The Privacy Act 1988 (Cth)

Personal information
The Privacy Act 1988 (Cth) (Privacy Act) regulates the handling of personal information about individuals.
The concept of “personal information” is central to the Privacy Act. Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable; it does not matter whether the information or opinion is true or not, and it does not matter whether the information or opinion is recorded in a material form or not: s 6 of the Privacy Act.
Examples of personal information includes an individual’s name, date of birth, contact details (such as residential address, telephone number and email address) and tax file number. Legal practitioners should note that certain information

Sensitive information is information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health information, genetic information, biometric information that is to be used for the purpose of automated biometric verification or biometric identification, or biometric templates.
Generally, biometric information includes (for example) fingerprints, retina iris patterns, voice waves and DNA. It is useful to note here that the handling of biometric information is only regulated by the Privacy Act to the extent that it is also “personal information”.
Australian Privacy Principles
The Privacy Act includes thirteen Australian Privacy Principles (APPs). The APPs set out standards, rights and obligations for the handling, holding, use, accessing and correction of personal information, including sensitive information.
Who has responsibilities under the Privacy Act
Australian Government agencies and the Norfolk Island administration have responsibilities under the Privacy Act. Those responsibilities are similar but not identical to the responsibilities of

OAIC’s webpage “Legally binding guidelines and rules” (https://www.oaic.gov.au/agencies-and-organisations/legally-binding-guidelines-and-rules/) provides a list of these legislative instruments which legal practitioners would find useful when advising clients. An example of this is the Privacy (Tax File Number) Rule 2015.
OAIC also issues non-binding guidelines, which can be accessed on OAIC’s webpage “Advisory guidelines” (https://www.oaic.gov.au/agencies-and-organisations/advisory-guidelines/). An example of this is the Guidelines for recognising external dispute resolution schemes.
Importantly, OAIC’s APP guidelines (https://www.oaic.gov.au/agencies-and-organisations/app-guidelines/) is a useful tool for legal practitioners because (among other things) they outline the mandatory requirements of the APPs and how OAIC will interpret the APPs. Importantly, legal practitioners will find information on what OAIC may take into account when exercising its functions and powers under the Privacy