How specific does my purpose for using information need to be?

Under the Privacy Act, there is a general obligation not to use or disclose  personal information, unless an exception applies.

One of the main exceptions which allows you to use or disclose personal information is where that use or disclosure was the purpose for which you obtained the personal information (or was directly connected to one of your purposes for obtaining the personal information).

In other words, if, when you collected the personal information, you told the individual concerned that you would be using or disclosing their personal information in a certain way, you are entitled to go ahead and do so.

However, you will need to keep in mind how specific you were about what your purpose or purposes were when you collected the information.

A good test to keep in mind is the ‘no surprises’ test. In other words, would the way in which you’re planning to use or disclose personal information come as a surprise to the person you collected it from? If the answer is yes, that might be a sign that your intended use or disclosure is for a new purpose, in which case you’ll need to find another exception you can rely on to use or disclose the information.

It may also be a good sign that it’s time for you to review what you tell individuals when you collect their information.