Privacy Act 1988 (Part VI) - Public Interest Determination No. 9 - Legislation

PRIVACY ACT 1988 (PART VI)
PUBLIC INTEREST DETERMINATIONS 9 AND 9A
Explanatory Front Sheet

Background information on Public Interest Determinations

Public Interest Determinations (PIDs) enable the Privacy Commissioner to reduce the privacy protections of any one or more of the National Privacy Principles (NPPs). However, in order to issue a PID, the Privacy Commissioner must be satisfied of two matters: first, that an act or practice of an organisation breaches or may breach a NPP or a privacy code (a Code); and second, that the act or practice should nevertheless be allowed to continue, because the public interest in its continuation substantially outweighs the public interest in adhering to the NPP or Code. The Privacy Commissioner can issue a PID in response to an organisation's application, and can also choose to make a further PID expanding the effect of the original applicant's PID to organisations generally.

The effect of Public Interest Determinations 9 and 9A

The combined effect of PIDs 9 and 9A is, in effect, to exempt providers of health services l in certain circumstances from complying with NPP 10.1. In summary, under PIDs 9 and 9A, a health service provider may collect health information from a health consumer about a third party without the consent of the third party when both of the following circumstances are met:

 the collection of the third party's information into a consumer's social, family or medical history is necessary for ACHA Health to provide a health service directly to the consumer; and

 the third party's information is relevant to the family, social or medical history of that consumer.

PIDs 9 and 9A do not reduce all of the privacy protections contained in the NPPs

PIDs 9 and 9A do not represent an exemption from all of the NPPs. NPPs 1 to 9 and NPPs 10.2 to 10.3 continue to apply to the handling of this type of information by organisations providing a health service. NPP 10.1 also continues to apply in all circumstances outside those covered by the PIDs. In addition, health service providers that collect third party information into social, family or medical histories will need to comply with the protections afforded under NPP 2.1(a), including that health service providers should ensure that a third party would reasonably expect any proposed uses or disclosures of their information.

The Commissioner has issued PIDs 9 and 9A for a period of 5 years, with a review of the Determinations to take place at 5 years from the effect of the Determinations, or sooner, if the Commissioner becomes aware of a matter incidental to or effecting the performance or operation of the Determinations.

For further information, talk to your peak health provider association or consumer association, or contact our Hotline on 1300 363 992, TTY 1800 620 241 (dedicated for people who are hearing impaired) or by email at privacy@privacy.gov.au.

1 Section 6 of the Privacy Act defines `health service' as an activity performed in relation to an individual:

 to assess, record, maintain or improve the individual's health; or

 to diagnose the individual's illness or disability; or

 to treat the individual's illness or disability or suspected illness or disability; or

 the dispensing of a prescription drug or medicinal preparation by a pharmacist.

The Privacy Act applies to all private sector organisations that deliver these types of services, including all small health services that hold health information. The types of health services covered include traditional health service providers such as private hospitals and day surgeries, medical practitioners, pharmacists, and allied health professionals such as counsellors, as well as complementary therapists, gyms, weight loss clinics and many others.

EXPLANATORY STATEMENT
Privacy Act 1988, Part VI
in regard to
Public Interest Determination No. 9
and
Public Interest Determination No. 9A (Determination Under
Section 72(4) Giving General Effect To
Public Interest Determination 9)

Contents

Explanation
Authority for making these determinations
Reason for making determinations
Likely impact of these determinations
Unusual aspects calling for special comment
Fees
Consultation

Note: This explanatory statement has been drafted to assist the Senate Standing
Committee on Regulations and Ordinances. Section 79(3) of the Privacy Act requires
that each public interest determination include a statement of reasons. This
explanatory statement includes much of the material from the `Statement of Reasons'
section of Public Interest Determination No. 9.

1. Explanation Background

On 21 December 2001 the Privacy Amendment (Private Sector) Act 2000 commenced, extending the Privacy Act 1988 (Privacy Act) to the private sector through the operation of 10 National Privacy Principles (NPPs). The NPPs govern the collection, use, disclosure and other handling of personal information.

Under the Privacy Act (including the private sector provisions), Public Interest Determinations (Determinations) can be issued by the Privacy Commissioner, enabling the Commissioner to reduce the privacy protections in any one or more of the National Privacy Principles (NPPs). However, in order to issue a Determination, the Privacy Commissioner must be satisfied of two matters: firstly, that an activity of an organisation breaches or may breach a NPP or a privacy code (a Code); and secondly, that the activity should nevertheless be allowed to continue, as the public interest in its continuation substantially outweighs the public interest in adhering to the NPP or Code. The Privacy Commissioner can issue a Determination in response to an organisation's application, and can also chose to make a further Determination expanding the effect of the original applicant's Determination to organisations generally.

Social, family or medical histories

The new provisions of the Privacy Act cover all health service providers in the private sector, including medical practices and private hospitals. During consultation with the health sector during 2001, it was brought to the attention of the Office of the Federal Privacy Commissioner that the National Privacy Principles may impede the accepted practice by health service providers of collecting social, family or medical histories.

2. Authority for making these determinations

Determinations responding to an application by an organisation

Under section 72(2) of the Privacy Act, the Privacy Commissioner is, as stated above, empowered to issue a determination where he or she is satisfied that (i) an act or practice of an organisation breaches or may breach a NPP or an approved privacy code (Code), and (ii) the public interest in the agency doing the act or engaging in the practice substantially outweighs the public interest in adhering to that NPP or Code. Under section 72(3) of the Privacy Act, the effect of such a determination is that the act or practice of the organisation will be disregarded for the purpose of section 16A of the Privacy Act. That is, the act or practice will not be regarded as an act or practice that breaches a NPP.

Giving general effect to a determination

In addition, section 72(4) of the Privacy Act provides:

The Commissioner may make a written determination that no organisation is taken to contravene section 16A if, while that determination is in force, an organisation does an act, or engages in a practice, that is the subject of a determination under subsection (2) in relation to that organisation or any other organisation.

Disallowable instrument

Under section 80 of the Privacy Act, a Determination is to be treated as a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901. Subject to section 80(2)(b) of the Privacy Act, the Determination shall take effect on the first day on which the determination is no longer liable to be disallowed.

3. Reason for making the determinations

The Application

On 19 December 2001, ACHA Health applied to the Privacy Commissioner under section 73 of the Privacy Act 1988 (the Privacy Act) for a Determination under section 72 of the Privacy Act. ACHA Health is a not-for-profit private hospital operator located in Adelaide, South Australia.

ACHA Health has requested a Determination to enable the continuation of a practice that breaches or may breach National Privacy Principles (NPP) 10.1 and 1.5. The practice concerns the collection of third party `sensitive information', (including `personal information' and `health information'), in the context of the collection of social, family or medical histories from health consumers "across all clinical settings" and by "all clinicians".

ACHA Health submits that the practice of the collection of family, social or medical history information of a health consumer is a critical part of the treatment and diagnosis regime of consumers. ACHA Health also submits that obtaining the consent of third parties to collect their information, and notifying third parties of the collection of their information, in this context is clearly impractical and could compromise the health care of consumers. ACHA Health also submits that the public interest is served by the efficient and accurate diagnosis of consumers by clinicians. Once the information is collected, ACHA Health asserts that clinicians will treat collected personal information confidentially and the use and disclosure of health consumer and third party information would only occur for purposes relevant to the treatment of the consumer.

On 21 December 2001, in response to ACHA Health's application, the Privacy Commissioner issued two temporary Determinations on an urgent basis: Temporary Public Interest Determination No. 2001-1 and Determination under s. 80B(3) of the Privacy Act giving general effect to Temporary Public Interest Determination No. 2001-1. The temporary Determinations successfully passed the parliamentary period for disallowable instruments without comment and are effective from 21 December 2001 (the commencement date of the Privacy Amendment (Private Sector) Act 2000) to 20 December 2002.

Public Interest Determination No. 9

Public Interest Determination No. 9 is issued in response to ACHA Health's application of 19 December 2001. The details of that application, the process of consultation, findings, and relevant statutory provisions are set out in the Statement of Reasons attached to PID 9. Those Statement of Reasons also includes the Privacy Commissioner's consideration of matters relevant to section 72(2) (that is, that an activity of an organisation breaches or may breach a NPP or a privacy code (a Code) and, that the activity should nevertheless be allowed to continue, as the public interest in its continuation substantially outweighs the public interest in adhering to the NPP or Code).

Public Interest Determination No. 9A

PID 9A is issued to give general effect in relation to PID 9 to health services generally. In addition to applying for a Determination for itself, ACHA Health referred to the importance of a Determination applying to health service providers and health services generally. Further, a range of submitters argued that it is in the public interest that all providers of health services should be able to collect third party information without consent in the circumstances identified. The submissions noted that it is in the consumer's best interests – that is, to enable a more accurate health assessment. If the information is not collected, it is further submitted, correct and accurate diagnoses and health outcomes will be compromised. The submissions argue that the benefits to health care, and to the public, outweigh any disadvantages to third party individuals.

In Public Interest Determination No. 9, I determined that the public interest in continuing the activity of collecting third party information into the consumer's medical, social or family history, where it is necessary to provide a health service directly to a consumer, substantially outweighs the interest in adhering to NPP 10.1 in those circumstances.

For the above reasons, and the reasons set out in detail in the Statement of Reasons attached to PID 9, I am of the view that, under section 72(4) of the Privacy Act, PID 9 should be given general effect to apply to all health service providers.

Public Interest Considerations

This information is set out in the Statement of Reasons following PID 9, in the sections headed "Breach of a National Privacy Principle" and "Public Interest". The Privacy Commissioner's reasoning is reproduced here:

"Breach of a National Privacy Principle

National Privacy Principle 10.1

The proposed collection of information, as set out in ACHA's application, involves the collection by ACHA Health from consumers of third party information (sensitive information) that is necessary to obtain the family, social or medical history of the consumer during the provision of a health service.

I am of the view that the proposed collection may breach NPP 10.1, where such collection does not come within the limited exceptions outlined in NPPs 10.1 to 10.3. Accordingly, I am satisfied for the purposes of section 72(2)(a) of the Act that the act or practice in question breaches, or may breach, NPP 10.1.

National Privacy Principle 1.5

In addition to comments regarding NPP 10.1, ACHA Health's application refers to the collection of family, social or medical history information in the context of providing a health service without notifying the third party of the collection of the information, as is required under NPP 1.5. NPP 1.5 provides that an organisation must, when collecting personal information about an individual (third party), `take reasonable steps to ensure' that the third party is aware of the items set out under NPP 1.3, namely:

a) the identity of the organisation and how to contact it; and

b) the fact that he or she is able to gain access to the information; and

c) the purposes for which the information is collected; and

d) the organisations (or types of organisations) to which the organisation usually discloses information of that kind; and

e) any law that requires the particular information to be collected; and

f) the main consequences (if any) for the individual if all or part of the information is not provided.

Therefore, in most circumstances organisations collecting personal information from an individual about a third party need to take steps to inform the third party about the NPP 1.3 items. As a general guide, the greater the privacy implications for the third party, the prejudice to the third party's interests, or the sensitivity of the information, the more reasonable it is for organisations to take steps to satisfy NPP 1.5. However, deciding what steps are reasonable in particular types of situations involve making a judgment based on the situation as a whole and balancing a number of possible factors, including:

 a third party's expectations and existing knowledge about the collection of the information;

 the practicalities of providing notice to the third party;

 conflicting legal obligations, such as legal professional privilege and obligations of confidentiality on the organisation; and

 the costs of providing notice to a third party.

The Privacy Commissioner is of the view that it may not be necessary to take steps to make people aware of the NPP 1.3 items where they are already aware of them, where there are no steps that are reasonable in the circumstances or where, in the overall context in which the information is collected, steps could be taken but it is unreasonable to do so. "No steps that are reasonable in the circumstances" means that there are no steps that could reasonably be taken — that is, because of cost or difficulty in contacting a third party. On the other hand "steps could be taken but it is unreasonable to do so" acknowledges that there are some steps that might be reasonable to take but for other factors besides the reasonableness of the steps themselves, for example the fact that the steps if taken would undermine the purpose of collection. There are circumstances in relation to the collection of family, social and medical histories where both of these circumstances might apply.

During the consultation process on the draft Determinations, ACHA Health and a number of submitters have referred to the difficulties involved in notifying third parties of the collection of family, social and medical histories. These difficulties are similar to the difficulties relating to the obtaining consent for the collection of personal or health information from a health consumer about a third party. They are set out in detail under the heading "Public Interest" (below). However, for the purposes of this issue, the difficulties, in summary, relate to the fact that notifying a third party under NPP 1.5 in the circumstances set out under the Determinations would be onerous, time consuming, costly, and often impracticable. In addition, notifying a third party could diminish the health consumer's confidentiality and could deter consumers from providing information when seeking health care.

In light of the above considerations, Determination No. 9 does not include reference to NPP 1.5. This approach in Determination No. 9 represents a departure from the terms set out in the temporary Determinations. In the period since the commencement of the Privacy Amendment (Private Sector) Act 2000, the OFPC has considered the application of NPP 1.5 in particular situations, including in the health sector. The OFPC is of the view that in some circumstances, it may be reasonable to take few steps, or to take no steps to notify a third party of the collection of their personal or health information. In the normal course of events, when a health service provider collects third party information for inclusion in a consumer's medical, social or family history, it will be reasonable for the provider to take no steps (under NPP 1.5) to notify the third party of the collection, in particular where the community generally is aware of such collections, and health services (for example, through appropriate education for the community) seek to ensure that the public is aware of the need for these collections.

Public Interest

During the consultation process, the reasons for support of ACHA Health's application and the draft Determinations varied, but the main areas of support focused on the importance of obtaining health consumer social, family or medical histories in providing continued quality diagnosis and treatment services and health care. The submissions in support also often noted the impracticalities, inefficiencies and

detriment to provision of quality health care if there was a requirement to obtain the consent of third parties. The comments made by ACHA Health and the submitters are set out in detail below, along with my considerations regarding the public interest test set out in section 72(2)(ii) of the Privacy Act.

The nature of the public interest objectives served by the proposed interference with privacy

ACHA Health's application, and the written submissions received about the application and the draft Determinations, asserted that the collection of a health consumer's social, family or medical history information (including information about third parties) is essential and integral to comprehensive, continuing and quality medical (clinical and therapeutic) diagnosis, assessment, treatment or care, including medical examination across all crafts of medicine and involving information about third parties that are first and second degree relatives and non-genetically related people such as spouses, work colleagues and sexual partners.

The written submissions emphasised that medical, family or social history taking is important across the full range of providers of health services and should apply to all health or medical settings. Submissions gave examples of the extent of care cases in which this practice is critical: it is important in providing counselling on foetal health care; it is integral to a daily part of nursing care; it is frequently central to the provision of effective psychological services; it is necessary for treating and advising health consumers who are receiving dietary care and developing effective diet management plans; it can provide knowledge of inherited genetic conditions particularly autosomal or recessive conditions; and it can enable rapid and more accurate diagnosis, assessment and treatment for the consumer and following generations.

The written submissions noted that, for the above reasons, it is in the public interest that providers of health services are able to collect third party information without consent. The submissions noted that it is in the consumer's best interests – that is, to enable a more accurate health assessment. If the information is not collected, it is further submitted, correct and accurate diagnoses and health outcomes will be compromised. The submissions argue that the benefits to healthcare and the public outweigh any disadvantages to third party individuals.

The extent to which the proposed act or practice is inconsistent with an individual's reasonable expectation of privacy

Where ACHA Health is able to collect information as proposed in their application, relevant third parties will not have the opportunity to give or withhold consent to the collection of their sensitive information (including personal or health information), as is required under NPP 10.1. In support of its application, ACHA Health has submitted evidence of the training that health service professionals receive in relation to the process of taking of a health consumer's social, family or medical history. That process routinely includes collecting information about individuals other than the consumer in order to assess and accurately diagnose the consumer's condition.

Submissions also referred to the fact that standards for the accreditation of Australian general practitioners include the collection of current and accurate health summaries, including pertinent medical or social history information for consumer care.

Submissions noted that this is a long held practice and important to good clinical care, which should not be impeded by the application of the NPPs. Significantly, a State health complaints body noted that it receives complaints based on the failure by providers of health services to incorporate family history information in the diagnosis of a consumer.

The potential for the proposed act or practice to harm the interests of individuals

The ACHA application and the written submissions noted the following:

 that this information is collected in an environment of maximum consumer privacy (including professional codes about privacy and confidentiality) and staff are trained to appreciate the confidentiality and sensitivity of such data;

 clinicians treat personal information collected in the course of providing a health service confidentially, regardless of the person to whom the particular facts and opinions relate;

 use and disclosure of health consumer information and family, social or medical information clearly relates to the treatment of the consumer;

 a doctor will not treat this information as fact, but as hearsay, and will use the information to form an opinion; and

 the application does not seek to dilute the concept of information belonging to individual family members, but to ensure that a lack of consent does not prevent family, medical or social history information about a health consumer being collected when necessary for provision of a health service.

The need to balance the competing interests contained in section 29 of the Privacy Act and the impact on the public interest if the proposed act or practice is not permitted Under section 29 of the Privacy Act, the Privacy Commissioner must, amongst other matters:

(a)have due regard for the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information (through the media and otherwise) and the recognition of the right of government and business to achieve their objectives in an efficient way;....

The ACHA Health application and the submissions noted:

 if the consents of the relevant third parties were sought this would be onerous, time consuming, costly, often impracticable and probably not usually given by the relevant third party;

 that obtaining consent could diminish the health consumer's confidentiality and could deter consumers from providing information when seeking health care. That is, if organisations providing health services were required to obtain the consent of third parties to collect their information, the sensitive, health and personal information of the consumer (for example, their health service details and type of health service they are receiving) may be inadvertently disclosed during the consent process with the third party;

 if health consumer history information is not sought, the end result could be increased investigation and litigation in relation to medical negligence claims;

 if the consent of third parties was required, the consumer could suffer potential adverse health effects while waiting for consent to be obtained;

 that the collection of health consumer history information is in the public interest and in the consumer's best interest as it can assist in obtaining a correct and accurate diagnosis and health outcome.

The views of the submitters set out in written submissions that did not support ACHA Health 's application

Some submitters argued that clinicians could obtain a third party's whole medical history and the collection, use and disclosure of that information would be beyond the control of the third party. Submitters also argued the third party information collected could be accessed from a data base by other health professionals and would affect other areas of that person's life, such as life insurance and bank loan application.

The views expressed in these submissions are important to consider, because the interests of third parties are important, and the purpose of this Determination is not to diminish those interests. However, in receipt of an application for a public interest determination, I am required to consider whether the public interest in adhering to a privacy principle is substantially outweighed by the interest in allowing an activity or practice to continue that may breach or breaches the NPPs. The nature of the public interest objectives to be served by the proposed interference with privacy (that is, continuing, comprehensive and quality health care for consumers and better public health outcomes), the long held and health industry wide practice of collecting consumer family, social and medical histories for good health care and treatment, the need to balance the competing interests of a health consumer's privacy, and the need for efficient and effective running of health care services, satisfies me that the public interest in allowing this activity to continue substantially outweighs the adherence to NPP 10.1.

Further, the privacy protection standards in NPPs 1 to 9 and 10.2 to 10.3 remain effective, to protect the third party's information once collected. In particular, NPPs 1.1 and 1.2 ensure that information that is collected should be confined to that necessary to an organisation's functions or activities and be collected by lawful and fair means only, and in a way that is not intrusive. In addition, NPP 2 provides protection for the use and disclosure of the sensitive information (and indeed all other personal information) collected under the Determinations. Under NPP 2, sensitive information collected may generally only be used or disclosed for the primary purpose of providing a health service directly to an individual. More particularly, under NPP2.1(a) for example, sensitive information may be used or disclosed only for a directly related secondary purpose within the reasonable expectations of the person to whom the information relates, or in a limited number of other circumstances as set out in paragraphs 2.1(b) and 2.1(d) to 2.1(h). The remaining NPPs overall appear to provide adequately for the protection of information that may be collected under the Determinations.

One submitter argued that a legislative amendment may provide a better and more durable solution — as it may be possible to specify to whom the practice applies and include recognition of the common law duty of confidentiality. The Privacy Act regulatory framework enables the Privacy Commissioner to issue Determinations and reduce the privacy protection standards in the NPPs where he or she is satisfied that an activity or practice may breach or breaches an NPP and a public interest test is met under section 72 of the Privacy Act. In Determinations the Privacy Commissioner can specify to which organisations the practice applies and Determinations can be issued for any period as decided by the Commissioner, having regard to submissions received. In addition, the high level NPPs in the Privacy Act operate to complement

the common law duty of confidentiality, and professional and ethical obligations related to the provision of health care. The development of a Determination under the Privacy Act requires the completion of a number of processes around developing an application and a draft document, and the consultation on the draft document. Determinations are tabled in parliament as disallowable instruments. In summary, Determinations are instruments of law and as such meet the tests brought out by this submitter.

Substantive matters raised at the Conference on the draft Determinations

1. Broadening the Determinations to permit collection for the provision of health services generally

Two submitters, in their written submissions and during the Conference on the draft Determinations, argued that the Determinations should be broadened to permit the collection of family, medical or social history-related health information for the provision of medical services generally, including for the production of medical assessments and medico-legal reports by health service providers, and to permit

the use and disclosure of such information for the production of reports for legal and insurance purposes.

The effect of such an approach would be to enable organisations that provide health care services — that is, to treat and care for health consumers — to collect third party information related to a health consumer's medical, social or family history in order to provide any health service offered. These submitters argued:

 there is no valid argument against a health service provider collecting third party social and medical history information where it is for the purpose of providing a medical assessment for a medico legal report;

 health consumers often require health service providers to provide medico legal assessments and medico legal reports for insurance purposes (for example, travel, disability, life cover), employment purposes, superannuation purposes and licence purposes (for example, pilot and driver's licences);

 the potential harm arising from the collection of social and medical history information about third parties for the purpose of preparing medical assessments is no different from any harm that might arise in collection of material in the course of providing a health service;

 medical and social history taking for assessment reports is central to the accuracy of medical assessments which are prepared to assist third party organisations to make decisions that impact upon the safety of the individual or members of the public;

 the practice of health services taking third party social and medical histories is reasonably expected by third parties who interrelate with the patients, whether or not the information is collected for diagnosis, treatment, care or for a medical assessment report;

 health service providers should not be unreasonably curtailed in their work, nor exposed to legal liability from the inability to provide accurate and thorough work;

 industrial and financial harm to individuals and third parties can result if health services are not able to provide reports to the best of their professional ability.

National peak associations and organisations related to health consumers, privacy advocates, public law advocates and health service providers were asked to consider this proposal as part of the Conference on the draft Determinations. No opposition to this submission was raised by any parties attending or invited to attend the Conference.

It is important that health consumers are not prevented from obtaining quality, comprehensive and continuing health care from their health care providers in all the services provided. It is also important to recognise that, as stated above, under the draft Determination, the remainder of the NPPs continue to provide protection for the handling of the information collected. In particular, NPP 2 provides protection for the use and disclosure of the sensitive information (and indeed all other personal information) collected under the Determinations.

Under NPP 2, sensitive information collected may generally only be used or disclosed for the primary purpose of providing a health service directly to an individual. In addition, under NPP2.1(a), sensitive information may be used or disclosed only for a directly related secondary purpose within the reasonable expectations of the person to whom the information relates, or in a limited number of other circumstances as set out in paragraphs 2.1(b) and 2.1(d) to 2.1(h). Given that some health services may seek to disclose under NPP 2.1(a), health service providers will be in a better position to assume such activities are within the reasonable expectations of a third party, if there has been appropriate community education about the activities. This would likely have the added secondary effect of meeting the intent of NPP 1.5

The effect of the broadening of the draft Determinations is that it does provide for any performer of a "health service" as defined under section 6 of the Privacy Act to collect family, medical and social histories regarding the provision of any kind of "health service" activity. Should a particular kind of service or activity arise where third party information is allegedly inappropriately collected under the broader Determinations, then this may trigger a review of the instruments earlier than the proposed review of the Determinations. I have determined that a review of the Determinations should be held, in any event, 5 years from their date of effect.

2. Genetic issues

During the consultation process, several submissions raised issues related to the

collection of genetic information under the draft Determinations. The issues included:

 health care test information indicating the genetic markers of an individual should be treated differently to genetic information provided by patients as hearsay information of family members and others. Whilst it was submitted that genetic information provided as hearsay should continue to be collected as part of the history of the consumer, it was also submitted that the handling of genetic test information (being information derived from a test to a biological sample) should be protected more highly and further considered through public/community debate with appropriate protocols adopted;

 the draft Determinations should prohibit the collection of genetic information about consumers by way of genetic samples taken from third parties; and

 it is important to clarify whether genetic information is (for the purposes of the Determinations) to be treated only as the personal information of the person seeking treatment, and who provided the biological sample, if any.

This is because genetic information can be regarded as information about

the individual, but also about others who are biologically related. If this is not clarified, biological others may seek access and correction rights to the consumer's information. It was further submitted that this should not be allowed under the Determinations, and the consent of the consumer must be required.

In relation to the first dot point above, whilst there is a distinction under the Privacy Act between the privacy protection standards based on whether the information is `personal information', `sensitive information' and `health information', there is no distinction under the Act based on the factual or hearsay nature of information. The definition of `health information' under the Privacy Act clearly includes genetic information, including the predictive characteristics of genetic information. Instead of having a separate piece of legislation, or a separate section of the Act, which applies to health information or genetic information, the current legislation allows for a consistent approach to privacy regulation across the three categories of information.

On the basis that the information (both test information and information based on hearsay) is equally protected under the Privacy Act, it is difficult to sustain an artificial distinction under the Privacy Act between information related to genetics and non-genetic information beyond the various tests of "reasonableness" and how they might apply in different circumstances. In addition, and having regard to the comments above regarding the adequate protection of information once collected under the Determination, I am persuaded that there is no requirement at this stage to force a distinction between types of health information, that is between health information and genetic information, and provide further protection for genetic test information under this Determination.

In relation to the second dot point above, the Australian Law Reform Commission and the Australian Health Ethics Committee in the Joint Inquiry into the Protection of Human Genetic Information (the Joint Inquiry into Genetic Information) are currently considering this issue in some detail. In the mean time, the fundamental premise of the Privacy Act is to protect the informational privacy of individuals, including personal information derived from genetic samples and genetic testing. The Privacy Act should provide sufficient protection of this information.

The third dot point above relates to the proposal that the unique characteristics of genetic information may raise additional privacy risks. Put simply, the claimed risks are that genetic relatives may seek access to a consumer's health information, because this can also be regarded as information about those relatives – if so, how is such access controlled, and how are the claimed access rights of those relatives weighed against the privacy of the consumer? This matter is already provided for within the Privacy Act, under NPP 6.1(c), which states that a request for access may be denied where:

Hence, the health consumer's information would generally be protected in these circumstances, because where giving access to the information by a genetic relative

would unreasonably affect the privacy of the consumer, then reliance could be had upon NPP 6.1(c) to deny the access request. The question of whether a health service should grant a request by a genetic relative for access to the genetic information is a matter of judgement for the service provider in the usual context of the professional obligation of patient confidentiality, and related professional training and guidance.

3. Counsellors and complementary therapists

One submitter argued that the extent to which the acts and practices of

complementary therapists and counsellors are covered by the Determinations should be clarified and counsellors, in particular, need to be specifically included. As stated above, the Determinations refer to "health services", which are defined in section 6 of the Privacy Act. "Health service" is broadly defined in the Act to include any activity that involves:

 assessing, recording, maintaining or improving a person's health; or

 diagnosing or treating a person's illness or disability; or

 dispensing a prescription drug or medicinal preparation by a pharmacist.

The Privacy Act applies to all private sector organisations that deliver these types of services, including all small health services that hold health information. The types of health services covered include traditional health service providers such as private hospitals and day surgeries, medical practitioners, pharmacists, and allied health professionals, as well as complementary therapists andcounsellors.

The Determinations currently refer to "health services". By virtue of the use of those words, the Determinations aptly describes and includes counsellor and complementary therapists as the type of services that are covered by the Determinations.

In relation to the above matters, I am satisfied that the public interest in allowing ACHA Health to collect the information in question in the circumstances set out in this Determination substantially outweighs the public interest in adhering to NPP 10.1, for the following reasons:

(a) the central public interest objective being served by this Determination is that of the provision of quality health services to health consumers, and ultimately, safeguarding public health. On the basis of the evidence presented, I am satisfied that social, family or medical history taking, including in counselling and therapeutic settings, is central to good health care and services;

(b) public health would be jeopardised by strict compliance with NPP 10.1 in this regard;

(d) to require ACHA Health to adhere to NPP 10.1 in this environment would be an unrealistic curtailment on their core and essential practices;

(e) the Determination modifies the privacy protection standard set out in NPP 10.1 — the effect being that the consent of a third party in not required in the circumstances set out under the Determination. However, the remaining privacy protection standards set out in NPPs 1 to 9 and 10.2 to 10.3 continue to apply and provide protection for third parties, including for the handling of their sensitive information when collected under this Determination."

4. Likely impact and effect of these determinations

These determinations will have the effect of allowing the continuation of the accepted practice of collecting social, family or medical histories. This will allay concerns that the Privacy Amendment (Private Sector) Act 2000 may have a detrimental effect on health care.

5. Unusual aspects calling for special comment

Not applicable

6. Fees

No fees are imposed or changed as a result of these determinations.

7. Consultation

As referred to above, on 21 December 2001 the Privacy Commissioner issued two temporary Determinations in order to deal urgently with ACHA Health's application. The temporary Determinations formed the basis of the words for the draft Determinations issued for community consultation, in accordance with section 75(1) of the Privacy Act.

Notice of receipt of ACHA Health's application

In June 2002, the Privacy Commissioner published a notice of receipt of ACHA Health's application for a Determination ("Notice of Receipt"), as required under section 74(1) of the Privacy Act. The Notice of Receipt included information on the temporary Determinations, a request for written submissions on ACHA Health's application, and notice of an intention to invite the applicant, and others the Commissioner considered appropriate, to indicate whether they wished to hold a conference on the draft Determinations. Information regarding ACHA Health's application, the temporary Determinations, and the Privacy Commissioner's exposure draft of the revised "Guidelines on Public Interest Determinations" were made available on the OFPC website and in hard copy on request.

The Notice of Receipt was published in "The Weekend Australian" on 22-23 June 2002, on the Office of the Federal Privacy Commissioner (OFPC) website on 20 June 2002 and in a special notice in the "Commonwealth Gazette" on 21 June 2002. A media release was issued and directed to national television, radio and press (general and health specialist) organisations on 21 June 2002. In addition, a letter was sent to 300 stakeholder organisations in the week of 20 to 27 June 2002 and emails were sent to Federal agency Privacy Contact Officers and 1600 members of the OFPC Privacy Connections Network on 21 June 2002.

Written submissions received in response to the Notice of Receipt

Following the call for submissions, 61 written submissions were received. 49 of the submitters indicated support for ACHA Health's application and the need for a PID in corresponding terms. 5 submitters indicated they either did not support the application, or did not support the issue of a PID. Of the 7 remaining submitters, their comments indicated either they were not directly concerned with the taking of health consumer histories under the NPPs, or they had no comments to add. One State agency provided a copy of regulations previously issued in this area. A list of the

written submissions received in response to the Notice of Receipt appears at Appendix A.

The conference on the draft Determinations

A number of organisations commented in written submissions (including in the written submission of ACHA Health) that they would be interested in attending a conference on the Determinations, "if one is held". As required under sections 75(2A) (a) and (b) of the Privacy Act, on 15 August 2002, the Privacy Commissioner invited the applicant and 11 other organisations to indicate whether they wished the Commissioner to hold a conference on the draft Determinations. The organisations invited were considered appropriate to provide a broad range of views and comments, reflective of the breadth of stakeholder interest in this issue in the private health sector. A list of the organisations invited to the Conference appears at Appendix B.

In response to the Commissioner's invitations, on 22 August 2002, the Strategic Planning Group for Private Psychiatric Services (SPGPPS) requested the Commissioner hold a conference on the draft Determinations. Subsequent to SPGPPS's request, and as required under section 76(1) of the Privacy Act, on 30 August 2002 a Conference was held. The organisations that attended the conference and the details of the Conference appear at Appendix C.

The Commissioner's invitations of 15 August 2002, and an issues paper of 23 August 2002 to those organisations invited, set out some major issues to be considered at a Conference on the Determinations. Organisations were also invited to raise any other relevant matters.

Appendix A — written submissions

Committee of Presidents of Medical Colleges
Public Health Association of Australia
Royal Australian College of Surgeons
The Cancer Council of Australia
Royal Australian College of General Practitioners
Royal Australian College of Physicians
Royal College of Nursing Australia
Australian Dental Association
The Pharmacy Guild of Australia
Australian Private Hospitals Association
Royal College of Pathologists of Australia
Australian Psychological Society
Strategic Planning Group for Private Psychiatric Services
Australian Medical Association
Catholic Welfare Association
Australian Nursing Council
Dieticians Association of Australia
Australian Nursing Federation
Royal Australian and NZ College of Psychiatrists
Australasian College for Emergency Medicine
Association for the Blind of WA
Southern Tasmanian Division of General Practice (professional comments)

23. Southern Tasmanian Division of General Practice (consumer comments)

24. General Practice Division of WA Ltd

25. Aged and Community Services Association of NSW and ACT Inc

26. Private Hospital Association of Qld

27. Health Care Complaints Commission of NSW

28. Disability Council of NSW.

29. ACHA Health

30. Genetic Health Services Victoria

31. Uniting HealthCare

32. United Medical Protection

33. Australian Red Cross Blood Services

34. St John of God Health Care Inc

35. South Australian Clinical Genetic Services, SA Women's Hospital.

36. Australian Privacy Foundation

37. Public Interest Advocacy Centre

38. NSW Guardianship Tribunal

39. Health Rights Commission Qld

40. University of Sydney School of Public Health

41. Department of Health and Human Services, Tasmania

42. Australian Institute of Aboriginal and Torres St Islander Studies

43. Guardianship and Administration Tribunal Qld

44. Qld Health

45. Health West (WA)

46. Health Department of Qld

47. Health Department of WA

48. Defence Personnel

49. Gold Coast District Health Service.

50. Michael J Fagan from Accenture

51. Robin J Cheyne (note that in addition, Ms Cheyne's general text informing individuals by email of ACHA Health's Application for the Determination was forwarded by another individual, Mr B.Ferguson — Mr Ferguson made no

comments.)

52. Commonwealth Ombudsman

53. Jan Whitaker — JL Whitaker and Associates

54. Privacy NSW

55. ATO

56. Office of Health Review WA

57. Department of Education, Science and Training

58. Centrelink

59. Australian Federal Police

60. ChildSupport

61. Department of Health Services Victoria

Appendix B — organisations invited to notify if they wish to hold a Conference on
the draft Determinations

 ACHA Health (the Applicant);

 Australian Privacy Foundation;

 Australian Private Hospitals Association;

 Australian Medical Association;

 Strategic Planning Group for Private Psychiatric Services;

 Consumer Health Forum;

 Privacy NSW;

 Catholic Welfare Australia;

 Public Interest Advocacy Centre;

 Australian Nursing Federation;

 Australian Dental Association;

 Human Genetics Society of Australia.

Appendix C — Conference attendees and details of Conference

The following organisations attended the Conference:

 Australian Nursing Federation;

 Consumer Health Forum;

 Catholic Welfare Australia;

 Privacy NSW;

 Australian Private Hospitals Association Limited;

 Strategic Planning Group for Private Psychiatric Services.

The Australian Privacy Foundation also provided a written submission in lieu of their attendance at the Conference.

Conference details:

The conference took place on 30 August 2002 in Canberra. The Conference process consisted of an introduction to proceedings by the Privacy Commissioner, followed by discussion and comment by conference attendees on the adequacy of the draft Determinations. The Privacy Commissioner reviewed points of agreement and disagreement, and outlined future processes regarding the decision to issue relevant Determinations or dismiss ACHA’s application.

Privacy Act 1988 (Part VI) - Public Interest Determination No. 9

Administered by Department of the Prime Minister and Cabinet

Interactions

Legislation content

Interactions

Authorises

All Versions