AustraliaPrivacy Act 1988 (Cth), Schedule 1, sensitive information categories
Privacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 3, read with s. 6
In force since .
A sensitive categories rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
- Audit expectation
- none
What it requires
- Do not collect sensitive information about an individual, including biometric information used for automated biometric verification or identification, or a biometric template, unless the individual consents and the collection is reasonably necessary for the entity's functions, or a listed exception in Australian Privacy Principle 3.4 applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Australian Privacy Principle 3.3 and the definition of sensitive information in section 6 limit the collection of sensitive information, including biometric information and biometric templates. They state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
An APP entity must not collect sensitive information about an individual unless the individual consents and the collection is reasonably necessary for the entity's functions, or a listed exception applies.
Sensitive information is defined to include information or an opinion about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record, where that is also personal information; health information about an individual; and genetic information about an individual that is not otherwise health information.
It also includes biometric information that is to be used for the purpose of automated biometric verification or biometric identification, and biometric templates. This is the provision that reaches a voiceprint or faceprint collected for biometric identification, on top of the entity's general Australian Privacy Principle 3 duty for ordinary personal information.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .