Explanatory Statement

Issued by the authority of the Australian Information Commissioner.

Privacy (Persons Reported as Missing) Rule 2024

This explanatory statement explains the purpose and intended operation of the Privacy (Persons Reported as Missing) Rule 2024 (the Rule) made under subsection 16A(2) of the Privacy Act 1988 (Privacy Act). The Rule replaces the Privacy (Persons Reported as Missing) Rule 2014 (Previous Rule) which was due to sunset on 1 April 2024.

Authority for the Rule

The Australian Information Commissioner is empowered by subsection 16A(2) of the Privacy Act to make the Rule.

Subsection 16A(2) of the Privacy Act states:

The Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).

Subsection 6(1) of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010.’

Item 3 of the table in subsection 16A(1) states:

An APP entity is permitted to collect, use or disclose personal information if:

(a)    the entity reasonably believes that the collection, use or disclosure is reasonably necessary to assist any APP entity, body or person to locate a person who has been reported as missing, and

(b)    the collection, use or disclosure complies with the rules made under subsection (2).

Purpose

The purpose of the Rule is to give effect to item 3 of the table in subsection 16A(1) of the Privacy Act, which subject to the conditions specified in column 3 of the table, permits an APP entity to collect sensitive information, and use or disclose personal information for the purpose of locating a person reported as missing.

In making the Rule, the Information Commissioner has had regard to the objects of the Privacy Act, in particular:

• to promote the protection of the privacy of individuals (s 2A(a))
• to promote responsible and transparent handling of personal information by entities (s 2A(d)).

Operation of the Rule

The Australian Privacy Principles (APPs) are legally binding principles that set out standards, rights and obligations in relation to handling, holding, accessing and correcting personal information. They apply to most Australian and Norfolk Island Government agencies and certain private sector organisations – collectively referred to as APP entities.

Under the APPs, an APP entity must not collect sensitive information, and must not disclose personal information for a purpose other than the primary purpose of collection, unless an exception applies. One exception is the existence of a permitted general situation. The permitted general situations are set out in s 16A(1) of the Privacy Act.

The collection, use or disclosure of personal information by an APP entity under permitted general situation 3 must be in accordance with the Rule. Permitted general situation 3 provides an exception to the general prohibition of the collection of sensitive information, and the use and disclosure of personal information for a secondary purpose by an APP entity.

The Rule limits the scope of the permitted general situation 3, in the following ways:[1]

• an APP entity must only collect sensitive information if it is a locating entity as defined in the rule
• the sensitive information that is collected by the locating entity must be limited to the extent reasonably necessary to make contact with, or offer ‘proof of life’ of the person reported as missing
• an APP entity must only use or disclose the personal information of a person reported as missing in response to requests from locating entities, as defined in the rule
• an APP entity must only use or disclose the personal information of a person reported as missing with that individual’s consent, or in circumstances where it is unreasonable or impracticable to obtain the individual’s consent
• where it is unreasonable or impracticable to obtain the consent of a person reported as missing, the use or disclosure of their personal information must not be contrary to any wish expressed by the person reported as missing of which the APP entity is aware
• the personal information that is used or disclosed must be limited to the extent reasonably necessary to make contact with, or offer ‘proof of life’ of the person reported as missing, and
• an APP entity must not collect sensitive information, or use or disclose personal information if the APP entity reasonably believes that the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual.

The Rule makes clear that an APP entity is permitted, but is not required, to collect, use or disclose personal information where necessary to assist in locating a person reported as missing.

Details of the Rule are set out in Attachment A.

A Statement of Compatibility with Human Rights is at Attachment B.

Consultation

Consistent with the requirements of section 17 of the Legislation Act 2003, the Office of the Australian Information Commissioner (OAIC) has undertaken a two-stage consultation process, involving:

• preliminary consultation with selected entities involved in locating missing persons, including those entities which were defined as a ‘locating bodies’ under the Privacy (Persons Reported as Missing) Rule 2014; and 
• public consultation on  a draft rule.

The OAIC incorporated the feedback received during preliminary consultation and released an amended draft rule for public consultation in November 2023. Comment on the proposed amendments was invited from interested individuals, agencies and organisations. Consultation documents were made available on the OAIC’s website during the four week consultation period.

The OAIC received four written submissions in response to the public consultation documents.

The submissions received in relation to the preliminary and public consultations were considered and incorporated where appropriate in finalising the Privacy (Persons Reported as Missing) Rule 2024.

The Rule is substantially to the same as that provided for the public consultation process.

Changes from the Previous Rule

The Information Commissioner has updated the Rule with minor amendments based on feedback received during the consultation process:

• replacing the term ‘locating body’ with ‘locating entity’
• revising the definition of ‘locating entity’ to:
  • remove the Salvation Army Family Tracing Service, which is no longer in operation,
  • amend the reference to Australian Red Cross Tracing Service to Australian Red Cross Society
•  inserting a Note to clause 6 to clarify that after a missing person is found, any subsequent use or disclosure of personal information must comply with Australian Privacy Principle 6
• inserting an ‘Authority’ clause.
• The changes are largely intended to have a clarifying effect to ensure the Rule is up to date and usable.

Policy Impact Analysis

The Office of Impact Assessment (OIA) has assessed the Rule as unlikely to have more than a minor regulatory impact. The OIA has confirmed that the preparation of a Policy Impact Analysis is not required for the Rule. The OIA reference number is OIA24-06555.

Attachment A

Details of the Privacy (Persons Reported as Missing) Rule 2024

1. Name of Rule

Section 1 provides that the title of the Rule is the Privacy (Persons Reported as Missing) Rule 2024.

2.       Commencement

Section 2 provides that the Rule commences on 1 April 2024.

2A.  Authority

Section 2A states that the Rule is made under s 16A(2) of the Privacy Act 1988.

3.       Purpose

Section 3 sets out the purpose of the Rule.

4.       Definitions

Section 4 provides for the definitions of words and expressions used in the Rule, including a definition of ‘locating entity’, and a definition for ‘a person reported as missing’.

The entities listed in the definition of a ‘locating entity’ are the key entities involved in locating persons reported as missing in Australia, or Australians reported as missing overseas.

Inclusion on the list of locating entities is not an endorsement of the information handling practices or searching processes undertaken by these bodies.

An individual will only be a ‘person reported as missing’ under the Rule if they have been reported as missing to a locating entity, their whereabouts are unknown to the locating entity, and they are being sought by the locating entity because there are serious concerns for their safety and/or welfare, or for the purpose of re-uniting them with their family, but not in relation to other matters.

In circumstances where a person has been reported as missing to a locating entity, and their whereabouts remain unknown to that entity, they fall within the definition of ‘person reported as missing’ for the purposes of the Rule (where the other elements of the definition are satisfied) even if another APP entity does not consider the person to be missing.

5.       Collection of sensitive information by a locating entity

Section 5 sets out the conditions in which an APP entity may collect sensitive information under item 3 of the table in subsection 16A(1) of the Privacy Act.

Paragraph 5(1)(a) requires that the APP entity be a locating entity.

Paragraph 5(1)(b) requires that the APP entity reasonably believes that the collection is reasonably necessary to assist the entity to locate the person reported as missing.

Paragraph 5(1)(c) requires that the information collected is limited to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing.

Paragraph 5(1)(d) prohibits the collection of sensitive information if the APP entity reasonably believes that the collection would pose a serious threat to the life, health or safety of any individual.

To form a reasonable belief, the APP entity must take reasonable steps to determine whether the collection of the sensitive information would pose a serious threat to the life, health or safety of any individual.

6.       Use or disclosure of personal information without the consent of the person reported as missing.

Subsection 6(1) sets out the conditions in which an APP entity may use or disclose personal information under item 3 of the table in subsection 16A(1) of the Privacy Act.

Paragraph 6(1)(a) requires that the use or disclosure is in response to a request from a locating entity.

Paragraph 6(1)(b) requires that the APP entity reasonably believes that the use or disclosure is reasonably necessary to assist the locating entity to locate a person reported as missing.

Paragraph 6(1)(c) requires that in the case of disclosure the recipient of the information is a locating entity.

Paragraph 6(1)(d) requires that in order to use or disclose the personal information it must be unreasonable or impracticable to obtain the consent of the person reported as missing to the use or disclosure of the information.

Paragraph 6(1)(e) limits the use or disclosure to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing.

Paragraph 6(1)(f) requires that the use or disclosure is not contrary to any wish expressed by the person reported as missing of which the APP entity is aware.

This means that use or disclosure cannot occur if the use or disclosure goes against any known wishes of the person reported as missing.

Paragraph 6(1)(g) prohibits the use or disclosure of personal information if the APP entity reasonably believes that the use or disclosure would pose a serious threat to the life, health or safety of any individual.

To form a reasonable belief, the APP entity must take reasonable steps to assess whether the use or disclosure of the personal information would pose a serious threat to the life, health or safety of any individual.

Subsection 6(2) requires an APP entity to make a written note of the disclosure of personal information under subsection (1).

A note to subsection 6(2) clarifies that after a person reported as missing has been located, any subsequent use and disclosure of that person’s personal information must comply with the Australian Privacy Principles (APPs), particularly APP 6. APP 6 outlines the circumstances in which an APP entity may use or disclose personal information.

7.       Collection, use or disclosure must not pose a serious threat to an individual

Section 7 prohibits the collection, use or disclosure of personal information if the APP entity reasonably believes that the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual.

8.       Operation of the Rule

Subsection 8(1) provides that nothing in the Rule is intended to impact on other legislative provisions dealing with the collection, use or disclosure of the personal information of a person reported as missing.

Subsection 8(2) provides that nothing in the Rule is to be taken to require an APP entity to collect, use or disclose personal information.

Attachment B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Privacy (Persons Reported as Missing) Rule 2024

This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The purpose of the Privacy (Persons Reported as Missing) Rule 2024 (the Rule) is to give effect to item 3 of the table in subsection 16A(1) of the Privacy Act 1988, which subject to the conditions specified in column 3 of the table, permits an APP entity to collect sensitive information, and use or disclose personal information for the purpose of locating a person reported as missing. Subsection 16A(2) of the Privacy Act states that the Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).

Item 3 of the table in subsection 16A(1) constitutes one of seven ‘permitted general situations’ under the Privacy Act and provides an exception to the information handling requirements imposed by the Australian Privacy Principles (APPs) in relation to the collection of sensitive information (APP 3) and the use or disclosure of personal information (APP 6).

The Rule limits the scope of the permitted general situation by placing strict requirements around the circumstances in which it applies. The Rule gives effect to the intention of the Parliament by addressing the matters identified by the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012, which enacted section 16A, as  being matters that rules made under subsection 16A(2) should address:

• that uses and disclosures should only be in response to requests from appropriate bodies with recognised authority for investigating reported missing persons
• that, where reasonable and practicable, the individual’s consent should be sought before using or disclosing their personal information
• where it is either unreasonable or impracticable to obtain consent from the individual, any use or disclosure should not go against any known wishes of the individual
• disclosure of personal information should be limited to that which is necessary to offer ‘proof of life’ or contact information, and
• agencies and organisations should take reasonable steps to assess whether disclosure would pose a serious threat to any individual.

The Rule is aimed at assisting entities to handle personal information in an appropriate way that facilitates the locating of persons who have been reported as missing while protecting the privacy interests of the missing person. The Rule contains minor updates from the Privacy (Persons Reported as Missing) Rule 2014 based on feedback received from stakeholders during the consultation process. These include minor changes to the definition of ‘locating entity’ to remove a family tracing service that is no longer in operation, and the insertion of a Note to clause 6 clarifies that after a missing person is found, any subsequent use or disclosure of personal information must comply with Australian Privacy Principle 6.

Human rights implications

The Rule engages the following rights:

• the right to privacy – Article 17 of the International Covenant on Civil and Political Rights (ICCPR)

Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference and attacks.

The term ‘arbitrary’ in Article 17(1) of the ICCPR means that any interference with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted ‘reasonableness’ to mean that any limitation must be proportionate and necessary in the circumstances.

The Rule engages the right to privacy by permitting the collection of the sensitive information and the use or disclosure of the personal information of a person reported as missing.

However, the Rule protects against the arbitrary interference with privacy, and advances the right to the protection of the law against such interference, by placing a number of specific limitations on the operation of the permitted general situation at item 3 of the table in subsection 16A(1) of the Privacy Act 1988. This includes by:

• limiting the collection of sensitive information to ‘locating entities’ that reasonable believe the collection to be necessary to assist them to locate the person reported as missing
• limiting the type of personal information (including sensitive information) that may be collected, used or disclosed to that which is reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing
• limiting the entities that an APP entity may use or disclose personal information to, to those defined by the term ‘locating entities’
• limiting the circumstances in which an APP entity may use or disclose personal information
• preventing the collection, use or disclosure of personal information where it would pose a serious threat to the life, health or safety of any individual
• limiting the Rule’s operation to circumstances in which a person is being sought by a locating entity due to serious concerns for their safety and/or welfare or for the purpose of reuniting them with their family
• preventing entities from using the Rule to collect, use or disclose personal information to locate a person in relation to legal matters or for the purposes of genealogical research
• emphasising that an APP entity is permitted, but not required, to use or disclose personal information.

These restrictions are aimed at ensuring that any collection, use or disclosure of personal information under the general permitted situation at item 3 of the table in subsection 16A(1) of the Privacy Act is reasonable, necessary and proportionate to achieving the objective of facilitating the location of persons reported as missing while protecting the privacy of such persons.

Conclusion

The Rule is compatible with human rights because it advances the protection of human rights by limiting the circumstances in which an APP entity may collect, use or disclose the personal information of an individual in accordance with item 3 of subsection 16A(1) of the Privacy Act.

Angelene Falk, Australian Information Commissioner

[1] These matters are listed in the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 as matters that the Information Commissioner’s Rules should address.