Does the Privacy Act apply to unsolicited information?

If you didn’t ask to be given the relevant personal information, and didn’t set up a system to collect that type of information, you haven’t ‘collected’ it. The information is unsolicited. This means that you don’t have to comply with the general principles about collection.

It is up to you to decide what you do with any unsolicited information you receive. If you think you’ve received the information in error, you may want to consider contacting the person or agency who sent it. If you think there is an existing lawful purpose for using the information (in other words, if the information is relevant to your business), then you can keep the information if you want.

However, if you do keep the information, the other obligations set out in the privacy principles (including the obligation to keep the information secure, rights of access and correction, restrictions on use, etc.) will apply.