Fat Zebra may collect, use, disclose, transfer or otherwise handle any Personal Information, and complies with the PrivacyAct 1988 (Cth) and associated Australian Privacy Principles.
Without limiting section A, Fat Zebra must:
a) only use Personal Information in the to the extent necessary to perform its obligations in accordance with this Agreement;
b) not disclose any Personal Information to any other person (including to a subcontractor) without the prior written consent of TheClient or, subject to section B, sub-paragraph l., as required by Law;
c) without limiting any of Fat Zebra’s other obligations under this Agreement, take such steps as are reasonable in the circumstances to protect any Personal Information from:
(i) misuse, interference and loss; and
(ii) unauthorised access, modification or disclosure,
d) not do anything that adversely affects the accuracy, currency or completeness of any Personal Information;
e) without limiting section B, paragraph (c) above, ensure that none of Fat Zebra’s Personnel who have access to any PersonalInformation use, disclose, transfer or retain such Personal Information except to the extent necessary to perform their duties of engagement;
f) notify the Client immediately if Fat Zebra becomes aware of any actual or potential misuse, interference, loss or unauthorised access, modification or disclosure of Personal Information, or if it becomes aware of a breach of this clause;
g) notify the Client as soon as reasonably practicable after Fat Zebra receives any:
(i) request concerning access to or correction of anyPersonal Information; or
(ii) complaint about the handling of any PersonalInformation;
h) comply with any reasonable requests or directions ofThe Client concerning:
(i) the storage, security, use and disclosure of anyPersonal Information;
(ii) remedying or otherwise dealing with any event referred to in paragraph l) (vi); and
(iii) the handling of any request or complaint referred to in paragraph l) (vii);
i) notify The Client as soon as reasonably practicable after Fat Zebra becomes aware that a disclosure of any Personal Information maybe required by Law and, if requested by The Client, prior to any such disclosure:
(i) assist the Client to obtain a written legal opinion, from a reputable law firm or senior counsel nominated by The Client and at theClient’s cost, confirming that the disclosure is required by Law; and/or
(ii) assist The Client to prevent, resist, object to or limit such disclosure (at the Client’s cost);
j) at any time upon The Client’s request, or on the termination or expiry of an Agreement for any reason:
(i) ensure that any Personal Information is De-Identified(as defined in the Privacy Act) or destroyed except as required by Law; or
(ii) otherwise deal with any Personal Information, in accordance with the reasonable directions of the Client; and
k) if FatZebra becomes aware that there are reasonable grounds to suspect that anEligible Data Breach may have occurred in relation to any Personal Information collected, stored or processed by Fat Zebra in the course of providing theServices:
(i) promptly provide written notice to the Client specifying the nature and details of the suspected Eligible Data Breach, the kind of Personal Information potentially affected and recommendations for any actions to be taken by The Client in response to the breach;
(ii) carry out a reasonable and prompt assessment of whether there are reasonable grounds to believe that the suspected Eligible Data Breach amounts to an actual Eligible Data Breach; and
(iii) promptly discuss in good faith the results of the assessment with the Client and the proposed preventative, remedial or other action to be taken by Fat Zebra;
l) if FatZebra becomes aware that there are reasonable grounds to believe that anEligible Data Breach has occurred in relation to any such Personal Information(whether after conducting an assessment of a suspected Eligible Data Breach in accordance with paragraph (k) above or otherwise):
(i) if an assessment pursuant to paragraph (k) above has not been conducted, prior to taking any other action in connection with theEligible Data Breach, immediately provide written notice to the Client of the nature and details of the Eligible Data Breach, the kinds of information concerned and recommendations for any actions to be taken by the Client and/or affected individuals in response to the breach;
(ii) promptly discuss and negotiate in good faith with theClient which Party will be the Party responsible for fulfilling the relevant notification requirements under the Privacy Law in respect of the Eligible DataBreach, including to the Office of the Australian Information Commissioner (OAIC) and the relevant affected individuals;
(iii) where the parties agree that Fat Zebra will be the party responsible for fulfilling the relevant notification requirements, andFat comply with all such requirements in accordance with the Privacy Act, and the Client must provide all such assistance as may be necessary;
(iv) in any event, obtain the Client’s approval prior to issuing any relevant notification statements to the OAIC and affected individuals in accordance with the Privacy Act and the Client must not unreasonably withhold its approval where Fat Zebra is required by Law to issue a notification and the Client has not made a determination to itself fulfil the notification requirement;
(v) the Client must provide approval as soon as reasonably practicable to Fat Zebra under sub-paragraph (iv) above to enable Fat Zebra to comply with its notification requirements;
(vi) promptly take appropriate remedial action to mitigate any loss or interference with privacy flowing from the Eligible Data Breach, prevent any further serious harm to affected individuals and protect the affected Personal Information from further misuse or breach; and
(vii) without limiting the foregoing, cooperate with and provide reasonable assistance to the Client for the purpose of ensuring that the Client complies with its statutory obligations under the Privacy Act.
