Understanding Indirect Privacy Notification: What you need to know

The Privacy Amendment Bill (the Bill), if passed into law, will require agencies to notify individuals when their personal information is collected from a source other than the individual themselves, unless an exemption applies.  

The Bill is currently being considered by Parliament who has indicated that the Bill is expected to become law and come into force on 1 May 2026.  In anticipation of this, the Office of the Privacy Commissioner (OPC) has released their draft guidance (Guidelines) to assist with compliance preparations.  The Guidelines are currently being consulted on.

What are the New Obligations? 

Currently, agencies are only required to notify individuals when they are collecting personal information directly under Information Privacy Principle (IPP) 3.  IPP3A extends this obligation to situations where information is collected indirectly. 

The new requirements would mean that an agency that has collected the information from a source other than the individual concerned will need to take reasonable steps to ensure the individual is aware of:

• Collection: That their personal information has been collected and the kind of information that has been collected.

• Purpose: Why the information has been collected.  Vague terms, such as “for business purposes” are unlikely to be sufficient.

• Recipients: The individuals or organisations that are going to receive the information.

• Agency Details: The name and address of the collecting and holding agency.

• Legal Basis: If the collection is authorised by a specific law, the relevant legal authority must be specified.

• Rights: Individuals must be informed about their right to access and correct their information and advised how they can exercise those rights. 

Under IPP3A, agencies are required to notify individuals as soon as reasonably practicable after indirectly collecting their personal information, unless a relevant exception applies.  What is reasonably practicable will depend on an agency’s circumstances, which may be influenced by the level of knowledge as well as the cost and effort that is required to provide the notification. 

What Exceptions are Available?

Notification will not be required when an exception applies.  The same exceptions that exist under IPP3 will still apply, but the Bill introduces additional exceptions specifically for indirect collections, including: 

• Already aware: The individual has already been made aware of all the required information.  This needs to be evidenced based, and not based on assumptions.

• Would not prejudice the individual: The individual will not suffer any detriment or lose important information because they are not notified.  The Guidelines suggest collecting agencies apply the ‘no surprises’ test, which asks whether the person would be surprised that their personal information has been collected.  If the answer is yes, notification of the collection will likely be required.

• Not reasonably practicable: Notification is not reasonably practical in the circumstances.  However, just because it is inconvenient, or there is an administrative burden, does not automatically mean notification will not be reasonably practical.  The Guidelines make it clear that the more extensive or sensitive the data, the higher the threshold will be.

If an exception applies which permits non-compliance with IPP3A, this exception may not last forever.  Agencies should be reassessing any changes of circumstances as needed, and consider whether notification is subsequently required.  

What should Agencies do now?

In anticipation of the Bill becoming law, now is a good time to start undertaking an assessment of how you are collecting personal information and identifying any indirect collection.  Consideration should also be given to the terms on which you are obtaining that information, as well as any personal information you are disclosing to third parties.  This will allow you to start building a picture of what compliance requirements may need to be met and to think about what systems could be used to ensure smooth compliance once the Bill is enacted.

If you have any questions or wish to find out more, please contact our Corporate & Commercial Team or your usual contact at Hesketh Henry. 

Disclaimer:  The information contained in this article is current at the date of publishing and is of a general nature.  It should be used as a guide only and not as a substitute for obtaining legal advice.  Specific legal advice should be sought where required.