Explanatory Statement

Guidelines issued under Section 95(1) of the Privacy Act 1988 (Cth)

This explanatory statement has been prepared by the National Health and Medical Research Council (NHMRC). It fulfils the NHMRC Chief Executive Officer’s obligations under subsection 15J(2) of the Legislation Act 2003 (Cth) (Legislation Act). It explains the purpose and operation of the Guidelines issued under Section 95 of the Privacy Act 1988, 2014 (updated 2024) (‘these guidelines’) about the protection of privacy by agencies in the conduct of medical research.

Authority

Section 95(1) of the Privacy Act 1988 (Cth) (the Privacy Act) provides the authority for the NHMRC CEO to issue guidelines for the protection of privacy by agencies in the conduct of medical research, where such research, if not done in accordance with these guidelines, would be considered a breach of the Australian Privacy Principles.

The NHMRC CEO may only issue these guidelines with the approval of the Commissioner (defined in Section 6 of the Privacy Act as ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act’). In accordance with section 95(2) of the Privacy Act, approval will only be provided if the Commissioner is satisfied that the public interest in the promotion of research of the kind to which the guidelines relate outweighs to a substantial degree the public interest in maintaining adherence to the Australian Privacy Principles (APPs).

Purpose

Medical research that involves the use of personal information held by an agency, including the compilation or analysis of statistics, provides important information to health care providers and health policy decision-makers. It may underpin good decision-making on health care policies and the development of health programs within the Australian community. Translation of research into service delivery enables ongoing quality improvements in Australia’s health care sector and assists service providers, non-government organisations and governments to minimise wastage in the health care sector.

To support such research it may, at times, be necessary for personal information to be collected, used or disclosed without consent from an individual. These guidelines apply where medical research involves the use of personal information held by an agency. The processes that are set out in these guidelines must be followed in order for the information to be lawfully used or disclosed. They support the conduct of such activities in a way that minimises intrusion on individual privacy.

On balance, noting the public good that flows from health and medical research, NHMRC considers that the public interest in the facilitation of research of the kind to which these guidelines relate outweighs to a substantial degree the public interest in maintaining adherence to the APPs.

Australian Privacy Principles

The APPs are a set of legally binding privacy principles that establish standards, rights and obligations in relation to the handling, holding, accessing and correcting of personal information. They apply to most Australian Government agencies and certain private sector organisations, collectively referred to as APP entities.

AAP 6 prohibits uses or disclosures of personal information for secondary purposes unless the individual to whom the personal information relates has consented or a listed exception in relation to the use or disclosure of that information applies.

The APPs do not permit agencies to use or disclose personal information for medical research purposes, unless the individual has consented to the use or disclosure, or the use or disclosure is allowable through an exception contained in the Privacy Act.

2024 Guidelines   

These 2024 guidelines have been remade in substantially the same terms as the 2014 guidelines; minor revisions have been applied to maintain the document’s currency. This action has been taken to ensure the utility of these guidelines while the Australian Government implements its response to a substantial review of the Privacy Act that has proposed significant changes to the legislation, with implications for these guidelines. Once that work is complete, a substantial review of these guidelines is anticipated.

These guidelines should be read together with the NHMRC National Statement on Ethical Conduct in Human Research (National Statement), as in force or existing from time to time. The National Statement contains some guidance on protection of privacy of personal information in research and generally refers to the relevant laws and standards of conduct.

Consultation

Section 17 of the Legislation Act requires that the rule-maker be satisfied that there has been appropriate consultation, which draws on the knowledge of persons having expertise in fields relevant to the proposed instrument and ensures that people likely to be affected by the proposed instrument had an adequate opportunity to comment on its proposed content.[1]

In consultation with NHMRC, the Office of the Australian Information Commissioner (OAIC) undertook public consultation on the proposed remaking of these guidelines in November-December 2023. Consultation documents were made available on the OAIC’s website during a 4-week consultation period. Comment was invited from the public and the consultation was shared on relevant social media platforms and with relevant NHMRC stakeholders through a fortnightly newsletter.

The OAIC received 2 submissions in response to the public consultation documents. Submissions received expressed concerns with the proposal to include a five-year self-repeal provision in the approval, stating that it could create uncertainty for stakeholders. Submitters were not opposed to approving the guidelines in substantially the same terms. This feedback was considered, and the five-year self-repeal provision was not incorporated into the instrument.

Policy Impact Analysis

The Office of Impact Assessment (OIA) assessed the Instrument and confirmed that the preparation of a detailed Impact Analysis is not required. The OIA reference number is
OIA24-07113.

Legal status of the guidelines

These guidelines form part of the legal requirements for compliance with the Privacy Act. They apply where medical research involves the use of personal information held by an agency. The processes that are set out in these guidelines must be followed, in order for the information to be lawfully used or disclosed.

A breach of the guidelines constitutes an interference with privacy under section 13 of the Privacy Act because the act or practice would breach an APP in relation to personal information about the individual. An individual may complain to the Office of the Australian Information Commissioner about an act or practice they believe has not been done in accordance with these guidelines.

These guidelines take effect from the day of registration on the Federal Register of Legislative Instruments.

A Statement of Compatibility with Human Rights is at Attachment A.

Attachment A

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (Cth)

Guidelines issued under section 95 of the Privacy Act 1988, 2014 (updated 2024)

This legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the legislative instrument

This legislative instrument enacts guidelines issued by the CEO of the National Health and Medical Research Council (NHMRC) under section 95(1) of the Privacy Act 1988 (Cth) (the Privacy Act). These Guidelines issued under section 95 of the Privacy Act 1988, 2014 (updated 2024) (‘these guidelines’) provide a framework for the protection of privacy by agencies in the conduct of medical research, where such research, if not done in accordance with these guidelines, would be considered a breach of the Australian Privacy Principles.

Medical research that involves the use of personal information held by an agency, including the compilation or analysis of statistics, provides important information to health care providers and health policy decision-makers. It may underpin good decision-making on health care policies and the development of health programs within the Australian community. Translation of research into service delivery enables ongoing quality improvements in Australia’s health care sector and assists service providers, non-government organisations and governments to minimise wastage in the health care sector.

To support such research it may, at times, be necessary for personal information to be collected, used or disclosed without consent from an individual. These guidelines apply where medical research involves the use of personal information held by an agency. The processes that are set out in these guidelines must be followed in order for the information to be lawfully used or disclosed. They support the conduct of such activities in a way that minimises intrusion on individual privacy.

Human rights implications

This legislative instrument engages the following rights:

• the right to protection against unlawful and arbitrary interferences with privacy in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), and
• the right to health in Article 12 of the International Covenant on Economic, Social and Cultural Rights (ISECR).

The Preamble to the Privacy Act makes clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the International Covenant on Civil and Political Rights (ICCPR). Specifically, article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence. However, the right to privacy is not absolute and there may be circumstances in which the guarantees in article 17 can be outweighed by other considerations, such as the protection of the right to health.

In any event, interferences with privacy must be authorised by law and not arbitrary. The use of the term arbitrary in the ICCPR means that any interferences with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.

With respect to the right to health, article 12 of the International Covenant on Economic, Social and Cultural Rights (ICESCR) provides that:

1. The State Parties to the present Covenant recognise the right of everyone to the enjoyment of the highest attainable standard of physical and mental health.

Article 12(2) of the ICESCR outlines the steps to be taken to achieve the full realisation of this right, including those necessary for:

(c) The prevention, treatment and control of epidemic, endemic, occupational and other diseases.

In General Comment No. 14: The Right to the Highest Attainable Standard of Health (2000), the United Nations Committee on Economic, Social and Cultural Rights states that ‘health is a fundamental human right indispensable for the exercise of other human rights’, and that the right to be healthy is not to be understood as a right to be healthy, but includes the right to a system of health protection which provides equal opportunity for people to enjoy the highest attainable level of health. 

Research, and the compilation or analysis of statistics, are important for providing information to help the community make decisions that impact on the health of individuals and the community. The properly informed management of health services is necessary to ensure individuals and the community receive the best possible health and medical care. These activities should be carried out in a way that minimises intrusion on people’s privacy. However, it may be necessary for personal information to be collected, used or disclosed without consent from an individual in order for the research, the compilation or analysis of statistics, or the management of a health service to proceed.

The guidelines enacted by this instrument provide a framework in which medical research involving personal information obtained by Commonwealth agencies should be conducted, to ensure that such information is protected against unauthorised collection or disclosure.

Having considered the competing rights to privacy and health, the Australian Privacy Commissioner has approved the issue of these guidelines by the Chief Executive Officer of the National Health and Medical Research Council, as required under Section 95 of the Privacy Act.

Conclusion

This legislative instrument is compatible with human rights because the right to privacy is not an absolute right. In some circumstances, it must be weighed against the equally justified rights of others and against matters that benefit society as a whole. To the extent the guidelines authorised by this legislative instrument advance the protection of human rights and the right to health and to the extent that it may also limit human rights, those limitations are reasonable and proportionate.

Prue Alison Torrance, Chief Executive Officer (A/g)
National Health and Medical Research Council

[1]  See Federal Register of Legislation - Legislation Act 2003.