When can I use the directly related purpose exception?

Under the Privacy Act, there is a general obligation not to use or disclose personal information, unless an exception applies.

One of the main exceptions which allows you to use or disclose personal information is where use or disclosure was the purpose for which you obtained the personal information (or was one of your purposes for obtaining the personal information).

There is another exception linked to this which allows you to use or disclose personal information, where the use or disclosure is for a purpose which is ‘directly related’ to your original purpose or purposes for obtaining the information.

If you want to rely on this exception, you will need to be able to show how your proposed use or disclosure links back to your original reason for obtaining the personal information, and/or what you originally told the individual you’d be using their information for when you collected it.

The Human Rights Review Tribunal has said there needs to be an ‘uninterrupted, immediate relationship to the original lawful purpose’.

As an example, a tradesperson might collect an individual’s name and contact details for the purpose of providing services to them. If the individual then didn’t pay the tradesperson for their work, the tradesperson might use the name and contact information to chase up the debt or might disclose it to a debt collector for the same reason.

While chasing a debt or using a debt collector wasn’t the tradesperson’s original reason for obtaining the individual’s information (namely providing a service), it is clearly linked (because the person failed to pay for the service).