What is the Privacy Act?
As the name suggests, the Privacy Act 1988 (Cth) purports to protect the privacy of individuals
by regulating how certain organisations handle their personal information. For example, it
places various privacy obligations on the following:
- Organisations with an annual turnover of over $3 million
- Australian Government agencies
- Private sector health service providers
- Businesses that sell or purchase personal information
- A credit reporting body
- A business that holds accreditation under the Consumer Data Right System
- A business that has opted-in to the Privacy Act
What does this mean for employees?
If an employee works for an organisation outlined above, they have certain responsibilities under the Privacy Act 1988. However, these responsibilities generally only apply to employees acting on behalf of an organisation or agency, and not when acting in their personal capacity. According to Australian Privacy Principle 6, where personal information about an individual is collected for a particular purpose (the primary purpose), an employee cannot use or disclose the information for another purpose (the secondary purpose) unless it is reasonably necessary to assist with establishing or defending a legal claim. An employee may lawfully send work emails or documents to their personal email address for the purposes of obtaining legal advice and/or pursuing a legal claim against their employer. This might include correspondence from managers, human resources, and colleagues. It might also involve various documents like company policies, performance reviews.
This is only permissible if the emails and documents do not contain a “government related identifier” of an individual, according to Australian Privacy Principle 9. Therefore, an employee cannot send themselves anything that contains an individual’s Medicare number, Centrelink Reference Number, Driver’s License Number or Australian Passport Number.
Employees need to mindful of their confidentiality obligations so it is also important to carefully consider if the emails contain any commercially sensitive information.