Privacy Act & codes

An agency that holds personal information shall ensure -

(a) that the information is protected, by such security safeguards as it is reasonable in the circumstances to take, against -

(i) loss; and
(ii) access, use, modification, or disclosure, except with the authority of the agency that holds the information; and(iii) other misuse; and

(b) that if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or unauthorised disclosure of the information.