s 6(1) · effective control
Whether data goes overseas starts with use or disclosure
Use or disclosure decides which rules apply, and for an arrangement with a provider the answer usually turns on who still controls the handling. This guide sorts five arrangements the way the OAIC does, and says where the line can move.
General information about Australian privacy law, not legal advice. The OAIC’s APP Guidelines, chapter 8, on cross-border disclosure are at oaic.gov.au.
The two words, in the Act’s terms
A use, as the OAIC’s APP Guidelines read the Act: “An APP entity uses personal information where it handles, or undertakes an activity with the personal information, within the entity’s effective control.”
A disclosure: “An APP entity discloses personal information where it makes it accessible to others outside the entity and releases the subsequent handling of the information from its effective control.”
Sending personal information overseas is not forbidden: the OAIC says the APPs do not prevent an organisation or agency from doing it, but that organisations and agencies “will need to carefully consider steps that may need to be taken to comply with the APPs”.
The effective control test
Effective control is the OAIC’s reading of the Act’s word for holding: an entity holds personal information “if the entity has possession or control of a record that contains the personal information”; a number of APPs apply to an entity that holds information (among them APPs 6, 11, 12 and 13); and where the handling is a use, the entity may still be considered to hold the information even though it is physically located overseas.
The OAIC’s warning, kept with the test: “Whether or not other examples are considered a ‘use’ or a ‘disclosure’ will depend on the circumstances of each individual case, having regard to the degree of control held by the organisation or agency.”
Five arrangements, sorted
Five arrangements, each placed by the OAIC’s own paragraph:
| The arrangement | On the plane | The OAIC’s placement |
|---|---|---|
| Your own office overseas | In your control, overseas | “This means that where an APP entity in Australia sends information to an overseas office of the entity, APP 8 will not apply as the recipient is the same entity.” (OAIC APP Guidelines, chapter 8, 8.6) |
| A related company overseas | Released from your control, overseas | The related body corporate is “a different entity to the APP entity in Australia. It will therefore be an ‘overseas recipient’ and APP 8 will apply.” (8.6) |
| An offshore contractor or cloud provider | Released from your control, overseas | “Where an APP entity engages a contractor located overseas to perform services on its behalf, in most circumstances, the provision of personal information to that contractor is a disclosure. This means that the entity will need to comply with APP 8 before making that disclosure.” (8.12) |
| A cloud provider | Released from your control, overseas | The Act does not prevent engaging a cloud service provider to store or process personal information overseas; the entity “must comply with the APPs in sending personal information to the overseas cloud service provider, just as they need to for any other overseas outsourcing arrangement” (OAIC, Sending personal information overseas). |
| A cloud provider where you keep control | In your control, overseas | “However, in limited circumstances providing personal information to an overseas contractor to perform services on behalf of the APP entity may be a use, rather than a disclosure. This occurs where the entity does not release the subsequent handling of personal information from its effective control.” (8.14) |
What it turns on
What it turns on, in the OAIC’s words: “The distinction between a ‘use’ and a ‘disclosure’ depends on the degree of control the organisation or agency has over the information after it is provided to the overseas recipient.” That is why the same arrangement can fall on different sides for two businesses: the degree of control is a fact about the arrangement, not about the label.
Two markers from the OAIC on where the line falls. The keep-control arrangement sits in “relatively limited circumstances”: an organisation or agency “might retain such a degree of control over the information that it is considered to be ‘using’ that information”, and in most circumstances a contractor overseas is a disclosure.
And what to do when the answer is unclear: “where it is unclear whether the personal information is being used or disclosed, the best approach is to take reasonable steps to ensure the APPs are complied with”. The OAIC also says an organisation or agency that sends personal information overseas may be liable if it is mishandled.