this Part:CVS means the Certificate Validation Service operated by the Registry on behalf of the Council of Australasian Registrars for Births, Deaths and Marriages.DVS means the National Document Verification Service managed by the Commonwealth Attorney-General’s Department.issuing agency means:(a) in relation to the CVS, a State or Territory Government agency that:(i) issues proof of identity documents, and(ii) is authorised to receive and respond to validation requests, and(b) in relation to the DVS, a Commonwealth, State or Territory Government agency that:(i) issues proof of identity documents, and(ii) is authorised to receive and respond to validation requests.proof of identity document means:(a) any certificate issued by the Registry under section 49 of the Births, Deaths and Marriages Registration Act 1995, and(b) a document issued by any other issuing agency that may be used to establish a person’s identity.the Registry means the Registry of Births Deaths and Marriages.user agency means:(a) in relation to the CVS, a government or non-government agency or organisation that is authorised to use the CVS to verify personal information contained in documents presented to it as proof of identity documents, and(b) in relation to the DVS, a Commonwealth, State or Territory Government agency that is authorised to use the DVS to verify personal information contained in documents presented to it as proof of identity documents.validation request means a request made through the CVS or the DVS by a user agency to verify personal information contained in a document presented to the user agency as a proof of identity document issued by an issuing agency.(2) A reference in this Part to the Registry includes a reference to the Registrar of Births, Deaths and Marriages and the Registrar’s staff.
(1) The Registry is not required to comply with section 9, 10 or 11 of the Act if the personal information concerned is collected:(a) through the DVS from a user agency, and(b) only to enable the Registry, as an issuing agency, to respond to a validation request, and(c) in accordance with any applicable operating protocols of the DVS.(2) The Registry is not required to comply with section 17 of the Act if the use of the personal information concerned:(a) is for the purpose only of enabling the Registry, as an issuing agency, to respond to a validation request, and(b) is in accordance with any applicable operating protocols of the DVS.(3) The Registry is not required to comply with section 18 of the Act if the disclosure of the personal information concerned:(a) is only for the purpose of enabling the Registry, as an issuing agency, to respond to a validation request, and(b) is in accordance with any applicable operating protocols of the DVS.
(1) The Registry is not required to comply with section 9, 10 or 11 of the Act if the personal information concerned is collected:(a) through the CVS from a user agency or an issuing agency, and(b) only for one or more of the following purposes:(i) to enable the Registry, as an issuing agency, to respond to a validation request,(ii) to enable the Registry, as the operator of the CVS (the CVS operator), to direct a validation request to the appropriate issuing agency,(iii) to enable the Registry, as the CVS operator, to direct a response from an issuing agency to a validation request, to the user agency that made the request,(iv) to enable the Registry, as the CVS operator, to perform billing and associated auditing functions, and(c) in accordance with any applicable operating protocols of the CVS.(2) The Registry is not required to comply with section 17 of the Act if the use of the personal information concerned:(a) is for either or both of the following purposes only:(i) to enable the Registry, as an issuing agency, to respond to a validation request,(ii) to enable the Registry, as the CVS operator, to perform billing and associated auditing functions, and(b) is in accordance with any applicable operating protocols of the CVS.(3) The Registry is not required to comply with section 18 of the Act if the disclosure of the personal information concerned:(a) is only for one or more of the following purposes:(i) to enable the Registry, as an issuing agency, to respond to a validation request,(ii) to enable the Registry, as the CVS operator, to direct a validation request to the appropriate issuing agency,(iii) to enable the Registry, as the CVS operator, to direct a response from an issuing agency to a validation request, to the user agency that made the request,(iv) to enable the Registry, as the CVS operator, to perform billing and associated auditing functions, and(b) is in accordance with any applicable operating protocols of the CVS.
(1) Agencies exchanging personal information Roads and Traffic Authority,Attorney General’s Department.(2) Type of personal information Vehicle registered operator details.(3) Purpose for which information is exchanged To permit the Sheriff to verify vehicle registered operator details in connection with the proposed or actual seizure of a vehicle.
(1) Agencies exchanging personal information Roads and Traffic Authority,Environment Protection Authority.(2) Type of personal information Vehicle registered operator details.(3) Purpose for which information is exchanged To permit the Environment Protection Authority to contact the operator of a vehicle when it has received a report about an environmental offence concerning the vehicle.
Column 1 | Column 2 | |
Public register | Agency responsible for keeping the register | |
1 | The record maintained under section 58 of the Contaminated Land Management Act 1997, however, this exception does not extend to the name of an individual who is the occupier, owner or polluter of a contaminated site or the address of such an individual if the individual does not reside at a contaminated site. | Environment Protection Authority |
2 | The registers listed in regulation 15.1 of the Road Transport Reform (Dangerous Goods) Regulations 1997 of the Commonwealth that apply in New South Wales as the Road Transport Reform (Dangerous Goods) (New South Wales) Regulations under the Road and Rail Transport (Dangerous Goods) Act 1997, however, this exception does not extend to information relating to the medical condition or the driving history of an individual. | Environment Protection Authority |
3 | The Credit Register for the tradeable emission scheme known as the Hunter River Salinity Trading Scheme, made publicly available by the EPA through the Internet, comprising the name and contact details of a member of the Scheme or an employee or agent of that member and the member’s business facilities, credit holdings and trading history. | Environment Protection Authority |
4 | The information made publicly available by the EPA through the Internet concerning the Waste Reduction Grants Program paid from the Waste Fund set up under section 19 of the Waste Avoidance and Resource Recovery Act 2001 comprising the name and contact details of the person awarded the grant, or an employee or agent of that person, the amount of the grant, the grant number and the details of the project for which the grant was given. | Environment Protection Authority |
5 | The information made publicly available by the EPA through the Internet concerning grants made under the Stormwater Trust Grants Scheme administered by the EPA comprising the name and contact details of the person offered the grant, or an employee or agent of that person, the amount of the grant, the grant number and the details of the project for which the grant was offered. | Environment Protection Authority |
6 | The public register kept under Part 9.5 of the Protection of the Environment Operations Act 1997. | Environment Protection Authority |
7 | The Register of Chiropractors for New South Wales kept under clause 21 of Schedule 1 to the Chiropractors Act 2001. | Chiropractors Registration Board |
8 | The Register of Dental Technicians of New South Wales kept under section 14 of the Dental Technicians Registration Act 1975. | Dental Technicians Registration Board |
9 | The Register of Dentists for New South Wales kept under clause 21 of Schedule 1 to the Dental Practice Act 2001. | Dental Board |
9A | The Register of Dental Auxiliaries for New South Wales kept under clause 21 of Schedule 1 to the Dental Practice Act 2001. | Dental Board |
10 | The Register of Medical Practitioners for New South Wales kept under clause 21 of Schedule 1 to the Medical Practice Act 1992. | New South Wales Medical Board |
11 | The Register of Nurses kept under section 16 of the Nurses and Midwives Act 1991. | Nurses and Midwives Board |
11A | The Register of Midwives kept under section 16 of the Nurses and Midwives Act 1991. | Nurses and Midwives Board |
11B | The Roll of Nurses kept under section 26 of the Nurses and Midwives Act 1991. | Nurses and Midwives Board |
12 | The Register of Optical Dispensers for New South Wales kept under section 21 of the Optical Dispensers Act 1963. | Optical Dispensers Licensing Board |
13 | The Register of Optometrists for New South Wales kept under clause 21 of Schedule 1 to the Optometrists Act 2002. | Optometrists Registration Board |
14 | The Register of Osteopaths for New South Wales kept under clause 21 of Schedule 1 to the Osteopaths Act 2001. | Osteopaths Registration Board |
15 | The Register of Pharmacists kept under clause 15 of Schedule 1 to the Pharmacy Practice Act 2006. | Pharmacy Board of New South Wales |
16 | The Register of Physiotherapists for New South Wales kept under clause 21 of Schedule 1 to the Physiotherapists Act 2001. | Physiotherapists Registration Board |
17 | The Register of Podiatrists for New South Wales kept under clause 21 of Schedule 1 to the Podiatrists Act 2003. | Podiatrists Registration Board |
18 | The Register of Psychologists for New South Wales kept under clause 21 of Schedule 1 to the Psychologists Act 2001. | Psychologists Registration Board |
(1) Despite section 9 of the Act, an ADHC agency may, if the individual to whom personal information relates lacks the capacity to provide the information and the information is being collected for the primary purpose of providing ageing, disability or home care services to the individual:(a) collect the information from any of the following persons:(i) the individual’s guardian (within the meaning of the Guardianship Act 1987),(ii) the individual’s attorney (within the meaning of the Powers of Attorney Act 2003),(iii) the spouse of the individual, if the relationship between the individual and the spouse is close and continuing,(iv) a person who provides domestic services or support for the individual, or who arranges for domestic services or support to be provided to the individual,(v) a person who has the care of the individual (within the meaning of the Guardianship Act 1987),(vi) a close friend or relative of the individual (within the meaning of the Guardianship Act 1987), and(b) if the information cannot be collected from a person referred to in paragraph (a), collect the information from another person.(2) An ADHC agency is not required to comply with section 9 of the Act or subclause (1) if it is unreasonable or impracticable in the circumstances to do so.
If the individual to whom personal information relates lacks the capacity to understand the matters listed in section 10 of the Act, the ADHC agency must instead of complying with that section make a record of those matters in its files and must ensure that the record is readily accessible by:(a) if the individual regains capacity, the individual, or(b) any personal information custodian of the individual, or(c) the agency itself.
Without limiting section 14 of the Act, if an ADHC agency holds personal information that relates to an individual who lacks capacity to understand that personal information or the purpose for which it was collected (or is to be used), the agency must, at the request of a personal information custodian of the individual and without excessive delay or expense, provide that custodian with access to the information.
(1) Without limiting section 15 of the Act, if an ADHC agency holds personal information that relates to an individual who lacks capacity to understand that personal information or the purpose for which it was collected (or is to be used), the agency must, at the request of a personal information custodian of the individual, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information:(a) is accurate, and(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.(2) If an ADHC agency is not prepared to amend personal information in accordance with a request by an individual’s personal information custodian, the agency must, if so requested by the custodian, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.(3) If personal information is amended in accordance with this clause, the individual to whom the information relates and the individual’s personal information custodian is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the agency.
Without limiting section 16 of the Act, for the purposes of that section, reasonable steps to ensure information is relevant, accurate, up to date, complete and not misleading include:(a) making inquiries of the individual concerned, or(b) in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used), making inquiries of a relevant personal information custodian of the individual.
(1) Despite section 17 of the Act, an ADHC agency that holds personal information that relates to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may use the information for a purpose other than that for which it was collected if:(a) a personal information custodian of the individual has consented to the use of the information for that other purpose, or(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.(2) Despite section 17 of the Act and subclause (1) (a), an ADHC agency that holds personal information in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may use the information for a purpose other than that for which it was collected without the consent of a personal information custodian of the individual, if:(a) no personal information custodian of the individual exists or can be found, and(b) an officer of the Department of Ageing, Disability or Home Care appointed by the Director-General of that Department to act for individuals who have no personal information custodian consents to that use of the information on the grounds that the disclosure is in the best interests of the individual, and(c) the ADHC agency records details of that use of the information in its files and ensures that the record is readily accessible by:(i) if the individual regains capacity, the individual, or(ii) if the individual gains a personal information custodian, the personal information custodian, or(iii) the agency itself.
(1) Despite section 18 of the Act, an ADHC agency that holds personal information that relates to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may disclose the information to a person other than the individual to whom the information relates, or another body (whether or not such other person or body is a public sector agency), if:(a) the disclosure is directly related to the purpose for which the information was collected, or(b) a personal information custodian of the individual has consented to the disclosure of the information for that other purpose, or(c) the disclosure is made to a personal information custodian of the individual.(2) Despite subclause (1) (b), an ADHC agency that holds personal information in relation to an individual who lacks capacity to understand the personal information or the purpose for which it was collected (or is to be used) may disclose the information to a person (other than the individual to whom the information relates) or other body without the consent of a personal information custodian of the individual, if:(a) no personal information custodian of the individual exists or can be found, and(b) an officer of the Department of Ageing, Disability or Home Care appointed by the Director-General of that Department to act for individuals who have no personal information custodian consents to the disclosure on the grounds that the disclosure is in the best interests of the individual, and(c) the ADHC agency records details of the disclosure in its files and ensures that the record is readily accessible by:(i) if the individual regains capacity, the individual, or(ii) if the individual gains a personal information custodian, the personal information custodian, or(iii) the agency itself.(3) If personal information is disclosed in accordance with this clause to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
Despite section 19 of the Act, an ADHC agency may disclose personal information of an individual who lacks capacity to understand the personal information relating to the individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities if:(a) a personal information custodian of the individual has consented to the disclosure of the information, or(b) the agency believes on reasonable grounds the disclosure of the personal information is necessary to give effect to the purpose for which the personal information was collected.Example—If, in collecting personal information about an individual for the purpose of providing ageing, disability or home care services, an ADHC agency collected the information that the individual was a member of a religious group with strict dietary rules, the agency may disclose that information to a person providing such services where it is necessary, ie where a service provider is preparing food for the individual.