This case note has been taken from the recently published second-edition of a Guide to ACT Strata Law. A physical copy of the full text can be purchased here.
In this case, the Commissioner emphasised how the APPs also govern the security and storage of personal information. There are three lessons which arise from this investigation in maintaining compliance with the APPs.
Lesson one – keep it secret, keep it safe. APP 11 deals with the security of personal information, with APP 11.1 requiring information to be kept safe from misuse, interference and loss, and also from unauthorised access, modification or disclosure. In PRMC, the Commissioner found that keeping medical records locked in a garden shed did not constitute compliance with the terms of APP 11.1 (then National Privacy Principle (NPP) 4.1). Strata managers should ensure all records, both physical and electronic, are properly secured and protected from unauthorised access and interference.
Lesson two – knowing when (and how) to let go. APP 11.2 stipulates that any personal information that is no longer needed and is not required to be retained by law must be destroyed or appropriately de-identified. In PRMC, the Commissioner found that the storage of records that were 10 years old was in breach of the requirement to destroy or de-identify the personal information contained in those records.
Thus, any personal information retained should be current and relevant. Any personal information that is no longer required (such as the names and contact details of ex-owners) should be destroyed.
Lesson three – comply with your own procedures. Whilst the Commissioner was satisfied that PRMC had established procedures governing the storage, review and destruction of documents containing personal information, it found that PRMC had ignored its own procedures, and that this constituted a failure to take ‘reasonable steps’ (as required in the equivalent of APP 11.2) to destroy the information or ensure it was de-identified.
Strata managers and owners corporations should ensure that relevant policies are in place to guarantee the regular review of documentation containing personal information and that procedures are established – and followed – in relation to the destruction or deidentification of personal information.
This is general information and should not be considered to be legal advice. You should obtain legal advice specific to your individual situation.
