Part 2 · The questions
Which questions is an online form allowed to ask?
For a business the Privacy Act covers, every question a form asks has to pass one test: the answer must be reasonably necessary for one or more of the business's functions or activities. Sensitive answers need consent as well, unless an exception applies. And the OAIC has applied the test to a real collection and to the examples it gives.
General information, not legal advice. APP 3 is in the Privacy Act 1988, and the OAIC's APP 3 guidelines chapter explains it.
The test for each question
The collection rule, in the OAIC's words: an APP entity must only collect personal information which is reasonably necessary for one or more of the entity's functions or activities (APPs 3.1 and 3.2). And the test is an objective one: whether a reasonable person who is properly informed would agree that the collection is necessary. It is the responsibility of an APP entity to be able to justify that the particular collection is reasonably necessary.
Two consequences follow from failing it. Where a collection of personal information is not reasonably necessary, it may also be unfair and/or unlawful in breach of APP 3.5. And an APP entity must collect personal information only by lawful and fair means, a requirement that applies to all APP entities.
The OAIC's security guidance adds the practical case for asking less: under APP 3, you should only collect personal information that is reasonably necessary (and for agencies, directly related) to carry out your functions or activities. Over-collection can increase risks for the security of personal information.
Staying anonymous
Individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with an APP entity in relation to a particular matter, unless an exception applies. In a form, that is the question behind each field that asks who the person is.
Sensitive questions
Sensitive information has its own definition in the Act, in s 6(1). It means:
- information or an opinion about an individual's: racial or ethnic origin; political opinions; membership of a political association; religious beliefs or affiliations; philosophical beliefs; membership of a professional or trade association; membership of a trade union; sexual orientation or practices; or criminal record; that is also personal information; or
- health information about an individual; or
- genetic information about an individual that is not otherwise health information; or
- biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or
- biometric templates.
A sensitive answer, then, is not just any answer about a person. For one, APP 3.3 says an entity must not collect sensitive information unless the individual consents or an exception applies. And the guidelines say an APP entity should generally seek express consent from an individual before collecting the individual's sensitive information, given the greater privacy impact this could have. Consent cannot be assumed: generally, it should not be assumed that an individual has given consent on the basis alone that they did not object to a proposal to handle personal information in a particular way, and an APP entity cannot infer consent simply because they have provided individuals with notice of a proposed collection of personal information, including sensitive information.
A worked example from an OAIC determination
The OAIC publishes its determinations, and one is a worked example of this test meeting biometric data in a store. The Australian Information Commissioner and Privacy Commissioner, Angelene Falk, determined that convenience store group 7-Eleven interfered with customers' privacy by collecting sensitive biometric information that was not reasonably necessary for its functions and without adequate notice or consent.
The findings go to the two halves of this guide. On consent and notice: the Commissioner found that individuals did not give either express or implied consent to the collection of their facial images or faceprints, nor did 7-Eleven take reasonable steps to notify individuals of the collection of personal information. On necessity: the Commissioner found that the large-scale collection of sensitive biometric information through 7-Eleven's customer feedback mechanism was not reasonably necessary for the purpose of understanding and improving customers' in-store experience. The OAIC's own page on the findings is the source for all three.
The same test on an enquiry form
The same test applies to an ordinary enquiry form, and it is a test rather than a list: whether each answer the form collects is reasonably necessary for the function the form serves, judged by what a reasonable person who is properly informed would agree, with the business able to justify each collection.
The OAIC's examples of collections that may not be reasonably necessary are worth holding against any form. One is collecting personal information about a group of individuals, when information is only required for some of those individuals: for example, collecting personal information about all job applicants, when information is only required for shortlisted candidates. Another is collecting more personal information than is required for a function or activity: for example, collecting all information entered on an individual's driver licence when the purpose is to establish if the individual is aged 18 years or over.
Where a collection fails the test, APP 3.5 is the second edge: a collection that is not reasonably necessary may also be unfair or unlawful, and personal information must be collected only by lawful and fair means.