Keeping personal information listed
(1) A database operator must not keep personal information about a particular person in the operator's residential tenancy database for longer than—
(a) 3 years; or
(b) if, under the national privacy principles, the operator of the database is required to remove the personal information before the 3 year period referred to in paragraph (a) ends, the period ending when the information must be removed under the national privacy principles.
Penalty: 150 penalty units in the case of a natural person; 750 penalty units in the case of a body corporate.
(2) However, a database operator may keep the person's name in the operator's residential tenancy database for longer than the period stated in subsection (1)(a) or (b) if—
(a) other personal information about the person in the database is attached to the name; and
(b) the other personal information is not required to be removed under subsection (1) or another law.
(3) This section does not limit the operation of this Part or a provision of another law that requires the removal of the personal information.
(4) In this section— national privacy principles means the principles stated in Schedule 3 of the Privacy Act 1988 of the Commonwealth.
Comments