Explanatory Statement
Approval by the Privacy Commissioner of guidelines issued under section 95AA of the Privacy Act 1988
December 2009
- PURPOSE AND AUTHORITY
This explanatory statement fulfils the Privacy Commissioner’s obligations under section 26(1) of the Legislative Instruments Act 2003 (the Legislative Instruments Act).
The instrument approves new binding guidelines about the use and disclosure of an individual’s genetic information to a genetic relative without the individual’s consent.
Section 95AA of the Privacy Act 1988 (Cth) (the Privacy Act) allows the Privacy Commissioner to approve guidelines, that are issued by the National Health and Medical Research Council (NHMRC).
Authority for making the guidelines
Subsections 95AA(1) to (2) of the Privacy Act set out the authority to approve the making of the guidelines. They state:
(1) This section allows the Commissioner to approve for the purposes of the National Privacy Principles (the NPPs) guidelines that are issued by the National Health and Medical Research Council.
(2) For the purposes of subparagraph 2.1(ea)(ii) of the NPPs, the Commissioner may, by legislative instrument, approve guidelines that relate to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety (whether or not the threat is imminent) of an individual who is a genetic relative of the individual to whom the genetic information relates.
Relevant provisions of the Privacy Act 1988
NPP 2.1 prohibits secondary uses or disclosures of personal information unless the individual has consented or a listed exception applies.
NPP 2.1(ea) provides that an organisation may use or disclose personal information about an individual:
if the information is genetic information and the organisation has obtained the genetic information in the course of providing a health service to the individual:
(i) the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety (whether or not the threat is imminent) of an individual who is a genetic relative of the individual to whom the genetic information relates; and
(ii) the use or disclosure is conducted in accordance with guidelines approved by the Commissioner under section 95AA for the purposes of this subparagraph; and
(iii) in the case of disclosure—the recipient of the genetic information is a genetic relative of the individual.
‘Health information’ is defined in Section 6 of the Privacy Act to include:
(d) genetic information about an individual, in a form that is, or could be predictive of the health of the individual or a genetic relative of an individual.[1]
‘Genetic relative’ is defined as follows in Section 6 of the Privacy Act:
genetic relative of an individual (the first individual) means another individual who is related to the first individual by blood, including but not limited to a sibling, a parent or a descendant of the first individual.
2. REASONS FOR MAKING THESE GUIDELINES
Background to the Guidelines
In 2006 the Privacy Act was amended[2] to safeguard the handling of genetic information by changing the definitions of ‘health information’ and ‘sensitive information’ to expressly include genetic information.[3] Genetic information that is not otherwise health information, such as the result of a parentage test, is not treated as health information, but is sensitive information.[4]
The Privacy Legislation Amendment Act 2006 also introduced an additional exception to the general requirement that personal information must not be used or disclosed for any other purpose other than that for which it was collected. NPP 2.1(ea) now allows for the use or disclosure of genetic information to an individual’s genetic relatives, without the individual’s consent, if the organisation reasonably believes that this is necessary to lessen or prevent a serious threat to life, health or safety of the relative.[5] In the case of disclosure, the recipient must be a genetic relative of the individual.
Section 95AA of the Privacy Act allows the Privacy Commissioner to approve guidelines developed and issued by the NHMRC to clarify circumstances in which genetic information may be used or disclosed without consent. Under NPP 2.1(ea)(ii) the use or disclosure of genetic information by a health practitioner without the consent of the patient must comply with these guidelines.
The amendments do not require disclosure of information but provide the framework for this to occur in appropriate circumstances and subject to the guidelines.
Information regulated by the guidelines
Pursuant to subsection 95AA (2) of the Privacy Act, the guidelines apply to ‘genetic information’.
Genetic information is not defined in the Privacy Act. The amendments to the Privacy Act alter the definitions of ‘health information’ and ‘sensitive information’ to include ‘genetic information’, without expressly defining ‘genetic information’.
In its 2003 report, the Australian Law Reform Commission did not apply a definition to ‘genetic information’, suggesting that the context determine whether the use of genetic related information requires any special handling or protection. It notes that genetic information is gained from a range of sources and may confirm a condition that is clinically apparent, or which may be predictive of the likelihood of an individual developing a condition.[6]
Issues considered in approving the guidelines
In approving these guidelines, the Privacy Commissioner has met her statutory obligation to have regard to certain matters set out in section 29 of the Privacy Act. These matters include giving due regard to important social interests that may compete with privacy, as well as the right of Government and business to achieve their objectives in efficient ways.
In particular, the Privacy Commissioner has considered the legislative intent of the Privacy Legislation Amendment Act 2006. The Commissioner also took into account that, in some circumstances, the use or disclosure of genetic information can prevent serious health consequences for genetic relatives by allowing the early detection and treatment of inherited genetic disorders.[7]
3. CONSULATION
The Privacy Commissioner’s approval of the guidelines is subject to the consultation requirements of the Legislative Instruments Act.
In accordance with Section 18(2) of that Act, the Privacy Commissioner is satisfied that an appropriate consultation process has been conducted by the NHMRC.
NHMRC consultation process
To develop the guidelines the NHMRC formed a working group comprising representatives from health services with expertise in genetic issues.
The NHMRC had three separate consultation processes on the draft guidelines:
- targeted consultation – September to October 2007
- public consultation – February to April 2008 (advertised in the Australian and on the NHMRC’s website)
- further targeted consultation – February 2009.
In response to this process, the NHMRC received 51 written submissions from a range of stakeholders, including public sector agencies, academics with expertise in genetics, medical professional associations and privacy and consumer advocacy groups.
The NHMRC also worked closely with the Office of the Privacy Commissioner throughout the process of developing the guidelines.
4. Legal status of the GUIDELINES
The guidelines are legally binding on all private sector organisations that have obtained genetic information in the course of providing a health service.[8]
The guidelines establish when, by whom and in what manner the use or disclosure of genetic information without consent may take place with particular reference to NPP 2.1(ea) obligations. If the statutory requirements are satisfied, use or disclosure to genetic relatives is only permitted in accordance with these guidelines.
A breach of the guidelines constitutes an interference with privacy under section 13A of the Privacy Act because the act or practice would breach NPP 2.1(ea). An individual may complain to the Privacy Commissioner about an act or practice they believe has not been done in accordance with NPP 2.1 (ea) or the guidelines.
In addition to setting out binding legal requirements, the guidelines provide general advice on good practice to assist health practitioners to meet their obligations under NPP 2.1(ea) and the guidelines.
The guidelines will take effect from 15 December 2009.
[1] The full text of the definition of ‘health information’ is available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF
[2] The Act was amended to give effect to the Australian Government’s decision to implement some of the recommendations of the Australian Law Reform Commission (ALRC) and the Australian Health Ethics Committee (AHEC) in their report Essentially Yours: the Protection of Human Genetic Information in Australia. Report available at: http://www.austlii.edu.au/au/other/alrc/publications/reports/96/
[3] Privacy Legislation Amendment Act 2006, available at: http://www.comlaw.gov.au/ComLaw/Legislation/Act1.nsf/framelodgmentattachments/AEF21969839237FDCA2571ED0013C974
[4] Section 6 of the Privacy Act defines ‘sensitive information’ so as to include all health information about an individual. The definition of sensitive information is available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF
[5] The ALRC and AHEC Inquiry concluded that there was a need to amend the Privacy Act to broaden the circumstances in which health professionals may use or disclose genetic information without consent. The Inquiry considered that the requirement of NPP 2.1(e)(i) that a threat be ‘serious and imminent’ is too restrictive in the context of genetic information, given that most genetic conditions will take time to manifest. See Essentially Yours: the Protection of Human Genetic Information in Australia, chapter 21, available at: http://www.austlii.edu.au/au/other/alrc/publications/reports/96/
[6] Essentially Yours: the Protection of Human Genetic Information in Australia, chapter , chapter 3, available at: http://www.austlii.edu.au/au/other/alrc/publications/reports/96/3_Coming_to_Terms_with_Genetic_Information.doc.html#heading1
[7] Ibid, p4.
[8] Health service’ is defined in Section 6 of the Privacy Act, Available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF