Where your data goes, the duty follows.
Hand records to a cloud service provider or an offshore contractor and the law asks two questions: is the handling still within your effective control, and is the recipient in Australia? The OAIC’s answer to both is one line: your entity is responsible and accountable for the personal information it collects, even when a provider or contractor holds it.
Two questions decide what happens when records go to a data service: is it still in your control, and is it still in Australia? Find your arrangement on the plane.
General information about Australian privacy law, not legal advice. The OAIC’s guidance on sending personal information overseas is at oaic.gov.au.
The two questions, in the law’s words
The OAIC’s APP Guidelines define a use this way: “An APP entity uses personal information where it handles, or undertakes an activity with the personal information, within the entity’s effective control.”
A disclosure: “An APP entity discloses personal information where it makes it accessible to others outside the entity and releases the subsequent handling of the information from its effective control.”
And the word underneath both, from the Act itself: an entity holds personal information “if the entity has possession or control of a record that contains the personal information” (s 6(1), via the OAIC’s page on sending personal information overseas).
Before records leave
Four checks the OAIC’s guidance sets out, in order:
- First, whether the Act covers the business at all.
- Second, whether the handling stays within your effective control, or is a disclosure: the OAIC says the distinction depends on the degree of control the entity has over the information after it is provided to the recipient.
- Third, before a disclosure overseas, the reasonable steps APP 8.1 asks for: the OAIC generally expects an enforceable contractual arrangement requiring the recipient to handle the personal information in accordance with the APPs other than APP 1.
- Fourth, the countries the records go to, named in the privacy policy: the OAIC says an APP privacy policy must set out whether personal information is likely to be disclosed to overseas recipients, and the countries where they are likely to be located if it is practicable to specify them (APP 1.4(f) and 1.4(g)).
Where these lines come from
The plane is drawn from the law and the guidance, page by page: the Privacy Act 1988 on the Federal Register of Legislation (s 6(1), APP 8, s 16C); the OAIC’s APP Guidelines, chapter 8; the OAIC’s Sending personal information overseas; and the ASD’s cloud shared responsibility model guidance, which sets the security work beside that accountability.