Explanatory Statement
Guidelines under section 95 of the Privacy Act 1988
November 2014
1. PURPOSE AND AUTHORITY
Section 95 of the Privacy Act 1988 (Cth) (the Privacy Act) allows the National Health and Medical Research Council (NHMRC) to issue guidelines, with the approval of the Commissioner, for the protection of privacy by agencies in the conduct of medical research.
Authority for making the guidelines
Section 95 of the Privacy Act set out the authority to approve the making of the guidelines. They state:
95 Medical research guidelines
(1) The CEO of the National Health and Medical Research Council may, with the approval of the Commissioner, issue guidelines for the protection of privacy by agencies in the conduct of medical research.
(2) The Commissioner shall not approve the issue of guidelines unless he or she is satisfied that the public interest in the promotion of research of the kind to which the guidelines relate outweighs to a substantial degree the public interest in maintaining adherence to the Australian Privacy Principles.
(3) Guidelines shall be issued by being published in the Gazette .
(4) Where:
(a) but for this subsection, an act done by an agency would breach an Australian Privacy Principle; and
(b) the act is done in the course of medical research and in accordance with guidelines under subsection (1);
the act shall be regarded as not breaching that Australian Privacy Principle.
2. REASONS FOR MAKING THESE GUIDELINES
Background to the s95 Guidelines
The s95 guidelines have been re-issued to address minor formatting and content errors in the previous version dated 12 March 2014.
The guidelines were updated in March 2014 to ensure that they accord with the Privacy Amendment (Enhancing Privacy Protection) Act 2012, which amended the Privacy Act effective 12 March 2014.
Information regulated by the s95 guidelines
The s95 guidelines apply where medical research involves the use of personal information held by an agency, the processes that are set out in the s95 guidelines must be followed, in order for the information to be lawfully used or disclosed.
3. CONSULATION
Public consultation was not undertaken due to the minor/ machinery nature of the changes which give effect to a legislative change, which has been debated in Parliament.
The NHMRC worked closely with the Office of the Australian Information Commissioner in making the updates to the guideline.
4. LEGAL STATUS OF THE GUIDELINES
The s95 guidelines form part of the legal requirements for compliance with federal legislation, namely the Privacy Act.
The s95 guidelines apply where medical research involves the use of personal information held by an agency, the processes that are set out in the s95 guidelines must be followed, in order for the information to be lawfully used or disclosed.
A breach of the s95 guidelines constitutes an interference with privacy under section 13A of the Privacy Act.
An individual may complain to the Privacy Commissioner about an act or practice they believe has not been done in accordance with the s95 guidelines.
The s95 guidelines take effect from the day of registration on the Federal Register of Legislative Instruments.
Overview
The Privacy Amendment (Enhancing Privacy Protection) Act 2012 was enacted by the Australian Parliament to amend the Privacy Act 1988, strengthening privacy protections for individuals. This Act introduced various measures to enhance the privacy framework, including the establishment of a more robust mechanism for handling personal information. One significant aspect of this legislative change is the provision for the National Health and Medical Research Council (NHMRC) to issue guidelines under section 95 of the Privacy Act for the protection of privacy in the conduct of medical research, subject to the Commissioner's approval. The primary policy objective of these guidelines is to balance the public interest in advancing medical research with the need to protect individual privacy, ensuring that research can proceed without breaching the Australian Privacy Principles when conducted in accordance with the specified guidelines.
The s95 guidelines, which were updated in November 2014 to correct minor errors and align with the 2012 amendments, outline the necessary processes for the lawful use and disclosure of personal information in medical research. These guidelines are integral to the legal requirements for compliance with federal legislation and apply when medical research involves the use of personal information held by an agency. Breaches of these guidelines are considered interferences with privacy under section 13A of the Privacy Act, and individuals have the right to lodge complaints with the Privacy Commissioner. The guidelines took effect from the day of their registration on the Federal Register of Legislative Instruments.
Scope and Application
The F2014L01500 Guidelines under Section 95 of the Privacy Act 1988 (Cth) apply to the use of personal information in medical research conducted by agencies. These guidelines were issued by the Chief Executive Officer of the National Health and Medical Research Council (NHMRC) with the approval of the Privacy Commissioner. They are designed to protect privacy while facilitating medical research by allowing certain acts that might otherwise breach the Australian Privacy Principles. These guidelines are integral to federal legislation and apply to any agency conducting medical research that involves the use of personal information. Breach of these guidelines is considered an interference with privacy under section 13A of the Privacy Act, and individuals can lodge complaints with the Privacy Commissioner if they believe the guidelines have not been adhered to. The guidelines came into effect from the day of their registration on the Federal Register of Legislative Instruments and are subject to potential extensions or restrictions through subordinate instruments, though no such changes were specified in the explanatory statement.
Key Provisions
Section 95 of the Privacy Act 1988 (Cth) authorises the CEO of the National Health and Medical Research Council (NHMRC) to issue guidelines for the protection of privacy by agencies conducting medical research, provided the Commissioner approves these guidelines (Section 95(1)). The Commissioner must be satisfied that the public interest in promoting the kind of research outweighs the interest in maintaining adherence to the Australian Privacy Principles (APP) (Section 95(2)). These guidelines are to be published in the Gazette (Section 95(3)), and any act done in accordance with these guidelines during medical research will not be considered a breach of the APP (Section 95(4)).
The obligations imposed by the s95 guidelines require agencies involved in medical research to follow specific processes when using or disclosing personal information. These processes are outlined in the guidelines and are necessary to ensure lawful use and disclosure of personal information in the context of medical research. Failure to comply with these guidelines can result in an interference with privacy under section 13A of the Privacy Act. It is also important for agencies to ensure that their practices align with the APP, as outlined in the guidelines, to avoid any potential breaches of privacy.
Failure to comply with the s95 guidelines can have serious consequences, as a breach constitutes an interference with privacy under section 13A of the Privacy Act. Individuals who believe their privacy has been interfered with due to non-compliance can lodge a complaint with the Privacy Commissioner. Additionally, non-compliance with the guidelines can result in legal action being taken against the offending agency or individual. The severity of penalties will depend on the nature and extent of the breach, but it is crucial for agencies to adhere to the guidelines to avoid potential civil or criminal consequences.