Privacy Act 1988 - Public Interest Determination No. 8

EXPLANATORY STATEMENT
Privacy Act 1988, Part VI
in regard to

Public Interest Determination No. 8

Contents

1. Explanation
2. Authority for making these determinations
3. Reason for making the Determination
4. Likely impact and effect of the Determination
5. Unusual aspects calling for special comment
6. Fees

Note: This explanatory statement has been drafted to assist the Senate Standing Committee on Regulations and Ordinances. Section 79(3) of the Privacy Act requires that each public interest determination include a statement of reasons for that determination. This explanatory statement includes much of the material from the `Statement of Reasons ' section of Public Interest Determination 8.

1. Explanation Background

The Privacy Act 1988 (the Act) sets out eleven Information Privacy Principles (the IPPs) which bind the way most federal government agencies handle personal information.

The IPPs:

(i).                    regulate the way government agencies collect, store, use and disclose information about people;

(ii).                  allow people access to information agencies keep about them; and

(iii).               allow people to request changes to this information.

Of particular relevance to Public Interest Determination No. 8 is IPP 11, which limits the way agencies may disclose personal information. IPP 11 (1) says:

"A record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless:

(a)      the individual concerned is reasonably likely to have been aware,  or made aware under Principle 2, that information of that kind is               usually passed to that person, body or agency;

(b)     the individual concerned has consented to the disclosure;

(c)      the record-keeper believes on reasonable grounds that the  disclosure is necessary to prevent or lessen a serious and imminent               threat to the life or health of the individual concerned or of another               person;

(d)     the disclosure is required or authorised by or under law; or

(e)      the disclosure is reasonably necessary for the enforcement of the

   criminal law or of a law imposing a pecuniary penalty, or for the

   protection of the public revenue."

However, the Act allows for agencies to apply to the Privacy Commissioner for a public interest determination (PID), which in effect authorises an agency to do an act or engage in an practice that will (or may) breach an IPP.

Part VI of the Act gives the Privacy Commissioner the power to make such a determination only where he or she is satisfied that the public interest in the agency doing the act, or engaging in the practice, outweighs to a substantial degree, the public interest in adhering to that IPP.

The Consultation Process

The Commonwealth Director of Public Prosecutions (CDPP) applied for a Public Interest Determination under section 72 of the Act in an application dated 7 January 2002.

The Office published a notice of the receipt of the application from the CDPP in accordance with section 74 of the Act. The notice was issued on the Office website, in the Commonwealth Government Gazette and in a national newspaper (the Australian) inviting comment from interested parties.

A draft determination was agreed to by the Commissioner on Thursday, 28 February 2002. The Office contacted approximately 85 agencies, organisations and people thought to have an interest in the application, inviting them to call a conference to discuss the Draft Determination. An invitation was also issued on the website along with the draft of the Determination. No serious objections were raised by interested parties and as a result, no changes have been made to the draft version of the Determination.

The statement of reasons has been altered since the draft version was made available for comment. However, the only changes have been to make the legislative requirements for issuing a PID more explicit. There have been no significant changes to the reasons given for issuing the Determination.

The Commissioner signed the Determination on 22 March 2002.

2.    Authority for making this determination

Under section 72 of the Act, the Privacy Commissioner is empowered to issue a determination where he or she is satisfied that (i) an act or practice of an agency breaches or may breach an IPP, and (ii) the public interest in the agency doing the act or engaging in the practice outweighs to a substantial degree the public interest in adhering to that IPP. Under section 72(1) of the Act, the effect of such a determination is that the act or practice of the agency will be disregarded for the purpose of section 16 of the Act. That is, the act or practice will not be regarded as an act or practice that breaches an IPP.

Under section 80 of the Act, a PID is to be treated as a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901. Subject to section 80(2)(b) of the Act, the PID shall take effect on the first day on which the determination is no longer liable to be disallowed.

3.    Reason for making the Determination The Application

The Commonwealth Director of Public Prosecutions (CDPP) in an application dated 7 January 2002, pursuant to section 73 of the Privacy Act (the Act), sought a Public Interest Determination (PID) under section 72 of the Act to allow it to engage in an act or practice that breaches or may breach IPP 11. The act or practice in question involves the disclosure of personal information to the Australian Institute of Criminology (AIC) for research purposes.

The CDPP applied for the PID for the following reasons:

1. The CDPP believes that such a disclosure would infringe IPP 11 as it involves the disclosure of personal information by permitting an officer of the AIC to inspect documents held in files maintained by the CDPP and to record the information in question.
2. The CDPP believes that it would be impracticable to gain the consent of individuals who might be affected by the disclosure.

The CDPP has been approached by the AIC for permission to inspect twenty-eight (28) of the CDPP's completed files relating to prosecutions involving charges of serious fraud, dishonesty and deception and to record certain information contained in those files.

The application advised that the AIC has informed the CDPP that it wishes to inspect the files in question for the sole purpose of conducting research into the nature and extent of serious fraud in Australia and New Zealand by compiling data extracted from completed prosecution files in the categories listed in Attachment A to the Determination. Data is being gathered from every jurisdiction in Australia and New Zealand in order to publish a report and other papers that describe the nature and extent of serious fraud and how allegations of serious fraud are investigated, prosecuted and disposed of in the courts. The AIC, which is an agency and therefore

bound by the IPPs itself, has affirmed that all documents will be published in such a way that it will not be possible to identify any individuals whose information was collected from the CDPP files.

The research being conducted by the AIC is funded jointly by the AIC and by PricewaterhouseCoopers with each entity sharing intellectual property in the results of the research.

The application for a PID relates to the disclosure in the following circumstances of personal information contained in certain CDPP files:

1. the information will be used by the AIC solely for the purpose of conducting research into the nature and extent of serious fraud in Australia and New Zealand;
2. the information disclosed will relate only to the categories of matters listed in Attachment A;
3. the names of witnesses, suspects, offenders, victims and those acquitted of the crime will not be recorded by the AIC;
4. access to the information shall be provided on CDPP premises exclusively and under CDPP supervision;
5. the staff member of the AIC responsible for inspecting the information held by the CDPP shall have substantial prior experience in criminological research involving access sensitive data and be personally authorised to undertake the research by the Director of the AIC;
6. the results of the research will be published in aggregate form to prevent the identification of individuals;
7. the results of the research will be published in such a way as to prevent the information being used to inspire or to facilitate the commission of crime; and
8. the personal information will not be disclosed to any other agency and organisation (including PricewaterhouseCoopers) or unauthorised AIC research officer.

Findings

The findings on material questions of fact relating to the application are as follows:

1. The CDPP is an agency established under the Director of Public Prosecutions Act 1983 ("the DPP Act").
2. The functions of the agency are set out in section 6 of the DPP Act and include the following:

a. to institute and carry on prosecutions on indictment for indictable   offences against the laws of the Commonwealth;

b.         to institute and carry on proceedings for the commitment of persons for trial in respect of indictable offences against the laws of the Commonwealth;

c.         to institute and carry on proceedings for the summary conviction of persons in respect of offences against the laws of the Commonwealth;

d.         to assist a coroner in inquests and inquiries conducted under the laws of the Commonwealth;

e.         to appear in proceedings under the Extradition Act 1988 or the Mutual Assistance in Criminal Matters Act 1987;

f.           where the Director, with the consent of the Attorney-General, holds an  appointment to prosecute offences against the laws of a State - to institute and carry on, in accordance with the terms of the appointment, prosecutions for such offences;

g.         to take, or co-ordinate or supervise the taking of, civil remedies;

h.         to institute, carry on, or co-ordinate or supervise the institution or carrying on of, proceedings for the recovery of pecuniary penalties under the laws of the Commonwealth; and

i.          to take proceedings under the Proceeds of Crimes Act 1987.

3.         In handling personal information, the agency is required to comply with the IPPs set out in section 14 of the Act.

4.         IPP 11.1 limits the disclosure of personal information held by an agency to   certain prescribed circumstances. It is the opinion of the CDPP that none of               these circumstances apply to the disclosure practice in question, and therefore               the CDPP would be in breach of IPP 11 if it were to make such a disclosure.

Breach of an IPP

The proposed disclosure of information involves the disclosure by the CDPP to the AIC of information from 28 of its case files relating to serious cases of fraud, dishonesty and deception. Information contained in those files may comprise information relating to witnesses, suspects, offenders, victims and those charged but not convicted. Under the proposed arrangement an officer of the AIC will be permitted to inspect those files and record certain information.

IPP 11.1 provides that a record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless certain specified circumstances, which are set out in paragraphs 11.1 (a) to (e), exist. Section 6(1) of the Act provides that personal information is information or an opinion whether true or not about an

individual.

The Privacy Commissioner is of the view that the proposed disclosure may involve the disclosure of personal information in terms of IPP 11.1 and that such disclosure does not come within paragraphs 11.1 (a) to (e). Accordingly, the Privacy

Commissioner is satisfied for the purposes of section 72(1)(a) of the Act the act or practice in question breaches or may breach IPP 11.

Public interest

The CDPP submits that the information sought to be gathered by the AIC will enable an accurate understanding to be gained of the nature and extent of serious fraud in Australia and New Zealand. The CDPP submits that research in this level of detail has not been undertaken in Australia before and the results will be of benefit to the community in understanding why serious fraud occurs, in assessing the appropriateness of sanctions imposed on convicted offenders, in designing fraud prevention initiatives, and in determining the cost of fraud to the Australian community. In particular, knowledge of the motivations and rationalisations of offenders and the manner in which their offences were committed and detected, will provide guidelines for both law enforcement agencies and their investigatory bodies in responding to crimes of this nature. The community will also benefit from knowledge concerning individual vulnerability to victimisation of crimes of this nature that are currently being committed in Australia and New Zealand.

Having regard to the benefits to be gained by the community as a result of AIC's research, the Privacy Commissioner accepts that there is significant public interest in the CDPP disclosing the information in question to the AIC.

The CDPP advises that the privacy interests of the offenders and more importantly, of the witnesses, victims and those individuals that have been acquitted of the charges of fraud are something that have been given due consideration. Consideration was given to whether the CDPP should cull or de-identify the file in regard to certain personal information before the files are inspected. However, the CDPP and the AIC advise that such steps would be unreasonably resource intensive and would likely impede the objects of the research.

According to the application, the staff member of the AIC responsible for inspecting the information held by the CDPP will have substantial prior experience in criminological research involving access to sensitive data and be personally authorised to undertake the research by the Director of the AIC. Furthermore, the authorised staff member will not record the names of witnesses, suspects, offenders, victims or those acquitted of the crime as part of the inspection, nor will their identities be obtainable from any of the published research.

The CDPP believes there is no other way in which the proposed research could be conducted as files maintained by complainants and other agencies, such as the police and the courts, do not contain the level of detail that is sought by the AIC in carrying out this research.

The proposed disclosure will relate only to completed files that have resulted in the offender being dealt with to finality in court proceedings. Disclosure will not be provided in respect to ongoing proceedings. This PID relates only to a discrete disclosure of personal information and does not apply to any ongoing activity.

The Privacy Commissioner accepts that having regard to the circumstances of the disclosure set out in (2) of the Determination the proposed disclosure of personal information will be strictly limited and controlled. In particular, the Privacy Commissioner notes that: the AIC officer who will access the files will have substantial experience in accessing sensitive material; that officer will not record the names of individuals; the personal information will not be disclosed to any other agency or organisation; and that the research will be published in a form to prevent the identification of individuals.

Bearing in mind the significant public interest in the CDPP allowing the AIC to access that information and having regard to the strict limits and controls set out in (2) of the Determination in relation to such disclosure, the Privacy Commissioner is of the view that the public interest in the proposed disclosure by the CDPP substantially outweighs the public interest in the CDPP adhering to IPP 11.

4.    Likely impact and effect of the Determination

This determination will have the effect of allowing the CDPP to disclose information held in 28 case files to the AIC. AIC, which is itself bound by the IPPs, will not be able to disclose the personal information it collects for any reason other than for those reasons set out in IPP 11. Therefore, the likely impact on privacy will be minimal with regards to this disclosure.

5.    Unusual aspects calling for special comment

Not applicable

6.    Fees

No fees are imposed or charged as a result of these determinations