New restrictions on disclosing personal information overseas.

Amendments to the Privacy Act 1988 have taken effect today with scary new powers for the Privacy Commissioner and greater obligations on businesses being just a couple of the features of the revamped privacy regime.  Among the changes is an obligation that privacy policies include a statement as to whether or not a business is likely to disclose personal information to overseas entities, and if so, the countries in which those entities are located. Enter Coles’ privacy policy.

Coles’ updated privacy policy contains the following clause:

The third parties to whom we disclose personal information may be located in Australia and other countries including Argentina, China, Canada, Hungary, India, Israel, Ireland, Italy, Japan, Hong Kong, Mexico, Netherlands, New Zealand, Pakistan, Philippines, Poland, Singapore, Spain, South Africa, South Korea, UAE, United Kingdom and United States of America.

Poland?

Overseas disclosure of personal information is a hot topic in privacy law reform. The amended Act only allows a business to disclose information overseas if it:

  1. takes reasonable steps to ensure the overseas recipient doesn’t breach Australian privacy laws (probably what Coles is doing, as a behemoth it can bargain hard and get its suppliers to agree to comply); or

  2. reasonably believes that the overseas recipient is subject to a privacy regime that is substantially similar to Australia’s privacy laws (we make no comment on Polish privacy law); or

  3. gets the informed and express consent of the individual to whom that personal information relates to the effect that Australian privacy laws won’t apply to the information once disclosed.

So, Coles has done the right thing amending its privacy policy and letting you know where your information is going.  Interestingly, Woolworths’ amended policy only lists New Zealand, the US and Switzerland as likely overseas recipients (although it does helpfully suggest that your info could go anywhere –it’s just too hard for them to tell you where).