Privacy (Public Health Contact Information) (Data Store Administrator) Determination 2021

Overview

The Privacy (Public Health Contact Information) (Data Store Administrator) Determination 2021 was enacted to address the need for a specific administrative framework for managing public health contact information under the Privacy Act 1988. This legislation was introduced to ensure that the handling of sensitive health data is appropriately regulated and overseen during public health emergencies, such as the COVID-19 pandemic. The determination was made by Dr. Brendan Murphy, Secretary of the Health Department, under the authority granted by subsection 94Z(1) of the Privacy Act 1988. The policy objective behind this determination is to streamline the administration and oversight of public health contact information, thereby enhancing the efficiency and effectiveness of contact tracing and public health responses. The Determination is set to commence on 27 September 2021, and it will be repealed at the end of 4 October 2021, following the resolution of the public health crisis that necessitated its creation.

Scope and Application

The Privacy (Public Health Contact Information) (Data Store Administrator) Determination 2021, made under subsection 94Z(1) of the Privacy Act 1988, designates the Department of Health and the Digital Transformation Agency as joint data store administrators for all relevant provisions of Part VIIIA of the Privacy Act 1988. This determination came into effect on 27 September 2021 and will be repealed on 4 October 2021, as specified in the commencement provisions and Schedule 1, which also repeals the Privacy Amendment (Public Health Contact Information) (Data Store Administrator) Determination 2020. The scope of this Determination is confined to the appointment of data store administrators for public health contact information, with no stated exclusions or exemptions within its purview. The Determination does not extend or restrict its application through subordinate instruments, but rather operates within the broader framework of the Privacy Act 1988.

Key Provisions

The Privacy (Public Health Contact Information) (Data Store Administrator) Determination 2021 (sections 1-7) specifies that the Department of Health and the Digital Transformation Agency are designated as joint data store administrators under the Privacy Act 1988. This designation pertains to the relevant provisions of Part VIIIA of the Privacy Act 1988, which concerns the management of public health contact information. This determination is effective from 27 September 2021 and will be repealed on 4 October 2021, as outlined in the commencement table (section 2). The repeal of this instrument is detailed in Schedule 1, which includes the Privacy Amendment (Public Health Contact Information) (Data Store Administrator) Determination 2020. The obligations imposed on the Department of Health and the Digital Transformation Agency, as joint data store administrators, include ensuring the proper management, security, and confidentiality of public health contact information in accordance with the Privacy Act 1988. They are required to implement and maintain appropriate administrative, technical, and physical safeguards to protect the data from unauthorised access, use, disclosure, destruction, loss, alteration, or damage. This involves adhering to the standards and guidelines set forth in the Privacy Act and any related regulations. Failure to comply with the obligations outlined in the Privacy Act 1988 and this determination may result in civil or criminal penalties. For instance, under section 137 of the Privacy Act, a person who contravenes a provision of the Act may be liable to pay a civil penalty not exceeding the greater of three times the amount of any financial benefit obtained, or $270,000 for a corporation. Additionally, under section 138, a person who is negligent in the performance of a function or exercise of a power under the Act may be liable to pay a civil penalty not exceeding $54,000 for an individual or $270,000 for a corporation. Furthermore, under section 141, an officer of an organisation who is responsible for a contravention by the organisation may be subject to criminal penalties, including fines and imprisonment. The maximum penalties for these offences are specified in the relevant sections of the Privacy Act 1988.