This precedent has been authored by Sonia Sharma, Senior Associate, Maddocks.

Introductory note

Australian Privacy Principle (APP) 5 requires an APP entity to take reasonable steps to notify individuals of certain matters, or otherwise ensure the individual is aware of those matters, when an APP entity collects personal information about an individual. In some cases, an APP entity's privacy policy may be sufficient to meet the notification requirements. However, in certain circumstances it may be best practice to provide a specifically tailored collection notice. This template collection notice can be specifically tailored to individual circumstances (for example, when an APP entity is collecting personal information for competitions and promotions or for internal processes such as issuing a security card).

Matters to include

The matters that should be included in a collection notice are:

• the relevant APP entity’s identity and contact details;

• the fact and circumstances of collection;

• whether the collection is required or authorised by law;

• the purposes of collection;

• the consequences if the personal information is not collected;

• APP entity 's usual disclosures of personal information of the kind being collected;

• information about an APP entity 's privacy policy; and

• whether an APP entity is likely to disclose personal information to overseas recipients, and if practicable, the countries where they are located.

APP 7 provides that an organisation must not use or disclose personal information it holds for the purpose of direct marketing unless an exception applies. Consent is one exception and express consent is required for “sensitive information”. Where we undertake direct marketing, we must include a simple means for opting-out of any further direct marketing communication.