Drafting MillworkDrawersThe clockThe method
12 drawers0 lawyersWrite to us
Drawer 04

Ask a company for everything it holds on you

Insurer, super fund, administrator, bank, doctor. Australian Privacy Principle 12. Thirty days is the guide.

Subject: Request for access to my personal information — Australian Privacy Principle 12 — [your full name], DOB [your date of birth] — [their reference]

Dear Privacy Officer,

Under Australian Privacy Principle 12 I request access to the personal information [the agency] holds about me.

What I am asking for

  1. All personal information [the agency] holds about me, in every system and every version: records generated by [the agency], received by [the agency], and held on its behalf by anyone else.
  2. All logs of activity relating to my information: every occasion it was accessed, viewed, amended, exported or transmitted, by whom, and when. If a log is produced by applying filters, produce it unfiltered and say in writing what each filter excludes.
  3. All records of disclosure of my information to anyone outside [the agency]: the date, the recipient, the legal basis, and what was disclosed.
  4. If [the agency] says it has already given me everything, say so in writing and state that it holds no further personal information about me of any kind.
  5. If any part is refused, a written notice under APP 12.9 naming the ground in APP 12.3 relied on, the reasons, and how I may complain.

Form and time

PDF by email to this address. There is no charge for making this request (APP 12.8). The Commissioner’s guideline is that a reasonable period does not exceed 30 calendar days; I ask for the information by then.

Please acknowledge receipt and give me a reference.

Regards,
[your full name]
[your email]
today

Which body

The company’s privacy officer. The address is in its privacy policy; “privacy@” usually reaches it. Copy their complaints address.

Which clock

30 days

APP 12.4(a); OAIC APP Guidelines 12.67

Which document

ID if they have never verified you. If they have, say so and do not send it twice.

The receipts
An APP entity that holds personal information about an individual must, on request by the individual, give the individual access to the information.Privacy Act 1988 (Cth) Sch 1, APP 12.1
APP 12.4(a)(ii) provides that an organisation must respond ‘within a reasonable period after the request is made’. … as a general guide, a reasonable period should not exceed 30 calendar days.OAIC, APP Guidelines, Chapter 12, para 12.67
An organisation cannot impose upon an individual a charge for the making of the request to access personal information.OAIC, APP Guidelines, Chapter 12, para 12.77 (APP 12.8)