Overview

The Privacy Act 1988, enacted to address issues surrounding the protection of personal information in Australia, includes provisions for the handling of sensitive data such as health information. To provide further clarity and direction on how such information should be managed, particularly for research and public health purposes, the Act incorporates guidelines under Section 95A. The Privacy Commissioner, Timothy Pilgrim, approved updated guidelines issued by the Chief Executive Officer of the National Health and Medical Research Council, replacing earlier guidelines from 2001. These guidelines pertain to the use and disclosure of health information for research or statistical analysis relevant to public health or public safety, as well as the collection of such information for similar purposes or for the management, funding, or monitoring of health services. This legislative action aims to ensure that health information is handled appropriately, balancing the need for research and public health initiatives with the protection of individual privacy rights. The approval of these guidelines by the Privacy Commissioner reflects a commitment to maintaining and enhancing the integrity of health information management in alignment with the objectives of the Privacy Act.

Scope and Application

The approval of guidelines under Section 95A of the Privacy Act 1988 applies to health information that is used, disclosed, or collected for specific purposes including research, the compilation or analysis of statistics relevant to public health or public safety, and the management, funding or monitoring of a health service. This approval is issued by the Privacy Commissioner, Timothy Pilgrim, who has the authority to approve guidelines relating to the use and disclosure of health information under subsection 95A(2), and those relating to the collection of such information under subsection 95A(4). The jurisdictional reach of this Act is federal, affecting entities and persons who handle health information across Australia. This approval specifically concerns guidelines issued by the Chief Executive Officer of the National Health and Medical Research Council. The approval repeals the previous approval of guidelines issued in December 2001 and takes effect from 12 March 2014, thereby ensuring that the guidelines are current and compliant with the requirements of the Privacy Act.

Key Provisions

The primary operative sections of this legislation are sections 95A(2) and 95A(4) of the Privacy Act 1988, which provide the framework for the approval of guidelines related to the use and disclosure of health information for research and statistical purposes relevant to public health or public safety (s 95A(2)) and the collection of health information for similar purposes or for the management, funding, or monitoring of health services (s 95A(4)). These sections empower the Privacy Commissioner to approve guidelines that are specifically tailored to ensure the proper handling of health information in contexts that directly impact public health and safety. The obligations imposed by the Act on the parties or entities it governs include adherence to the approved guidelines set forth by the Privacy Commissioner. This means that any entity handling health information for the purposes outlined in the approved guidelines must ensure that their practices comply with these directives. Such compliance is necessary to safeguard the privacy and security of individuals' health information while enabling necessary research, statistics compilation, and health service management. In terms of offences, penalties, or consequences for breach, the legislation itself does not explicitly detail specific penalties for non-compliance with the approved guidelines. However, non-compliance with the overarching Privacy Act 1988 can lead to enforcement actions by the Office of the Australian Information Commissioner. These actions can include formal warnings, orders for corrective action, and in severe cases, the imposition of substantial fines. The maximum penalties for breaches of the Privacy Act can reach up to $2.1 million for corporations and $210,000 for individuals, reflecting the seriousness with which the Act treats violations of privacy standards.