Tasmania’s (PIPA) + (PIPPs)

The Personal Information Protection Act 2004 (PIPA) is a privacy law that applies to Tasmanian public and private sector organizations. It establishes guidelines for these organizations' use of personal data and provides individuals with certain rights.

Under PIPA, organizations must obtain an individual's consent before collecting their personal information and must only use that information for the purposes for which it was initially collected. Organizations must also take reasonable steps to ensure that individuals’ personal information is accurate, up-to-date, and secure.

The Personal Information Protection Principles (PIPPs) are principles outlined in the Tasmanian Personal Information Protection Act 2004 (PIPA). The PIPPs were created to safeguard individuals’ privacy and regulate how personal information is collected, used, stored, and disclosed by organizations in Tasmania. The 10 PIPPs are as follows:

1. Openness: Organizations must establish transparent and clear policies for handling personal data.
2. Collection: Personal information must only be collected for lawful purposes and must be collected in a fair and non-intrusive manner.
3. Use and disclosure: Personal information must only be used or disclosed for the purpose for which it was collected or for a related purpose that the individual would reasonably expect and obtain data subject’s consent for it.
4. Data quality: Personal information must be accurate, complete and up-to-date.
5. Data security: Organizations must take reasonable steps to protect personal information from misuse, loss, unauthorized access, modification, or disclosure.
6. Access and correction: Individuals have the right to access and correct their personal information held by an organization.
7. Unique identifiers: Organizations must not adopt a person's government-related identifier as their own identifier, except in certain circumstances.
8. Anonymity: Individuals have the right to deal with an organization anonymously, where it is lawful and practical.
9. Transborder data flows: Organizations must ensure that personal information is adequately protected when it is transferred overseas.
10. Sensitive information: should not collect sensitive information about an individual unless the individual has given consent, the collection is required or permitted by law, or it is necessary to prevent a serious threat to an individual's life or health and they are unable to give consent.