Introduction
If you work frequently on issues under the Privacy Act, one of the topics you’ll have addressed over the years is the position where an agency (let’s call it the “Primary Agency”) uses another agency or organisation (let’s call it the “Processing Agency”) to store or process personal information for the Primary Agency. In this scenario, under section 3(4) of the Privacy Act 1993, the personal information is deemed to be held by the Primary Agency, and not the Processing Agency, as long as the Processing Agency doesn’t use or disclose the information for its own purposes.