Commonwealth Consolidated Acts

PRIVACY ACT 1988 - SECT 33D

             (1)  If:

                     (a)  an agency proposes to engage in an activity or function involving the handling of personal information about individuals; and

                     (b)  the Commissioner considers that the activity or function might have a significant impact on the privacy of individuals;

the Commissioner may, in writing, direct the agency to give the Commissioner, within a specified period, a privacy impact assessment about the activity or function.

             (2)  A direction under subsection (1) is not a legislative instrument.

Privacy impact assessment

             (3)  A privacy impact assessment is a written assessment of an activity or function that:

                     (a)  identifies the impact that the activity or function might have on the privacy of individuals; and

                     (b)  sets out recommendations for managing, minimising or eliminating that impact.

             (4)  Subsection (3) does not limit the matters that the privacy impact assessment may deal with.

             (5)  A privacy impact assessment is not a legislative instrument.

Failure to comply with a direction

             (6)  If an agency does not comply with a direction under subsection (1), the Commissioner must advise both of the following of the failure:

                     (a)  the Minister;

                     (b)  if another Minister is responsible for the agency--that other Minister.

Review

             (7)  Before the fifth anniversary of the commencement of this section, the Minister must cause a review to be undertaken of whether this section should apply in relation to organisations.