How to Respond to Requests for Access to Personal Information

When a club receives a request for access to an individual’s personal information, it is important that it follows the correct steps to deal with it. The club’s privacy policy should outline how an individual can access their personal information, and the club should consider developing a process (similar to a complaint procedure) to assist in dealing with these requests. 

The Office of the Australian Information Commissioner provides guidance on handling requests for access to personal information, including a flow chart, available here. A simplified outline of the process for providing access to personal information is outlined below:

1. Can you verify the individual’s identity? A club must be able to ensure that the request is being made by the individual or another person who is authorised to make a request on an individual’s behalf (i.e. a legal guardian).
2. Can you locate the requested personal information? APP 12 requires clubs to provide access to personal information that they hold on an individual. For further information on what ‘holds’ means, click here.
3. Is there a reason to deny access? Under the Privacy Act 1988, there are ten grounds when a club may refuse to give access to personal information, including where giving access would be unlawful. If a club decides not to grant access due to one of these grounds, it must consider and take reasonable steps to give access in a way that can meet the needs of the individual and the club.
4. Can access be provided in the manner requested? A club must give individuals access to their personal information in the way requested (i.e. in writing) unless it would be impractical or unreasonable to do so.
5. Can you give access by other means? Where a club has refused access to personal information or in the manner requested, the club should take reasonable steps to give access in a manner that suits both parties.
6. Will you charge for access? A club can charge an individual for providing access to their personal information. However, this is not a requirement. If a club chooses to do this, the cost should be proportional and can only be for providing access.

Clubs are encouraged to seek relevant legal advice in any instance to ensure compliance with obligations under privacy laws.