Federal Register of Legislation - Australian Government

Primary content

Determinations/Other as made
This Determination extends the exemption contained in Public Interest Determination 9 to any health service provider, for the same purpose.
Administered by: Prime Minister and Cabinet
Registered 19 Sep 2008
Tabling HistoryDate
Tabled HR16-Oct-2002
Date of repeal 19 Mar 2014
Repealed by Spent and Redundant Instruments Repeal Regulation 2014




Public Interest Determination No. 9A




ACHA Health

Nature of Application:


In the context of a health service provider collecting the social, family or medical history of an individual (a consumer) for the provision of a health service to that consumer:

the collection of personal or health information about another individual (a third party) without obtaining the third party’s consent or notifying the third party of the collection of the information.

National Privacy Principle Concerned:

National Privacy Principle 10.1 – Sensitive Information


15 October 2002


16 October 2002


11 December 2002






I, Malcolm Woodhouse Crompton, Privacy Commissioner, make the following determination under section 72(4) of the Privacy Act 1988.


No organisation is taken to contravene section 16A of the Privacy Act 1988 if, while Public Interest Determination (PID) 9 is in force, an organisation does an act, or engages in a practice, that is the subject of PID 9.


Dated this 15th day of October 2002







Privacy Commissioner


Statement of reasons under section 79(3) for Determination 9A


ACHA Health is a not-for-profit private hospital operator located in Adelaide, South Australia and is an “organisation” for the purposes of section 6C of the Privacy Act 1988 (the Privacy Act).  ACHA Health has requested a Determination to enable the continuation of a practice that breaches or may breach National Privacy Principles (NPP) 10.1 and 1.5.  The practice concerns the collection of third party ‘sensitive information’, (including ‘personal information’ and ‘health information’), in the context of the collection of social, family or medical histories from health consumers “across all clinical settings” and by “all clinicians”. 


Public Interest Determination No. 9 is issued in response to ACHA Health’s application of 19 December 2001.  The details of that application, the process of consultation, findings, and relevant statutory provisions are set out in the Statement of Reasons attached to PID 9.  Those Statement of Reasons also includes the Privacy Commissioner’s consideration of matters relevant to section 72(2) (that is, that an activity of an organisation breaches or may breach an NPP or a privacy code (a Code) and, that the activity should nevertheless be allowed to continue, as the public interest in its continuation substantially outweighs the public interest in adhering to the NPP or Code).


In addition to applying for a Determination for itself, ACHA Health referred to the importance of a Determination applying to health service providers and health services generally.  Further, a range of submitters argued that it is in the public interest that all providers of health services should be able to collect third party information without consent.  The submissions noted that it is in the individual’s best interests – that is, to enable a more accurate health assessment.  If the information is not collected, it is further submitted, correct and accurate diagnoses and health outcomes will be compromised.  The submissions argue that the benefits to health care and the public outweigh any disadvantages to third party individuals. 


In Public Interest Determination No. 9, I determined that the public interest in continuing the activity of collecting third party information into the consumer’s medical, social and family history where it is necessary to provide a health service directly to a consumer, substantially outweighs the interest in adhering to NPP 10.1 in those circumstances. 




For the above reasons, and the reasons set out in detail in the Statement of Reasons attached to PID 9, I am of the view that, under section 72(4) of the Privacy Act, PID 9 should be given general effect to apply to all health service providers.


In written submissions received during the consultation process regarding the draft Determinations for PID 9 and PID 9A, a number of submitters discussed the matter of the period of time in which the Determination should remain in force.  These submitters argued that if, following consultation on the draft Determinations, Determinations are made by the Privacy Commissioner, then they should be made to operate for a specific period only and should not be made for an indefinite period.  Further, the Determinations should be subject to a review within a specified period.  Conference attendees argued that, given that certain matters are only becoming clearer as the private sector gains more expertise in applying the NPPs, it would seem wise for the Determinations to be reviewed after a reasonable period of time.


In consideration of the above submissions, I have decided to issue this Determination for a period of 5 years, with a review of the Determination to take place at 5 years from the date of effect of the Determination, or sooner, if I become aware of a matter incidental to or effecting the operation or performance of the Determination.