Explanatory Statement

Privacy (Persons Reported as Missing) Rule 2014

This explanatory statement has been prepared by the Privacy Commissioner, in accordance with the functions and powers conferred on him by section 12 of the Australian Information Commissioner Act 2010 (Cth) (the Australian Information Commissioner Act).

It explains the purpose and intended operation of the Privacy (Persons Reported as Missing) Rule 2014 (the Rule) made under subsection 16A(2) of the Privacy Act 1988 (Privacy Act).

Authority for the Rule

The Australian Information Commissioner is empowered by subsection 16A(2) of the Privacy Act to make the Rule.

Subsection 16A(2) of the Privacy Act states:

The Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).

Subsection 6(1) of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010.’

Item 3 of the table in subsection 16A(1) states:

An APP entity is permitted to collect, use or disclose personal information if:

(a)   the entity reasonably believes that the collection, use or disclosure is reasonably necessary to assist any APP entity, body or person to locate a person who has been reported as missing, and

(b)   the collection, use or disclosure complies with the rules made under subsection (2).

As a ‘privacy function’ the Rule can be made by the Privacy Commissioner in accordance with the functions and powers conferred in s 12 of the Australian Information Commissioner Act.

Purpose

The purpose of the Rule is to give effect to item 3 of the table in subsection 16A(1) of the Privacy Act, which subject to the conditions specified in column 3 of the table, permits an APP entity to collect sensitive information, and use or disclose personal information for the purpose of locating a person reported as missing.

In making the Rule, the Privacy Commissioner has had regard to the objects of the Privacy Act, in particular:

• to promote the protection of the privacy of individuals (s 2A(a))
• to promote responsible and transparent handling of personal information by entities (s 2A(d)).

Operation of the Rule

The Australian Privacy Principles (APPs) are legally binding principles that set out standards, rights and obligations in relation to handling, holding, accessing and correcting personal information. They apply to most Australian and Norfolk Island Government agencies and certain private sector organisations – collectively referred to as APP entities.

Under the APPs, an APP entity must not collect sensitive information, and must not disclose personal information for a purpose other than the primary purpose of collection, unless an exception applies. One exception is the existence of a permitted general situation. The permitted general situations are set out in s 16A(1) of the Privacy Act.

The collection, use or disclosure of personal information by an APP entity under permitted general situation 3 must be in accordance with the Rule. Permitted general situation 3 provides an exception to the general prohibition of the collection of sensitive information, and the use and disclosure of personal information for a secondary purpose by an APP entity.

The Rule limits the scope of the permitted general situation 3, in the following ways:[1]

• an APP entity must only collect sensitive information if it is a locating body as defined in the rule
• the sensitive information that is collected by the locating body must be limited to the extent reasonably necessary to make contact with, or offer ‘proof of life’ of the person reported as missing
• an APP entity must only use or disclose the personal information of a person reported as missing in response to requests from locating bodies, as defined in the rule
• an APP entity must only use or disclose the personal information of a person reported as missing with that individual’s consent, or in circumstances where it is unreasonable or impracticable to obtain the individual’s consent
• where it is unreasonable or impracticable to obtain the consent of a person reported as missing, the use or disclosure of their personal information must not be contrary to any wish expressed by the person reported as missing of which the APP entity is aware
• the personal information that is used or disclosed must be limited to the extent reasonably necessary to make contact with, or offer ‘proof of life’ of the person reported as missing, and
• an APP entity must not collect sensitive information, or use or disclose personal information if the APP entity reasonably believes that the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual.

The Rule makes clear that an APP entity is permitted, but is not required, to collect, use or disclose personal information where necessary to assist in locating a person reported as missing.

Details of the Rule are set out in the Attachment.

Consultation

Consistent with the requirements of the Legislative Instruments Act[2] and the recommendations set out in the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012, the Office of the Australian Information Commissioner undertook a comprehensive three stage consultation process:

• preliminary consultation with selected bodies involved in locating missing persons
• targeted consultation on a draft set of rules and guidance material.
• public consultation on the draft set of rules.

The OAIC incorporated the information gained during preliminary consultation, and the feedback received during the targeted consultation, and released a draft set of rules for public consultation in December 2013. Comment was invited from locating bodies and Australian Government agencies. Consultation documents were made available on the OAIC’s website during the seven week consultation period.

The OAIC received three written submissions in response to the consultation documents. The submissions are available on the OAIC website.

The submissions received in relation to these consultations were considered and incorporated where possible in finalising the Privacy (Persons Reported as Missing) Rule 2014.

The Rule is substantially similar to that provided for public consultation.

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Privacy (Persons Reported as Missing) Rule 2014

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The purpose of the Privacy (Persons Reported as Missing) Rule 2014 (the Rule) is to give effect to item 3 of the table in subsection 16A(1) of the Privacy Act 1988, which subject to the conditions specified in column 3 of the table, permits an APP entity to collect sensitive information, and use or disclose personal information for the purpose of locating a person reported as missing.

Human rights implications

The Rule engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR), which provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference and attacks.

The Rule protects against the arbitrary interference with privacy, and advances the right to the protection of the law against such interference, by introducing a number of specific limitations on the operation of the permitted general situation at item 3 of the table in subsection 16A(1) of the Privacy Act 1988, including by:

• limiting the entities that may collect sensitive information
• limiting the type of personal information (including sensitive information) that may be collected, used or disclosed
• limiting the entities that an APP entity may use or disclose personal information to
• limiting the circumstances in which an APP entity may use or disclose personal information
• emphasising that an APP entity is permitted, but not required, to use or disclose personal information.

Conclusion

The Rule is compatible with human rights because it advances the protection of human rights by limiting the circumstances in which an APP entity may collect, use or disclose the personal information of an individual in accordance with item 3 of subsection 16A(1) of the Privacy Act.

Timothy Pilgrim, Privacy Commissioner

Attachment

Details of the Privacy (Persons Reported as Missing) Rule 2014

1. Name of Rule

Section 1 provides that the title of the Rule is the Privacy (Persons Reported as Missing) Rule 2014.

2.      Commencement

Section 2 provides that the Rule commences on 12 March 2014.

3.      Purpose

Section 3 sets out the purpose of the Rule.

4.      Definitions

Section 4 provides for the definitions of words and expressions used in the Rule, including a definition of ‘locating body’, and a definition for ‘a person reported as missing’.

The entities listed in the definition of a ‘locating body’ are the key entities involved in locating persons reported as missing in Australia, or Australians reported as missing overseas.

Inclusion on the list of locating bodies is not an endorsement of the information handling practices or searching processes undertaken by these bodies.

An individual will only be a ‘person reported as missing’ under the Rule if they have been reported as missing to a locating body, their whereabouts are unknown to the locating body, and they are being sought by the locating body because there are serious concerns for their safety and/or welfare, or for the purpose of re-uniting them with their family, but not in relation to other matters.

5.      Collection of sensitive information by a locating body

Section 5 sets out the conditions in which an APP entity may collect sensitive information under item 3 of the table in subsection 16A(1) of the Privacy Act.

Paragraph 5(1)(a) requires that the APP entity be a locating body.

Paragraph 5(1)(b) requires that the APP entity reasonably believes that the collection is reasonably necessary to assist the entity to locate the person reported as missing.

Paragraph 5(1)(c) requires that the information collected is limited to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing.

Paragraph 5(1)(d) prohibits the collection of sensitive information if the APP entity reasonably believes that the collection would pose a serious threat to the life, health or safety of any individual.

To form a reasonable belief, the APP entity must take reasonable steps to determine whether the collection of the sensitive information would pose a serious threat to the life, health or safety of any individual.

6.      Use or disclosure of personal information without the consent of the person reported as missing.

Subsection 6(1) sets out the conditions in which an APP entity may use or disclose personal information under item 3 of the table in subsection 16A(1) of the Privacy Act.

Paragraph 6(1)(a) requires that the use or disclosure is in response to a request from a locating body.

Paragraph 6(1)(b) requires that the APP entity reasonably believes that the use or disclosure is reasonably necessary to assist the locating body to locate a person reported as missing.

Paragraph 6(1)(c) requires that in the case of disclosure the recipient of the information is a locating body.

Paragraph 6(1)(d) requires that in order to use or disclose the personal information it must be unreasonable or impracticable to obtain the consent of the person reported as missing to the use or disclosure of the information.

Paragraph 6(1)(e) limits the use or disclosure to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing.

Paragraph 6(1)(f) requires that the use or disclosure is not contrary to any wish expressed by the person reported as missing of which the APP entity is aware.

This means that use or disclosure cannot occur if the use or disclosure goes against any known wishes of the person reported as missing.

Paragraph 6(1)(g) prohibits the use or disclosure of personal information if the APP entity reasonably believes that the use or disclosure would pose a serious threat to the life, health or safety of any individual.

To form a reasonable belief, the APP entity must take reasonable steps to assess whether the use or disclosure of the personal information would pose a serious threat to the life, health or safety of any individual.

Subsection 6(2) requires an APP entity to make a written note of the disclosure of personal information under subsection (1).

7.      Collection, use or disclosure must not pose a serious threat to an individual

Section 7 prohibits the collection, use or disclosure of personal information if the APP entity reasonably believes that the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual.

8.      Operation of the Rule

Subsection 8(1) provides that nothing in the Rule is intended to impact on other legislative provisions dealing with the collection, use or disclosure of the personal information of a person reported as missing.

Subsection 8(2) provides that nothing in the Rule is to be taken to require an APP entity to collect, use or disclose personal information.

[1] These matters are listed in the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 as matters that the Information Commissioner’s Rules should address.

[2] See the Legislative Instruments Act 2003, s 17.