Communication of personal data

• Pages: 5-6

Code of practice

5

8.4. Employers should verify periodically that the personal data stored is

accurate, up to date and complete.

8.5. Personal data should be stored only for so long as it is justified by the

specific purposes for which they have been collected unless:

(a) a worker wishes to be on a list of potential job candidates for a specific period;

(b) the personal data are required to be kept by national legislation; or

(c) the personal data are required by an employer or a worker for any legal proceedings

to prove any matter to do with an existing or former employment relationship.

8.6. Personal data should be stored and coded in a manner:

(a) that the worker can understand; and

(b) that does not ascribe any characteristics to the worker that have the effect of

discrimination against the worker.

9. Use of personal data

9.1. Personal data should be used consistent with the principles in this code that

apply to its collection, communication and storage.

10. Communication of personal data

10.1. Personal data should not be communicated to third parties without the

worker’s explicit consent unless the communication is:

(a) necessary to prevent serious and imminent threat to life or health;

(b) required or authorized by law;

(c) necessary for the conduct of the employment relationship;

(d) required for the enforcement of criminal law.

10.2. A worker’s personal data should not be communicated for commercial or

marketing purposes without the worker’s informed and explicit consent.

10.3. The rules applicable to communications to third parties should apply to the

communication of personal data between employers in the same group and between

different agencies of government.

10.4. Employers should instruct those who receive a worker’s personal data that

the personal data can be used only for the purposes for which the data are

communicated, and should request confirmation that the instructions have been

followed. This does not apply to regular communications pursuant to any statutory

obligation.

10.5. Internal communications of personal data should be limited to those

explicitly drawn to the attention of the worker.

10.6. Personal data should be internally available only to specifically authorized

users, who should have access only to such personal data as are needed for the

fulfilment of their particular tasks.