(2) The Commissioner may approve a privacy code if, and only if, the Commissioner is satisfied:
(a) that the code incorporates all the National Privacy Principles or sets out obligations that, overall, are at least the equivalent of all the obligations set out in those Principles; and
(b) that the code specifies the organisations bound by the code or a way of determining the organisations that are, or will be, bound by the code; and
(c) that only organisations that consent to be bound by the code are, or will be, bound by the code; and
(d) that the code sets out a procedure by which an organisation may cease to be bound by the code and when the cessation takes effect; and
(e) of the matters mentioned in subsection (3), if the code sets out procedures for making and dealing with complaints in relation to acts or practices of an organisation bound by the code that may be an interference with the privacy of an individual; and
(f) that members of the public have been given an adequate opportunity to comment on a draft of the code.
(3) If the code sets out procedures for making and dealing with complaints, the Commissioner must be satisfied that:
(a) the procedures meet:
(i) the prescribed standards; and
(ii) the Commissioner's guidelines (if any) in relation to making and dealing with complaints; and
(b) the code provides for the appointment of an independent adjudicator to whom complaints may be made; and
(c) the code provides that, in performing his or her functions, and exercising his or her powers, under the code, an adjudicator for the code must have due regard to the matters that paragraph 29(a) requires the Commissioner to have due regard to; and
(d) the determinations, findings, declarations, orders and directions that the adjudicator may make under the code after investigating a complaint are the same as those that the Commissioner may make under section 52 after investigating a complaint under this Act; and
(e) the code obliges an organisation bound by the code not to repeat or continue conduct of the organisation declared by the adjudicator (after investigating a complaint) to constitute an interference with the privacy of the complainant; and
(f) the code obliges an organisation bound by the code to perform an act or course of conduct that the adjudicator has declared (after investigating a complaint) that the organisation should perform to redress loss or damage suffered by the complainant; and
(g) the code requires organisations bound by the code to co-operate with the adjudicator when the adjudicator is performing functions or exercising powers under the code; and
(h) the code requires a report (in a form satisfactory to the Commissioner) to be prepared as soon as practicable after 30 June each year on the operation of the code during the financial year that ended on that 30 June; and
(i) the code requires that a copy of each report is to be given to the Commissioner within a timetable that is satisfactory to the Commissioner; and
(j) the code requires that a copy of each report is to be made available to anyone who asks for it; and
(k) the code requires the report prepared for each year to include the number and nature of complaints made to an adjudicator under the code during the relevant financial year; and
(ka) the code requires the report prepared for each year to include, for each complaint finally dealt with by an adjudicator under the code during the relevant financial year, a summary identifying:
(i) the nature of the complaint; and
(ii) the provisions of the code applied in dealing with the complaint; and
(iii) the outcome of the dealing;
whether or not the adjudicator made a determination, finding, declaration, order or direction in dealing with the complaint; and
(l) the code identifies an adjudicator for the code or another person as the person responsible for the requirements in this subsection relating to the annual report for the code.
(4) In deciding whether to approve a privacy code, the Commissioner may consider the matters specified in guidelines issued by the Commissioner (if any).
(5) An approval must be in writing.
(6) This section does not prevent the Commissioner approving a privacy code if:
(a) the code also sets out:
(i) the period during which it will operate; or
(ii) the circumstances in which it will expire; and
(b) the Commissioner considers that the period or circumstances are appropriate.
(7) This section does not prevent the Commissioner approving a privacy code if the code is expressed to apply to:
(a) all personal information or a specified type of personal information; or
(b) a specified activity or class of activities of an organisation; or
(c) a specified industry sector and/or profession; or
(d) a specified class of industry sectors and/or professions.
(2) The day specified must not be before the day on which the approval is given.
(2) The Commissioner may approve in writing the variation.
(3) In deciding whether to approve the variation, the Commissioner must consider all of the matters that the Commissioner would consider in deciding whether to approve under section 18BB a privacy code identical to the approved privacy code with the variation.
(4) However, if the Commissioner thinks that a variation is minor, he or she need not be satisfied that members of the public have been given an adequate opportunity to comment on a draft variation of the code (as would otherwise be required by paragraph 18BB(2)(f)). Instead, the Commissioner may consult any person he or she thinks appropriate about the draft variation.
(5) The approval of the variation takes effect on the day specified in the approval.
(6) The day specified must not be before the day on which the approval is given.
(a) on his or her own initiative; or
(b) on application by an organisation that is bound by the code.
(2) Before deciding whether to revoke the approval of a code or variation, the Commissioner must:
(a) if practicable, consult the organisation that originally sought approval of the code or variation; and
(b) consult any other person the Commissioner considers appropriate; and
(c) consider the extent to which members of the public have been given an opportunity to comment on the proposed revocation.
(3) A revocation must be in writing.
(4) A revocation comes into effect on the day specified in the revocation.
(5) The day specified must not be before the day on which the revocation is made.
(a) written guidelines to assist organisations to develop privacy codes or to apply approved privacy codes; and
(b) written guidelines relating to making and dealing with complaints under approved privacy codes; and
(c) written guidelines about matters the Commissioner may consider in deciding whether to approve a privacy code or a variation of an approved privacy code.
(1A) Before making guidelines for the purposes of paragraph (1)(b), the Commissioner must give everyone the Commissioner considers has a real and substantial interest in the matters covered by the proposed guidelines an opportunity to comment on them.
(2) The Commissioner may publish guidelines made under subsection (1) in any way the Commissioner considers appropriate.
(2) The Commissioner may decide the form of the register and how it is to be kept.
(3) The Commissioner must make the register available to the public in the way that the Commissioner determines.
(4) The Commissioner may charge fees for:
(a) making the register available to the public; or
(b) providing copies of, or extracts from, the register.
Note: The review may inform a decision by the Commissioner under section 18BE to revoke the approved privacy code.
(2) The Commissioner may do one or more of the following for the purposes of the review:
(a) consider the process under the code for making and dealing with complaints;
(b) inspect the records of an adjudicator for the code;
(c) consider the outcome of complaints dealt with under the code;
(d) interview an adjudicator for the code.
Note: The review of the adjudicator's determination will include review of any finding, declaration, order or direction that is included in the determination.
(2) Divisions 1 and 2 of Part V apply in relation to the complaint covered by the application as if the complaint had been made to the Commissioner and subsection 36(1A) did not prevent the Commissioner from investigating it.
Note: Divisions 1 and 2 of Part V provide for the investigation and determination of complaints made to the Commissioner.
(3) The adjudicator's determination continues to have effect unless and until the Commissioner makes a determination under Division 2 of Part V relating to the complaint.