Explanatory Statement
Privacy Commissioner’s
Temporary Public Interest Determinations
2009-1 and 2009-1A
December 2009
Explanatory Statement
1. PURPOSE AND AUTHORITY
1.1 Temporary Public Interest Determinations 2009-1 and 2009-1A
This explanatory statement fulfils the Privacy Commissioner’s obligations under section 26(1) of the Legislative Instruments Act 2003 (Cth).
This explanatory statement refers to two determinations issued under section 80A(2) of the Privacy Act 1988 (Cth) (the Privacy Act):
- Temporary Public Interest Determination 2009-1
- Temporary Public Interest Determination 2009-1A.
1.2 Purpose
The purpose of Temporary Public Interest Determination (TPID) No. 2009-1 is to determine that the applicant (a medical practitioner in private practice) will not be committing a breach of National Privacy Principle 10.1 or National Privacy Principle 2.1 of the Privacy Act 1988 in specified circumstances.
TPID 2009-1 permits the applicant to collect or use the contact details of a patient’s genetic relative in circumstances where:
a) it is impractical to gain the consent of the genetic relative and
b) the applicant intends to use the contact details to inform the relative of the potential consequences of genetic information obtained from the patient for the relative’s own health and
c) the applicant has a reasonable belief that this is necessary to lessen or prevent a serious threat to the life, health or safety of the genetic relative and
d) where consent has not been obtained from the patient for the disclosure of their genetic information, the disclosure will be made in accordance Guidelines issued under section 95AA of the Privacy Act.
Consistent with section 80B(3), TPID 2009-1A gives general effect to TPID 2009-1 for other health service providers in the same circumstances.
1.3 Provisions for Public Interest Determinations
The Privacy Act provides a mechanism in part VI for dealing with matters where the public interest in an organisation doing an act or a practice that may breach a National Privacy Principle substantially outweighs the public interest in adhering to that Principle.
This mechanism is given effect through the Privacy Commissioner’s power to make a public interest determination. The Privacy Commissioner may make a public interest determination by declaring that a specific act or practice of the organisation will not be a breach of the National Privacy Principles (NPPs), where she is satisfied there is a substantial public interest in doing so.
The Privacy Act also provides a method for dealing with urgent matters by giving the Privacy Commissioner the power to make a temporary public interest determination in certain circumstances.
1.4 Authority for making these determinations
The authority for the Privacy Commissioner (the Commissioner) to make TPID 2009-1 rests in subsection 80A(2) of the Privacy Act. Subsection 80A(2) states that the Privacy Commissioner may make a written determination about an organisation’s acts and practices if the Commissioner is satisfied that:
(a) an act or practice of an organisation breaches, or may breach, an approved privacy code, or a National Privacy Principle, that binds the organisation; but
(b) the public interest in the organisation doing the act, or engaging in the practice, substantially outweighs the public interest in adhering to that code or Principle.
(c) the application raises issues that require an urgent decision.
TPID 2009-1A is made pursuant to subsection 80B(3) of the Privacy Act which states that:
The Commissioner may make a written determination that no organisation is taken to contravene s 16A if, while that determination is in force, an organisation does an act, or engages in a practice, that is the subject of a temporary public interest determination in relation to that organisation or another organisation.
1.5 Application for a Public Interest Determination
On 16 July 2009, an application was made under section 72 of the Privacy Act for a public interest determination.
The applicant is an organisation for the purposes of the Privacy Act in that the applicant is a corporation or individual (section 6C) and provides a health service to another individual and holds health information; therefore, whether or not the organisation has an annual turnover of more than $3 million, the applicant is subject to the Privacy Act (section 6D(4)(b)).
Two National Privacy Principles were raised in the application for a public interest determination. These are NPP 10.1 and NPP 2.1. This explanatory statement considers each of these in turn.
NPP 10.1 concerns the collection of ‘sensitive information’. Sensitive information is defined in section 6 of the Privacy Act to include ‘health information’.[1] This principle prohibits organisations from collecting sensitive information unless a prescribed exception applies.
NPP 2.1 governs the use and disclosure of personal information and states that an organisation may only use or disclose personal information for the purpose for which it was collected unless a prescribed exception applies.
As required under section 74(1) of the Privacy Act, notice of receipt by the Commissioner of the application is publicly available on the Office of the Privacy Commissioner’s website at: http://www.privacy.gov.au/law/act/pid#notices
2. REASONS FOR MAKING DETERMINATIONS
2.1 Amendments to the Privacy Act
The Privacy Legislation Amendment Act 2006 introduced an additional exception to the general requirement that personal information must not be used or disclosed for any other purpose other than that for which it was collected. NPP 2.1(ea) allows for the use or disclosure of genetic information to a patient’s genetic relatives, without the patient’s consent, if the organisation reasonably believes that this is necessary to lessen or prevent a serious threat to the life, health or safety of the relative.
Section 95AA of the Privacy Act, also introduced in 2006, allows the Privacy Commissioner to approve guidelines developed and issued by the NHMRC to clarify circumstances in which genetic information may be used or disclosed without consent. NPP 2.1(ea) requires that use or disclosure of genetic information by a health practitioner without the consent of the patient be conducted in accordance with these guidelines.
2.2 Issues raised by the applicant
The applicant requested a determination to exempt her, in limited and specified circumstances, from complying with NPP 10.1 and NPP 2.1.
The act or practice concerns the collection or use of the contact details of a genetic relative of a patient, with a view to informing the relative of the implications of genetic information obtained from the patient for the relative’s own health.
In applying for a public interest determination, the applicant submitted that if a patient’s genetic information suggests that there is potential for a serious threat to the life, health or safety of the patient’s genetic relatives, and disclosure of the information may lessen or prevent the threat, she would like to be able to provide the genetic information to the genetic relatives to enable them to take any relevant action if they wish to do so.
The applicant expressed a concern that the collection of the contact details of a genetic relative may breach NPP 10.1[2], as it is impractical to gain consent for the collection of the contact details and no other exceptions seem to apply. The applicant also raised a concern that the secondary use of the contact details of a genetic relative (which are already on file) without their consent may breach NPP 2.1.[3] The applicant noted that these issues arise whether or not the patient consents to the genetic information being provided to their genetic relatives.
The applicant considered that in the absence of a public interest determination, the health care of individuals could be compromised and the end result could be a failure to recognise and treat the manifestations of these diseases in a timely manner, and increased investigation, intervention and cost.
2.2 Public interest considerations
In issuing TPIDs 2009-1 and 2009-1A, the Privacy Commissioner took account of the matters raised in the application and written submissions.
2.2.1 Consideration given to NPP 10.1
Under NPP 10.1, an organisation must not collect sensitive information about an individual unless the individual has consented or a listed exception applies.
When making TPID 2009-1, the Privacy Commissioner was satisfied that the collection of contact details of a genetic relative in these circumstances would or may constitute a breach of NPP 10.1.
The Privacy Commissioner accepted the applicant’s view that it is impractical to gain consent in these circumstances. It does not appear that the circumstances detailed in the application would allow the applicant to rely on any other exception.
Based on the available evidence, the Privacy Commissioner considered that:
a) it is impractical to obtain consent for the collection of the genetic relative’s contact details in these circumstances and
b) the central public interest objective being served by this determination is the provision of quality health care for the genetic relative, and ultimately good public health outcomes for the community and
c) the collection of the contact details of the genetic relative(s) in circumstances where the applicant has a reasonable belief that this is necessary to lessen or prevent a serious threat to the life, health or safety of the genetic relative may contribute significantly to good health care in both respects outlined in (b).
In addition, if health service providers were unable to collect the contact details of a genetic relative in these circumstances, they would be prevented from disclosing genetic information in accordance with NPP 10.1(ea) and the section 95AA guidelines. In the Privacy Commissioner’s view, this would not be in accordance with the legislative intent of the Privacy Legislation Amendment Act 2006.
The Privacy Commissioner also noted that the privacy protection standards in NPPs 1 to 9[4] will continue to apply to protect the genetic relative’s information collected in these circumstances.
Accordingly, the Privacy Commissioner found that the public interest in permitting the collection of the contact details of a patient’s genetic relatives in these circumstances substantially outweighed the public interest in maintaining the privacy protections of NPP 10.1.
2.2.2 Consideration given to NPP 2.1
Under NPP 2.1, an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless the individual (whom the information is about) has consented or a listed exception applies.
When making TPID 2009-1, the Privacy Commissioner was satisfied that the use of contact details of a genetic relative in these circumstances would or may constitute a breach of NPP 2.1.
The Privacy Commissioner accepted the applicant’s view that it is impractical to obtain consent for the use of the genetic relative’s contact details in these circumstances. It does not appear that the circumstances detailed in the application would allow the applicant to rely on any other exception.
The public interest considerations relating to secondary use of the contact details of a genetic relative are very similar to those outlined above in relation to collection (NPP 10.1).
Accordingly, the Privacy Commissioner found that the public interest in permitting the use of the contact details of a patient’s genetic relatives in these circumstances substantially outweighed the public interest in maintaining the privacy protections of NPP 2.1.
Does the application require an urgent decision?
As required by section 80A(1)(c), the Privacy Commissioner was satisfied that the matter is urgent as, in the absence of a TPID or any other legislative protection, health service providers would or may be in breach of NPP 10.1 when collecting the contact details of a genetic relative in these circumstances. Health service providers may also be in breach of NPP 2.1 when using contact details of a genetic relative which are already on the practitioner’s file.
3. CONSULTATION PROCESS
A TPID may only be issued when the matter requires an urgent decision.
The Office held discussions with clinicians with expertise in the field of genetics and the Department of Prime Minister and Cabinet. As well, 17 stakeholder organisations and individuals, including the Department of Health and Ageing and the NHMRC, were provided an opportunity to comment.
Ten submissions were received from state government agencies, peak health professional bodies, private sector health service providers, and a privacy advocacy group. The majority of the submissions received were highly supportive of the necessity for a determination relating to the collection and use of genetic relatives’ contact details.
4. OPERATION OF PUBLIC INTEREST DETERMINATIONS 2009-1 AND 2009-1A
TPID 2009-1 applies directly to the applicant, in her capacity as the provider of a ‘health service’ and hence an ‘organisation’ under the Privacy Act.
TPID 2009-1A applies to all other organisations that provide a ‘health service’[5] under the Privacy Act (health service providers) where those health services collect or use the contact details of a patient’s genetic relatives in the limited circumstances referred to under TPID 2009-1.
These determinations have the effect of allowing health practitioners to collect or use the contact details of a genetic relative of a patient without consent in limited circumstances. This collection or use will only occur for the purpose of informing the relative of the implications of genetic information obtained from the health consumer for the relative’s own health.
In instances where consent has not been obtained from the health consumer for the disclosure of their genetic information, the disclosure would be made in accordance with guidelines issued under section 95AA of the Privacy Act by the NHMRC and approved by the Privacy Commissioner.
These determinations are temporary measures to allow health practitioners to collect or use the contact details of a genetic relative of a patient in limited circumstances.[6] TPID 2009-1 and TPID 2009-1A will operate from 15 December 2009 to 14 December 2010, inclusive.
The Government has indicated in its response to the Australian Law Reform Commission’s review of privacy that it intends to amend the Privacy Act to permit the collection or use of a genetic relative’s contact details in these circumstances.
[1] The definitions of the terms ‘sensitive information’ and ‘health information’ are available at: www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/BD5EBA9DBCC9E1FECA25765400048053
[2] The text of NPP 10.1 is available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF
[3] The text of NPP 2.1 is available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF
[4] The text of NPPs 1 to 9 is available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF
[5] The term ‘health service’ is defined in section 6 of the Privacy Act, available at: www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/BD5EBA9DBCC9E1FECA25765400048053
[6] The Government has indicated in its response to the Australian Law Reform Commission’s review of privacy that it intends to amend the Privacy Act to permit the collection or use of a genetic relative’s contact details in these circumstances.