New restrictions on disclosing personal information overseas.
The third parties to whom we disclose personal information may be located in Australia and other countries including Argentina, China, Canada, Hungary, India, Israel, Ireland, Italy, Japan, Hong Kong, Mexico, Netherlands, New Zealand, Pakistan, Philippines, Poland, Singapore, Spain, South Africa, South Korea, UAE, United Kingdom and United States of America.
Overseas disclosure of personal information is a hot topic in privacy law reform. The amended Act only allows a business to disclose information overseas if it:
takes reasonable steps to ensure the overseas recipient doesn’t breach Australian privacy laws (probably what Coles is doing, as a behemoth it can bargain hard and get its suppliers to agree to comply); or
reasonably believes that the overseas recipient is subject to a privacy regime that is substantially similar to Australia’s privacy laws (we make no comment on Polish privacy law); or
gets the informed and express consent of the individual to whom that personal information relates to the effect that Australian privacy laws won’t apply to the information once disclosed.