Comply when dealing with personal or health information.
NSW privacy regulation focuses on the handling of personal and health information. Know how each type of information is described in the legislation to determine the kind of information you have:
The legal definition of personal information includes information or opinion about an individual whose identity 'can reasonably be ascertained', even if it is not apparent. Use this fact sheet on reasonable ascertainable identity to work out if an individual's identity can be reasonably ascertained.
NSW Government agencies must:
Only collect the data you need. Under legislation both personal and health information are subject to strict storage and access requirements. Speak to your agency's privacy contact officer to know more.
Familiarise yourself with your agency's privacy management plan. It describes how your agency will comply with the privacy legislation. Every NSW Government agency must have one.
Here are some ways that you can comply with the main obligations in the legislation.
You must inform users:
You must make them aware before, or soon after you are collecting that information. You can provide this notice in the way best suited to your audience. You could do this by linking to a privacy collection notice that describes what you intend to do with their information.
If you're recording video or audio, it's good practice to inform the user of this in the collection notice.
You need to get specific consent from users when you collect their personal or health information. This is so they can provide full informed consent to the use of the information.
Avoid bundling multiple requests for an individual's consent to a range of collections, uses or disclosures. Instead, give the user the option to choose which collections, uses or disclosures they agree to.
Also get consent if you want to use the personal or health information for a purpose other than for which it was collected. this includes sharing the information with other agencies, or across jurisdictions. Read the Transborder Disclosure Principle for guidance on the rules, exemptions and outsourcing to cloud relating to personal information.
For consent to be valid, the user must have the capacity to give or withhold consent. A user has capacity if they can understand the general nature and effect of a proposed use or disclosure of their personal or health information, and can communicate their consent.
Issues that could affect an individual's capacity to consent include:
You may be able to address such issues by providing the individual with support so they have capacity to consent. For example, it may be appropriate for a parent or guardian to consent on behalf of a young person.
Use the consent checklist to assess whether consent is required for the use and disclosure of personal information.
Agencies should keep personal and health information protected against loss, unauthorised access, use, modification or disclosure and against all other misuse. To do this, take reasonable security safeguards. For example, you can:
Dispose of personal information securely as soon as you have completed the objective it was collected for. For personal information or health information that you no longer need, you must delete or dispose of it at a set frequency.
Before you dispose of personal or health information, talk to your records expert to clarify the minimum retention periods for your situation. This will ensure you comply with the State Records Act 1998, and any other regulations that may apply.
We pay respect to the Traditional Custodians and First Peoples of NSW, and acknowledge their continued connection to their country and culture.