As a business that collects customers’ personal information, you may receive a privacy access request from a customer. How your business should respond to a privacy access request will depend on what privacy laws apply to you and where the individual making the access request is located. This article will outline what a privacy access request is and what you should do if you receive one.
What is a Privacy Access Request?
A privacy access request is an application by someone for access to the personal information your business has collected and stored about them. The privacy access request may relate to the following:
- all of the relevant personal information; or
- specific personal information, such as a particular call recording.
Personal information includes any details that someone may use to identify a person. For instance, this may be individual pieces of information or a set of details that, when together, can identify a person.
Examples of personal information include a person’s:
- name;
- contact details;
- bank account details; and
- preferences and opinions.
Does My Business Need to Reply to a Privacy Access Request?
The first step in determining how to respond to a privacy access request is understanding how Australian privacy laws apply to your business. Under the law, certain businesses must comply with a privacy access request. Whether your business must comply is determined according to set criteria.
Examples of these criteria are whether your business:
- has an annual turnover of over $3 million;
- provides a health service or trades in personal information; or
- is a contracted service provider under a Commonwealth contract.
Generally, you must take practical steps to respond to a privacy access request. Even if there is no legal requirement compelling your business, responding to a customer’s request is usually the best practice.
If you are required to respond to a request for access to personal information, you must do so within a reasonable period, which the OAIC suggests is within 30 days.
Continue reading this article below the formSteps To Take in Response to a Privacy Access Request
Identify the Individual
First, you should ensure that the person requesting access to personal information is the person the information relates to. In most cases, you should only disclose personal information to the relevant person. Nevertheless, an exception may apply where you receive a request from a legal guardian or attorney under a power of attorney.
You can verify the person’s identity by asking to see current identity documentation (ID). However, you should not ask for a copy or make copies of the ID. This is because you should only hold personal information that your business needs.
Request an Administrative Fee
Under Australian law, you may ask for a reasonable fee to cover your administrative costs. However, if you wish to do so, you must provide an upfront quote to the person making the request, and they must agree to it before you give access to their information.
The fee may include the cost of:
- locating and retrieving the information;
- reproducing the information; and
- the postage required to send the information.
If you are a company director, complying with directors’ duties are core to adhering to corporate governance laws.
This guide will help you understand the directors’ duties that apply to you within the Australian corporate law framework.
Locate the Relevant Personal Information
Once you have verified the identity of the person requesting the information, you will need to locate the relevant information.
Ensure you source all of the personal information you hold about that individual, such as:
- their customer profile;
- any logs of their interaction with your business; and
- your email correspondence with them.
You may also need to locate any further information that a third party, such as a contractor, holds on your behalf.
Provide the Information
Whenever possible, provide the personal information in the form requested by the individual. For example, you should provide a hard copy if they request a hard copy. However, if it is impractical for you to do so, you may provide an electronic copy of the information. For example, this could be the case if you do not have access to a printer or the customer refuses to pay for your printing costs.
What is the Turnaround Time?
There are no set time constraints for responding to a privacy access request. Instead, the time will depend on factors like how much information is requested and how easy it is for you to access that information.
The Office of the Australian Information Commissioner (OAIC) previously stated that it could take businesses at least a few days to respond to a simple access request.
Can I Deny a Privacy Access Request?
According to the law, you may deny an access request on specific grounds. For example, you may not have to comply if the request:
- poses a risk to life;
- would result in an unreasonable impact on the privacy of others;
- risks revealing commercially sensitive information;
- relates to legal proceedings;
- is unlawful; or
- is unreasonable.
For example, suppose you believe that the request poses a risk to the privacy of others or to sharing confidential information. In that case, consider redacting certain parts of the information before providing access.
It may be inappropriate or even impossible to give access directly to the individual. If this is the case, you may be able to provide access via an intermediary. For example, an intermediary could be a medical professional.
Key Takeaways
Proper preparation can allow your business to process privacy access requests quickly and efficiently. First, you should find out what steps to take if you do face a request, what information you will need to source and whether you will need to deny the request. Additionally, it is essential you comply with any privacy obligations you may have.
If you need help designing your access request response plan or developing a guide for customers, our experienced privacy lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 1300 544 755 or visit our membership page.
Frequently Asked Questions
Not every business is required to comply with a privacy access request, but even if your business is not legally required to do so, it usually is best practice to respond to a customer’s request for commercial reasons.
Businesses can charge customers for accessing their personal information, but this fee cannot be excessive. If you decide to charge, you must notify the individual that there is a cost and outline the reasons for the cost. You cannot use the fee to discourage individuals from making privacy access requests, and you should provide alternative options to reduce cost, such as delivering the information by electronic means rather than by post or limiting the scope of the request.
We appreciate your feedback – your submission has been successfully received.
