Federal Register of Legislation - Australian Government

Primary content

Determinations/Other as made
This Determination exempts ACHA Health (a provider of health services) in certain circumstances from complying with National Privacy Principle (NPP) 10.1 by allowing the accepted practice of collecting relevant social, family and medical histories without the consent of third parties, during the course of providing a health service directly to a consumer.
Administered by: Prime Minister and Cabinet
General Comments: Subject to section 80(2)(b) of the Privacy Act, this Determination takes effect on the first day on which the determination is no longer liable to be disallowed.
Registered 19 Sep 2008
Tabling HistoryDate
Tabled HR16-Oct-2002
Date of repeal 19 Mar 2014
Repealed by Spent and Redundant Instruments Repeal Regulation 2014






Public Interest Determination No. 9




ACHA Health

Nature of Application:


In the context of a health service provider collecting the social, family or medical history of an individual (a consumer) for the provision of a health service to that consumer:

the collection of personal or health information about another individual (a third party) without obtaining the third party’s consent or notifying the third party of the collection of the information.

National Privacy Principle Concerned:

National Privacy Principle 10.1 – “Sensitive Information”.



15 October 2002


16 October 2002


11 December 2002





I, Malcolm Woodhouse Crompton, Privacy Commissioner, make the following determination under section 72(2) of the Privacy Act 1988.


I am satisfied, in accordance with section 72(2) of the Privacy Act 1988 (Privacy Act), of the following:

(1)        ACHA Health is an organisation for the purposes of section 6C of the Privacy Act; and

(2)        ACHA Health has applied under section 73 of the Privacy Act for a Public Interest Determination under section 72 of the Privacy Act in relation to the acts and practices set out in (3) below; and

(3)        ACHA Health collects health information from an individual (a consumer) about another individual (a third party) in circumstances where

(a)        the collection of the third party’s information into the consumer’s social, family or medical history is necessary for ACHA Health to provide a health service directly to the consumer; and

(b)        the third party is a member of the consumer’s family or household, or the third party’s information is otherwise relevant to the consumer’s family, medical or social history; and

(c)        ACHA Health collects the information about the third party without obtaining the consent of the third party; and

 (4)       the acts and practices set out in (3) above breach or may breach National Privacy Principle 10.1; and

(5)        the public interest in ACHA Health doing the acts, or engaging in the practices, set out in (3) above substantially outweighs the public interest in adhering to National Privacy Principle 10.1 in the stated circumstances; and

(6)        this Determination is issued for a period of 5 years, with a review of the Determination to take place 5 years from the date of effect of the Determination, or sooner, if the Privacy Commissioner becomes aware of a matter incidental to or affecting the operation or performance of the Determination.


Dated this 15th day of October 2002







Privacy Commissioner