APP 8 · s 16C
Before it crosses the border
APP 8.1 asks for reasonable steps before personal information goes overseas, and the OAIC generally expects an enforceable contract among them. The exceptions are real, and narrower than they look.
General information about Australian privacy law, not legal advice. The OAIC’s guidance on sending personal information overseas is at oaic.gov.au.
What APP 8 asks first
APP 8.1, as the OAIC states it: “Before an APP entity discloses personal information to an overseas recipient, the entity must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs (other than APP 1) in relation to the information.”
The framework behind that step: APP 8 and s 16C “create a framework for the cross-border disclosure of personal information”, generally requiring the entity to ensure the recipient will handle the information in accordance with the APPs, and making the entity accountable if the recipient mishandles it.
What reasonable steps means in practice, for the OAIC: it is “generally expected” that the entity will enter into an enforceable contractual arrangement requiring the recipient to handle the information in accordance with the APPs other than APP 1; an entity is not excused from ensuring the recipient does not breach the APPs “by reason only that it would be inconvenient, time-consuming or impose some cost to do so”; and where it is not reasonable to enter a contract requiring all the APPs, the OAIC says to consider what other steps might satisfy APP 8.1, “with a view to minimising the risk that the personal information will be mishandled by the overseas recipient”.
What the contract is expected to carry
| What the OAIC expects | Where the OAIC states it |
|---|---|
| “It is generally expected that an APP entity will enter into an enforceable contractual arrangement with the overseas recipient that requires the recipient to handle the personal information in accordance with the APPs (other than APP 1).” | OAIC APP Guidelines, chapter 8, 8.16 |
| “It is generally expected that an organisation or agency will enter into an enforceable contractual arrangement … and that it will take steps to ensure compliance with those contractual arrangements.” | OAIC, Sending personal information overseas, on reasonable steps |
| “Where a subcontractor may be engaged, the entity should also take reasonable steps to ensure that the subcontractor does not breach the APPs in relation to the personal information.” | OAIC APP Guidelines, chapter 8, 8.12 |
The exceptions, and what they do not excuse
The reasonable-steps duty is not absolute: as the OAIC’s privacy impact assessment guidance puts it, the entity must take reasonable steps to ensure the recipient does not breach the APPs in relation to the information, “unless an exception applies, such as the individual has given informed consent”.
The OAIC’s summary of the framework: “There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the accountability provision in s 16C.” Three practical notes from the OAIC on how narrow they are. It has no list of countries with substantially similar laws or binding schemes, so that exception rests on the entity’s own belief, and a belief must have “a reasonable basis … and not merely a genuine or subjective belief”, for example based on independent legal advice. A substantially similar law or binding scheme “would provide a comparable, or a higher level of privacy protection to that provided by the APPs”, and the enforcement mechanism should be accessible to the individual and should have effective powers to enforce the protections.
And what they do not excuse: the Privacy Act “is clear about an organisation or agency’s accountability where an overseas recipient handles personal information in a way that would breach one or more APPs”.
The countries, in the privacy policy
The countries go in the privacy policy before anything crosses a border: “An APP Privacy Policy must set out whether personal information is likely to be disclosed to overseas recipients and the countries in which such recipients are likely to be located ‘if it is practicable to specify those countries in the policy’ (APP 1.4(f) and 1.4(g)).”
The OAIC’s expectations around that duty: an entity “is not excused from specifying the countries by reason only that it would be inconvenient, time-consuming or impose some cost to do so”; another option may be a link to a regularly updated list of countries on the entity’s website; and where it is not practicable to specify the countries, the entity “could instead identify general regions (such as European Union countries)”.
The Australian link
Section 16C turns on whether the Australian Privacy Principles apply to the recipient itself. Section 16C applies where an APP entity discloses personal information to an overseas recipient, APP 8.1 applies to the disclosure, and “the Australian Privacy Principles do not apply, under this Act, to an act done, or a practice engaged in, by the overseas recipient in relation to the information” (s 16C(1)(c)); where it applies, the recipient’s act “is taken, for the purposes of this Act … to have been done … by the APP entity; and … to be a breach of those Australian Privacy Principles by the APP entity” (s 16C(2)).
The Act’s definition of a link, s 5B: an organisation or small business operator has an Australian link if it is, among other things, a body corporate incorporated in Australia or an external Territory, a partnership formed in Australia or an external Territory, or an unincorporated association with its central management and control in Australia or an external Territory; it also has a link if it is not one of those and carries on business in Australia or an external Territory.
The link is one question; whether the Act covers the business is another.