Privacy Act Duties When Handling Financial Records

Establish Whether the Privacy Act Applies

Identify the legal entity holding the records, its activity and the information before applying the Australian Privacy Principles (APPs). The Privacy Act 1988 generally covers Commonwealth agencies and covered private-sector organisations. A law firm, an outside analyst and a state department can have different coverage.

A private business with annual turnover above $3 million is generally covered. A smaller business can also be covered through a statutory exception or voluntary opt-in. Check the OAIC’s small-business coverage guidance, including Commonwealth service contracts and trading in personal information. Do not assume every small law firm is exempt.

For a firm that becomes an anti-money laundering and counter-terrorism financing reporting entity, coverage can attach to its regulated activities despite its size. The OAIC’s reporting-entity guidance distinguishes this activity-based coverage from coverage of the whole business. Identify which applies to the particular records.

State and territory public-sector bodies generally sit outside the Commonwealth APP framework. Identify the body’s governing legislation and any relevant exception or Commonwealth contractual obligations. A state agency’s engagement of a private analyst does not give both parties identical privacy duties.

Record the coverage conclusion and its basis in the matter file. Separate special rules, such as tax file number handling, from the conclusion about general APP coverage.

Classify the Information in Financial Records

Personal information is information or an opinion about an identified or reasonably identifiable individual, whether true or false. Account ownership, transaction history and an analyst’s inference about a person can meet that definition. The OAIC’s definitions guidance explains the statutory categories.

Financial information is not automatically statutory sensitive information. Sensitive information includes health information and specified information about matters such as religious beliefs, political opinions and sexual orientation. It also includes specified genetic and biometric information.

Consider these fictional transaction descriptions. A payment labelled “North Clinic” may reveal health information when read with appointment records. A recurring membership payment may disclose a person’s political affiliation. A supermarket debit ordinarily reveals spending, without itself establishing a sensitive-information category.

Assess what the description actually communicates in context. A merchant name alone may support several explanations. Record an inference separately from the transaction fact, and apply the additional collection requirements where the material is sensitive information.

Map Collection, Use and Disclosure

Map each handling step to its purpose and authority. Receiving statements from a client, deriving a spending classification and sending a report to another party are separate decisions.

For solicited collection, APP 3 requires an organisation’s collection to be reasonably necessary for its functions or activities. An agency has the alternative of collection directly related to its functions or activities. Collection must be lawful and fair. Sensitive information generally requires consent as well as the relevant necessity test, unless an exception applies.

Creating personal information through analysis can itself be collection. Apply the collection assessment to an identifiable person’s inferred spending or income, alongside the source statement. Assess unsolicited records under APP 4 when they arrive without being requested.

Under APP 5, take reasonable steps to notify the individual of relevant collection matters, or ensure awareness. Assess what is reasonable in the actual circumstances. Receiving information from someone other than the individual does not automatically remove that obligation.

For each later recipient, assess the primary purpose and any applicable exception under APP 6. Consent is one route. Others include a qualifying expected related purpose or handling required or authorised by Australian law or a court or tribunal order. Sensitive information has a stricter directly-related-purpose condition for the reasonable-expectation exception.

Read a production order and any use restrictions before sharing the resulting analysis. Compulsory acquisition for a proceeding does not authorise every later use. Record the particular legal basis, permitted recipients and intended reliance.

Assess the Outside Financial Analyst Arrangement

Create a matter-specific information-flow record before transferring financial records to an outside analyst. It must describe the actual engagement, including subcontracted processing and remote support access.

Record item	What the matter file needs
Source set	Statement files, account holders and relevant periods
Purpose	The analysis required and permitted uses of the output
Recipients	Analyst staff, subcontractors and intended report recipients
Locations	Storage, processing, backup and support-access countries
Controls	Access permissions, onward-use restrictions and incident reporting
Completion	Return, retained copies and disposal arrangements

Resolve disclosure authority separately from the provider’s security controls. A secure transfer method cannot supply a missing legal basis. The firm’s professional client confidentiality obligations also require their own assessment.

Under APP 8 guidance, provision to an overseas contractor is usually disclosure. Whether an arrangement remains a use depends on effective control and the actual terms. Check overseas staff access as well as the server location.

Where APP 8 applies, assess reasonable steps concerning the overseas recipient and any applicable exception. Section 16C can make the Australian entity accountable for the recipient’s conduct. A contract is part of the assessment, without automatically resolving it.

For example, a limited-purpose spreadsheet might show a named person’s transactions with account numbers hidden. Source references and matter context may still identify that person. Treat the spreadsheet and cited findings as personal information while identification remains reasonably possible.

A new processing arrangement with wider access or more revealing analysis may warrant a separate privacy impact assessment. Keep its project-risk assessment distinct from the handling authority for this matter.

Respond to Access and Correction Requests

A covered entity must assess a person’s request against the access and correction rules applying to that entity. Establish identity and the personal information held, including analysis about the person.

APP 12 distinguishes agencies from organisations. An organisation’s legal-proceedings refusal ground requires proceedings between that organisation and the individual. It also requires that the information would be inaccessible through discovery. A client’s litigation does not automatically satisfy those conditions for the client’s law firm.

Assess other applicable grounds, including unreasonable impact on another person’s privacy. Consider partial access or another suitable means where direct access is refused. Give the required written refusal notice and identify complaint mechanisms. Include reasons subject to the statutory qualification.

An agency cannot charge for APP 12 access. An organisation cannot charge for making the request, although a charge for giving access must not be excessive.

Under APP 13, correction concerns accuracy and suitability for the purpose of holding the information. Take reasonable steps when the entity is satisfied correction is needed, or the person requests correction. Correction requests and corrections are free.

Keep the bank’s source statement intact as evidence. If an analyst wrongly labels a transfer as income, correct the derived classification and record the source, explanation and version change. A dispute about an opinion requires assessment of its factual basis and presentation.

If refusing correction, give the required written reasons and complaint information. On request, take reasonable steps to associate the person’s statement of disagreement with the information. Assess any duty to notify another APP entity of a correction when the individual requests it.

Maintain Security, Retention and Accountability

APP 11 requires reasonable protection against misuse, interference and loss. It also covers unauthorised access, modification or disclosure. Reasonable steps include technical and organisational measures. Restrict matter access, protect transfers and establish a workable incident-response process.

Record who makes privacy decisions and who manages provider access. Keep the information-flow record with handling decisions, disclosure approvals and correction history. Apply APP 1’s governance requirements through the entity’s privacy practices and policy.

Retention needs a reason that remains valid. APP 11.2 requires reasonable steps towards destruction or de-identification when its conditions are met. Those conditions account for permitted uses, Commonwealth records and retention required by Australian law or a court or tribunal order.

Check legal preservation obligations and any hold before destroying statements or working files. Record the retention basis and review point, then apply disposal arrangements to provider copies when lawful.

If financial records may have been exposed, escalate to the responsible privacy decision-maker and the distinct notifiable data breach assessment process. Preserve the incident evidence and contain further access while that assessment proceeds.