Explanatory Statement
Guidelines under section 95 of the Privacy Act 1988
12 March 2014
1. PURPOSE AND AUTHORITY
Section 95 of the Privacy Act 1988 (Cth) (the Privacy Act) allows the National Health and Medical Research Council (NHMRC) to issue guidelines, with the approval of the Commissioner, for the protection of privacy by agencies in the conduct of medical research.
Authority for making the guidelines
Section 95(1) and (2) of the Privacy Act set out the authority to approve the making of the guidelines. They state:
95 Medical research guidelines
(1) The CEO of the National Health and Medical Research Council may, with the approval of the Commissioner, issue guidelines for the protection of privacy in the conduct of medical research.
(2) The Commissioner shall not approve the issue of guidelines unless he or she is satisfied that the public interest in the promotion of research of the kind to which the guidelines relate outweighs to a substantial degree the public interest in maintaining adherence to the Information Privacy Principles.
2. REASONS FOR MAKING THESE GUIDELINES
Background to the s95 Guidelines
The s95 guidelines have been issued to reflect amendments to the Privacy Act which take effect on 12 March 2014. They replace the previous version dated March 2000.
In response to the Australian Law Reform Commission’s report in relation to Australian privacy law and practice, the Privacy Amendment (Enhancing Privacy Protection) Act 2012 amended the Privacy Act 1988 to replace the Information Privacy Principles (IPPs) for the public and private sectors respectively with a single set of privacy principles (the Australian Privacy Principles (APPs)). The s95 guidelines were updated in accordance with the amended Act, to replace references to the IPPs with the APPs.
In addition, references to the National Statement on Research Involving Humans, 1999 was updated with references to the National Statement on Ethical Conduct in Human Research, 2007. This human research guideline promotes ethically good human research by providing ethical guidance for researchers, ethical review bodies, those involved in research governance and research participants.
The Joint NHMRC/AVCC Statement and Guidelines on Research Practice has been replaced by the Australian Code for the Responsible Conduct of Research, 2007 and these references have also been updated. This document is a guide to institutions and researchers in responsible research practices.
Information regulated by the s95 guidelines
The s95 guidelines apply where medical research involves the use of personal information held by an agency, the processes that are set out in the s95 guidelines must be followed, in order for the information to be lawfully used or disclosed.
3. CONSULATION
Public consultation was not undertaken due to the minor/ machinery nature of the changes which give effect to a legislative change, which has been debated in Parliament.
The NHMRC worked closely with the Office of the Australian Information Commissioner in making the updates to the guideline.
4. LEGAL STATUS OF THE GUIDELINES
The s95 guidelines form part of the legal requirements for compliance with federal legislation, namely the Privacy Act.
The s95 guidelines apply where medical research involves the use of personal information held by an agency, the processes that are set out in the s95 guidelines must be followed, in order for the information to be lawfully used or disclosed.
A breach of the s95 guidelines constitutes an interference with privacy under section 13A of the Privacy Act.
An individual may complain to the Privacy Commissioner about an act or practice they believe has not been done in accordance with the s95 guidelines.
The s95 guidelines take effect from 12 March 2014.
Overview
The Privacy Act 1988, enacted by the Australian Parliament, is designed to protect the privacy of individuals by regulating the collection, use, storage, and disclosure of personal information. In addressing the specific need for privacy protection in medical research, Section 95 of the Privacy Act empowers the National Health and Medical Research Council (NHMRC) to issue guidelines, subject to the Commissioner's approval, for the safeguarding of privacy during medical research activities. These guidelines were updated in March 2014 to align with the Privacy Amendment (Enhancing Privacy Protection) Act 2012, which introduced the Australian Privacy Principles (APPs), replacing the previous Information Privacy Principles. The policy objective is to balance the public interest in promoting significant medical research with the imperative to uphold privacy standards, ensuring that any use or disclosure of personal information in medical research adheres to the APPs. Breaches of these guidelines are considered interferences with privacy under the Act, and individuals have the right to lodge complaints with the Privacy Commissioner.
Scope and Application
The F2014L00245 guidelines, issued under section 95 of the Privacy Act 1988, provide specific directions for the protection of privacy during the conduct of medical research by agencies. These guidelines apply to any agency involved in medical research that utilises personal information, necessitating adherence to the stipulated processes to ensure lawful use and disclosure of such information. The guidelines are issued by the Chief Executive Officer of the National Health and Medical Research Council, contingent upon the Commissioner's approval, and their purpose is to reflect legislative changes, particularly the introduction of the Australian Privacy Principles (APPs) and updates to related ethical and research conduct standards. This Act applies on a Commonwealth level, influencing agencies across Australia involved in medical research. Notably, the guidelines do not extend to instances where the public interest in the research does not outweigh the interest in maintaining adherence to the APPs. Additionally, these guidelines, while forming part of the legal requirements for compliance with federal legislation, are not subject to subordinate instruments that might extend or restrict their application.
Key Provisions
The main operative sections of these guidelines (F2014L00245) pertain to the authority and process for issuing privacy guidelines for medical research under section 95 of the Privacy Act 1988 (Cth) (section 1). Specifically, section 95(1) grants the CEO of the National Health and Medical Research Council (NHMRC) the power, subject to the Commissioner's approval, to issue guidelines aimed at protecting privacy in medical research. This section also stipulates that the Commissioner will only approve these guidelines if they determine that the public interest in promoting the research outweighs the public interest in maintaining adherence to the Information Privacy Principles (IPPs) to a substantial degree (section 95(2)). The guidelines were updated to reflect the legislative changes that introduced the Australian Privacy Principles (APPs) as a replacement for the IPPs, and to incorporate updated references to ethical guidelines in human research and research practice (section 2).
The obligations imposed by these guidelines on the parties involved in medical research are primarily concerned with the lawful use and disclosure of personal information. Where medical research involves the use of personal information held by an agency, the processes outlined in these guidelines must be followed to ensure compliance with the Privacy Act (section 2). This includes adherence to the APPs and updated ethical guidelines, which are integral to the lawful processing of personal information in the context of medical research. The NHMRC and the Office of the Australian Information Commissioner have collaborated closely to ensure these guidelines meet the requirements of the amended Privacy Act.
Breaches of these guidelines constitute an interference with privacy under section 13A of the Privacy Act. Such breaches may result in complaints being lodged with the Privacy Commissioner by individuals who believe that an act or practice has not been conducted in accordance with the guidelines. While the specific penalties for breaches are not detailed within these guidelines, under the Privacy Act, both civil and criminal penalties can apply. Civil penalties for serious or repeated breaches can include substantial fines, while criminal penalties can include imprisonment, reflecting the seriousness of non-compliance with privacy obligations in medical research.
In summary, the guidelines under section 95 of the Privacy Act mandate that the NHMRC, with the Commissioner's approval, issue privacy guidelines for medical research. These guidelines require adherence to the APPs and updated ethical standards when using personal information in medical research. Failure to comply with these guidelines can lead to complaints and potential penalties under the Privacy Act, highlighting the importance of strict adherence to these provisions.