It is in an individuals best interest to ensure that when they provide personal information to an organisation, that they are given some guarantee that that information will not be misused, used for identity theft or used to discriminate.
An organisation might request access to a birth certificate to verify the legal name of an individual if they cannot provide verification using another document, like a passport. In this case the individual should ensure that the organisation only accesses the name on the certificate and does not access other information. The individual should refuse to allow any copies to be made of the certificate and should ensure that only the information that is required by the organisation is given to them. The organisation should not look to keep information on the individuals parents, birth location, date of birth or sex.
The Australian Privacy ACT states:
“Personal information shall not be collected by a collector for inclusion in a record or in a generally available publication unless:
(a) the information is collected for a purpose that is a lawful purpose directly related to a function or activity of the collector”
The conclusion that can be drawn from this is that an organisation that collects information relating to the sex of an individual must have a lawful purpose in wanting to obtain it. This has resulted in a number of organisations reviewing their actual business requirement for wanting to store it (See Point 6) and deciding not to.