Explanatory Statement

Issued by the authority of the Privacy Commissioner (the Commissioner), in accordance with the functions and powers conferred on him by s 12 of the Australian Information Commissioner Act 2010 (Cth) (the Australian Information Commissioner Act).

Privacy (Comcare Contestability Review) Temporary Public Interest Determination 2015

This explanatory statement relates to the Privacy (Comcare Contestability Review) Temporary Public Interest Determination 2015 (TPID 2015).

This explanatory statement fulfils the Commissioner’s obligations under s 26(1) of the Legislative Instruments Act 2003 (the Legislative Instruments Act).

Authority for the making of the determination

The Commissioner is empowered by s 80A(2) of the Privacy Act 1988 (Cth) (the Privacy Act) to make TPID 2015. Under s 80A(2) the Commissioner may, by legislative instrument, make a temporary public interest determination (TPID) by declaring that a specific act or practice of an APP entity will not be in breach of the Australian Privacy Principles (APPs), where the Commissioner is satisfied that the public interest in doing so substantially outweighs the public interest in adhering to the APP in question, and the application raises issues that require an urgent decision.

Under s 73(1) of the Privacy Act, an APP entity may apply to the Commissioner for a determination under s 72 in relation to an act or practice of that entity. Where the application raises issues that require an urgent decision a TPID can be made under s 80A(2).  The Commissioner received such an application from Comcare (the Applicant) on 13 March 2015.

The application can be viewed on the Register of Public Interest Determinations on the Office of the Australian Information Commissioner’s (OAIC) website, www.oaic.gov.au.

Purpose of the determination

The purpose of TPID 2015 is to permit the Applicant to disclose personal information contained in no more than 100 injured worker records without breaching Australian Privacy Principle (APP) 6.1 and s 15 of the Privacy Act. Specifically, TPID 2015 will ensure that the Applicant does not breach APP 6.1 and s 15 when disclosing personal information contained in no more than 100 injured worker claims files to professional services firm Ernst & Young for the purposes of the undertaking of a ‘Contestability Review’ of the Commonwealth’s insurable risk portfolio.

APP 6.1 sets out the circumstances when the Applicant may use or disclose personal information. Section 15 provides that the Applicant must not do an act or engage in a practice that breaches an APP.

Application for a public interest determination

The application received on 13 March 2015 indicated a concern that, in the absence of a determination, the Applicant may breach APP 6.1 and s 15 of the Privacy Act when disclosing personal information necessary for the conducting of the Contestability Review by Ernst & Young.

The application provided an overview of Contestability Reviews and the Government’s broader Contestability Program. The Contestability Program is intended to improve the performance of Government by systematically assessing Government functions to ensure that they are provided effectively and by the organisations most able to do so efficiently. Contestability Reviews investigate in detail the options for provision of a Government function and make recommendations to Government on the most efficient means of future provision.

Relevant to the application, the Contestability Review into the management of the Commonwealth’s insurable risks was commissioned by the Minister for Finance, Senator the Hon Mathias Cormann in December 2014. The Review is being managed jointly by the Department of Employment and the Department of Finance (Finance) who have engaged Ernst & Young to conduct the review. The Applicant’s claims management processes are to be a key focus of the review.

Ernst & Young have advised the Applicant that the Ernst & Young reviewers will require access to the Applicant’s electronic claims management database for the purpose of assessing how compensation claims are handled and managed. The personal information contained in the claims files will be required by the reviewers to gain an understanding of the decision making process and rationale employed by the Applicant in the management of the claim.

To conduct the review, Ernst & Young has requested access to up to 100 of the Applicant’s electronic injured workers claims files. The claims files contain the details of the claim including names and contact details of claimants, next of kin and medical practitioners, nature of the injury, progress of claim, financial details, medical history of the claimed condition and other relevant health and personal information.

Reasons for the decision

Might the disclosure of claims file information breach an APP?

APP 6.1 provides that where an APP entity holds personal information about an individual, it can only use or disclose the information for a particular purpose for which it was collected (known as the ‘primary purpose’ of collection), or where the individual has consented, unless an exception applies. Where an exception applies the entity may use or disclose personal information for another purpose (known as the ‘secondary purpose’). The exceptions to APP 6.1 are found in APP 6.2.

In the application, the Applicant submitted that it would be unable to rely on any of the relevant exceptions to APP 6.1 when disclosing the personal information necessary for the conducting of the Contestability Review.

Relevantly, the Applicant submitted that disclosure for the secondary purpose of the Contestability Review would not be authorised under APP 6.2(a).  APP 6.2(a) permits an APP entity to use or disclose personal information for a secondary purpose if the individual would reasonably expect the entity to use or disclose the information for that secondary purpose, and:

• if the information is sensitive information, the secondary purpose is directly related to the primary purpose of collection, or
• if the information is not sensitive information, the secondary purpose is related to the primary purpose of collection.

This exception creates a two-limb test which focuses both on the reasonable expectations of the individual, and the relationship between the primary and secondary purposes.

The Applicant submitted that in the context of making a workers compensation claim, it is unlikely that claimants would ‘reasonably expect’ that their personal information would be disclosed to a contracted service provider of another Commonwealth agency for the purposes of the Contestability Review.

The OAIC has issued the APP guidelines which outline the mandatory requirements of the APPs and how the OAIC will interpret them. Chapter 6 of the APP guidelines states that the ‘reasonably expects’ test is an objective one that has regard to what a reasonable person, who is properly informed, would expect in the circumstances. The APP guidelines provide, by way of example, that an individual may reasonably expect their personal information to be used or disclosed for a secondary purpose include where the secondary purpose is a normal internal business practice, such as auditing, business planning, billing or de-identifying the personal information.[1]

The Contestability Review is to consider potential alternative arrangements for the management of the Commonwealth’s insurable risks, including recommendations for improved processes or provision by alternative providers. While the Contestability Review is considering the Applicant’s internal processes, the purpose of the review appears to be broader than those that may be considered a normal business process that the Applicant would undertake, and therefore not within the reasonable expectations of the individual.

In order to rely on the exception, the use or disclosure must also be ‘related’, or for sensitive information ‘directly related’, to the primary purpose of collection. A related secondary purposes requires more than a tenuous link. In the case of sensitive information, a directly related secondary purpose is one which is closely associated with the primary purpose.[2] Regarding this aspect of the exception, the Applicant submitted that as the nature of the information is, at least in part, sensitive information, disclosure to Ernst & Young for its purpose of conducting the review is unlikely to be ‘directly related’ to the primary purpose of collection, which is processing the individual claim.

Compliance with APP 6.1 not practicable 

As the Applicant cannot rely on any of the relevant APP 6.2 exceptions, the Applicant will need to comply with APP 6.1 when using or disclosing personal information contained in its claims files.

The Applicant submitted that it is not practical to take additional steps to ensure compliance with APP 6.1 either through seeking consent from individuals whose personal information is contained in the relevant files or through the de-identification of the information to which Ernst & Young will have access.

Seeking consent

The Applicant considered that it is not appropriate to obtain the consent from the individual claimants on the basis that it may cause undue stress or anxiety to the individuals concerned in circumstances where the intended disclosure is for a limited purpose and timeframe. In addition, claim files contain personal information of third parties, whose consent will also need to be obtained. This would make the seeking of consent impracticable and inefficient.

De-identification

Prior to making the application, the Applicant undertook the redaction of personal information from printed copies of the claim files to determine whether this process would be effective. It was determined that a print and redact approach would be unlikely to be effective method for conducting the Contestability Review. This is because the highly specific nature of the claims information which the reviewers require may be sufficient to enable the identification of the individuals concerned. Information about the date of injury, type of injury, workplace of injured worker, circumstances of injury and duration of time away from work could in combination be sufficient to reasonably identify some claimants and so be considered personal information for the purposes of the Privacy Act.

Ernst & Young also advised the Applicant that the approach of printing the information and then redacting it would not be effective because it would not allow the reviewer to understand in real terms how the Applicant’s claims management framework operates. Ernst & Young explained that the reviewer needs to access the information through the claims management software in order to understand how the system itself works and whether it provides an efficient and effective platform for managing claims.

The Applicant further noted that it is not practical or feasible to undertake a redaction process for the information within the claims management software, primarily because the Applicant’s claims management software does not have this capability. The Applicant also noted that even if it were possible, the necessary level of redaction would obliterate the key information that is required (such as time and location of injury, nature of injury and recovery times) to undertake the review.

Additionally, the Applicant considered whether its officers could review the electronic information and provide it to Ernst & Young. While this is feasible, it would not provide the most efficient or effective review process. In particular, it would not facilitate Ernst & Young independently and rigorously analysing whether the Applicant’s processes are capable of delivering efficient and effective claims management because their knowledge of the capability will be reliant on the description provided by the officer. Ernst & Young have advised the Applicant that the provision of the claims files is integral to production of a Contestability Review which is accurate, reliable, and useful.

The Commissioner’s view

The Commissioner was satisfied that the Applicant may breach APP 6.1 when disclosing personal information contained within injured worker claims files to Ernst & Young during the undertaking of the Contestability Review.  Further, the particular purpose cannot be served by alternate methods such as through the use of de-identified information.

Does the public interest in disclosing the personal information substantially outweigh the public interest in complying with the APPs?

The Applicant made a number of arguments as to why the public interest in disclosing personal information contained within the claims files substantially outweighs the public interest in complying with APP 6.1.

Public benefits associated with the review

The Contestability Review is to assess the appropriateness and efficiency of current arrangements for the management of the Commonwealth’s insurable risks, with a focus on those undertaken by the Applicant and Finance.

The Applicant submitted that it is of significant public interest to seek to identify efficiencies which result in either savings or further benefits to be passed on to taxpayers.  In the case of the recommendations from the Contestability Review, this is likely to consist of reductions in premiums paid and regulation which government departments are subjected to, with a subsequent substantial reduction in taxpayer costs. 

Finance’s core functions include assisting the Government across a wide range of policy areas, particularly with regard to expenditure, financial management, and the operations of government. Promoting the efficiency of government expenditure is a core part of this function which the Contestability Program, of which contestability reviews are an important part, attempts to achieve. Finance’s commissioning of Ernst & Young to produce a report, and consequently Ernst & Young’s access to the information necessary for the making of the report, are clearly in the interest of this core function.

The Applicant’s interest in providing workplace compensation is similarly advanced by the making of a TPID. Making improvements to the systems, whether by improving the quality of service, or by increasing the efficiency of the claims process, promotes the Applicant’s functions as set out under s 69 of the Safety, Rehabilitation and Compensation Act 1988.

Specifically, the Applicant suggests that it promotes those functions which relate to making accurate and quick determinations, the quick arrangement of rehabilitation, promoting effective procedures for the rehabilitation of workers, and those functions conferred by the Work Health and Safety Act 2011 relating to the provision of compensation for work-related injuries.

Improved process will also benefit injured workers through improved claims management practices which would facilitate better return to work and health outcomes.

Impact on the privacy of individuals

The Applicant submitted that the Contestability Review will focus on its management process rather than the content of the claims. As such, the potential for the proposed disclosure to adversely affect the privacy interests of individuals is limited.

The conduct of the review will not be used as an opportunity to review or reconsider any complainant’s payments or circumstances. It is not intended to in any way prejudice or limit any claimant’s entitlements. The Applicant also undertakes that it will not use the information exchange process with Ernst & Young to the disadvantage of any individual claimant or their circumstances in the event that their file is selected for review unless it considers itself legally obliged to do so.

When conducting the review, Ernst & Young will not collect personal information of any individual, other than that of the Applicant’s employees in the context of the performance of their duties. Accordingly, the Applicant has advised that none of the Ernst & Young notes, drafts or final report will include any information which could identify individuals in the claims files.

The application further outlined steps that will be taken to limit the intrusion and minimise the impact on individuals, this includes requirements that any Ernst & Young employee accessing the personal information must have signed a confidentiality undertaking in relation to the project. Access is also to be limited to a maximum of three Ernst & Young employees with a strict need to access the information for the purposes of the review.  

The Applicant noted that Ernst & Young’s contractual arrangement with Finance also includes relevant clauses for the protection of personal information and requires Ernst & Young to treat personal information as if it were an agency for the purpose of the Privacy Act. Consequently, any breach of an APP will also result in a breach of the relevant clause in the contract.

The Commissioner’s view

Based on the available evidence presented in the application, the Privacy Commissioner considered on balance, that the public interest in permitting the relevant acts or practices engaged in as part of the Contestability Review substantially outweighs the public interest in adherence to the APPs that might be breached.

In forming this view the Privacy Commissioner has had regard to the objects of the Privacy Act, in particular:

• to promote the protection of the privacy of individuals (paragraph 2A(a))
• to recognise that the protection of the privacy of individuals is balanced with the interest of entities in carrying out their functions and activities (paragraph 2A(b))
• to promote responsible and transparent handling of personal information by entities (paragraph 2A(d)).

In making TPID 2015 the Commissioner acknowledges the importance of systematically assessing Government functions to ensure that they are provided effectively and efficiently.  Seeking to identify efficiencies which result in either savings or improved outcomes for injured workers is of benefit to the broader community. 

The Commissioner was satisfied that, in the circumstances, the proposed disclosure of personal information is reasonable, necessary and proportionate and that TPID 2015 includes a number of conditions that mitigate and minimise privacy impacts. In particular the Commissioner took into consideration that the number of claims files that are permitted to be disclosed is limited to that which is necessary to achieve the objectives of the review and the requirement that Ernst & Young is not to collect personal information about any individual contained in the claims files (other than that of the Applicant’s employees in the context of the performance of the employees’ duties).

Does the application raise issues that require an urgent decision?

The Applicant sought a temporary PID under section 80A of the Privacy Act in order to enable reporting by Ernst & Young to Finance by 26 March 2015. The Applicant and Finance advised that the Contestability Review into the management of the Commonwealth’s insurable risks was commissioned by the Minister for Finance, Senator the Hon Mathias Cormann. Minister Cormann has requested that the Review be concluded by the end of March, to allow the recommendations to be considered in accordance with other Government processes. Accordingly, there is no ability to extend the reporting timeframes. 

The Commissioner’s view

The Commissioner accepts that the timely completion of the Contestability Review may assist in achieving the Australian Government’s objective of seeking ways of improving the performance of existing or proposed government functions.

The Privacy Commissioner was satisfied that an urgent decision is required because:

• compliance with the otherwise required processes in Division 1, Part VI of the Privacy Act and the Legislative Instruments Act 2003 (Legislative Instruments Act), will require a period of time that extends well beyond the period required for TPID 2015.
• the review is be concluded by the end of March, to allow the recommendations to be considered in the context of other Government processes. Accordingly, there is no ability to extend the reporting timeframes.  

Operation

TPID 2015 will remain in force from the date of commencement until 22 May 2015, as permitted by subsection 80A(3) unless ceased earlier (see s 80D(2)).

TPID 2015 applies directly to the Applicant as an APP entity under the Privacy Act.

Consultation

The Applicant and Finance were consulted in the making of TPID 2015. No other entities were consulted.

The Privacy Act does not require consultation to occur prior to the making of a TPID. The Privacy Commissioner was satisfied that any further consultation required under section 17 of the Legislative Instruments Act is unnecessary or inappropriate because the TPID is required as a matter of urgency (paragraph 18(2)(b)).

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Privacy (Comcare Contestability Review) Temporary Public Interest Determination 2015 (TPID 2015)

This Legislative Instruments is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The purpose of TPID 2015 is to permit the Applicant to disclose personal information contained in no more than 100 injured worker records without breaching the Australian Privacy Principles (APPs). Specifically, TPID 2015 will ensure that the Applicant does not breach APP 6.1 when disclosing personal information contained in no more than 100 injured worker claims files to professional services firm Ernst & Young for the purposes of the undertaking of a ‘Contestability Review’ of the Commonwealth’s insurable risk portfolio.

The central public interest objective served by TPID 2015 is the systematic assessment of Government functions to ensure that they are provided effectively and efficiently.  Seeking to identify efficiencies which result in either savings or improved outcomes for injured workers is of benefit to the broader community

Human rights implications

The determinations engage Article 17 of the International Covenant on Civil and Political Rights (ICCPR), which provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference and attacks. The Preamble to the Privacy Act makes clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the ICCPR.

TPID 2015 limits the right against the arbitrary interference with privacy, and the right to the protection of the law against such interference, by limiting the application of protections in the Privacy Act in relation to the disclosure of personal information.

However, the right to privacy is not absolute and there may be circumstances in which the guarantees in article 17 can be outweighed by other considerations. Importantly, the Commissioner must have regard to the objects of the Privacy Act when exercising his functions and powers. These objects include:

• to promote the protection of the privacy of individuals (paragraph 2A(a))
• to recognise that the protection of the privacy of individuals is balanced with the interest of entities in carrying out their functions and activities (paragraph 2A(b))
• to promote responsible and transparent handling of personal information by entities (paragraph 2A(d)).

The Privacy Commissioner was satisfied that the public interest in permitting the acts or practices the subject of TPID 2015 substantially outweigh the public interest in adhering to the APPs. In particular, the Privacy Commissioner was satisfied that the limitation was reasonable, necessary and proportionate and that TPID 2015 included a number of conditions that mitigate and minimise privacy impacts. Relevantly, the number of claims files that are permitted to be disclosed is limited to that which is necessary to achieve the objectives of the review and the restriction on the collection of personal information by Ernst & Young.

Conclusion

It is considered that to the extent that the acts or practices authorised by TPID 2015 limit human rights, those limitations are reasonable and proportionate.

Timothy Pilgrim,

Privacy Commissioner

[1] APP Guidelines, paras 6.20-6.22

[2] Ibid, para 6.24-6.26