The Privacy Act 1988 is an Australian law dealing with privacy. Section 14 of the Act stipulates a number of privacy rights known as the Australian Privacy Principles (APPs). These principles apply to Australian Government and Australian Capital Territory agencies or private sector organizations contracted to these governments, organizations and small businesses who provide a health service, as well as to private organisations with an annual turnover exceeding AUD$3M (with some specific exceptions). The principles govern when and how personal information can be collected by these entities. Information can only be collected if it is relevant to the agencies' functions. Upon this collection, that law mandates that Australians have the right to know why information about them is being acquired and who will see the information. Those in charge of storing the information have obligations to ensure such information is neither lost nor exploited. An Australian will also have the right to access the information unless this is specifically prohibited by law. 2000 amendments The Privacy Act was amended in 2000 to cover the private sector. Schedule 3 of the Privacy Act sets out a significantly different set of privacy principles, the National Privacy Principles (NPPs). These apply to private sector organizations (including not for profit organizations) with a turnover exceeding three million dollars, other than health service providers or traders in personal information. These principles extend to the transfer of personal information out of Australia. 2014 amendments The Australian Privacy Principles (APPs) replaced the National Privacy Principles and Information Privacy Principles on 12 March 2014 via the Privacy Amendment (Enhancing Privacy Protection) Act 2012, which amended the Privacy Act 1988. State legislation Privacy principles that are substantially the same as the NPPs are also included in the legislation applying to the public sectors of some Australian States and Territories, namely the Information Privacy Act 2000 (Victoria), Information Act 2002 (Northern Territory), Personal Information Protection Act 2004 (Tasmania), and the Health Records and Information Privacy Act 2002 (New South Wales). Administration Australia's privacy principles, the APPs, depend upon the meaning of "personal information" (as defined in Privacy Act 1988 s6). This term has not yet been interpreted in a restrictive way as has been "personal data" in the UK Durant case. The Privacy Act creates an Office of the Privacy Commissioner and a Privacy Commissioner in Australia. Section 36 of the Act states that Australians may appeal to this Commissioner