Personal information must only be collected for a lawful purpose connected with the function or activity of the agency and necessary for that purpose. If the lawful purpose for which personal information is collected does not require collection of an individual’s identifying information, the agency may not require it.

Personal information must be collected from the individual concerned (unless limited exceptions apply).

If an agency collects personal information, the individual concerned must be made aware of the fact of collection, the purpose of collection, the intended recipient/s, the name and address of the collecting and holding agencies, the applicable law under which collection is required, if relevant, the consequences of providing or not providing the information, and the right to access and correction of information provided. These steps must be taken before the personal information is collected, or as soon as reasonably practicable after it is collected.

Personal information may only be collected by lawful means, and by a means that, in the circumstances of the case (particularly where information is being collected from children or young persons) is fair and does not unreasonably intrude to an unreasonable extent upon the personal affairs of the individual concerned.