Explanatory Statement

Privacy (Guidelines issued under section 95AA) Approval 2024

This explanatory statement has been prepared by the Australian Information Commissioner. It fulfils the Commissioner’s obligations under subsection 15J(2) of the Legislation Act 2003 (Cth) (Legislation Act).

It explains the purpose and operation of the Privacy (Guidelines issued under section 95AA) Approval 2024 (the approval) about the use and disclosure of an individual’s genetic information to a genetic relative without the individual’s consent.

Purpose

The Australian Information Commissioner is empowered by section 95AA of the Privacy Act 1988 (Cth) (Privacy Act) to approve guidelines issued by the National Health and Medical Research Council relating to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates (the guidelines).

This approval replaces the Approval by the Privacy Commissioner of guidelines issued under section 95AA of the Privacy Act 1988 (March 2014, FRLI F2014L00244).

Authority

The authority for the Australian Information Commissioner to approve these guidelines rests in:

• section 95AA of the Privacy Act, and
• section 10 of the Australian Information Commissioner Act 2010 (Cth) (the Australian Information Commissioner Act).

Subsections 95AA(1) to (2) of the Privacy Act state:

(1)    This section allows the Commissioner to approve for the purposes of the Australian Privacy Principles guidelines that are issued by the National Health and Medical Research Council.

(2)    For the purposes of paragraph 16B(4)(c), the Commissioner may, by legislative instrument, approve guidelines that relate to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates.

Section 6 of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act’.

Relevant provisions of the Privacy Act

The Australian Privacy Principles (APPs) are a set of legally binding privacy principles that establish standards, rights and obligations in relation to the handling, holding, accessing and correcting of personal information. They apply to most Australian Government agencies and certain private sector organisations, collectively referred to as APP entities.

Under the APPs, an APP entity must not collect sensitive information, and must not use or disclose personal information for a purpose other than the primary purpose of collection, unless an exception applies.

Australian Privacy Principle (APP) 6 prohibits uses or disclosures of personal information for secondary purposes unless the individual to whom the personal information relates has consented or a listed exception in relation to the use or disclosure of that information applies.

APP 6.2(d) provides that an APP entity may use or disclose personal information about an individual if the APP entity is an organisation and a permitted health situation exists in relation to the use or disclosure of the personal information by the entity.

Permitted health situations are set out in section 16B of the Privacy Act. Subsection 16B(4) states that:

A permitted health situation exists in relation to the use or disclosure by an organisation of genetic information about an individual (the first individual) if:

(a)                the organisation has obtained the information in the course of providing a health service to the first individual; and

(b)                the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of another individual who is a genetic relative of the first individual; and

(c)                the use or disclosure is conducted in accordance with guidelines approved under section 95AA; and

(d)                in the case of disclosure—the recipient of the information is a genetic relative of the first individual.

‘Genetic information’ is not defined in the Privacy Act. The definitions of ‘health information’ in section 6FA and ‘sensitive information’ in subsection 6(1) include ‘genetic information’, without expressly defining ‘genetic information’.

‘Genetic relative’ is defined as follows in subsection 6(1) of the Privacy Act:

genetic relative of an individual (the first individual) means another individual who is related to the first individual by blood, including but not limited to a sibling, a parent or a descendant of the first individual.

‘Health service’ is defined as follows in section 6FB of the Privacy Act:

health service means:

(1)    An activity performed in relation to an individual is a health service if the activity is intended or claimed (expressly or otherwise) by the individual or the person performing it:

(a)                to assess, maintain or improve the individual’s health; or

(b)                where the individual’s health cannot be maintained or improved—to manage the individual’s health; or

(c)                to diagnose the individual’s illness, disability or injury; or

(d)                to treat the individual’s illness, disability or injury or suspected illness, disability or injury; or

(e)                to record the individual’s health for the purposes of assessing, maintaining, improving or managing the individual’s health.

(2)    The dispensing on prescription of a drug or medicinal preparation by a pharmacist is a health service.

(3)    To avoid doubt:

(a)                a reference in this section to an individual’s health includes the individual’s physical or psychological health; and

(b)                an activity mentioned in subsection (1) or (2) that takes place in the course of providing aged care, palliative care or care for a person with a disability is a health service.

Background to the guidelines

In 2006, the Privacy Act was amended to safeguard the handling of genetic information by changing the definitions of ‘health information’ and ‘sensitive information’ to expressly include genetic information.[1] Genetic information that is not otherwise health information, such as the result of a parentage test, is not treated as health information, but is sensitive information.

The Privacy Legislation Amendment Act 2006 also introduced an additional exception to the general requirement that personal information must not be used or disclosed for any purpose other than that for which it was collected.[2] The exception provides for the use or disclosure of genetic information of an individual by an organisation where the organisation has obtained the genetic information in the course of providing a health service to the individual, and in circumstances where the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to life, health or safety of a person who is the individual’s genetic relative. In the case of disclosure, the recipient of the individual’s genetic information must be a genetic relative of that individual.

Section 95AA of the Privacy Act allows the Commissioner to approve guidelines issued by the National Health and Medical Research Council that relate to circumstances in which genetic information may be used or disclosed without the consent of the individual to whom the genetic information relates. Guidelines for this purpose were first issued by the National Health and Medical Research Council in 2009, namely, Use and disclosure of genetic information to a patient’s genetic relatives under Section 95AA of the Privacy Act 1988 (Cth) – guidelines for health practitioners in the private sector.

The National Health and Medical Research Council issued a revised version of the guidelines in 2014 to reflect amendments to the Privacy Act made by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth).

The Australian Government released its response to the Privacy Act Review Report in September 2023 and has committed to progressing work on proposals ‘agreed’ and ‘agreed in-principle’. This substantial package of reforms will impact the framework for public interest research under the Privacy Act, including the issuing of the guidelines. As a result, the National Health and Medical Research Council has issued a revised version of the guidelines in substantially the same terms as the 2014 guidelines. This approach will allow for greater certainty around how or if the proposals in the review of the Privacy Act will be implemented before a substantive review of the guidelines is undertaken. A comprehensive review of the guidelines will be undertaken once there is clarity as to the outcomes of the Privacy Act review.

Consultation

As a legislative instrument, the approval must be made in accordance with the requirements in the Legislation Act. Section 17 of the Legislation Act requires that the rule-maker be satisfied that there has been appropriate consultation, which draws on the knowledge of persons having expertise in fields relevant to the proposed instrument and ensures that people likely to be affected by the proposed instrument had an adequate opportunity to comment on its proposed content.[3]

The Office of the Australian Information Commissioner (OAIC) undertook public consultation on the draft approval in November-December 2023. Consultation documents were made available on the OAIC’s website during a 4-week consultation period. Comment was invited from the public and the consultation was shared on relevant social media platforms and with relevant National Health and Medical Research Council stakeholders through a fortnightly newsletter.

The OAIC received 2 submissions in response to the public consultation documents. Submissions received expressed concerns with the OAIC’s proposal to include a five-year self-repeal provision in the approval, stating that it could create uncertainty for stakeholders. Submitters were not opposed to approving the guidelines in substantially the same terms. This feedback was considered, and the five-year self-repeal provision was not incorporated into the approval.

Policy Impact Analysis

The Office of Impact Assessment (OIA) assessed the approval and confirmed that the preparation of a detailed Impact Analysis is not required. The OIA reference number is OIA24-06886.

Legal status of the guidelines

The guidelines are legally binding on all private sector organisations that have obtained genetic information in the course of providing a health service.

The guidelines establish when, by whom and in what manner the use or disclosure of genetic information without consent may take place under APP 6.2(d) and section 16B(4) of the Privacy Act. Use or disclosure to genetic relatives under APP 6.2(d) and section 16B(4) is only permitted in accordance with these guidelines. 

A breach of the guidelines constitutes an interference with privacy under section 13 of the Privacy Act because the act or practice would breach an APP in relation to personal information about the individual. An individual may complain to the Office of the Australian Information Commissioner about an act or practice they believe has not been done in accordance with APP 6.2(d).

In addition to setting out binding legal requirements, the guidelines provide general advice on good practice to assist health practitioners to meet their obligations under APP6.2(d), s 16B(4) and the guidelines.

The guidelines will take effect on 1 April 2024.

A Statement of Compatibility with Human Rights is at Attachment A.

Attachment A

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Privacy (Guidelines issued under section 95AA) Approval 2024

This legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the legislative instrument

This legislative instrument approves the guidelines issued by the National Health and Medical Research Council (NHMRC) under section 95AA of the Privacy Act 1988 (Privacy Act) (the guidelines).

The Privacy Act sets out the Australian Privacy Principles (APPs), which are a set of legally binding privacy principles that establish standards, rights and obligations in relation to the handling, holding, accessing and correcting of personal information. They apply to most Australian Government agencies and certain private sector organisations, collectively referred to as APP entities.

Under the APPs, an APP entity must not collect sensitive information, and must not use or disclose personal information for a purpose other than the primary purpose of collection, unless an exception applies.

APP 6 prohibits uses or disclosures of personal information for secondary purposes unless the individual to whom the personal information relates has consented or a listed exception in relation to the use or disclosure of that information applies.

APP 6.2(d) provides that an APP entity may use or disclose personal information about an individual if the APP entity is an organisation and a permitted health situation exists in relation to the use or disclosure of the personal information by the entity.

Permitted health situations are set out in section 16B of the Privacy Act. Section 16B(4) of the Privacy Act allows organisations to use and disclose genetic information without consent for certain purposes if it is conducted in accordance with the guidelines approved under section 95AA of that Act.

Section 95AA of the Privacy Act allows the Australian Information Commissioner to approve guidelines issued by the NHMRC that relate to the use and disclosure of genetic information for the purposes of lessening or preventing a serious threat to the life, health or safety of an individual who is a genetic relative of the individual to whom the genetic information relates.

Human rights implications

This legislative instrument engages the following rights:

• the right to protection against unlawful and arbitrary interferences with privacy in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), and
• the right to health in Article 12 of the International Covenant on Economic, Social and Cultural Rights (ISECR).

The Preamble to the Privacy Act makes clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the ICCPR. Specifically, article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence. However, the right to privacy is not absolute and there may be circumstances in which the guarantees in article 17 can be outweighed by other legitimate objectives, such as the protection of the right to health. In any event, interferences with privacy must be authorised by law and not arbitrary. The use of the term arbitrary in the ICCPR means that any interferences with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.

With respect to the right to health, article 12 of the ICESCR provides that:

1. The State Parties to the present Covenant recognise the right of everyone to the enjoyment of the highest attainable standard of physical and mental health.

Article 12(2) of the ICESCR outlines the steps to be taken to achieve the full realisation of this right, including those necessary for:

(c) The prevention, treatment and control of epidemic, endemic, occupational and other diseases.

In General Comment No. 14: The Right to the Highest Attainable Standard of Health (2000), the United Nations Committee on Economic, Social and Cultural Rights states that ‘health is a fundamental human right indispensable for the exercise of other human rights’, and that the right to be healthy is not to be understood as a right to be healthy, but includes the right to a system of health protection which provides equal opportunity for people to enjoy the highest attainable level of health.  

Genetic information resulting from assessment of an individual may be relevant not only to that person but also to genetic relatives, due to the shared genetic heritage within families. The use or disclosure of genetic information in appropriate circumstances can prevent serious health consequences for genetic relatives by allowing the early detection and treatment of inherited genetic disorders. The limitation on the right to privacy in this regard pursues the legitimate objective of advancing the right to health.

The use and disclosure of genetic information without consent must be a proportionate means by which to achieve the advancement of the right to health. Section 16B(4) of the Privacy Act ensures that the intrusion on individual privacy is appropriately circumscribed.

Section 16B(4) of the Privacy Act provides that organisations can only use or disclose genetic information about an individual (the first individual) without consent if:

• the organisation has obtained the information in the course of providing a health service to the first individual;
• the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of another individual who is the genetic relative of the first individual;
• the use or disclosure is conducted in accordance with the guidelines approved under section 95AA of the Privacy Act; and
• in the case of disclosure – the recipient of the information is a genetic relative of the first individual.

Section 16B(4) of the Privacy Act specifies a narrow set of circumstances where genetic information can be used or disclosed without consent, providing a proportionate framework that ensures use or disclosure only occurs where it is reasonable and necessary.

The guidelines approved by this legislative instrument serve to provide additional safeguards and oversight to guide the use or disclosure of genetic information under section 16B(4). The guidelines seek to further curtail the circumstances in which the right to privacy can be limited to situations that are reasonable and necessary to addressing the potential harm. Noting that the guidelines do not oblige the use or disclosure of such information but provides the framework for this to occur in a proportionate way.

The additional requirements set out in the guidelines that must be met for use or disclosure under section 16B(4) to occur include that:

• certain ethical considerations must be taken into account when making a decision about whether or not to use or disclose genetic information without consent;
• reasonable steps must be taken to first obtain the consent of the individual to use or disclose genetic information;
• the medical practitioner authorising the use or disclosure should have a significant role in the care of the individual and sufficient knowledge of the condition and its genetic basis;
• prior to any decision concerning the use or disclosure, the authorising medical practitioner must discuss the case with other health practitioners with appropriate expertise;
• where practicable, the identity of the individual should not be apparent or readily ascertainable in the course of inter-professional communication;
• disclosure of genetic information should be limited to only the information necessary for communicating the increased risk and should avoid identifying the individual or conveying that there was no consent for the disclosure;
• disclosure of genetic information should generally be limited to relatives no further removed than third-degree relatives; and
• that all stages of the process must be fully documented.

In approving the guidelines, the Australian Information Commissioner has considered the competing rights to privacy and health. It is considered that the limitation on the right to privacy authorised by section 16B(4) of the Privacy Act and the guidelines approved by this legislative instrument pursues the legitimate objective of advancing the protection of human rights and the right to health. Section 16B(4) of the Privacy Act and the guidelines approved by this legislative instrument specify in detail the precise circumstances in which an interference with privacy is permitted ensuring that the means to achieving the legitimate objective are reasonable, necessary and proportionate.

Conclusion

The Privacy (Guidelines issued under section 95AA) Approval 2024 by the Australian Information Commissioner is compatible with human rights because it advances the protection of human rights and to the extent that it may also limit human rights, those limitations are reasonable, necessary and proportionate.

Angelene Falk, Australian Information Commissioner

Note: The name of this instrument was amended on registration as the instrument as lodged did not have a unique name (see subsection 10(2), Legislation Rule 2016).

[1] Privacy Legislation Amendment Act 2006, Schedule 2, clauses 2 and 3.

[2] Privacy Legislation Amendment Act 2006, Schedule 2, clause 5.

[3]  See Federal Register of Legislation - Legislation Act 2003.