sign up Your signup was successful Subscribing..


< back

Your obligations under the Privacy Act

By Andrew Wong - 22 Nov 2018

The Privacy Act ( PA) governs the collection, use and disclosure of personal information. This might be retailers collecting email addresses for newsletters, sign ups for loyalty cards or landlords collecting information from prospective tenants. The list goes on. Everyone, including those in business, is captured by the PA and what this means is that they are all subject to the rules under the PA on how to store, use and give access to this information.

As a business, you must use this information for lawful purposes which must relate to what you do as a business (e.g. running credit checks on a prospective tenant if you are a landlord). The collection of this information must also be necessary for this. You are obliged to ensure that information is correct and up to date and an individual is allowed to ask you to hand over information about them under the PA (an information request).

But what if some of this information is embarrassing, damaging or commercially sensitive? What can you do to withhold some of this information from the requesting individual? In most cases, the information is only going to be embarrassing or disparaging about the requesting individual. However, at the opposite end of the spectrum the information could be damaging not just to your reputation, but also to your bottom line.

Luckily, the PA has provided that you can refuse an information request on some grounds, fully or partially withholding information you have about the person provided you tell them why you are holding the information back. There are various ways of refusing to give information under the PA. The common grounds for refusing to hand information to individuals for most businesses will be that the information is commercially sensitive or evaluative.

However, this is not the end of it. If the individual making the information request is persistent, he or she can then make a complaint to the Privacy Commissioner who then makes a decision on whether you have withheld the information for a proper reason. The Commissioner will then attempt to mediate between you and the individual. If this is unsuccessful, he can then refer this to the Human Rights Review Tribunal which can then make an order against you.

If you are currently being requested to hand over information about someone and want a full explanation of what your rights and obligations are, please contact Andrew Wong or any member of our Commercial Law team.


Forward to a friend

Leave a comment