Privacy Act 1988, Schedule 1, APP 6.1 and 6.2(a): use or disclosure for a secondary purpose (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 6.1, 6.2(a))
Licensing records to an AI buyer is a disclosure for a secondary purpose. The holder needs consent, or must show the individual would reasonably expect it and that it is related (directly related for sensitive information) to why the records were collected.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“If an APP entity holds personal information about an individual that was collected for a particular purpose (the primary purpose), the entity must not use or disclose the information for another purpose (the secondary purpose) unless: (a) the individual has consented to the use or disclosure of the information; or (b) subclause 6.2 or 6.3 applies in relation to the use or disclosure of the information. ... (a) the individual would reasonably expect the APP entity to use or disclose the information for the secondary purpose and the secondary purpose is: (i) if the information is sensitive information-directly related to the primary purpose; or (ii) if the information is not sensitive information-related to the primary purpose;”
Where it was read
Also read from the same source
- Privacy Act 1988, Schedule 1, APP 8.1 and 8.2(b): disclosure to an overseas recipient (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 8.1, 8.2(b))
- Privacy Act 1988, Schedule 1, APP 8.3: disclosure to a prescribed country or binding scheme (in force from 11 December 2024) (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 8.3)
- Privacy Act 1988, section 16C: the holder is accountable for the overseas recipient's breaches (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 16C(2))
- Privacy Act 1988, section 100(1A): what the Minister must be satisfied of before prescribing a country (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 100(1A))
- Privacy Act 1988, section 6(1): definition of de-identified (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 6(1) (definition of de-identified))
- Privacy Act 1988, section 6D: a small business that discloses personal information for a benefit loses the exemption (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 6D(1), (4)(c), (7))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides