Clause 9

by inserting, immediately after the words “section 15” in subsection (3)(a), the words “or 15A”; and

by deleting subsection (4) and substituting the following subsections:“(4) Despite subsection (3), an organisation must comply with subsection (5) on or before collecting, using or disclosing personal data about an individual for the purpose of or in relation to the organisation —

entering into an employment relationship with the individual or appointing the individual to any office; or

managing or terminating the employment relationship with or appointment of the individual.(5) For the purposes of subsection (4), the organisation must inform the individual of the following:

the purpose for which the organisation is collecting, using or disclosing (as the case may be) the personal data about the individual;

on request by the individual, the business contact information of a person who is able to answer the individual’s questions about that collection, use or disclosure (as the case may be) on behalf of the organisation.”.