Quiz for Organisations:
This quiz will test your knowledge of the National Privacy Principles (NPPs). The NPPs form the law that applies to many private sector organisations. For more information about the NPPs, please go to: http://www.privacy.gov.au/publications/npps01.html
Question 1:
Generally, if an organisation holds personal information about an individual, it must provide the individual with access to the information on request. Which of the following is an exception to that rule?
(a) where providing access would have an unreasonable impact on the privacy of other individuals
(b) where providing access would excessively irritate the administration staff
(c) where providing access would be detrimental to the reputation of the organisation
(d) where the individual has not paid in full for goods or services already rendered, the organisation can deny the requesting individual access to any personal information held by the organisation
Question 2:
Generally, an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection. Which one of the following is not an exception to that rule:
(a) the individual has consented to the use or disclosure
(b) the use or disclosure is required or authorised by or under law
(c) another organisation asks for the information for a marketing campaign (and this was not the purpose for which the information was collected)
(d) the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious and imminent threat to an individual´s life, health or safety
Question 3:
Generally, an organisation must set out in a document clearly expressed policies on its handling of personal information. Which of the following is not a responsibility regarding the privacy policy of an organisation?
(a) the organisation must make the document available to anyone who asks for it
(b) when someone asks, the organisation should take reasonable steps to let the person know what sort of personal information it holds and for what purpose
(c) when someone asks, the organisation must take reasonable steps to let the person know how it uses and discloses personal information
(d) the organisation must have a designated contact who is responsible for the proper management of privacy within the organisation
Question 4:
Private organisations that have an annual turnover of $3 million or less are generally exempt from the Privacy Act. Which of the following is not an exception to that rule?
(a) organisations that trade in personal information (e.g buying or selling a mailing list)
(b) organisations that are related to a larger business (a related body corporate)
(c) a contractor that provides services under a Commonwealth contract
(d) your local fish and chip shop
Question 5:
The Privacy Commissioner may decline to investigate a complaint if the complainant has not given the respondent an adequate opportunity to deal with the complaint. How long is generally considered ‘an adequate opportunity´ for an organisation to deal with the complaint?
(a) 7 days
(b) 30 days
(c) 60 days
(d) 90 days
Question 6:
Generally, when an organisation collects personal information about an individual, it must make the individual aware of a number of things. Which of the following must an organisation make individuals aware of?
(a) the identity of the organisation and how to contact it
(b) the fact that the individual is able to gain access to the information
(c) the purposes for which the information is collected
(d) all of the above
Question 7:
An organisation in Australia may transfer personal information about an individual to someone who is in a foreign country only under certain conditions. Which of the following is a condition?
(a) the organisation reasonably believes that the recipient of the information is subject to a regime that is substantially similar to the National Privacy Principles
(b) the organisation requires the transfer of the information to enhance business efficacy
(c) the individual to which the information relates to would reasonably expect the information to be passed onto a foreign country
(d) the organisation is required by the law of a foreign jurisdiction to disclose the information
Question 8: In total, how many Privacy Commissioner´s have there been in Australia?
(a) 1
(b) 4
(c) 6
(d) 9
Question 9:
True or False, if an employee of an organisation breaches the Privacy Act, it is the employee that must bear personal responsibility for the breach not the organisation as a whole?
Question 10:
Does your organisation have a privacy policy?
(a) yes
(b) no
ANSWERS
1: (a) where providing access would have an unreasonable impact on the privacy of other individuals
All the others are not valid reasons for denying access to personal information.
2: (c) another organisation asks for the information for a marketing campaign (and this was not the purpose for which the information was collected).
All the others are valid reasons for using or disclosing personal information about an individual for a purpose other than the primary purpose of collection.
3: (d) the organisation must have a designated contact who is responsible for the proper management of privacy within the organisation. However, the Office encourages organisations to have an appropriate contact (sometimes called a Privacy Contact Officer or Chief Privacy Officer) who is willing and able to handle privacy enquiries and complaints and who can ensure that the NPPs are properly implemented within the organisation.
4: (d) your local fish and chip shop
As long as the fish and chip ship is a small business earning $3 million or less, is not related to a larger business and does not trade in personal information.
5: (b) 30 days.
If a privacy complaint is lodged against your organisation, we consider 30 days to deal with or start dealing with the matter to be reasonable. In some circumstances, 30 days may be considered too long and it might be more appropriate to deal with the complaint more promptly.
6: (d) all of the above.
Apart from the those listed above, organisations must also take reasonable steps to ensure the individual it has collected information about is aware of: the organisations to which the organisation usually discloses information of that kind, any law that requires the particular information to be collected and the main consequences (if any) for the individual if all or part of the information is not provided.
7: (a) the organisation reasonably believes that the recipient of the information is subject to a regime that is substantially similar to the National Privacy Principles. The others are not valid reasons under the Privacy Act.
8: (b) 4.
The four Commissioners have been:
Judge Kevin O´Connor AM (1989 1996)
Moira Scollay (1996 1999)
Malcolm Crompton (1999 2004)
Karen Curtis (2004 )
9: False. Under the Privacy Act, individuals cannot be found to interfere with the privacy of another individual because the Privacy Act only provides obligations on organisations and Australian and ACT Government agencies. However, organisations may be able to take action against employees who are responsible for the organisation breaching the Privacy Act.
10: If you answered no, then it would be a good idea to draft one. Many organisations are under an obligation to set out in a document clearly expressed policies on its management of personal information. If you would like to know more about what to include in a privacy policy, see our website www.privacy.gov.au or contact our Enquiries Line on 1300 363 992.
Rating scale
Score:
9-10 Privacy guru
7-8 Very privacy aware
6-7 Moderately privacy aware
4-5 Not so privacy aware
0-3 You may like to contact our Privacy Enquiries line on 1300 363 992 or write to privacy@privacy.gov.au for information about privacy.
Copyright - Privacy Commissioner