Explanatory Statement

Temporary Public Interest Determination No. 2006-1

and

Determination No. 2006-1A giving general effect to Temporary Public Interest Determination No. 2006-1

 

This Explanatory Statement has been drafted for the purpose of fulfilling the Office of the Privacy Commissioner’s obligations under section 26(1) of the Legislative Instruments Act 2003.

1.      PURPOSE

The purpose of Temporary Public Interest Determination No. 2006-1 is to determine that the applicant (a general practitioner in private practice) will not be committing a breach of National Privacy Principle 10 of the Privacy Act 1988 (the Privacy Act) in certain limited circumstances.  This is where the applicant is collecting information about the Pharmaceutical Benefits Scheme (PBS) history of one of their patients from Medicare Australia’s Prescription Shopping Project Information Service (the Information Service) without the consent of that individual. 

In making Temporary Public Interest Determination No. 2006-1, the Privacy Commissioner also considered whether a claim to exclude the applicant from the obligations imposed by National Privacy Principle 1 was valid.  For the reasons discussed below, the Privacy Commissioner dismissed this element of the application. 

Although it was not raised in the application, the Privacy Commissioner also considered whether the circumstances raised would require an exclusion from National Privacy Principle 2.  For the reasons discussed below, it is not necessary for this to be included in the Temporary Public Interest Determination.

The purpose of Determination No. 2006-1A is to give general effect to Temporary Public Interest Determination No. 2006-1 so that other organisations, in the same circumstances as set out in the application, may carry out the same act or practice as the applicant without breaching National Privacy Principle 10 of the Privacy Act.

1.2    Provisions for Public Interest Determinations

The Privacy Act provides a mechanism for dealing with matters where the public interest in protecting the privacy of individuals and other public interests need to be considered, and where in some circumstances the protection of privacy should be set aside to some degree. 

This mechanism is given effect through the Privacy Commissioner’s power to make a public interest determination.  The Privacy Commissioner may make a public interest determination setting aside the protection of the privacy of individuals by declaring that a specific act or practice of the organisation will not be a breach of the National Privacy Principles.  Alternatively, the Privacy Commissioner may make a public interest determination dismissing the application.

The Privacy Act also provides a method for dealing with urgent matters by giving the Privacy Commissioner the power to make a temporary public interest determination in certain circumstances.

The Privacy Commissioner may also make a further determination extending the effect of the public interest determination (or temporary public interest determination) from the act or practice of the applicant to the same act or practice engaged in by any organisation.

1.3    Authority for making these determinations

Temporary Public Interest Determination No. 2006-1 is made under section 80A(2) of the Privacy Act.  Section 80A states:

80A  Temporary public interest determinations

(1) This section applies if the Commissioner is satisfied that:

(a)       the act or practice of an agency or organisation that is the subject of an application under section 73 for a determination under section 72 breaches, or may breach:

(i) in the case of an agency—an Information Privacy Principle; and

(ii) in the case of an organisation—an approved privacy code, or a National Privacy Principle, that binds the organisation; and

(b)       the public interest in the agency or organisation doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Principle or code; and

(c) the application raises issues that require an urgent decision.

(2)       The Commissioner may make a written temporary public interest determination that he or she is satisfied of the matters set out in subsection (1). The Commissioner may do so:

(a)       on request by the agency or organisation; or

(b)       on the Commissioner’s own initiative.

Determination No. 2006-1A, giving general effect to Temporary Public Interest Determination No. 2006-1, is made under section 80B(3) of the Privacy Act, which states:

80B  Effect of temporary public interest determination

Giving a temporary public interest determination general effect

(3)       The Commissioner may make a written determination that no organisation is taken to contravene section 16A if, while that determination is in force, an organisation does an act, or engages in a practice, that is the subject of a temporary public interest determination in relation to that organisation or another organisation.

Effect of determination under subsection (3)

(4)       A determination under subsection (3) has effect according to its terms.

1.4    Application for a Public Interest Determination

On 2 February 2005, the applicant applied under section 73 of the Privacy Act for a public interest determination under section 72 of the Privacy Act.  The applicant is an organisation for the purposes of the Privacy Act in that the applicant is a corporation or individual (s 6C) and provides a health service to another individual and holds health information; therefore, whether or not the organisation has an annual turnover of more than $3 million, the applicant is subject to the Privacy Act (s 6D(4)(b)).

Given the urgency of the situation and after satisfying herself of the required matters, the Privacy Commissioner issued Temporary Public Interest Determination No. 2005-1 on 10 February 2005 (and a determination giving general effect) in regard to the collection of information from the Information Service without consent.  These Determinations were for 12 months. The applicant advised the Privacy Commissioner on 16 January 2006 that the concerns underpinning the application remain.

The Attorney-General’s Department has confirmed that it is pursuing amendments to the Privacy Act to permit the collection of health information as authorised by law under NPP 10.2(b)(i).

Additionally, the Department of Health and Ageing has also confirmed that it is pursuing legislative amendment to primary health legislation, such as the National Health Act 1953, to include a provision to the effect that where the disclosure of information is authorised by or under a health law, the collection of that information by the person to whom it is disclosed is deemed also to be authorised by or under that law.

As these amendments have not been made before Temporary Public Interest Determination No. 2005-1 ceases to have effect on 9 February 2006, the Privacy Commissioner has decided to issue a second temporary public interest determination and a generalising determination.  These determinations will be effective from 10 February 2006 to 22 December 2006 (inclusive).

The temporary public interest determination provisions allow the Privacy Commissioner to modify the privacy protections of one or more of the National Privacy Principles where she has an application for public interest determination and where an urgent decision is required.

Although the Privacy Act does not prevent the Privacy Commissioner from issuing a second temporary public interest determination, she would not ordinarily consider doing this.

However the Privacy Commissioner has decided that, given the circumstances set out below, she will issue a second Temporary Public Interest Determination in respect of the current application.

In making Temporary Public Interest Determination No. 2005-1, the Privacy Commissioner decided to withhold the name of the applicant.  This decision recognised that the applicant is a general practitioner in private medical practice and disclosure of the applicant’s name may constitute an unnecessary interference with their privacy.  The Privacy Commissioner also considered the particularly sensitive nature of the application and recognised that disclosure of the applicant’s name could result in inaccurate and damaging inferences being made about patients of the applicant.

The determinations referred to in this Explanatory Statement are temporary measures to ensure that collection of PBS information by doctors from the Information Service without consent can continue until 22 December 2006, by which time it is expected that the Attorney-General’s Department and the Department of Health and Ageing will have pursued appropriate legislative measures. 

The Privacy Commissioner has indicated that if it appears that the matter will not be resolved by legislative amendments, by the expiry date of the second temporary public interest determination, then she would need to consider whether to make a public interest determination.

1.5    Relevant National Privacy Principles

On 21 December 2001, the Privacy Amendment (Private Sector) Act 2000 commenced, extending the Privacy Act to the private sector through the operation of ten National Privacy Principles (NPPs).  These principles govern the collection, use, disclosure and other aspects of the handling of personal information by organisations.

Two National Privacy Principles were raised in the application for a public interest determination.  These are National Privacy Principles 1 and 10.  Although it was not raised in the application, the Privacy Commissioner also considered the relevance of National Privacy Principle 2.  As it carries most significance to this matter, National Privacy Principle 10 is addressed first.

National Privacy Principle 10 concerns the collection of sensitive information, which is defined in section 6 of the Privacy Act to include information about an individual’s health.  Sensitive information is a sub-class of personal information and it attracts greater protection under the Privacy Act given the sensitivity and intimacy of the information concerned. 

This principle states that sensitive information cannot be collected by an organisation unless a prescribed exception applies.  These exceptions include where the individual consents (National Privacy Principle 10.1(a)) or where the collection is required by law (National Privacy Principle 10.1(b)).  The full text of National Privacy Principle 10.1 and 10.2 is provided at Section 5 of this Explanatory Statement (‘Further Information’).

The effect of National Privacy Principle 10 upon the circumstances put forward by the applicant is that the applicant cannot collect health information about a patient from the Information Service unless the collection is permitted by one of these exceptions.

National Privacy Principle 1 concerns the collection of personal information generally (that is, both sensitive and non-sensitive personal information).  This principle requires, amongst other things, that an organisation can only collect personal information where the information is necessary for one of the organisation’s functions or activities (National Privacy Principle 1.1) and collection must be by lawful and fair means (National Privacy Principle 1.2). 

The principle also requires an organisation to take reasonable steps to ensure that the individual is notified of certain things, including why the information has been collected and by whom.  These obligations exist whether the personal information is collected directly from the individual (National Privacy Principle 1.3) or from a third-party (National Privacy Principle 1.5).  The full text of National Privacy Principles 1.3 and 1.5 is provided in Section 5 of this Explanatory Statement (‘Further Information’).

The effect of National Privacy Principle 1 upon the circumstances put forward by the applicant is that if the applicant sought to collect personal information from a third-party (that is, Medicare Australia), then the applicant would need to take reasonable steps to ensure that the individual is aware of certain things listed in National Privacy Principle 1.3, unless doing this would pose a threat to the life or health of any individual.

Although not expressly raised by the applicant, the Privacy Commissioner also considered the relevance of National Privacy Principle 2.  This principle governs the use and disclosure of personal information (sensitive and non-sensitive) and states that an organisation may only use or disclose personal information for the purpose for which it was collected unless a prescribed exception applies.  These exceptions include, for example, where the use or disclosure is required or authorised by law (National Privacy Principle 2.1(g)) or where the individual has consented (National Privacy Principle 2.1(b)).

As discussed below in ‘Reasons for making this determination’, National Privacy Principle 2.1(a) was considered relevant to the application.  The full text of National Privacy Principle 2.1(a) is provided in Section 5 of this explanatory statement.

1.6    Documents incorporated by reference

As required under section 74(1) of the Privacy Act, notice of receipt by the Commissioner of the application is publicly available on the Office of the Privacy Commissioner’s website at www.privacy.gov.au.  This notice is in the form of a copy of the application.

2       REASONS FOR MAKING DETERMINATIONS

2.1    Background to Prescription Shopping Project Information Service

When considering issuing Temporary Public Interest Determination No. 2005-1 in February 2005, Medicare Australia (formerly the Health Insurance Commission) advised the Privacy Commissioner of the following matters.

A purpose of the Prescription Shopping Project is to reduce the number of individuals who obtain Pharmaceutical Benefits Scheme (PBS) medicines in excess of their therapeutic need. 

As part of the Prescription Shopping Project, an Information Service was developed whereby Medicare Australia is authorised to disclose certain health information about an individual to a prescribed organisation (e.g. a general practitioner).  This would be information relating to whether an individual has been identified under the Prescription Shopping Project as a ‘prescription shopper’ and, if necessary, information about the individual’s PBS history.

Medicare Australia’s authority to disclose this information, as well as to perform certain other functions necessary to implement the Information Service, was initially provided by the Health Insurance Commission (Additional Functions – Prescription Shopping Project) Determination 2003 made by the Minister for Health and Ageing.  This was replaced on 30 September 2005 by the Medicare Australia (Functions of the Chief Executive Officer) Direction 2005 (‘Medicare Australia Direction’) made by the Minister for Human Services.  The relevant extract from the Medicare Australia Direction is attached at A.

Prescription shoppers are ‘identified’ under the Prescription Shopping Project if they have met one or more of a number of prescribed criteria.  The Privacy Commissioner has been advised by Medicare Australia that at any time there may be around 20,000 individuals ‘identified’ by the Prescription Shopping Project.  This represents less than 1% of the PBS patient population.  The Information Service will only disclose information to organisations covered by the Medicare Australia Direction and only in regard to ‘identified’ individuals.  A prescribed organisation can only seek information from the Information Service about a current patient.

Further information on the Prescription Shopping Project Information Service is available from the Medicare Australia website.[1]

The Medicare Australia Direction defines a prescription shopper as an individual who, in any 3 month period.[2]

(a) has had supplied to him or her pharmaceutical benefits prescribed by 6 or more different prescribers; or

(b) has had supplied to him or her a total of 25 or more target pharmaceutical benefits; or

(c) has had supplied to him or her a total of 50 or more pharmaceutical benefits.

Medicare Australia advised that there are three levels of information about an individual that can be disclosed by Medicare Australia to a prescribed organisation. The three levels are:

1.      the release of information by telephone, asserting that an individual is or is not identified in accordance with the Prescription Shopping Project criteria;

2.      the release of information by telephone, confirming the total number of PBS medicines, and the total number of doctors involved in prescribing these PBS medicines, in relation to the individual during the most recent three month period; and

3.      the release of hard copy information containing the full PBS medicines record for the individual for this three month period. 

Prescribers select the level of information they require.  Use of the service is voluntary and prescribers are not required to access the Information Service. 

On 12 January 2006, the Privacy Commissioner was advised by Medicare Australia that there has been no change to the scope, criteria or operational procedures of the Prescription Shopping Project or the Information Service since Temporary Public Interest Determination No. 2005-1 came into effect. 

The agency also advised the Privacy Commissioner that from the implementation of the Information Service on 31 January 2005 until 8 January 2006, a total of 11,100 doctors had registered with Medicare Australia to use the system.  The Privacy Commissioner was advised that a significant number of enquiries made to the Information Service have resulted in a positive response (indicating that the individual in question has been identified under the Prescription Shopping project).

2.2    Issues raised by the applicant

In the application for a public interest determination in February 2005, the applicant raised a number of issues regarding the Information Service, including its value as a clinical tool and the possible consequences that may flow were the applicant prevented from accessing the service due to privacy obligations.

In order to provide appropriate diagnosis, assessment and treatment of an individual, the applicant has submitted that there may be occasion when the applicant needs to collect information through the Information Service.  The application relates to the practice of collecting this health information without obtaining the consent of the individual (i.e. the patient).

The form of collection envisaged by the applicant would occur in the context of providing a health service to an individual whom the applicant suspects may be seeking prescriptions for PBS medicines in excess of therapeutic need.  Such circumstances may include where an individual has a drug dependency.  The applicant submits that such an individual may be unwilling, if asked, to provide their consent to the collection of health information from the Information Service, as this collection may disclose their status as an identified person in the Prescription Shopping Project.

The applicant submits that it is impracticable to gain the consent of many drug dependent individuals for the following reasons:

·        it is the applicant’s experience that, in similar circumstances where it is necessary to obtain PBS medication or other health history, this group of patients is unwilling to provide accurate information or to consent to the applicant sourcing the information reliably from elsewhere; and

·        these individuals choose to leave the surgery rather than have their health treatment histories revealed.  This results in the applicant being denied the opportunity to counsel the individual or to arrange better care and treatment for these individuals

The applicant has expressed concerns that the collection of health information from the Information Service may be in breach of National Privacy Principle 10, as the individual’s consent is not be sought for the collection of the health information and no other exceptions seem to apply.

The applicant has submitted that the use of the Information Service may be critical in informing clinical judgements in relation to the applicant’s patients.

The Privacy Commissioner noted that the applicant has submitted that, in many cases, seeking consent from the individual for the collection of information from the Information Service will be entirely viable and appropriate.  While the Privacy Commissioner encourages health service providers to seek consent of the individual to collect health information from the Information Service, it is noted that the applicant’s concerns are about those individuals who may be unlikely to grant such consent.

The applicant advised the Privacy Commissioner on 16 January 2006 that these concerns remain.

2.3    Public interest considerations

Under section 80A of the Privacy Act, the Privacy Commissioner may make a Temporary Public Interest Determination where she is satisfied that each of the following apply:

·        an act or practice of an organisation that is subject of an application for a public interest determination breaches, or may breach, a National Privacy Principle

·        the public interest in the organisation doing the act or engaging in the practice outweighs to a substantial degree the public interest in adhering to the National Privacy Principle; and

·        where the application raises issues that require an urgent decision

Under section 80B(2) of the Privacy Act, the effect of a determination is that the organisation is taken not to breach the specified National Privacy Principle.

In considering the application, the Privacy Commissioner took account a number of factors:

·        the potential harm posed to those individuals whom the applicant suspects are seeking PBS medicines either in excess of, or otherwise against, their therapeutic needs; if, in some cases, the applicant is not permitted to collect health information from the Information Service without the consent of the individual

·        the nature of the public interest objectives which would be served by the proposed interference with privacy; and

·        the obligations contained in section 29(a) of the Privacy Act for the Privacy Commissioner, in the performance of her functions, to have regard to certain matters that may compete with privacy interests

For each of the two National Privacy Principles raised in the application and one other principle that was considered directly relevant, the Privacy Commissioner considered whether she was satisfied that the matters listed in section 80A(1) applied. 

2.4    Consideration given to National Privacy Principle 10

Matter 1)    Does or may the act or practice breach National Privacy Principle 10?

The applicant submitted that, in the circumstances detailed in the application, consent cannot be relied on when collecting health information about an individual.  It is clear that collecting health information without an individual’s consent will constitute a breach of National Privacy Principle 10 unless another exception applies.  It does not appear that the circumstances detailed in the application would allow the applicant to rely on any other exception.

In particular, when making Temporary Public Interest Determination No. 2005-1, the Privacy Commissioner considered whether the applicant may rely on National Privacy Principle 10.2(b)(ii), the terms of which were cited in the HIC Determination.  It is noted that the Medicare Australia Direction, which has superseded the HIC Determination, does not include an equivalent clause.  . The scope of this exception is unclear and untested in court.  In the circumstances set out in the application, the Privacy Commissioner remains satisfied that there may be a breach should the Applicant claim to rely on this exception to collect health information without consent.

 

The Privacy Commissioner is satisfied that the act or practice described in the application would or may constitute a breach of National Privacy Principle 10.

Matter 2)    Does the public interest in allowing the applicant to breach National Privacy Principle 10 outweigh to a substantial degree the public interest in adherence to the principle?

Generally, an individual’s right to be informed of how their personal information, and especially their health information, is handled and to have some measure of control over how their information is collected, is regulated by National Privacy Principles 1 and 10.  An individual may be harmed if their health information is handled without their consent or knowledge. 

In addressing a potential interference with privacy, it is necessary to take into consideration other matters that may compete with privacy.  The other interests raised by the application include the possibility of an immediate and direct threat posed to an individual’s health. 

The Privacy Commissioner is satisfied that, in certain cases, there may be an unwillingness on the part of an individual to provide consent to the collection of information from the Information Service, where this would assist in determining the individual’s therapeutic needs.  If the applicant cannot collect this information, it may lead to serious and potentially life-threatening consequences in respect of the individual’s clinical management and welfare.

Accurate and reliable information regarding an individual’s health history, including their medication history, underpins the clinical management of the individual.  The Privacy Commissioner accepts that some individuals may put their health and lives at risk in attempting to obtain PBS medication that is in excess of their therapeutic need.  It is likely that the Information Service may assist the applicant (and other organisations in the same circumstances) in the appropriate diagnosis, assessment and treatment of such individuals.

The Privacy Commissioner also notes that while the collection of health information in the circumstances raised by the application may constitute an interference with an individual’s privacy, the information, once collected, will continue to be afforded protections offered by the Privacy Act.  For example, the applicant will be prohibited by National Privacy Principle 2 from using or disclosing the health information for any other purpose unless permitted by the Privacy Act.  Similarly, obligations imposed by National Privacy Principles 4 and 6 will provide protections regarding the security of information collected and the individual’s access to it.

As was the case when making Temporary Public Interest Determination No. 2005-1, the Privacy Commissioner remains satisfied that the public interest in the applicant collecting health information from the Information Service outweighs to a substantial degree the public interest in the applicant adhering to National Privacy Principle 10 in these circumstances.  This is because the information sought by the applicant may immediately and directly affect the health care and treatment of an individual. The central public interest objective being served by this determination is the provision of quality health care to the individual and ultimately good public health outcomes for the community.

Matter 3)    Does the application raise issues that require an urgent decision?

The applicant submits that the health of some individuals is at risk and that this risk could be lessened by information available through the Information Service.  The applicant could not collect this information without breaching, or potentially breaching, National Privacy Principle 10.

In the absence of a determination, the applicant’s access to this government service may be restricted or prevented.  The applicant will or may breach the Privacy Act in the immediate future if they have reason to use the Information Service.  Accordingly, the Privacy Commissioner’s view is that the matter requires urgent consideration.

The Privacy Commissioner is satisfied that the matter is urgent as, in the absence of a temporary public interest determination, the applicant would or may be in breach of National Privacy Principle 10 when collecting health information from the Information Service once Temporary Public Interest Determination No. 2005-1 expires.  Such a collection may be critical in informing the applicant’s clinical judgment about one or more of the individuals the applicant treats.

2.5    Consideration given to National Privacy Principle 1

Matter 1)    Does or may the act or practice breach National Privacy Principle 1?

The application also raises the applicant’s obligations in respect of National Privacy Principle 1.  A collection by the applicant, from the Information Service, of information about one of their patients is likely to be necessary for one of the applicant’s functions (as required by National Privacy Principle 1.1) and, subject to the making of a determination, be lawful and fairly collected (National Privacy Principle 1.2).  Accordingly, there would be no breach of those elements of National Privacy Principle 1.

The Privacy Commissioner also considered whether the obligations under National Privacy Principles 1.3 and 1.5 (that is, to provide an individual with notice of certain things when collecting information about them) would impede the applicant’s collection of information from the Information Service.

The Privacy Commissioner noted the obligations imposed by National Privacy Principle 1.5 may be met at or before the time of collection, or if that is not possible, as soon as practicable after the collection. 

In addition, it should be noted that National Privacy Principle 1.5 requires that the applicant take “reasonable steps” to ensure that the individual is aware of certain matters; what is reasonable will depend on the circumstances at hand.  The principle also expressly provides that the applicant does not have to inform the individual of the various matters listed in National Privacy Principle 1.3 if such notice would pose a serious threat to the life or health of any individual.

Accordingly, the Privacy Commissioner was satisfied that National Privacy Principle 1 did not impose obligations which do, or are likely to, prevent the applicant from collecting information from the Information Service.  It follows therefore that the applicant could collect information from the Information Service without breaching the law in this respect.

As the act or practice would not constitute a breach of National Privacy Principle 1, it is not necessary for the Privacy Commissioner to consider the further matters listed in section 80A(1).

2.6    Consideration given to National Privacy Principle 2

Matter 1)    Does or may the act or practice breach National Privacy Principle 2?

Medicare Australia has advised the Privacy Commissioner that if the applicant contacts the Information Service, the applicant must disclose personal information concerning the patient to determine the patient’s identity (specifically, name, Medicare number and date of birth). This appears to be a disclosure of personal information under National Privacy Principle 2.

National Privacy Principle 2 sets out the general rule that an organisation must only use or disclose personal information for the primary purpose of collection. Use and disclosure for a secondary purpose is not allowed except where such use or disclosure falls within the exceptions listed in National Privacy Principle 2.

As the applicant is unlikely to have collected the individual’s identifying details initially for the primary purpose of disclosure to Medicare Australia, the Privacy Commissioner considered the relevance of National Privacy Principle 2.1(a) to the application.  This exception permits a disclosure of sensitive information where it is directly related to the primary purpose of collection and it falls within the individual’s reasonable expectations.

When necessary, the applicant contacts the Information Service to assist in clinical decision making relating to the individual’s presentation for a health service.  This purpose seems directly related to the primary purpose for which the relevant information was initially collected (to provide diagnosis, assessment, and treatment).  Thus, the disclosure of an individual’s identifying information to the Medicare Australia, in these circumstances, would be a directly related secondary purpose within the meaning of National Privacy Principle 2.1(a).

However, to rely on NPP 2.1, the applicant must also be confident that the individual would reasonably expect the disclosure to occur.  Health service providers will be in a better position to assume that such activities are within the reasonable expectations of an individual, if there has been appropriate education for the community about it.  This may include, for example, providers fully utilising the information material prepared and distributed by Medicare Australia. 

In making Temporary Public Interest Determination No. 2005-1, the Privacy Commissioner noted that Medicare Australia had committed to undertake communication strategies with providers (such as the applicant) and patients to explain the purpose and functions of the Information Service.  This is consistent with Medicare Australia’s functions under the Medicare Australia Direction to promote awareness of the Prescription Shopping Project.[3] 

The Privacy Commissioner has sought advice from Medicare Australia regarding the implementation of its communication strategy for the Information Service.  While responsibility for compliance with NPP 2 rests, in this case, with the applicant and other health service providers, it is the Privacy Commissioner’s view that information material provided by Medicare Australia to users of the Information Service will significantly assist health service providers in understanding their obligations under NPP 2.

In this regard, Medicare Australia has advised the Privacy Commissioner that it has undertaken an information campaign with health service providers, including by providing material in the form of brochures for distribution to consumers and posters.  This material explains to consumers that their personal information may be disclosed for the purposes of the Information Service.  Medicare Australia has also provided consumer material directly to smaller number of individuals identified under the Prescription Shopping Information Service.

Medicare Australia has undertaken to continue providing information material to health service providers.  This material will remind providers of their obligations under the NPPs, including the need to ensure that consumers have a reasonable expectation that their personal information may, in certain circumstances, be disclosed to the Information Service.  In addition, the Privacy Commissioner will develop information material for the health sector explaining, amongst other things, the importance of taking reasonable steps to promote individual’s awareness of the Information Service.

The Privacy Commissioner considers that the applicant could rely on National Privacy Principle 2.1(a) to disclose of an individual’s identifying information to Medicare Australia for the purpose of using the Information Service.  Accordingly, it is not necessary to exclude the applicant or organisations generally from the obligations imposed by this principle.

As the act or practice would not constitute a breach of National Privacy Principle 2, it is not necessary for the Privacy Commissioner to consider the further matters listed in section 80A(1).

3.      OPERATION OF TEMPORARY PUBLIC INTEREST DETERMINATION 2006-1 AND DETERMINATION 2006-1A

These determinations have the effect of allowing organisations that are prescribed in the Medicare Australia Direction to collect information from the Information Service without the consent of the individual.  This collection will only occur for the purposes allowed in the Medicare Australia Direction. 

Temporary Public Interest Determination No. 2006-1 is a direct response to the application made on 2 February 2005 and confirmation of continued concerns on 16 January 2006, and will operate in the manner described above.  Determination No. 2006-1A provides general effect to Temporary Public Interest Determination No. 2006-1.

4.      CONSULTATION

A temporary public interest determination may only be issued when the matter requires an urgent decision; such circumstances generally limit the opportunity for public consultation.  

Through her Office, the Privacy Commissioner sought information on the operation of the Information Service from Medicare Australia and with the Department of Health and Ageing.  Discussions were also held with these agencies to seek further information on the use and operation of the Information Service and the progress of anticipated amendments to the National Health Act.  The Attorney-General’s Department was also consulted on possible amendments to National Privacy Principle 10.

The Privacy Commissioner regards the circumstances of this case as being exceptional and has made the determinations in the belief that there is a strong likelihood that the matters raised in the application will be addressed by legislative amendments before the expiry date of the determinations

5.      FURTHER INFORMATION

The text of National Privacy Principles 1.3, 1.5, 2.1(a), 10.1 and 10.2 are provided below.

National Privacy Principles 1.3 states:

1.3 At or before the time (or, if that is not practicable, as soon as practicable after) an organisation collects personal information about an individual from the individual, the organisation must take reasonable steps to ensure that the individual is aware of:

(a) the identity of the organisation and how to contact it; and

(b) the fact that he or she is able to gain access to the information; and

(c) the purposes for which the information is collected; and

(d) the organisations (or the types of organisations) to which the organisation usually discloses information of that kind; and

(e) any law that requires the particular information to be collected; and

(f) the main consequences (if any) for the individual if all or part of the information is not provided.

National Privacy Principle 1.5 states:

1.5 If an organisation collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is or has been made aware of the matters listed in subclause 1.3 except to the extent that making the individual aware of the matters would pose a serious threat to the life or health of any individual.

National Privacy Principle 2 regulates the use and disclosure of personal information (whether sensitive or non-sensitive).  Relevantly, National Privacy Principle 2.1(a) states:

2.1 An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless:

(a) both of the following apply:

(i) the secondary purpose is related to the primary purpose of collection and, if the personal information is sensitive information, directly related to the primary purpose of collection;

(ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose;

National Privacy Principle 10 concerns the collection of “sensitive information”. 

Relevantly, NPP 10.1 and 10.2 state:

10.1 An organisation must not collect sensitive information about an individual unless:

(a) the individual has consented; or

(b) the collection is required by law; or

(c) the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual, where the individual whom the information concerns:

(i) is physically or legally incapable of giving consent to the collection; or

(ii) physically cannot communicate consent to the collection; or

(d) if the information is collected in the course of the activities of a non-profit organisation—the following conditions are satisfied:

(i) the information relates solely to the members of the organisation or to individuals who have regular contact with it in connection with its activities;

(ii) at or before the time of collecting the information, the organisation undertakes to the individual whom the information concerns that the organisation will not disclose the information without the individual’s consent; or

(e) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim.

10.2 Despite subclause 10.1, an organisation may collect health information about an individual if:

(a) the information is necessary to provide a health service to the individual; and

(b) the information is collected:

(i) as required by law (other than this Act); or

(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.



[2] Section 30(2).

[3] Section 30(6) of the Medicare Australia Direction.