Explanatory Statement

Approval of guidelines issued under section 95AA of the Privacy Act 1988

March 2014

Explanatory Statement

Approval of guidelines issued under section 95AA of the Privacy Act 1988

This explanatory statement has been prepared by the Australian Privacy Commissioner. It fulfils the Commissioner’s obligations under subsection 26(1A) of the Legislative Instruments Act 2003 (Cth) (Legislative Instruments Act).

This explanatory statement explains the scope and intended operation of the Approval of guidelines issued under section 95AA of the Privacy Act 1988 (the approval) about the use and disclosure of an individual’s genetic information to a genetic relative without the individual’s consent.

Purpose

The Australian Information Commissioner is empowered by section 95AA of the Privacy Act 1988 (Cth) (Privacy Act) to approve guidelines issued by the National Health and Medical Research Council relating to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates (the guidelines).

This approval replaces the Approval by the Privacy Commissioner of guidelines issued under section 95AA of the Privacy Act 1988 (December 2009, FRLI F2009L04608).

Authority

The authority for the Privacy Commissioner to approve these guidelines rests in:

• section 95AA of the Privacy Act, and
• section 12 of the Australian Information Commissioner Act 2010 (Cth) (the Australian Information Commissioner Act).

Subsections 95AA (1) to (2) of the Privacy Act state:

(1)   This section allows the Commissioner to approve for the purposes of the Australian Privacy Principles guidelines that are issued by the National Health and Medical Research Council.

(2)   For the purposes of paragraph 16B(4)(c), the Commissioner may, by legislative instrument, approve guidelines that relate to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates.

Section 6 of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act’.

The guidelines are approved by the Privacy Commissioner, who under section 12 of the Australian Information Commissioner Act has the privacy functions defined in section 9 of that Act. The privacy functions include functions conferred on the Information Commissioner by the Privacy Act.

Relevant provisions of the Privacy Act

The Australian Privacy Principles (APPs) are a set of legally binding privacy principles that establish standards, rights and obligations in relation to the handling, holding, accessing and correcting of personal information. They apply to most Australian Government agencies and certain private sector organisations, collectively referred to as APP entities.

Under the APPs, an APP entity must not collect sensitive information, and must not use or disclose personal information for a purpose other than the primary purpose of collection, unless an exception applies.

Australian Privacy Principle (APP) 6 prohibits uses or disclosures of personal information for secondary purposes unless the individual to whom the personal information relates has consented or a listed exception in relation to the use or disclosure of that information applies.

APP 6.2(d) provides that an APP entity may use or disclose personal information about an individual if the APP entity is an organisation and a permitted health situation exists in relation to the use or disclosure of the personal information by the entity.

Permitted health situations are set out in section 16B of the Privacy Act. Subsection 16B(4) states that:

A permitted health situation exists in relation to the use or disclosure by an organisation of genetic information about an individual (the first individual) if:

(a)               the organisation has obtained the information in the course of providing a health service to the first individual; and

(b)               the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of another individual who is a genetic relative of the first individual; and

(c)                the use or disclosure is conducted in accordance with guidelines approved under section 95AA; and

(d)               in the case of disclosure—the recipient of the information is a genetic relative of the first individual.

‘Genetic information’ is not defined in the Privacy Act. The definitions of ‘health information’ and ‘sensitive information’ in subsection 6(1) include ‘genetic information’, without expressly defining ‘genetic information’.

‘Genetic relative’ is defined as follows in subsection 6(1) of the Privacy Act:

genetic relative of an individual (the first individual) means another individual who is related to the first individual by blood, including but not limited to a sibling, a parent or a descendant of the first individual.

‘Health service’ is defined as follows in subsection 6(1) of the Privacy Act:

health service means:

(a)               an activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or the person performing it:

(i)                  to assess, record, maintain or improve the individual’s health; or

(ii)                to diagnose the individual’s illness or disability; or

(iii)              to treat the individual’s illness or disability or suspected illness or disability; or

(b)               the dispensing on prescription of a drug or medicinal preparation by a pharmacist.

Background to the guidelines

In 2006, the Privacy Act was amended to safeguard the handling of genetic information by changing the definitions of ‘health information’ and ‘sensitive information’ to expressly include genetic information.[1] Genetic information that is not otherwise health information, such as the result of a parentage test, is not treated as health information, but is sensitive information.

The Privacy Legislation Amendment Act 2006 also introduced an additional exception to the general requirement that personal information must not be used or disclosed for any purpose other than that for which it was collected.[2] The exception provides for the use or disclosure of genetic information of an individual by an organisation where the organisation has obtained the genetic information in the course of providing a health service to the individual, and in circumstances where the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to life, health or safety of a person who is the individual’s genetic relative. In the case of disclosure, the recipient of the individual’s genetic information must be a genetic relative of that individual.

Section 95AA of the Privacy Act allows the Commissioner to approve guidelines issued by the National Health and Medical Research Council that relate to circumstances in which genetic information may be used or disclosed without the consent of the individual to whom the genetic information relates. Guidelines for this purpose were issued by the National Health and Medical Research Council in 2009, namely, Use and disclosure of genetic information to a patient’s genetic relatives under Section 95AA of the Privacy Act 1988 (Cth) – guidelines for health practitioners in the private sector.

The Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Privacy Amendment Act) introduces a number of significant changes to the Privacy Act, taking effect on 12 March 2014. These changes mean that references to the Privacy Act in the 2009 guidelines will be out of date. The National Health and Medical Research Council has issued a revised version of the guidelines with amendments reflecting the changes to the Privacy Act.

Consultation

Prior to issuing the 2009 Use and disclosure of genetic information to a patient’s genetic relatives under Section 95AA of the Privacy Act 1988 (Cth) – guidelines for health practitioners in the private sector, the National Health and Medical Research Council undertook consultation in accordance with the consultation requirements under the Legislative Instruments Act.

In issuing revised guidelines to incorporate the legislative amendments to the Privacy Act, the National Health and Medical Research Council together with the Office of the Australian Information Commissioner considered whether further consultation was necessary.

Section 17 of the Legislative Instruments Act generally requires the rule-maker to undertake appropriate consultation before making a legislative instrument. However, section 18 of that Act sets out circumstances where consultation may be unnecessary or inappropriate. Paragraph 18(1)(a) provides that an instrument that is of a minor or machinery nature and that does not substantially alter existing arrangements is an example of an instrument having a nature such that the rule-maker may be satisfied that consultation is unnecessary or inappropriate.

In approving these guidelines, the Privacy Commissioner is satisfied that consultation was unnecessary because the changes made to the guidelines:

-          were limited to updating references to the amended Privacy Act; and

-          do not substantially alter existing arrangements.

Legal status of the guidelines

The guidelines are legally binding on all private sector organisations that have obtained genetic information in the course of providing a health service.

The guidelines establish when, by whom and in what manner the use or disclosure of genetic information without consent may take place under APP 6.2(d) and section 16B(4) of the Privacy Act. Use or disclosure to genetic relatives under APP 6.2(d) and section 16B(4) is only permitted in accordance with these guidelines. 

A breach of the guidelines constitutes an interference with privacy under section 13 of the Privacy Act because the act or practice would breach an Australian Privacy Principle in relation to personal information about the individual. An individual may complain to the Office of the Australian Information Commissioner about an act or practice they believe has not been done in accordance with APP 6.2(d).

In addition to setting out binding legal requirements, the guidelines provide general advice on good practice to assist health practitioners to meet their obligations under APP6.2(d), s 16B(4) and the guidelines.

The guidelines will take effect on 12 March 2014.

Statement of Compatibility with Human Rights

This Statement of Compatibility with Human Rights has been prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

The Approval by the Privacy Commissioner of guidelines issued under section 95AA of the Privacy Act 1988 (Privacy Act) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the legislative instrument

The legislative instrument approves the guidelines issued by the National Health and Medical Research Council under section 95AA of the Privacy Act relating to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates (the guidelines).

Human rights implications

Under section 29 of the Privacy Act, in performing Commissioner functions or exercising Commissioner powers, the Privacy Commissioner must, amongst other things:

(a) have due regard for the protection of important human rights and social interests that compete with privacy…

The Preamble to the Privacy Act makes clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the International Covenant on Civil and Political Rights (ICCPR). Specifically, article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence. However, the right to privacy is not absolute and there may be circumstances in which the guarantees in article 17 can be outweighed by other considerations, such as the protection of the right to health.

With respect to the right to health, article 12 of the International Covenant on Economic, Social and Cultural Rights (ICESCR) provides that:

1. The State Parties to the present Covenant recognise the right of everyone to the enjoyment of the highest attainable standard of physical and mental health.

Article 12(2) of the ICESCR outlines the steps to be taken to achieve the full realisation of this right, including those necessary for:

(c) The prevention, treatment and control of epidemic, endemic, occupational and other diseases.

In some circumstances, the use or disclosure of genetic information can prevent serious health consequences for genetic relatives by allowing the early detection and treatment of inherited genetic disorders, advancing the right to health. Ideally, this use or disclosure will occur with the consent of the individual to whom the genetic information relates. Section 95AA of the Privacy Act provides for the approval of guidelines which limit uses and disclosures of genetic information about an individual without consent to circumstances in which the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a genetic relative of the individual. The guidelines issued by the National Health and Medical Research Council specify the requirements that must be met if genetic information is used or disclosed without consent.

In approving the guidelines, the Privacy Commissioner has considered the competing rights to privacy and health. Privacy is a right that must be appropriately balanced against other competing rights, including the right to health. It is considered that the acts or practices authorised by this legislative instrument advance the protection of human rights and the right to health. To the extent that it may also limit human rights, those limitations are reasonable and proportionate.

Conclusion

The approval by the Privacy Commissioner of guidelines issued under section 95AA of the Privacy Act 1988 is compatible with human rights because it advances the protection of human rights and to the extent that it may also limit human rights, those limitations are reasonable and proportionate.

Timothy Pilgrim, Australian Privacy Commissioner

[1] Privacy Legislation Amendment Act 2006, Schedule 2, clauses 2 and 3.

[2] Privacy Legislation Amendment Act 2006, Schedule 2, clause 5.