Explanatory Statement

Privacy (Guidelines issued under section 95A) Approval 2024

This explanatory statement has been prepared by the Australian Information Commissioner. It fulfils the Commissioner’s obligations under subsection 15J(2) of the Legislation Act 2003 (Cth) (Legislation Act).

It explains the purpose and operation of the Privacy (Guidelines issued under section 95A) Approval 2024 (the approval), which relates to the handling of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, and for the purposes of the management, funding or monitoring of a health service.

Purpose

The Australian Information Commissioner is empowered by section 95A of the Privacy Act 1988 (Cth) (Privacy Act) to approve guidelines issued by the Chief Executive Officer (CEO) of the National Health and Medical Research Council relating to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety; and the collection of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, and the management, funding and monitoring of a health service (the guidelines).

This approval replaces the Approval of the Guidelines approved under Section 95A of the Privacy Act 1988 (March 2014, FRLI F2014L00243).

Authority

The authority for the Australian Information Commissioner to approve these guidelines rests in:

• section 95A of the Privacy Act, and
• section 10 of the Australian Information Commissioner Act 2010 (Cth) (the Australian Information Commissioner Act).

Subsections 95A(1), (2) and (4) of the Privacy Act state:

Overview

(1)               This section allows the Commissioner to approve for the purposes of the Australian Privacy Principles that are issued by the CEO of the National Health and Medical Research Council or a prescribed authority.

Approving guidelines for use and disclosure

(2)               For the purposes of paragraph 16B(3)(c), the Commissioner may, by notice in the Gazette, approve guidelines that relate to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety.

[…]

Approving guidelines for collection

(4)                 For the purposes of subparagraph 16B(2)(d)(iii) the Commissioner may, by notice in the Gazette, approve guidelines that relate to the collection of health information for the purposes of:

1. research, or the compilation or analysis of statistics, relevant to public health or public safety; or
2. the management, funding or monitoring of a health service.

Section 6 of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act’.

Relevant provisions of the Privacy Act

The Australian Privacy Principles (APPs) are a set of legally binding privacy principles that establish standards, rights and obligations in relation to the handling, holding, accessing and correcting of personal information. They apply to most Australian Government agencies and certain private sector organisations, collectively referred to as APP entities.

Under the APPs, an APP entity must not collect sensitive information, and must not use or disclose personal information for a purpose other than the primary purpose of collection, unless an exception applies.

Australian Privacy Principle (APP) 6 prohibits uses or disclosures of personal information for secondary purposes unless the individual to whom the personal information relates has consented or a listed exception in relation to the use or disclosure of that information applies.

APP 6.2(d) provides that an APP entity may use or disclosure personal information about an individual if the APP entity is an organisation and a permitted health situation exists in relation to the use or disclosure of the personal information by the entity.

Permitted health situations are set out in section 16B of the Privacy Act. Subsection 16B(2) states that:

A permitted health situation exists in relation to the collection by an organisation of health information about an individual if:

(a)               the collection is necessary for any of the following purposes:

(i)                  research relevant to public health or public safety;

(ii)               the compilation or analysis of statistics relevant to public health or public safety;

(iii)             the management, funding or monitoring of a health service; and

(b)               that purpose cannot be served by the collection of information about the individual that is de-identified information; and

(c)                it is impracticable for the organisation to obtain the individual’s consent to the collection; and

(d)               any of the following apply:

[…]

(iii)             the information is collected in accordance with guidelines approved under section 95A for the purposes of this subparagraph.

Subsection 16B(3) states that:

A permitted health situation exists in relation to the use or disclosure by an organisation of health information about an individual if:

(a)               the use or disclosure is necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety; and

(b)               it is impracticable for the organisation to obtain the individual’s consent to the use or disclosure; and

(c)                the use or disclosure is conducted in accordance with guidelines approved under section 95A for the purposes of this paragraph; and

(d)               in the case of disclosure—the organisation reasonably believes that the recipient of the information will not disclose the information, or personal information derived from that information.

‘Health information’ is defined as follows in section 6FA of the Privacy Act:

health information means:

(a)                information or an opinion about:

(i)                  the health, including an illness, disability or injury, (at any time) of an individual; or

(ii)               an individual’s expressed wishes about the future provision of health services to the individual; or

(iii)             a health service provided, or to be provided, to an individual;

that is also personal information; or

(b)                other personal information collected to provide, or in providing, a health service to an individual; or

(c)                 other personal information collected in connection with the donation, or intended donation, by an individual of his or her body parts, organs or body substances; or

(d)                genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

Background to the guidelines

Section 95A of the Privacy Act allows the Information Commissioner to approve guidelines issued by the CEO of the National Health and Medical Research Council or a prescribed authority that relate to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety; and the collection of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, and the management, funding and monitoring of a health service . Guidelines for this purpose were first issued by the National Health and Medical Research Council in 2001, namely, Guidelines approved under Section 95A of the Privacy Act 1988.

The National Health and Medical Research Council issued a revised version of the guidelines in 2014 to reflect amendments to the Privacy Act made by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth).

The Australian Government released its response to the Privacy Act Review Report in September 2023 and has committed to progressing work on proposals ‘agreed’ and ‘agreed in-principle’. This substantial package of reforms will impact the framework for public interest research under the Privacy Act, including the issuing of the guidelines. As a result, the National Health and Medical Research Council has issued a revised version of the guidelines in substantially the same terms as the 2014 guidelines. This approach will allow for greater certainty around how or if the proposals in the review of the Privacy Act will be implemented before a substantive review of the guidelines is undertaken. A comprehensive review of the guidelines will be undertaken once there is clarity as to the outcomes of the Privacy Act review.

Consultation

As a legislative instrument, the approval must be made in accordance with the requirements in the Legislation Act. Section 17 of the Legislation Act requires that the rule-maker be satisfied that there has been appropriate consultation, which draws on the knowledge of persons having expertise in fields relevant to the proposed instrument’ and ensures that people likely to be affected by the proposed instrument had an adequate opportunity to comment on its proposed content.[1]

The Office of the Australian Information Commissioner (OAIC) undertook public consultation on the draft approval in November-December 2023. Consultation documents were made available on the OAIC’s website during a 4-week consultation period. Comment was invited from the public and the consultation was shared on relevant social media platforms and with relevant National Health and Medical Research Council stakeholders through a fortnightly newsletter.

The OAIC received 2 submissions in response to the public consultation documents. Submissions received expressed concerns with the OAIC’s proposal to include a five-year self-repeal provision in the approval, stating that it could create uncertainty for stakeholders. Submitters were not opposed to approving the guidelines in substantially the same terms. This feedback was considered, and the five-year self-repeal provision was not incorporated into the approval.

Policy Impact Analysis

The Office of Impact Assessment (OIA) assessed the approval and confirmed that the preparation of a detailed Impact Analysis is not required. The OIA reference number is OIA24-06885.

Matters considered in approving the guidelines

Subsection 95A(3) of the Privacy Act requires that the Information Commissioner may give an approval under subsection 95A(2) of guidelines that relate to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety, only if satisfied that the public interest in the use and disclosure of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the APPs (disregarding subsection 16B(3)).

Similarly, subsection 95A(5) of the Privacy Act requires that the Information Commissioner may give an approval under subsection 95A(4) of guidelines relating to the collection of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety; or the management, funding or monitoring of a health service, only if satisfied that the public interest in the collection of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the APPs (disregarding subsection 16B(2)).

The Information Commissioner has considered the public interest matters raised in subsections 95A(3) and (5) and is satisfied that the public interest in the handling of health information for the purposes mentioned in subsections 95A(2) and (4) substantially outweighs the public interest in maintaining the level of privacy protection afforded by the APPs (disregarding subsections 16B(2) and 16B(3)). 

Legal status of the guidelines

The guidelines are legally binding on all private sector organisations that seek to collect, use or disclose health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety; or to collect health information for the management, funding or monitoring of a health service.

A breach of the guidelines constitutes an interference with privacy under section 13 of the Privacy Act because the act or practice would breach an APP in relation to personal information about the individual. An individual may complain to the Office of the Australian Information Commissioner about an act or practice they believe has not been done in accordance with APP 6.2(d).

The guidelines will take effect on 1 April 2024. 

A Statement of Compatibility with Human Rights is at Attachment A.

Attachment A

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Privacy (Guidelines issued under section 95A) Approval 2024

This legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the legislative instrument

This legislative instrument approves the guidelines issued by the CEO of the National Health and Medical Research Council (NHMRC) under section 95A of the Privacy Act 1988 (the Privacy Act) (the guidelines). 

The Privacy Act sets out the Australian Privacy Principles (APPs), which are a set of legally binding privacy principles that establish standards, rights and obligations in relation to the handling, holding, accessing and correcting of personal information. They apply to most Australian Government agencies and certain private sector organisations, collectively referred to as APP entities.

Under the APPs, an APP entity must not collect sensitive information, and must not use or disclose personal information for a purpose other than the primary purpose of collection, unless an exception applies.

APP 6 prohibits uses or disclosures of personal information for secondary purposes unless the individual to whom the personal information relates has consented or a listed exception in relation to the use or disclosure of that information applies.

APP 6.2(d) provides that an APP entity may use or disclose personal information about an individual if the APP entity is an organisation and a permitted health situation exists in relation to the use or disclosure of the personal information by the entity.

A number of permitted health situations are set out in section 16B of the Privacy Act. Section 16B(2) and (3) of the Privacy Act allows organisations to collect, use and disclose health information without consent for certain research purposes if it is done in accordance with the guidelines approved under section 95A of that Act.

Section 95A of the Privacy Act allows the Australian Information Commissioner to approve guidelines issued by the CEO of the NHMRC that relate to:

• the use and disclosure of health information for the purposes of research, or the compilation of analysis of statistics, relevant to public health or public safety; and
• the collection of health information for the purposes of:
  • research, or the compilation or analysis of statistics, relevant to public health or public safety; or
  • the management, funding or monitoring of a health service.

Human rights implications

This legislative instrument engages the following rights:

• the right to protection against unlawful and arbitrary interferences with privacy in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), and
• the right to health in Article 12 of the International Covenant on Economic, Social and Cultural Rights (ISECR).

The Preamble to the Privacy Act makes clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the ICCPR. Specifically, article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence. However, the right to privacy is not absolute and there may be circumstances in which the guarantees in article 17 can be outweighed by other legitimate objectives, such as the protection of the right to health. In any event, interferences with privacy must be authorised by law and not arbitrary. The use of the term arbitrary in the ICCPR means that any interferences with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.

With respect to the right to health, article 12 of the International Covenant on Economic, Social and Cultural Rights (ICESCR) provides that:

1. The State Parties to the present Covenant recognise the right of everyone to the enjoyment of the highest attainable standard of physical and mental health.

Article 12(2) of the ICESCR outlines the steps to be taken to achieve the full realisation of this right, including those necessary for:

(c) The prevention, treatment and control of epidemic, endemic, occupational and other diseases.

In General Comment No. 14: The Right to the Highest Attainable Standard of Health (2000), the United Nations Committee on Economic, Social and Cultural Rights states that ‘health is a fundamental human right indispensable for the exercise of other human rights’, and that ‘the obligation to fulfil (promote) the right to health requires States to undertake actions that create, maintain and restore the health of the population…such obligations include: (i) fostering recognition of factors favouring positive health results, e.g. research and provision of information… (iv) supporting people in making informed choices about their health’.

Collecting, using and disclosing health information for research, or for the compilation or analysis of statistics, is important for providing information to help the community make decisions that impact on the health of individuals and the community. Collecting health information for the properly informed management of health services is necessary to ensure individuals and the community receive the best possible health and medical care.

The collection, use and disclosure of health information without consent under section 16B(2) and (3) of the Privacy Act and the guidelines approved by this legislative instrument facilitate vital research, statistical analysis and health service management activities that provides health benefits to Australian society as a whole. The limitation on the right to privacy in this regard pursues the legitimate objective of advancing the right to health.

The collection, use and disclosure of health information without consent must be a proportionate means by which to achieve the advancement of the right to health. Section 16B(2) and (3) of the Privacy Act ensures that the intrusion on individual privacy is appropriately circumscribed.

Section 16B(2) of the Privacy Act provides that organisations can collect health information about an individual without consent if:

• the collection is necessary only for limited specified purposes, including for research, and the compilation or analysis of statistics, relevant to public health or public safety and for the management, funding or monitoring of a health service;
• that purpose cannot be served by the collection of information about the individual that is de-identified information;
• it is impracticable for the organisation to obtain the individual’s consent to the collection; and
• the information is collected in accordance with guidelines approved under section 95A of the Privacy Act.

Section 16B(3) of the Privacy Act provides that organisations can use or disclose health information about an individual without consent if:

• the use or disclosure is necessary for only limited specified purposes, including for research, and the compilation or analysis of statistics, relevant to public health or public safety;
• it is impracticable for the organisation to obtain the individual’s consent to the use or disclosure;
• the use or disclosure is conducted in accordance with guidelines approved under section 95A of the Privacy Act; and
• in the case of disclosure – the organisation reasonably believes that the recipient of the information will not disclose the information, or personal information derived from that information.

Section 16B(2) and (3) of the Privacy Act specifies a narrow set of circumstances where health information can be collected, used or disclosed without consent, providing a proportionate framework that ensures collection, use or disclosure only occurs where it is reasonable and necessary.

The guidelines approved by this legislative instrument serve to provide additional safeguards and oversight to guide the collection, use or disclosure of health information under section 16B(2) and (3). The guidelines seek to further curtail the circumstances in which the right to privacy can be limited to proposed activities that have been assessed and approved by human research ethics committees, ensuring that health information collected, used and disclosed is reasonable and necessary to addressing the potential harm.

These additional safeguards set out in the guidelines further mitigate and minimise the privacy impacts to individuals, including by:

• providing guidance for the conduct of research, or the compilation or analysis of statistics, relevant to public health or public safety and the management, funding or monitoring of a health service;
• providing for the review and approval of research, the compilation or analysis of statistics or the management, funding or monitoring of health service proposals by human research ethics committees to assess whether such proposals are consistent with the guidelines and the public interest in the proposed activity outweighs the public interest in the protection of privacy; and
• referencing the NHMRC’s National Statement on Ethical Conduct and the Australian Code for the Responsible Conduct of Research to provide further guidance on broader ethical obligations in the conduct of research, statistical and health service management activities.

In approving the guidelines, the Australian Information Commissioner has considered the competing rights to privacy and health. It is considered that the limitation on the right to privacy authorised by section 16B(2) and (3) of the Privacy Act and the guidelines approved by this legislative instrument pursues the legitimate objective of advancing the protection of human rights and the right to health. Section 16B(2) and (3) appropriately circumscribes the collection, use and disclosure of health information without consent. The guidelines provide additional safeguards beyond those prescribed in the legislation to further curtail the circumstances in which health information can be collected, used and disclosed without consent ensuring that any limitations on privacy are reasonable, necessary and proportionate.

Conclusion

The Privacy (Guidelines issued under section 95A) Approval 2024 by the Australian Information Commissioner is compatible with human rights because it advances the protection of human rights and to the extent that it may also limit human rights, those limitations are reasonable, necessary and proportionate.

Angelene Falk, Australian Information Commissioner

Note: The name of this instrument was amended on registration as the instrument as lodged did not have a unique name (see subsection 10(2), Legislation Rule 2016).

[1]  See Federal Register of Legislation - Legislation Act 2003.