Can an individual demand deletion of their personal information under the APP?

The Privacy Act 1988, which includes the Australian Privacy Principles (APP), grants individuals certain rights concerning their personal information, including the ability to request its deletion. However, this request is not unconditional and must be based on specific circumstances.

For example, individuals can request the deletion of their personal information if it is no longer necessary for the purposes for which it was collected or if they withdraw their consent upon which the processing is based, and there are no overriding legitimate interests for retaining the information. Additionally, compliance with this request is also subject to various legal and regulatory obligations that an organization may have.

The nature of the APP establishes that individuals do not have an absolute right to demand deletion at any time or under any circumstances, which distinguishes the correct response from others. While the options reflecting a blanket approval or a time constraint imply a simpler and more straightforward process, the reality is that the entitlement to deletion is contingent upon meeting specific conditions that protect both the individual's rights and the organization's responsibilities.