3. Privacy and confidentiality of records

In 2001, the Privacy Amendment (Private Sector) Act (2000) amended the Commonwealth's original Privacy Act (1988) to require private sector organisations to protect and safeguard their collection and use of personal information. Together, the Acts outline the principles (called the National Privacy Principles) that should be followed by organizations, such as associations, and are overseen by the Privacy Commissioner.

Associations need to obtain and keep information on clients, members and employees etc to provide a good service, and to comply with legal requirements (eg the member's register, tax details). Personal information must be kept private and confidential. In general, it may not be used for any unlawful purpose or without the person's consent.

In the case of the register of members, however, the privacy legislation does not protect this information from other members. And nor do members need to give consent for another member to view the register. The National Privacy Principles provide that an organisation must not disclose personal information about a person unless the disclosure is required or authorised under law. The Associations Incorporation Act 1987 is the law in Western Australia that requires giving a member access to the members' register in the way discussed above.

But it is very important that the members' register contains only their names and addresses and no other information!

Under the Commonwealth's privacy laws, clients, employees, members and anyone on whom an association gathers and holds information have a right to:

• have their privacy rights respected;
• be assured that their information will not be passed onto a third person without their consent;
• know what information will be kept and why it needs to be kept (this is why you need to tell members about the members' register!);
• know how information will be used;
• know how they can access this information;
• know how to correct an incorrect or misleading record; and
• be assured that information will only be used for the purpose it was supplied.