Privacy Act 1988 - Public Interest Determination No. 4

Overview

The Privacy Act 1988 was enacted to protect the personal information of individuals and to provide a framework for the handling of such information by agencies and organisations. The Act aims to ensure that personal information is managed responsibly and that individuals' privacy is safeguarded. Public Interest Determination No. 4 (PID 4), dated 29 April 1991, was introduced in response to an application from the Australian Federal Police to address the issue of disclosing personal information contained in criminal offence and motor vehicle accident reports for the purposes of pursuing insurance claims or civil litigation. The determination was issued by the Privacy Commissioner, Kevin O'Connor, under section 72 of the Privacy Act 1988. The policy objective is to allow the disclosure of relevant personal information under strict conditions to ensure it is handled in a manner consistent with the Information Privacy Principles, particularly with regard to limiting re-use and re-disclosure.

Scope and Application

The Privacy Act 1988, specifically Public Interest Determination No. 4 (PID 4) dated 29 April 1991, applies to the Australian Federal Police, governing the disclosure of personal information contained in criminal offence reports and motor vehicle accident reports. The determination allows for the disclosure of such information under certain conditions, primarily for the resolution of disputes or claims arising from the incidents documented in the reports. It is applicable to individuals or organisations directly affected by the incident or responsible for managing or resolving claims stemming from the incident. The determination sets forth specific conditions, including the requirement that the information be relevant to the incident, the disclosure be limited to the necessary parties, and that recipients must undertake to handle the information in accordance with the Information Privacy Principles, particularly Principle 11.3 regarding limiting re-use and re-disclosure. Additionally, the Privacy Commissioner is mandated to monitor the operation of this determination and has the authority to make further determinations if the initial one is not being adhered to.

Key Provisions

The main operative sections of Public Interest Determination No. 4 (PID 4) of the Privacy Act 1988 (section 72) permit the Australian Federal Police (AFP) to disclose personal information contained in criminal offence reports and motor vehicle accident reports under specific conditions. Section 1 outlines that the information may only be disclosed to the extent that it is relevant to resolving disputes or claims arising from the incidents documented in the reports. Section 2 stipulates that the information can only be shared with individuals or organisations directly affected by the incident or those responsible for managing or resolving claims. Section 3 requires that any disclosure is conditional on the recipient agreeing to handle the information in compliance with the Information Privacy Principles, specifically Information Privacy Principle 11.3, which addresses limiting reuse and redisclosure. Section 4 mandates that a record of the disclosure be kept, including the reason for the disclosure when appropriate. The PID imposes several obligations on the AFP. Firstly, the AFP must ensure that the disclosed information is strictly relevant to the resolution of disputes or claims. Secondly, they must limit the disclosure to only those individuals or organisations directly affected by the incident or those responsible for managing or resolving claims. Thirdly, the AFP must obtain an undertaking from recipients that they will handle the information in accordance with the Information Privacy Principles, particularly Principle 11.3, which limits further use and disclosure. Lastly, the AFP is required to maintain records of each disclosure, including the reasons for such disclosures. In terms of consequences, while the PID itself does not explicitly outline penalties for breaches, the Privacy Act 1988 provides for civil and criminal penalties for non-compliance with its provisions. For instance, unauthorised use or disclosure of personal information can result in civil penalties, including significant fines (up to $2.1 million for corporations and $210,000 for individuals under section 13G). Additionally, under section 13H, criminal offences can lead to imprisonment terms, with individuals facing up to two years and corporations up to $1.05 million in fines for serious breaches. The Privacy Commissioner retains the authority to revoke or vary the PID if it is deemed that the determination is not being observed.