When you initiate a relationship with a professional (an accountant, lawyer, real estate agent, or bank, for example - let's call them the "Primary Agency"), they are obliged to ask you for your personal information as part of their onboarding. This is due to recent legislation seeking to screen 'money laundering' i.e. criminals seeking to disguise the illegal origins of their money and using financial institutions to avoid detection. While targeted at criminals, this impacts on all including law-abiding citizens in the interests of "the greater good of society".

Occasionally, certain Primary Agencies outsource to a third party (let's call them the "Processing Agent") the task of collecting and assessing your personal information to avoid the hassle of doing it themselves. "Who are these agencies, and what are they doing with my information?" might be your first reaction. How do you know that your personal information is protected particularly in this age where our information can travel across borders and into cyber space?

The Privacy Act aims to protect the collection, storage, use and disclosure of your personal information through 13 Privacy Principles.

The Privacy Act imposes obligations on the Primary Agency, even if it outsources to a Processing Agent. If the Processing Agent breaches the Privacy Principles, then the Primary Agency will be accountable. For instance, Privacy Principle 5 of the Privacy Act states that an agent has a duty to take care of and protect a person's personal information. If a Primary Agency outsources its on-boarding requirements it has an obligation to make sure the Processing Agent follows prudent security protocols, standards and steps, to retain your personal information securely.

Secondly, the Processing Agent is also subject to the abovementioned Privacy Principles. So, for example, the Processing Agent needs to be transparent with their use of personal information to comply with principle 3 (tell the person what you are going to do with their information!)

The Privacy Commissioner recently awarded a Privacy Trust Mark to two Processing Agencies because they were highly transparent with clients about what happens to information once it is collected, as well as making it simple for clients to access or modify that information.

One of the concerns is that a Processing Agent might pass on their personal information to other Primary Agencies who are also on-boarding clients. This should not happen without obtaining the person's prior consent.

Thirdly, a Primary Agency cannot send your personal information to a Processing Agent unless they inform you first (Principle 3 – transparency).

If the Processing Agent is overseas, the Privacy Act imposes additional obligations on the Primary Agency.

In summary, the Privacy Act provides some comfort that your personal information will be protected. Primary Agencies retain accountability under the Privacy Principles even if a Processing Agent is used. The Processing Agent is also accountable. If you find yourself in this situation and have concerns, you may want to check with your Primary Agency that the Processing Agent is credible/trustworthy, or request that the Primary Agency directly handle the on-boarding themselves.

For clarity, Holmden Horrocks protects all your personal information and does not out-source any of our on-boarding requirements. We understand the purpose behind this legislation and, in your interests and ours, we take our duties seriously.

Written by Mina Kiryakos (Property & Commercial Solicitor) and Blair Franklin (Property & Commercial Partner)