What must an online form tell people before they type their name?

Before the first field

APP 5.1, in the OAIC's own words: an APP entity that collects personal information about an individual must take reasonable steps either to notify the individual of certain matters or to ensure the individual is aware of those matters. The timing it sets: an entity must take reasonable steps, before, or at the time it collects personal information. If this is not practicable, reasonable steps must be taken as soon as practicable after collection.

The guideline paragraph behind that timing puts it in two limbs. The requirement is to take reasonable steps to comply with APP 5 at or before the time an APP entity collects an individual's personal information, or, if that is not practicable, as soon as practicable after the collection occurs. And the reason is worth keeping in view: the requirement recognises that it is preferable that an individual can make an informed choice about whether to provide personal information to an APP entity.

There is a further acknowledgement in the guidelines: APP 5.1 acknowledges that it may be reasonable for an APP entity to not take any steps to provide a notice, or ensure awareness of all or some of the APP 5 matters. It is the responsibility of the entity to be able to justify not taking any steps.

A privacy policy is not the notice

A business can reasonably believe that its published privacy policy does the job. The OAIC's guidance and its determinations draw the line between the two instruments. In its guidance on generative AI, the OAIC notes that, generally, having information in a privacy policy is not a means of meeting the obligation to notify individuals under APP 5.

A privacy policy still matters, and has its own rule: it is a transparency mechanism that, in accordance with APP 1.4, must include information about an entity's personal information handling practices, including how an individual may complain and how any complaints will be dealt with. But a policy is not a notice. In one determination, the Commissioner noted that even if the privacy policy did provide adequate information about the APP 5 matters, simply publishing a privacy policy on a website does not amount to compliance with APP 5. In that matter, the respondent should have included a collection notice on, or in the vicinity of, the tablet screen: it should have notified customers about the APP 5 matters before the start of the survey, and, crucially, before the first facial image of the customer was captured.

A second determination makes the same point from the other direction. APP 5.1 requires an entity to take reasonable steps to notify an individual, or make sure they are aware, of certain matters around the handling of their personal information. The finding was that the entity failed to take reasonable steps to notify individuals about the facts, circumstances and purposes of their personal information being collected, as well as the consequences for them if their personal information was not collected.

What the notice says

Section 5.2 of the Act sets out the matters for the purposes of subclause 5.1. For the collection a form makes from the person filling it in, they are:

1. the identity and contact details of the APP entity;
2. if the collection of the personal information is required or authorised by or under an Australian law or a court/tribunal order: the fact that the collection is so required or authorised, including the name of the Australian law, or details of the court/tribunal order, that requires or authorises the collection;
3. the purposes for which the APP entity collects the personal information;
4. the main consequences (if any) for the individual if all or some of the personal information is not collected by the APP entity;
5. any other APP entity, body or person, or the types of any other APP entities, bodies or persons, to which the APP entity usually discloses personal information of the kind collected by the entity;
6. that the APP privacy policy of the APP entity contains information about how the individual may access the personal information about the individual that is held by the entity and seek the correction of such information;
7. that the APP privacy policy of the APP entity contains information about how the individual may complain about a breach of the Australian Privacy Principles, or a registered APP code (if any) that binds the entity, and how the entity will deal with such a complaint;
8. whether the APP entity is likely to disclose the personal information to overseas recipients;
9. if the APP entity is likely to disclose the personal information to overseas recipients: the countries in which such recipients are likely to be located, if it is practicable to specify those countries in the notification or to otherwise make the individual aware of them.

The forms of words above are the Act's own, and the questions guide turns to what a form may ask in the first place.

Where it sits on the form

The OAIC's guidelines give examples of reasonable steps an APP entity could consider taking to notify or ensure awareness of the APP 5 matters. One example: if the entity collects personal information directly from an individual who completes a form or uses an online facility, clearly and prominently displaying the APP 5 matters in the form, or providing a readily accessible and prominent link to an APP 5 notice.

Because the guidelines say these are steps an entity could consider taking, a prominent link is one reasonable step among possible others, not a rule on its own. What the determination shows is that a notice which only lives in a published policy does not reach the person. In that matter, given how sensitive the information was, the Commissioner said the notice should have come before the survey started and before the first facial image was captured.