Privacy Policy for a Residential Property Management App in Victoria, Australia: A Legal and Operational Framework

2. Secondary Purposes for Use and Disclosure (APP 6)

Personal information must generally not be used or disclosed for a purpose (secondary purpose) other than the primary purpose for which it was collected, unless an exception under APP 6 applies . The main exceptions are:

• Consent: The individual has consented to the secondary use
• Reasonably Expected and Related Purpose:The individual would reasonably expect the app to use or disclose the information for the secondary purpose, and:
  • If the information is not sensitive, the secondary purpose is related to the primary purpose of collection (e.g., using personal information for internal auditing, business planning, or de-identifying data for app improvement) [13] .
  • If the information is sensitive, the secondary purpose is directly related to the primary purpose of collection (e.g., using health information provided for an accessibility request to facilitate necessary property modifications) [13]
• Required or Authorised by Law or Court/Tribunal Order:The use or disclosure is required or authorised by an Australian law or a court/tribunal order (e.g., responding to a warrant, statutory reporting requirements) .
• Permitted General Situations:The use or disclosure is related to specific situations outlined in the Privacy Act, such as:
  • Lessen or prevent a serious threat to life, health, or safety [13]
  • Taking appropriate action regarding unlawful activity or serious misconduct [13].
  • Establishing, exercising, or defending a legal or equitable claim [13].
• Enforcement Related Activities:The app reasonably believes the use or disclosure is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body (e.g., police investigations) .

3. Requirements for Obtaining Consent

When consent is required for the secondary use or disclosure of personal information, it must meet stringent criteria to be valid [13] :

• Adequately Informed:The individual must understand what they are consenting to, including the purpose of the use or disclosure.
• Voluntary: Consent must be given freely, without coercion, undue pressure, or misrepresentation.
• Current and Specific:Consent should be recent and clearly define the particular use or disclosure it applies to.
• Capacity to Understand and Communicate:The individual must have the cognitive ability to understand the implications of their consent and communicate it effectively.

1. Best Practices for Retention Policies

• Develop clear, internal policies and procedures for retention and disposal, including minimum and maximum retention periods [17].
• Periodically review information holdings to determine if the original purpose for collection has been fulfilled [17].
• Create an inventory of personal information, its purpose, and retention duration [17] .
• Only collect data that is necessary for operations, avoiding the collection of "just in case" data [16] .
• Delete unused personal data and minimize unnecessary duplication [16] .

2. Secure Disposal Methods The goal of disposal is to irreversibly destroy media storing personal information, including associated copies and backup files, so it cannot be reconstructed or recovered [17]

• Hard copy:Complete destruction methods like disintegration, incineration, pulverizing, shredding, and melting [17].
• Electronic copy:Methods include physical destruction, overwriting data with non-sensitive data, and degaussing for magnetic media [17] . The choice of method will consider the sensitivity of the information and whether the media remains under the app's control [17] .

3. Managing Third-Party DisposalIf a third-party contractor is used for disposal, the app remains responsible for the information [17] . Contracts will ensure the contractor has verifiable credentials, guarantees secure transfer and destruction, and includes privacy protection and monitoring/auditing clauses [17].

1. Defining an "Eligible Data Breach"An eligible data breach occurs when three criteria are met :

• There is unauthorised access to, or unauthorised disclosure of, personal information, or a loss of personal information, that the app holds [18] . This includes situations where someone not permitted accesses personal information (unauthorised access), information is made visible to others without permission (unauthorised disclosure), or accidental loss occurs where it is likely to result in unauthorised access or disclosure [18] .
• This is likely to result in serious harm to one or more individuals to whom the information relates; "likely" means the risk is "more probable than not" .
• The app has not been able to prevent the likely risk of serious harm with remedial action [18]

2. Assessing "Serious Harm""Serious harm" is not explicitly defined but may include serious physical, psychological, emotional, financial, or reputational harm [18] . The assessment will consider:

• Type of information: Sensitivity (e.g., health information), documents used for identity fraud (e.g., Medicare, driver's license), financial information, or a combination that reveals more about an individual [18] .
• Circumstances of the breach: Whose information was involved (e.g., vulnerable individuals), the number of individuals affected, how long information was accessible, whether security measures (like encryption) were overcome, and who gained unauthorised access [18]
• Nature of the harm: Potential for identity theft, financial loss, threats to physical safety, loss of opportunities, humiliation, damage to reputation, bullying, or marginalisation [18] .

3. Remedial Action""If the app takes remedial action that successfully prevents the data breach from being likely to result in serious harm, it is not an eligible data breach, and notification is not required [18] .

4. Notification Requirements and Timelines

• Assessment: If an eligible data breach is suspected, the app will carry out a "reasonable and expeditious assessment" within 30 days to determine if an eligible data breach has occurred .
• Notification: If an eligible data breach is confirmed, the app must notify affected individuals and the Australian Information Commissioner (OAIC) as soon as practicable . There are proposed changes that would require notification to the OAIC within 72 hours of becoming aware of the breach [19].

5. Responsibilities to Individuals and OAIC

• To the OAIC: The app will prepare and provide a statement containing its identity and contact details, a description of the breach, the kinds of information concerned, and recommendations for individuals [19].
• To Individuals: The app will take reasonable steps to notify each affected individual directly or, if impracticable, publish the statement on its website and publicize its contents [19]. The notification will include sufficient detail for individuals to understand the breach, potential impacts, and steps they can take to reduce harm [20].
• Other Parties: The app may also notify other relevant parties such as Federal Police, insurers, and credit card companies, as suggested by OAIC guidance [19].

6. Handling Jointly Held Information If personal information is held jointly by multiple entities (e.g., outsourcing arrangements), an eligible data breach affects all holding entities. While all are responsible for compliance, typically one entity completes the assessment and notification, usually the one with the most direct relationship with affected individuals [18] .

7. Exemptions Exceptions to notification apply in specific situations, such as when another APP entity has already notified, law enforcement activities would be prejudiced, notification is inconsistent with Commonwealth secrecy, or the OAIC grants an exception .

1. Right to Anonymity and Pseudonymity (APP 2)

As an individual, you generally have the option to interact with our app anonymously or pseudonymously [22]

• Anonymity means you do not provide any personal information or identifiers, preventing the app from identifying you [22]
• Pseudonymity allows you to use a name or descriptor different from your actual name [22].

However, this option may not apply if our app is required or authorized by Australian law or a court/tribunal order to deal with identified individuals, or if it is impracticable for the app to deal with you without identification [22] . Our app will inform you of circumstances where anonymity or pseudonymity is not possible and any consequences, such as limited service provision [22] . Where identification is necessary, we will only collect personal information essential for the interaction [22] .

2. Right to Access Your Personal Information (APP 12)

You have the right to request access to the personal information our app holds about you . Our app "holds" personal information if it has possession or control of a record containing it, even if it's outsourced to a third party [23] .

Exercising your right to access:

• Requesting Access: While APP 12 does not impose formal requirements on how to make a request, our privacy policy will clearly state recommended procedures, such as an online portal or contact details [23] . We cannot require you to follow a specific procedure or use a designated form [23] .
• Identity Verification: To protect your privacy, we must be satisfied that the request is made by you or an authorized person [23] . We will employ appropriate identity verification steps, using the minimum necessary personal information [23] .
• Response Timeframe: We will respond to your request within a reasonable period, typically not exceeding 30 calendar days, by either providing access or notifying you of refusal [23] .
• Manner of Access: We will endeavor to provide access in the manner you request, if it is reasonable and practicable [23] . If not, or if access is refused, we will take reasonable steps to give access in an alternative way that meets both our needs and yours, preferably within 30 days [23] . This may involve an agreed-upon intermediary [23] .
• Access Charges: We will not charge for making an access request [23] . However, a reasonable charge may apply for giving access, which will not be excessive or used to discourage requests [23] . We will advise you of potential charges and discuss ways to minimize costs [23] .
• Grounds for Refusal: We may refuse access on specific legal grounds, such as if providing access poses a serious threat to life or privacy of others, the request is frivolous, or it would be unlawful [23] . Before refusing, we will consider if redacting certain information would enable partial access [23] . If access is refused or not provided in your requested manner, we will give you a written notice outlining the reasons, mechanisms for complaint, and any other available remedies [23]

3. Right to Correction of Personal Information (APP 13)

You have the right to request that our app correct personal information we hold about you that is inaccurate, out-of- date, incomplete, irrelevant, or misleading . We are obligated to take reasonable steps to correct your information upon request or when we discover inaccuracies ourselves [24].

Exercising your right to correction:

• Requesting Correction: Our app will provide clear means for you to submit correction requests, similar to access requests.
• Response Timeframe: We will acknowledge your request and take reasonable steps to correct your information within a reasonable period, generally within 30 calendar days [23] .
• Refusal to Correct: If we refuse to correct your personal information, we will explain the reasons for refusal and allow you to request that we associate a statement with the information noting your disagreement with its accuracy [24] .

4. Mechanisms for Exercising Your Rights

We are committed to providing practical and user-friendly mechanisms to facilitate your rights:

• Comprehensive Privacy Policy: This privacy policy clearly details how you can access and correct your personal information, covering collection purposes, types of information gathered, disclosure practices, and security measures . It will be regularly updated.
• User Interface/Online Portal: Our app will feature a dedicated online portal or a clear section within the app for you to manage your personal information and to submit access and correction requests directly [23] .
• Contact Information: We will provide clear contact details, such as an email address, for our designated privacy officer or contact person for all privacy-related inquiries and requests [23] .
• Secure Identity Verification: We integrate secure identity verification processes to ensure that only you or an authorized representative can access or modify your personal information [23] .
• Internal Procedures: We have established clear internal procedures for our staff to handle all privacy requests correctly, efficiently, and within the required timeframes, including locating relevant information, providing it in an accessible format, and amending records [24] .
• Record Keeping: We maintain thorough records of all access and correction requests and actions taken to demonstrate our compliance with privacy obligations [24] .

5. Victorian State Provisions

While the federal Privacy Act 1988 (Cth) and its Australian Privacy Principles (APPs) primarily govern our private sector app, we acknowledge the Privacy and Data Protection Act 2014 (Vic) (PDP Act) and the Health Records Act 2001 (Vic) (HR Act) [2] . These Victorian acts mainly apply to Victorian public sector organizations or to entities handling health information . In the event our app were to become a contracted service provider to a Victorian public sector organization or handle health information, the relevant Victorian acts would impose additional obligations . Under the PDP Act, individuals also have rights to anonymity where possible, knowing why information is collected, secure handling, and generally accessing and amending personal information, often via the Freedom of Information Act 1982 (Vic) [4] . We continually monitor the applicability of these state laws to ensure comprehensive compliance.