ABSTRACT
Although the exact nature of the relevant obligations varies somewhat depending upon the applicable set of privacy principles, it is ordinarily the case under privacy legislation that personal information must be collected:
• for lawful purposes directly related to a function or activity of the organisation and where the collection is necessary for that purpose;
• from the individual to whom the information relates, unless otherwise authorised or where the information is collected under an applicable exception;
• in circumstances where the individual from whom it is collected is made aware of the following matters: the fact that it is being collected, the purpose for collecting it, intended recipients of the information, whether the supply is mandatory or voluntary, relevant rights to access and correct the information, and the name and address of the collecting organisation and any holding organisation; and
• taking reasonable steps to ensure the information is relevant, accurate, not excessive and up to date and that the collection does not unreasonably intrude on the individual’s personal affairs.
