Public Interest Determination No. 12A - Collection of Family, Social and Medical Histories

Overview

The Public Interest Determination No. 12A Collection of Family, Social and Medical Histories, enacted in 2011 under section 72 of the Privacy Act 1988, was introduced to address the problem of balancing the need for the collection of sensitive personal information by health service providers with the protection of privacy. This legislative instrument was enacted by the Australian Privacy Commissioner, Timothy Pilgrim, to ensure that health service providers do not contravene the Privacy Act when collecting family, social, and medical histories for health-related purposes. The policy objective of this determination is to protect the privacy of individuals while allowing for necessary information collection that is critical for providing health services. This determination is in force from 11 December 2011 until 10 December 2016, with amendments made to enhance privacy protections as necessary.

Scope and Application

The Public Interest Determination No. 12A Collection of Family, Social and Medical Histories applies to organisations providing health services as defined under the Privacy Act 1988 (Cth). This determination allows such organisations to collect family, social, and medical histories without being considered in contravention of the Privacy Act, provided that the collection is necessary for the provision of a health service. This determination applies nationwide across Australia, aligning with the Commonwealth jurisdiction under the Privacy Act. The determination does not exempt any specific entity or category of information from its scope, and its application is not restricted by any specific thresholds or conditions. Subordinate instruments, such as amendments and repeals, can extend or modify the determination's application, as evidenced by the Privacy Public Interest (Enhancing Privacy Protection) Amendment and Repeal Determination 2014. This amendment, for instance, adjusted the original determination to enhance privacy protections, demonstrating how the scope and application of the legislation can evolve through supplementary instruments.

Key Provisions

This legislation, Public Interest Determination No. 12A Collection of Family, Social and Medical Histories, specifies certain circumstances under which health service providers can collect, use, and disclose personal information without contravening the Privacy Act 1988 (Cth). According to Section 4 of the determination, a health service provider is exempt from the requirements of section 15 of the Privacy Act if they are collecting, using, or disclosing personal information for the purpose of providing a health service, provided that the collection, use, or disclosure is in accordance with Australian Privacy Principle 3.3 (APP 3.3). Section 5 further clarifies that this exemption applies to any act or practice related to the collection, use, or disclosure of personal information that is necessary for the provision of a health service. This means that health service providers can engage in such activities as long as they are directly related to providing health services and comply with APP 3.3. The obligations imposed by this determination on health service providers include ensuring that the collection, use, and disclosure of personal information are necessary for the provision of health services. Health service providers must also ensure that any personal information collected, used, or disclosed is handled in accordance with APP 3.3, which includes requirements such as obtaining consent from the individual where necessary, ensuring the information is accurate and up-to-date, and protecting the information from misuse or unauthorised access. Additionally, health service providers must keep records of their compliance with these obligations and make them available for inspection if required by the Australian Privacy Commissioner. There are no explicit offences, penalties, or civil/criminal consequences outlined in this determination for breaches of its provisions. However, any failure to comply with the Privacy Act 1988 or the Australian Privacy Principles, including APP 3.3, could result in enforcement actions by the Office of the Australian Information Commissioner (OAIC). These actions may include issuing a compliance notice, seeking a court order, or imposing administrative penalties. The maximum penalties for contravening the Privacy Act can include significant fines for both individuals and organisations, depending on the nature and severity of the breach.