In this Act, unless the context otherwise requires,—

For the avoidance of doubt, it is hereby declared that the fact that any body (being a commission of inquiry or board of inquiry or court of inquiry or committee of inquiry appointed, by any provision of an Act, to inquire into a specified matter) is not excluded from the definition of the term agency in subsection (1) by virtue of subparagraph (xii) of paragraph (b) of that definition does not mean that such a body is not excluded from that definition by virtue of subparagraph (vii) or subparagraph (viii) of that paragraph.

Subject to subsection (2), information that is held by an officer or employee or member of an agency in that person’s capacity as such an officer or employee or member or in that person’s capacity as a statutory officer shall be deemed, for the purposes of this Act, to be held by the agency of which that person is an officer or employee or member.

Nothing in subsection (1) applies in respect of any information that any officer or employee or member of a public sector agency would not hold but for that person’s membership of, or connection with, a body other than a public sector agency, except where that membership or connection is in that person’s capacity as an officer or an employee or a member of that public sector agency or as a statutory officer.

Nothing in subsection (1) applies in respect of any information that any officer or employee or member of any agency (not being a public sector agency) would not hold but for that person’s membership of, or connection with, any other agency, except where that membership or connection is in that person’s capacity as an officer or an employee or a member of that first-mentioned agency.

For the purposes of this Act, where an agency holds information—

and does not use or disclose the information for its own purposes, the information shall be deemed to be held by the agency on whose behalf that information is so held or, as the case may be, is so processed.

Despite subsection (1), information that is held by an employee of a department carrying out the functions of a departmental agency must be treated for the purposes of this Act as held by the departmental agency.

For the purposes of this Act, an action done by, or information disclosed to, a person employed by, or in the service of, an agency in the performance of the duties of the person’s employment shall be treated as having been done by, or disclosed to, the agency.

This Act binds the Crown.

The information privacy principles are as follows:

Nothing in principle 6 or principle 11 derogates from any provision that is contained in any enactment and that authorises or requires personal information to be made available.

Nothing in principle 6 or principle 11 derogates from any provision that is contained in any other Act of Parliament and that—

Nothing in principle 6 or principle 11 derogates from any provision—

An action is not a breach of any of principles 1 to 5, 7 to 10, and 12 if that action is authorised or required by or under law.

Nothing in principle 7 applies in respect of any information held by the Department of Statistics, where that information was obtained pursuant to the Statistics Act 1975.

Subject to the provisions of Part 7, nothing in any of the information privacy principles shall apply in respect of a public register.

Subject to subsection (4), principles 1 to 4 apply only in relation to information collected after the commencement of this section.

Subject to section 9, principles 5 to 9 and principle 11 apply in relation to information held by an agency, whether the information was obtained before, or is obtained after, the commencement of this section.

Principle 10 applies only in relation to information obtained after the commencement of this section.

Nothing in principle 3 shall apply in relation to the collection, by means of any printed form, of any personal information, if the form was printed before the commencement of this section and is used, before 1 July 1995, for the purpose of collecting personal information.

Subclauses (1) to (3) of principle 12 apply only in relation to the assignment of unique identifiers after the commencement of this section.

Subclause (4) of principle 12 applies to any unique identifier, whether assigned before or after the commencement of this section.

Nothing in principle 11 shall apply, before 1 July 1996, in relation to the disclosure, by any agency, of personal information collected before 1 July 1993 for direct marketing purposes, where that disclosure is made to another agency for the purpose of enabling that other agency to engage in direct marketing.

For the purposes of subsection (1), direct marketing means—

by means of—

For the purposes of principle 5 and principles 8 to 11, information held by an agency includes information that is held outside New Zealand by that agency, where that information has been transferred out of New Zealand by that agency or any other agency.

For the purposes of principles 6 and 7, information held by an agency includes information held outside New Zealand by that agency.

Nothing in this section shall apply to render an agency in breach of any of the information privacy principles in respect of any action that the agency is required to take by or under the law of any place outside New Zealand.

The entitlements conferred on an individual by subclause (1) of principle 6, in so far as that subclause relates to personal information held by a public sector agency, are legal rights, and are enforceable accordingly in a court of law.

Subject to subsection (1), the information privacy principles do not confer on any person any legal right that is enforceable in a court of law.

There shall be a Commissioner called the Privacy Commissioner.

The Commissioner is—

The Crown Entities Act 2004 applies to the Commissioner except to the extent that this Act expressly provides otherwise.

The functions of the Commissioner shall be—

Without limiting subsection (1), the functions of the Commissioner in relation to information sharing under Part 9A are—

In subsection (1AA), adverse action, approved information sharing agreement, information sharing agreement, lead agency, and relevant Minister have the meanings given to them by section 96C.

Except as expressly provided otherwise in this or another Act, the Commissioner must act independently in performing his or her statutory functions and duties, and exercising his or her statutory powers, under—

The Commissioner may from time to time, in the public interest or in the interests of any person or body of persons, publish reports relating generally to the exercise of the Commissioner’s functions under this Act or to any case or cases investigated by the Commissioner, whether or not the matters to be dealt with in any such report have been the subject of a report to the responsible Minister or the Prime Minister.

In the performance of his or her functions, and the exercise of his or her powers, under this Act, the Commissioner shall—

The Governor-General may, on the recommendation of the Minister, appoint a deputy to the person appointed as Commissioner.

Part 2 of the Crown Entities Act 2004, except section 46, applies to the appointment and removal of a Deputy Commissioner in the same manner as it applies to the appointment and removal of a Commissioner.

Subject to the control of the Commissioner, the Deputy Commissioner shall have and may exercise all the powers, duties, and functions of the Commissioner under this Act or any other enactment.

On the occurrence from any cause of a vacancy in the office of the Commissioner (whether by reason of death, resignation, or otherwise), and in the case of the absence from duty of the Commissioner (from whatever cause arising), and so long as any such vacancy or absence continues, the Deputy Commissioner shall have and may exercise all the powers, duties, and functions of the Commissioner.

Subject to this Act, the Deputy Commissioner shall be entitled to all the protections, privileges, and immunities of the Commissioner.

In addition to the matters in section 30(2) of the Crown Entities Act 2004, a member of a local authority is disqualified from being appointed as Commissioner.

The appointment of a Judge as the Commissioner, or service by a Judge as the Commissioner, does not affect that person’s tenure of his or her judicial office or his or her rank, title, status, precedence, salary, annual or other allowances, or other rights or privileges as a Judge (including those in relation to superannuation), and, for all purposes, that person’s service as the Commissioner shall be taken to be service as a Judge.

If at any time it appears to the Commissioner that it may be desirable to obtain a declaratory judgment or order of the High Court in accordance with the Declaratory Judgments Act 1908, he or she may refer the matter to the Proceedings Commissioner for the purpose of deciding whether proceedings under that Act should be instituted.

In respect of any matter referred to the Proceedings Commissioner under subsection (1), the Proceedings Commissioner shall, notwithstanding anything to the contrary in the Declaratory Judgments Act 1908 or any other enactment or rule of law, have sufficient standing to institute proceedings under that Act whether or not the matter is one within his or her own functions and powers under this Act or under the Human Rights Commission Act 1977.

The Commissioner may from time to time, as the Commissioner thinks fit, cause to be published 1 or more publications that include all or any of the following information:

The Commissioner may from time to time bring the material contained in any publication published pursuant to subsection (1) up to date, either by causing to be published a new edition of that publication or by causing to be published supplementary material.

In determining whether or not any publication should be published pursuant to this section, the Commissioner shall have regard, among other things, to the need to assist members of the public to obtain personal information and to effectively exercise their rights under this Act.

Nothing in this section requires the publication of any information for which good reason for withholding would exist under section 27 or section 28.

For the purpose of—

the Commissioner may, from time to time, require any agency to supply to the Commissioner such information as the Commissioner may reasonably require in relation to the personal information held by that agency, and the agency shall comply with that requirement.

It shall be the responsibility of each agency to ensure that there are, within that agency, 1 or more individuals whose responsibilities include—

In relation to the functions of a departmental agency, the responsibility under this section lies with the departmental agency.

Without limiting the right of the Commissioner to report at any other time, but subject to section 120, the annual report of the Commissioner under section 150 of the Crown Entities Act 2004 must include a report with respect to the operation of this Act during the year to which the report relates.

The provisions of Schedule 1 shall have effect in relation to the Commissioner and the Commissioner’s affairs.

As soon as practicable after the expiry of the period of 3 years beginning on the commencement of this section, and then at intervals of not more than 5 years, the Commissioner shall—

As soon as practicable after receiving a report from the Commissioner under subsection (1)(c), the responsible Minister shall lay a copy of that report before the House of Representatives.

An agency may refuse to disclose any information requested pursuant to principle 6 if the disclosure of the information would be likely—

An agency may refuse to disclose any information requested pursuant to principle 6 if the disclosure of the information would be likely—

Subject to subsection (2), an agency may refuse to disclose any information requested pursuant to principle 6 if the withholding of the information is necessary to protect information where the making available of the information—

Information may not be withheld under subsection (1) if, in the circumstances of the particular case, the withholding of that information is outweighed by other considerations which render it desirable, in the public interest, to make the information available.

An agency may refuse to disclose any information requested pursuant to principle 6 if—

An agency may refuse a request made pursuant to principle 6 if—

For the purposes of subsection (1)(b), the term evaluative material means evaluative or opinion material compiled solely—

In subsection (1)(c), medical practitioner means a health practitioner who is, or is deemed to be, registered with the Medical Council of New Zealand continued by section 114(1)(a) of the Health Practitioners Competence Assurance Act 2003 as a practitioner of the profession of medicine.

Subject to sections 7, 31, and 32, no reasons other than 1 or more of the reasons set out in sections 27 to 29 justifies a refusal to disclose any information requested pursuant to principle 6.

Where a request made pursuant to principle 6 relates to information to which section 27 or section 28 applies, or would, if it existed, apply, the agency dealing with the request may, if it is satisfied that the interest protected by section 27 or section 28 would be likely to be prejudiced by the disclosure of the existence or non-existence of such information, give notice in writing to the applicant that it neither confirms nor denies the existence or non-existence of that information.

This Part applies to the following requests (in this Act referred to as information privacy requests):

An information privacy request may be made only by an individual.

Subject to section 36, a public sector agency shall not require the payment, by or on behalf of any individual who wishes to make an information privacy request, of any charge in respect of—

Subject to subsection (4), an agency that is not a public sector agency shall not require the payment, by or on behalf of any individual who wishes to make an information privacy request, of any charge in respect of—

An agency that is not a public sector agency may require the payment, by or on behalf of any individual who wishes to make a request pursuant to subclause (1)(a) or subclause (1)(b) of principle 6 or pursuant to principle 7, of a charge in respect of—

Where an agency that is not a public sector agency makes information available in compliance, in whole or in part, with an information privacy request, the agency may require the payment of a charge in respect of the provision of assistance, by that agency, in accordance with section 38, in respect of that request.

Any charge fixed by an agency pursuant to subsection (3) or subsection (4) or pursuant to an authority granted pursuant to section 36 in respect of an information privacy request shall be reasonable, and (in the case of a charge fixed in respect of the making available of information) regard may be had to the cost of the labour and materials involved in making information available in accordance with the request and to any costs incurred pursuant to a request of the applicant for the request to be treated as urgent.

The provisions of subsections (3) to (5), in so far as they relate to the fixing, by any agency that is not a public sector agency, of any charge in respect of any information privacy request, shall apply subject to any provisions to the contrary in any code of practice issued under section 46 and for the time being in force.

Where a public sector agency satisfies the Commissioner that the agency is commercially disadvantaged, in comparison with any competitor in the private sector, by reason that the agency is prevented, by subsection (1) of section 35, from imposing a charge in respect of any of the matters referred to in paragraph (e) or paragraph (f) of that subsection, the Commissioner may authorise that agency to impose a charge in respect of either or both of those matters.

The Commissioner may authorise a public sector agency to impose a charge in respect of the matter referred to in section 35(1)(e) if the information privacy request is received from, or on behalf of, an individual who—

The Commissioner may impose in respect of any authority granted pursuant to subsection (1) or (1A) such conditions as the Commissioner thinks fit.

The Commissioner may, at any time, revoke any authority granted to an agency pursuant to subsection (1) or (1A), but shall not revoke any such authority without giving the agency an opportunity to be heard.

If an individual making an information privacy request asks that his or her request be treated as urgent, that individual shall give his or her reasons why the request should be treated as urgent.

It is the duty of every agency to give reasonable assistance to an individual, who—

to make a request in a manner that is in accordance with the requirements of this Act or to direct his or her request to the appropriate agency.

Where—

the agency to which the request is made shall promptly, and in any case not later than 10 working days after the day on which the request is received, transfer the request to the other agency and inform the individual making the request accordingly.

Subject to this Act, the agency to which an information privacy request is made or transferred in accordance with this Act shall, as soon as reasonably practicable, and in any case not later than 20 working days after the day on which the request is received by that agency,—

Where any charge is imposed, the agency may require the whole or part of the charge to be paid in advance.

Where an information privacy request is made or transferred to a department, the decision on that request shall be made by the chief executive of that department or an officer or employee of that department authorised by that chief executive, unless that request is transferred in accordance with section 39 to another agency.

Nothing in subsection (3) prevents the chief executive of a department or any officer or employee of a department from consulting a Minister or any other person in relation to the decision that the chief executive or officer or employee proposes to make on any information privacy request made or transferred to the department in accordance with this Act.

Where an information privacy request is made or transferred to an agency, the agency may extend the time limit set out in section 39 or section 40(1) in respect of the request if—

Any extension under subsection (1) shall be for a reasonable period of time having regard to the circumstances.

The extension shall be effected by giving or posting notice of the extension to the individual who made the request within 20 working days after the day on which the request is received.

The notice effecting the extension shall—

Where the information in respect of which an information privacy request is made by any individual is comprised in a document, that information may be made available in 1 or more of the following ways:

Subject to section 43, the agency shall make the information available in the way preferred by the individual requesting it unless to do so would—

Where the information is not provided in the way preferred by the individual requesting it, the agency shall, subject to section 32, give to that individual—

Where the information in respect of which an information privacy request is made is comprised in a document and there is good reason for withholding some of the information contained in that document, the other information in that document may be made available by making a copy of that document available with such deletions or alterations as are necessary.

Where a copy of a document is made available under subsection (1), the agency shall, subject to section 32, give to the individual—

Where an information privacy request made by an individual is refused, the agency shall,—

Where an information privacy request is made pursuant to subclause (1)(b) of principle 6, the agency—

The Commissioner may from time to time issue a code of practice.

A code of practice may—

A code of practice may apply in relation to any 1 or more of the following:

A code of practice may also—

A code of practice may not limit or restrict the circumstances in which an individual is entitled,—

Notwithstanding the definition of the term individual in section 2(1),—

For the purposes of subsection (6), the term health information has the same meaning as it has in section 22B of the Health Act 1956.

Subject to section 48, the Commissioner may issue a code of practice under section 46 on the Commissioner’s own initiative or on the application of any person.

Without limiting subsection (1), but subject to subsection (3), any person may apply to the Commissioner for the issue of a code of practice in the form submitted by the applicant.

An application may be made pursuant to subsection (2) only—

Where an application is made to the Commissioner pursuant to subsection (2), the Commissioner shall give public notice that the application has been received by the Commissioner, which notice shall contain a statement that—

For the purposes of section 48, the publication of a notice under subsection (4) in relation to any proposed code of practice shall be sufficient compliance with the requirements of subsection (1)(a) of that section in relation to the issuing of that code.

Subject to section 52, the Commissioner shall not issue a code of practice under section 46 unless—

The fact that the Commissioner has published in the Gazette a notice under section 49(1) shall be conclusive proof that the requirements of this section have been complied with in respect of the code of practice to which the notice relates.

Nothing in subsection (1) prevents the Commissioner from adopting any additional means of publicising the proposal to issue a code or of consulting with interested parties in relation to such a proposal.

Where a code of practice is issued under section 46,—

Every code of practice issued under section 46 shall come into force on the 28th day after the date of its notification in the Gazette or on such later day as may be specified in the code.

All codes of practice issued under section 46 are disallowable instruments, but not legislative instruments, for the purposes of the Legislation Act 2012 and must be presented to the House of Representatives under section 41 of that Act.

The Commissioner may from time to time issue an amendment or revocation of a code of practice issued under section 46.

The provisions of sections 47 to 50 shall apply in respect of any amendment or revocation of a code of practice.

If the Commissioner considers that it is necessary to issue a code of practice under section 46, or to amend or revoke any such code of practice, and that following the procedure set out in section 48 would be impracticable because it is necessary to issue the code or, as the case may be, the amendment or revocation urgently, the Commissioner may issue the code of practice or, as the case may be, the amendment or revocation without complying with those procedures.

Every code of practice, and every amendment or revocation of a code of practice, issued in accordance with this section shall be identified as a temporary code or amendment or revocation, and shall remain in force for such period (not exceeding 1 year after the date of its issue) as is specified for that purpose in the code or, as the case may be, the amendment or the revocation.

Nothing in section 49(2) shall apply in respect of a code of practice, or any amendment or revocation of a code of practice, issued in accordance with this section.

Where a code of practice issued under section 46 is in force,—

The Commissioner may authorise an agency to collect, use, or disclose personal information, even though that collection, use, or disclosure would otherwise be in breach of principle 2 or principle 10 or principle 11, if the Commissioner is satisfied that, in the special circumstances of the case,—

The Commissioner may impose in respect of any authority granted under subsection (1) such conditions as the Commissioner thinks fit.

The Commissioner shall not grant an authority under subsection (1) in respect of the collection, use, or disclosure of any personal information for any purpose if the individual concerned has refused to authorise the collection or, as the case requires, the use or disclosure of the information for that purpose.

Nothing in principle 6 or principle 7 applies in respect of—

Nothing in the information privacy principles applies in respect of—

where that personal information is collected or held by that individual solely or principally for the purposes of, or in connection with, that individual’s personal, family, or household affairs.

The exemption in subsection (1) ceases to apply once the personal information concerned is collected, disclosed, or used, if that collection, disclosure, or use would be highly offensive to an ordinary reasonable person.

Information privacy principles 2, 3, and 4(b) do not apply to information collected by an intelligence and security agency.

In this Part, unless the context otherwise requires,—

The public register privacy principles are as follows:

Subject to subsection (3), the agency responsible for administering any public register shall, in administering that register, comply, so far as is reasonably practicable, with the information privacy principles and the public register privacy principles.

Every person shall, so far as is reasonably practicable, comply with principle 2 of the public register privacy principles.

Where any information privacy principle or any public register privacy principle is inconsistent with any provision of any enactment, then, for the purposes of this Part, that enactment shall, to the extent of the inconsistency, prevail.

The Commissioner may, on complaint made to the Commissioner by any person or on the Commissioner’s own initiative, inquire into any public register provision if it appears to the Commissioner that the provision is inconsistent with any of the information privacy principles or any of the public register privacy principles.

On completing any inquiry conducted pursuant to subsection (1), the Commissioner shall report the Commissioner’s findings to the Minister responsible for the administration of the enactment that was the subject of the inquiry, and any such report may include recommendations on the need for, or desirability of, taking any legislative, administrative, or other action to ensure adherence or greater adherence to the information privacy principles or the public register privacy principles, or both.

The Commissioner may, on complaint made to the Commissioner by any person or on the Commissioner’s own initiative, investigate—

On completing any inquiry conducted pursuant to subsection (3), the Commissioner shall report the Commissioner’s findings to the chief administrative officer of the agency whose actions were the subject of the inquiry (or the person whose actions were the subject of the inquiry, in the case of an inquiry to which paragraph (b) of that subsection applies), and any such report may include recommendations on the need for, or desirability of, taking any administrative or other action to ensure adherence or greater adherence to the information privacy principles or the public register privacy principles, or both.

Sections 68, 70, 71, 73, 75, 80, and Part 9 shall apply, so far as applicable and with all necessary modifications, in relation to the making of a complaint pursuant to this section and to any inquiry conducted by the Commissioner pursuant to this section.

The public register privacy principles do not confer on any person any legal right that is enforceable in a court of law.

The Commissioner may from time to time issue, in relation to any public register, a code of practice.

A code of practice issued under this section may—

A code of practice issued under this section may also contain provisions—

To the extent that any code of practice issued under this section is inconsistent with any provision of any enactment, the code shall, to the extent of the inconsistency, be of no effect.

Sections 47 to 52, so far as they are applicable and with all necessary modifications, shall apply with respect to the issue of any code of practice under this section and with respect to any code so issued.

Where a code of practice issued under section 63 is in force,—

The Governor-General may from time to time, by Order in Council made on the advice of the responsible Minister given after consultation with the Commissioner, amend Schedule 2 by adding any item.

An Order in Council made under this section may add an item to Part 2 of Schedule 2 only if the item relates to a document that contains personal information and that is held by a public sector agency.

For the purposes of this Part, an action is an interference with the privacy of an individual if, and only if,—

Without limiting subsection (1), an action is an interference with the privacy of an individual if, in relation to an information privacy request made by the individual,—

If, in relation to any information privacy request, any agency fails within the time limit fixed by section 40(1) (or, where that time limit has been extended under this Act, within that time limit as so extended) to comply with paragraph (a) or paragraph (b) of section 40(1), that failure shall be deemed, for the purposes of subsection (2)(a)(i) of this section, to be a refusal to make available the information to which the request relates.

Undue delay in making information available in response to an information privacy request for that information shall be deemed, for the purposes of subsection (2)(a)(i), to be a refusal to make that information available.

Any person may make a complaint to the Commissioner alleging that any action is or appears to be an interference with the privacy of an individual.

A complaint under this Part may be lodged with the Commissioner or an Ombudsman.

On receiving a complaint under this Part, an Ombudsman shall forward the complaint to the Commissioner as soon as practicable.

A complaint to the Commissioner may be made either orally or in writing.

A complaint made orally shall be put in writing as soon as practicable.

The Commissioner shall give such reasonable assistance as is necessary in the circumstances to enable an individual, who wishes to make a complaint to the Commissioner, to put the complaint in writing.

The functions of the Commissioner under this Part shall be—

The Commissioner may commence an investigation under subsection (1)(a) either on complaint made to the Commissioner or on the Commissioner’s own initiative.

On receiving a complaint under this Part, the Commissioner may—

The Commissioner shall, as soon as practicable, advise the complainant and the person to whom the complaint relates of the procedure that the Commissioner proposes to adopt under subsection (1).

The Commissioner may in his or her discretion decide to take no action or, as the case may require, no further action, on any complaint if, in the Commissioner’s opinion,—

Notwithstanding anything in subsection (1), the Commissioner may in his or her discretion decide not to take any further action on a complaint if, in the course of the investigation of the complaint, it appears to the Commissioner that, having regard to all the circumstances of the case, any further action is unnecessary or inappropriate.

In any case where the Commissioner decides to take no action, or no further action, on a complaint, the Commissioner shall inform the complainant of that decision and the reasons for it.

Where, on receiving a complaint under this Part, the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of an Ombudsman under the Ombudsmen Act 1975 or the Official Information Act 1982 or the Local Government Official Information and Meetings Act 1987, the Commissioner shall forthwith consult with the Chief Ombudsman in order to determine the appropriate means of dealing with the complaint.

As soon as practicable after consulting with the Chief Ombudsman under subsection (1), the Commissioner shall determine whether the complaint should be dealt with, in whole or in part, under this Act.

If the Commissioner determines that the complaint should be dealt with, in whole or in part, under the Ombudsmen Act 1975 or the Official Information Act 1982 or the Local Government Official Information and Meetings Act 1987, the Commissioner shall forthwith refer the complaint or, as the case requires, the appropriate part of the complaint to the Chief Ombudsman to be dealt with accordingly, and shall notify the complainant of the action that has been taken.

Where, on receiving a complaint under this Part, the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of the Health and Disability Commissioner under the Health and Disability Commissioner Act 1994, the Commissioner shall forthwith consult with the Health and Disability Commissioner in order to determine the appropriate means of dealing with the complaint.

As soon as practicable after consulting with the Health and Disability Commissioner under subsection (1), the Commissioner shall determine whether or not the complaint should be dealt with, in whole or in part, under this Act.

If the Commissioner determines that the complaint should be dealt with, in whole or in part, under the Health and Disability Commissioner Act 1994, the Commissioner shall forthwith refer the complaint or, as the case requires, the appropriate part of the complaint to the Health and Disability Commissioner to be dealt with accordingly, and shall notify the complainant of the action that has been taken.

Where, on receiving a complaint under this Part, the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of the Inspector-General of Intelligence and Security under subpart 1 of Part 6 of the Intelligence and Security Act 2017, the Commissioner shall forthwith consult with the Inspector-General of Intelligence and Security in order to determine the appropriate means of dealing with the complaint.

As soon as practicable after consulting with the Inspector-General of Intelligence and Security under subsection (1), the Commissioner shall determine whether or not the complaint should be dealt with, in whole or in part, under this Act.

If the Commissioner determines that the complaint should be dealt with, in whole or in part, under subpart 1 of Part 6 of the Intelligence and Security Act 2017, the Commissioner shall forthwith refer the complaint or, as the case requires, the appropriate part of the complaint to the Inspector-General of Intelligence and Security to be dealt with accordingly, and shall notify the complainant of the action that has been taken.

Where, on receiving a complaint under this Part, the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of an overseas privacy enforcement authority, the Commissioner may consult with that authority in order to determine the appropriate means of dealing with the complaint.

As soon as practicable after consulting with the overseas privacy enforcement authority under subsection (1), the Commissioner must determine whether the complaint should be dealt with, in whole or in part, under this Act.

If the Commissioner determines that the complaint should be dealt with, in whole or in part, by the overseas privacy enforcement authority, and both the authority and the complainant agree, the Commissioner may refer the complaint or, as the case requires, the appropriate part of the complaint, to the authority to be dealt with.

In this section, overseas privacy enforcement authority or authority means any overseas public body that is responsible for enforcing legislation that protects personal information, and that has the power to conduct investigations and pursue enforcement proceedings.

Before proceeding to investigate any matter under this Part, the Commissioner—

Where it appears from a complaint, or any written response made in relation to a complaint under section 73(b)(ii), that it may be possible to secure a settlement between any of the parties concerned and, if appropriate, a satisfactory assurance against the repetition of any action that is the subject matter of the complaint or the doing of further actions of a similar kind by the person concerned, the Commissioner may, without investigating the complaint or, as the case may be, investigating the complaint further, use his or her best endeavours to secure such a settlement and assurance.

Where any investigation is made following a complaint, the Commissioner shall conduct the investigation with due expedition and shall inform the parties concerned, as soon as reasonably practicable after the conclusion of the investigation and in such manner as the Commissioner thinks proper, of the result of the investigation and of what further action (if any) the Commissioner proposes to take in respect of that complaint.

The Commissioner may call a conference of the parties to a complaint by—

The objectives of the conference shall be—

Where a person fails to comply with a request under subsection (1) to attend a conference, the Commissioner may issue a summons requiring the person to attend a conference at a time and place to be specified in the summons.

Section 159 of the Criminal Procedure Act 2011 applies to a summons under this section as if it were a witness summons issued under that section.

Where the Commissioner, after making any investigation under this Part, is of the opinion,—

If,—

the Commissioner may refer the matter to the Director of Human Rights Proceedings for the purpose of deciding whether proceedings under section 82 should be instituted against the person against whom the complaint was made or in respect of whom the investigation was conducted.

Where a matter is referred to the Director of Human Rights Proceedings under subsection (2), it shall, subject to section 82(3), be for the Director of Human Rights Proceedings to determine, in his or her discretion, both whether a matter justifies the institution of proceedings under section 82 and whether proceedings should be instituted under section 82 in respect of that matter.

Notwithstanding anything in section 77, where the Commissioner, after making any investigation under this Part, is of the opinion that a charge fixed in respect of an information privacy request is unreasonable, the Commissioner shall determine the amount of the charge (if any) that may reasonably be imposed in respect of that request.

A determination of the Commissioner under subsection (1) shall be final and binding on the person who made the request and on the agency concerned, and, notwithstanding anything in section 82 or section 83, no proceedings may be brought before the Tribunal under either of those sections in respect of any action of any agency in so far as that action is the subject of a determination made by the Commissioner under subsection (1).

This section applies to any interference with the privacy of an individual involving a breach of any of principles 1, 2, 3, 4, 8, 9, 10, and 11, in any case where the action that constitutes the breach occurs before 1 July 1996.

Notwithstanding anything in this Part, but subject to subsection (3), where—

then, in so far as the complaint or investigation relates to an interference with the privacy of an individual (being an interference to which this section applies), the following provisions shall apply:

Nothing in this section applies in relation to any interference with the privacy of an individual involving a breach of any information privacy principle, where the action that breaches the principle constitutes a failure to comply with a code of practice issued under section 46.

If, during or after any investigation, the Commissioner is of the opinion that there is evidence of any significant breach of duty or misconduct on the part of any agency or any officer or employee or member of an agency, the Commissioner shall refer the matter to the appropriate authority.

Nothing in sections 76, 77, and 82 to 89 applies to—

If, after completing an investigation, the Commissioner is of the opinion that an action of an intelligence and security agency is an interference with the privacy of an individual, the Commissioner must provide to the intelligence and security agency a report setting out—

A report provided under subsection (2) may include any recommendations the Commissioner considers appropriate.

When making a report under subsection (2), the Commissioner may request the intelligence and security agency to notify him or her within a specified time of any steps the agency proposes to take in response to the report and to any recommendations included in the report.

If, within a reasonable time after any report is made, no steps are taken by the intelligence and security agency in response to the report that seem to be adequate and appropriate, the Commissioner may send a copy of the report to the Prime Minister.

As soon as practicable after receiving a report under subsection (5), the Prime Minister may present the report, or any part of the report, to the House of Representatives.

This section applies to any person—

Subject to subsection (3), civil proceedings before the Human Rights Review Tribunal shall lie at the suit of the Director of Human Rights Proceedings against any person to whom this section applies in respect of any action of that person that is an interference with the privacy of an individual.

The Director of Human Rights Proceedings shall not take proceedings under subsection (2) against any person to whom this section applies unless the Director of Human Rights Proceedings has given that person an opportunity to be heard.

The Director of Human Rights Proceedings may, under subsection (2), bring proceedings on behalf of a class of individuals, and may seek on behalf of individuals who belong to the class any of the remedies described in section 85, where the Director of Human Rights Proceedings considers that a person to whom this section applies is carrying on a practice which affects that class and which is an interference with the privacy of an individual.

Where proceedings are commenced by the Director of Human Rights Proceedings under subsection (2), the aggrieved individual (if any) shall not be an original party to, or, unless the Tribunal otherwise orders, join or be joined in, any such proceedings.

Notwithstanding section 82(2), the aggrieved individual (if any) may himself or herself bring proceedings before the Human Rights Review Tribunal against a person to whom section 82 applies if the aggrieved individual wishes to do so, and—

In any proceedings before the Human Rights Review Tribunal, the Director of Human Rights Proceedings or the aggrieved individual (as the case may be) may seek such of the remedies described in section 85 as he or she thinks fit.

If, in any proceedings under section 82 or section 83, the Tribunal is satisfied on the balance of probabilities that any action of the defendant is an interference with the privacy of an individual, it may grant 1 or more of the following remedies:

In any proceedings under section 82 or section 83, the Tribunal may award such costs against the defendant as the Tribunal thinks fit, whether or not the Tribunal makes any other order, or may award costs against the plaintiff, or may decline to award costs against either party.

Where the Director of Human Rights Proceedings is the plaintiff, any costs awarded against him or her shall be paid by the Privacy Commissioner, and the Privacy Commissioner shall not be entitled to be indemnified by the aggrieved individual (if any).

It shall not be a defence to proceedings under section 82 or section 83 that the interference was unintentional or without negligence on the part of the defendant, but the Tribunal shall take the conduct of the defendant into account in deciding what, if any, remedy to grant.

Whether or not the Director of Human Rights Proceedings is or was a party to the proceedings before the Human Rights Review Tribunal, the Director may appear and be heard, in person or by counsel,—

Where, pursuant to subsection (1), the Director of Human Rights Proceedings appears in any proceedings of a kind described in that subsection, he or she shall, unless those proceedings are by way of appeal, have the right—

but shall have no greater rights than parties to the proceedings in respect of the calling of evidence or evidence in rebuttal, or in respect of the examination, cross-examination, and re-examination of witnesses.

Where, pursuant to subsection (1), the Director of Human Rights Proceedings, not being a party to any proceedings before the Tribunal, appears in those proceedings or in any proceedings in any court in relation to those proceedings, the Tribunal or the court, as the case may be, may make such order as it thinks fit—

Costs ordered to be paid by the Director of Human Rights Proceedings shall be paid by the Privacy Commissioner.

The Privacy Commissioner may appear and be heard in any proceedings in which the Director of Human Rights Proceedings would be entitled to appear and be heard under this section but declines to do so, and, where the Privacy Commissioner so appears, the provisions of this section shall apply accordingly with all necessary modifications.

Nothing in this section limits or affects—

Where, by any provision of the information privacy principles or of this Act or of a code of practice issued under section 46 or section 63, conduct is excepted from conduct that is an interference with the privacy of an individual, the onus of proving the exception in any proceedings under this Part lies upon the defendant.

In any proceedings under section 82 or section 83, the Tribunal may award damages against the defendant for an interference with the privacy of an individual in respect of any 1 or more of the following:

Subsection (1) applies subject to subpart 1 of Part 2 of the Prisoners’ and Victims’ Claims Act 2005.

Damages recovered by the Director of Human Rights Proceedings under this section shall be paid to the aggrieved individual on whose behalf the proceedings were brought or, if that individual is a minor who is not married or in a civil union or lacks the capacity to manage his or her own financial affairs, in the discretion of the Director of Human Rights Proceedings to Public Trust.

Where money is paid to Public Trust under subsection (2),—

Sections 92Q to 92W and Part 4 of the Human Rights Act 1993 shall apply, with such modifications as are necessary, in respect of proceedings under section 82 or section 83 of this Act as if they were proceedings under section 92B, or section 92E, or section 92H of that Act.

Every investigation under Part 8 by the Commissioner shall be conducted in private.

Subject to section 120,—

Subject to the provisions of this Act, the Commissioner may regulate his or her procedure in such manner as he or she thinks fit.

The Commissioner may summon before him or her and examine on oath any person who in the Commissioner’s opinion is able to give information relevant to an investigation being conducted by the Commissioner under Part 8, or an inquiry being carried out by the Commissioner under section 13(1)(m).

The Commissioner may administer an oath to any person summoned pursuant to subsection (1).

Every examination by the Commissioner under subsection (1) shall be deemed to be a judicial proceeding within the meaning of section 108 of the Crimes Act 1961 (which relates to perjury).

The Commissioner may from time to time, by notice in writing, require any person who in the Commissioner’s opinion is able to give information relevant to an investigation being conducted by the Commissioner under Part 8, or an inquiry being carried out by the Commissioner under section 13(1)(m), to furnish such information, and to produce such documents or things in the possession or under the control of that person, as in the opinion of the Commissioner are relevant to the subject matter of the investigation or inquiry.

Where the attendance of any person is required by the Commissioner under this section, the person shall be entitled to the same fees, allowances, and expenses as if the person were a witness in a court and, for the purpose,—

This section applies in every case where, during the course of an investigation under Part 8 of any decision of any agency in relation to an information privacy request, the Commissioner, pursuant to any power conferred on the Commissioner by section 91, requires that agency to furnish or produce to the Commissioner any information or document or thing which relates to that investigation.

In any case to which this section applies, the agency to which the requirement is made shall, subject to section 93, as soon as reasonably practicable, and in no case later than 20 working days after the day on which the requirement is received by the agency, comply with the requirement.

If any agency (being a department or a Minister or an organisation) fails, within the time limit fixed by subsection (2) (or, where that time limit has been extended under section 93, within that time limit as so extended), to comply with any requirement to which subsection (1) applies, the Commissioner may report such failure to the Prime Minister.

Where any requirement to which section 92 applies is made to any agency, the agency may extend the time limit set out in subsection (2) of that section in respect of that requirement if—

Any extension under subsection (1) shall be for a reasonable period of time having regard to the circumstances.

The extension shall be effected by giving or posting notice of the extension to the Commissioner within 20 working days after the day on which the requirement is received.

The notice effecting the extension shall—

Except as provided in section 119, every person shall have the same privileges in relation to the giving of information to, the answering of questions put by, and the production of documents and things to, the Commissioner or any employee of the Commissioner as witnesses have in any court.

Nothing in subsection (1) prevents the Commissioner or any employee of the Commissioner from—

for the purpose of determining whether the information, document, or thing would be properly withheld, but not so as to give the Commissioner or employee any information, or enable the Commissioner or employee to make any use of the information, document, or thing, that he or she would not, apart from this subsection, be entitled to.

On the production of any information, document, or thing pursuant to subsection (1A), the Commissioner or any employee of the Commissioner—

No person shall be liable to prosecution for an offence against any enactment, other than section 127, by reason of that person’s compliance with any requirement of the Commissioner or any employee of the Commissioner under section 91.

Subject to subsection (2) and to section 94, any person who is bound by the provisions of any enactment to maintain secrecy in relation to, or not to disclose, any matter may be required to supply any information to, or answer any question put by, the Commissioner in relation to that matter, or to produce to the Commissioner any document or thing relating to it, notwithstanding that compliance with that requirement would otherwise be in breach of the obligation of secrecy or non-disclosure.