Explanatory Statement
Guidelines under section 95 of the Privacy Act 1988
November 2014
1. PURPOSE AND AUTHORITY
Section 95 of the Privacy Act 1988 (Cth) (the Privacy Act) allows the National Health and Medical Research Council (NHMRC) to issue guidelines, with the approval of the Commissioner, for the protection of privacy by agencies in the conduct of medical research.
Authority for making the guidelines
Section 95 of the Privacy Act set out the authority to approve the making of the guidelines. They state:
95 Medical research guidelines
(1) The CEO of the National Health and Medical Research Council may, with the approval of the Commissioner, issue guidelines for the protection of privacy by agencies in the conduct of medical research.
(2) The Commissioner shall not approve the issue of guidelines unless he or she is satisfied that the public interest in the promotion of research of the kind to which the guidelines relate outweighs to a substantial degree the public interest in maintaining adherence to the Australian Privacy Principles.
(3) Guidelines shall be issued by being published in the Gazette .
(4) Where:
(a) but for this subsection, an act done by an agency would breach an Australian Privacy Principle; and
(b) the act is done in the course of medical research and in accordance with guidelines under subsection (1);
the act shall be regarded as not breaching that Australian Privacy Principle.
2. REASONS FOR MAKING THESE GUIDELINES
Background to the s95 Guidelines
The s95 guidelines have been re-issued to address minor formatting and content errors in the previous version dated 12 March 2014.
The guidelines were updated in March 2014 to ensure that they accord with the Privacy Amendment (Enhancing Privacy Protection) Act 2012, which amended the Privacy Act effective 12 March 2014.
Information regulated by the s95 guidelines
The s95 guidelines apply where medical research involves the use of personal information held by an agency, the processes that are set out in the s95 guidelines must be followed, in order for the information to be lawfully used or disclosed.
3. CONSULATION
Public consultation was not undertaken due to the minor/ machinery nature of the changes which give effect to a legislative change, which has been debated in Parliament.
The NHMRC worked closely with the Office of the Australian Information Commissioner in making the updates to the guideline.
4. LEGAL STATUS OF THE GUIDELINES
The s95 guidelines form part of the legal requirements for compliance with federal legislation, namely the Privacy Act.
The s95 guidelines apply where medical research involves the use of personal information held by an agency, the processes that are set out in the s95 guidelines must be followed, in order for the information to be lawfully used or disclosed.
A breach of the s95 guidelines constitutes an interference with privacy under section 13A of the Privacy Act.
An individual may complain to the Privacy Commissioner about an act or practice they believe has not been done in accordance with the s95 guidelines.
The s95 guidelines take effect from the day of registration on the Federal Register of Legislative Instruments.