Federal Register of Legislation - Australian Government

Primary content

Determinations/Other as made
This Determination permits the applicant to collect or use of contact details of a patient's genetic relatives to enable disclosure of genetic information in specified circumstances.
Administered by: Prime Minister and Cabinet
General Comments: This Determination comes into effect on 15 December 2009.
Registered 14 Dec 2009
Tabling HistoryDate
Tabled HR02-Feb-2010
Tabled Senate02-Feb-2010
Date of repeal 19 Mar 2014
Repealed by Spent and Redundant Instruments Repeal Regulation 2014

Privacy Act 1988 Part VI – Temporary Public Interest Determination No 2009-1

Collection and use of contact details of genetic relatives to enable disclosure of genetic information 

 

In relation to National Privacy Principles 2.1 and 10.1

Effective:  15 December 2009 to 14 December 2010 (inclusive)

Under section 80A(2) of the Privacy Act 1988  I, Karen Curtis, Australian Privacy  Commissioner, determine that I am satisfied of the following:

(1)  Dr Elizabeth McCusker (the applicant) is an organisation for the purposes of section 6C of the Privacy Act. The applicant has applied under section 73 of the Privacy Act for a Public Interest Determination in relation to the acts and practices set out in (3) below.

(2)  The applicant may have reason to collect the contact details of a genetic relative of an individual (a ’patient’), in circumstances where:

a)      it is impractical to gain the consent of the genetic relative and

b)     the applicant intends to use the contact details to inform the relative of the potential consequences of genetic information obtained from the patient for the relative’s own health and

c)      the applicant has a reasonable belief that this is necessary to lessen or prevent a serious threat to the life, health or safety of the genetic relative and

d)     where consent has not been obtained from the patient for the disclosure of their genetic information, the disclosure will be made in accordance Guidelines issued under section 95AA of the Privacy Act.

(3)  The applicant also may have reason to use the contact details of a genetic relative of a patient (which she already has on file), in circumstances where:

a)      it is impractical to gain the consent of the genetic relative and

b)     the applicant intends to use the contact details to inform the relative of the potential consequences of genetic information obtained from the patient for the relative’s own health and

c)      the applicant has a reasonable belief that this is necessary to lessen or prevent a serious threat to the life, health or safety of the genetic relative and

d)     where consent has not been obtained from the patient for the disclosure of their genetic information, the disclosure will be made in accordance with the Section 95AA Guidelines.

(4)  The acts and practices set out in (2) and (3) above breach, or may breach, National Privacy Principle 10.1 or National Privacy Principle 2.1 in relation to the collection or use of the genetic relative’s contact details.

(5)  The public interest in the applicant doing the acts, or engaging in the practices, set out in (2) and (3) above substantially outweighs the public interest in adhering to National Privacy Principle 10.1 or National Privacy Principle 2.1 in those circumstances.

(6)  The application raises issues that require an urgent decision.

Accordingly, by virtue of section 80B(2) the applicant is taken not to contravene section 16A of the Privacy Act 1988 if the applicant engages in the acts and practices set out in paragraphs (2) and (3) above, during the period from 15 December 2009 to 14 December  2010 inclusive.  My reasons for making this determination are attached.

 

 

 

 

Karen Curtis

Australian Privacy Commissioner

10  December  2009


Statement of Reasons for Temporary Public Interest Determination 2009-1

The application

On 16 July 2009, the applicant applied under section 73 of the Privacy Act 1988 (Cth) (the Privacy Act) for a public interest determination (PID) to be issued under section 72 of the Privacy Act.  The applicant is a neurologist located in New South Wales.

The applicant has requested a determination to exempt her, in limited and specified circumstances, from complying with National Privacy Principles (NPP) 10.1 and 2.1.

The act or practice concerns the collection or secondary use of the contact details of a genetic relative of a patient, with a view to informing the relative of the implications of genetic information obtained from the patient for the relative’s own health.  In instances where consent has not been obtained from the patient for the disclosure of their genetic information, the disclosure would be made in accordance with guidelines under section 95AA of the Privacy Act, issued by the National Health and Medical Research Council (NHMRC) and approved by the Privacy Commissioner (see ‘Background to amendments to the Privacy Act’ below).

Background to amendments to the Privacy Act

In 2006, the Privacy Act was amended to give effect to the Australian Government’s decision to implement some of the recommendations of the Australian Law Reform Commission and the Australian Health Ethics Committee’s report Essentially Yours: the Protection of Human Genetic Information in Australia.[1]

The amendments aim to safeguard the handling of genetic information by changing the definitions of ‘health information’ and ‘sensitive information’ to expressly include genetic information.[2]  Genetic information that is or could be predictive of the health of an individual is now treated as health information[3] for the purposes of the Privacy Act. Genetic information that is not otherwise health information, such as the result of a parentage test, is treated as sensitive information[4] for the purposes of the Privacy Act.

The Privacy Legislation Amendment Act 2006 also introduced an additional exception to the general requirement that personal information must not be used or disclosed for any other purpose other than that for which it was collected.  The additional exception in NPP 2.1(ea) allows for the use or disclosure of genetic information to a patient’s genetic relatives, without the patient’s consent, if the organisation reasonably believes that this is necessary to lessen or prevent a serious threat to the life, health or safety of the relative.[5]

The inclusion of section 95AA in the Privacy Act allows the Privacy Commissioner to approve guidelines developed by the NHMRC to clarify circumstances in which genetic information may be used or disclosed without consent.  NPP 2.1(ea) requires that use or disclosure of genetic information by a health practitioner without the consent of the patient be conducted in accordance with these guidelines.

The amendments do not require disclosure of information but provide the framework for this to occur under the appropriate circumstances.

Issues raised by the applicant

The applicant notes that a person’s genetic information may be relevant not only to that person but also to genetic relatives, due to the shared genetic heritage of families.  The patient’s genetic information may indicate that the patient’s genetic relatives might also have a certain hereditary condition, or the propensity to acquire the condition in the future.

The applicant submits that if a patient’s genetic information suggests that there is potential for a serious threat to the life, health or safety of the patient’s genetic relatives, and disclosure of the information may lessen or prevent the threat, she would like to be able to provide the genetic information to the genetic relatives to enable them to take any relevant action if they wish to do so.  The applicant also submits that fulfilling the requirement to obtain the consent of the genetic relatives to collect or use their contact details in this context is impractical.

The applicant has expressed a concern that the collection of the contact details of a genetic relative may breach NPP 10.1[6], as it is impractical to gain consent for the collection of the contact details and no other exceptions seem to apply. The applicant has also raised a concern that the secondary use of the contact details of a genetic relative (which are already on file) without their consent may breach NPP 2.1.[7]  The applicant notes that these issues arise whether or not the patient consents to the genetic information being provided to their genetic relatives.

The applicant asserts that the collection of contact details will occur in a health service environment which is governed by strong professional codes of ethics and confidentiality.

The applicant submits that the public interest is served through early and accurate diagnoses and management of genetic conditions by clinicians.  The applicant considers that in the absence of a public interest determination, the health care of individuals could be compromised and the end result could be failure to recognise and treat the manifestations of these diseases in a timely manner, increased investigation, intervention and cost.  The applicant also submits that the outcome may be increased morbidity and mortality from potentially treatable conditions.

The applicant considers that the matter is urgent given that there are circumstances in which she and other medical practitioners currently seek to inform genetic relatives of the consequences for those genetic relatives of genetic information obtained from a patient (where the patient has consented to the disclosure).  The applicant also notes that this issue will prevent medical practitioners from disclosing genetic information in accordance with NPP 2.1(ea) and the section 95AA guidelines, where the patient has not consented.

Process of consultation

A temporary public interest determination may only be issued when the matter requires an urgent decision.

The Office held discussions with clinicians with expertise in the field of genetics and the Department of Prime Minister and Cabinet. As well, 17 stakeholder organisations and individuals, including the Department of Health and Ageing and the NHMRC, were given the opportunity to comment.

Submissions received

Ten submissions were received from a range of sectors, including state government agencies, peak health professional bodies, private sector health service providers, and a privacy advocacy group.

The majority of the submissions received were highly supportive of the necessity for a PID relating to the collection and use of genetic relatives’ contact details.  One submission expressed qualified support with additional comments, which were taken into consideration in the drafting of TPIDs 2009-1 and 2009-1A.  One submission opposed the application.

A number of submissions emphasised the need for a PID to ensure that medical practitioners are able to disclose genetic information to a genetic relative in accordance with the intent of the 2006 legislative amendments to the NPPs of the Privacy Act.  One submitter also noted that the PID is necessary to enable the continuation of established genetics practices of collecting and using contact information for genetic relatives of a patient, in circumstances where the patient consents to the disclosure of their genetic information.

One submitter suggested that the appropriate sources of contact information for genetic relatives of the patient be clarified. In drafting TPID 2009-1, I have specified the continuing application of NPPs 1 to 9 to information collected in these circumstances.  Accordingly, the collection of contact information must accord with NPP 1.2 which requires that an organisation must collect personal information only by lawful and fair means and not in an unreasonably intrusive way.  

The possibility that genetic relatives may not want to be informed about their risk of developing a condition was raised in several submissions. As noted in the section 95AA guidelines, in most cases the practitioner is unlikely to know the preferences of the genetic relatives.[8]  However, I agree with the view of the ALRC /AHEC Inquiry that if the circumstances in which disclosure is permitted are limited to situations where the practitioner considers that the disclosure is necessary due to the serious nature and ability to reduce the threat, it is reasonable to assume that only rarely would individuals not wish to know about the risk. [9]

One submitter noted that genetic information about the patient could, inadvertently, be disclosed to an individual who is not a genetic relative of the patient (if the contact details for the genetic relative are incorrect).  To address this issue, TPID 2009-1 includes reference to the continuing application of NPP 3, which requires that an organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete, and up-to-date.

Several submissions raised issues in relation to the decision making framework for disclosure of genetic information to a patient’s genetic relative.  In circumstances where the patient does not consent to the disclosure of their genetic information, the section 95AA guidelines address these issues, and are mandatory.   The section 95AA guidelines can also provide a useful framework for practitioners to follow when making a decision in circumstances where the patient gives consent to the disclosure of their genetic information although they are not mandatory in these circumstances.

Reasons for the decision

Public interest considerations

The application was made for a public interest determination under section 72 of the Privacy Act. The applicant requested that an urgent decision be made on this matter.

I have decided to deal with the application under section 80A of the Privacy Act because it raises matters requiring an urgent decision.

Under section 80A(1) of the Privacy Act, I am empowered to make a Temporary Public Interest Determination (TPID) where I am satisfied that each of the following apply:

a)      an act or practice of an organisation that is the subject of the application for a public interest determination breaches, or may breach, a National Privacy Principle (section 80A(1)(a)(ii)) and

b)     the public interest in the organisation doing the act or engaging in the practice outweighs to a substantial degree the public interest in adhering to that National Privacy Principle (section 80A(1)(b)) and

c)      where the application raises issues that require an urgent decision (section 80A(1)(c)).

Under section 80B(2) of the Privacy Act, the effect of such a determination is that the organisation is taken not to breach the specified National Privacy Principle when doing an act, or engaging in a practice, which is described in the determination.

National Privacy Principles 10 and 2 are raised in the application. 

Consideration given to National Privacy Principle 10.1

Under NPP 10.1, an organisation must not collect sensitive information about an individual unless the individual has consented or a listed exception applies.[10]

The act or practice raised in the application concerns the applicant collecting the contact details (such as name and address) of the patient’s genetic relative in order to inform the relative of the implications for their own health of information obtained from the patient. 

In some cases, the collection may occur in circumstances where the patient has given consent to the applicant for disclosure of their genetic information to their genetic relatives (but does not wish or is unable to make the disclosure themselves).  In such cases, the applicant may need to obtain the genetic relative’s contact details from the patient or from publicly available records (in circumstances where the patient is not able or willing to provide this information).[11]

In circumstances where the patient has not given consent to the disclosure of their genetic information, the disclosure must be made in accordance with the requirements of NPP 2.1(ea) and the section 95AA guidelines.  In such cases, the applicant may need to obtain the genetic relatives’ contact details from publicly available records.

Are contact details of a genetic relative health information?

Before considering whether the act or practice may breach NPP 10.1, it is necessary to establish whether the contact details of a genetic relative of the patient constitute, or may constitute, health information in these circumstances.

The Office has held that the recording of a person’s contact details may, in some circumstances, convey information about their health.  The context in which the contact details are held will inform what information can be inferred.

To disclose genetic information to a genetic relative, it is likely that the applicant would need to note these details in the patient’s record.  At this point, the contact details would be linked to other information on the patient’s record in such a way that it is possible to infer that:

·        the person whose contact details are recorded is related to a person with a genetic condition and

·        there is a possibility (or statistical probability) that the person whose contact details are recorded may also have a genetic condition.

Where the contact details of a genetic relative is associated with the genetic information of the patient, I consider this information is likely to constitute ‘health information’ and therefore sensitive information.  This would apply regardless of how the contact details are collected.

Does the act or practice breach National Privacy Principle 10.1?

It is clear that collecting health information without the genetic relative’s consent will constitute a breach of NPP 10.1 unless another exception prescribed in that Principle applies.

I accept the applicant’s view that it is impractical to gain consent in these circumstances as to do so would require contacting the relative to inform them of why they wanted to collect their contact details (that is, in order to disclose the patient’s genetic information).  It does not appear that the circumstances detailed in the application would allow the applicant to rely on any other exception.

I am satisfied that the act or practice described in the application would or may constitute a breach of NPP 10.1, as required by section 80A(1)(a).

Does the public interest in allowing the applicant to breach National Privacy Principle 10.1 outweigh to a substantial degree the public interest in adherence to the principle?

Generally, an individual’s right to be informed as to the handling of their personal information, especially their health information, and to have some measure of control over how their information is collected, is regulated by NPPs 1 and 10.  There is potential for harm to an individual if their health information is handled without their consent or knowledge.

In addressing a potential interference with privacy, it is necessary to consider other matters that may compete with privacy such as the possibility of a serious threat posed to an individual’s life or health.  The applicant’s application also noted the impracticalities, inefficiencies and detriment to provision of quality health care if medical practitioners are not able to collect health information of genetic relatives in the circumstances covered by this TPID.

I am satisfied that:

a)      it is impractical to obtain consent for the collection of the genetic relative’s contact details in these circumstances and

b)     the central public interest objective being served by this determination is the provision of quality health care for the genetic relative, and ultimately good public health outcomes for the community and

c)      the collection of the contact details of the genetic relative(s) in circumstances where the applicant has a reasonable belief that this is necessary to lessen or prevent a serious threat to the life, health or safety of the genetic relative may contribute significantly to good health care in both respects outlined in (b).

I also accept that if the applicant were unable to collect the contact details of a genetic relative in the circumstances covered by this TPID, she would be prevented from disclosing genetic information in accordance with NPP 2.1(ea) and the section 95AA guidelines. In my view, this would not be in accordance with the legislative intent of the Privacy Legislation Amendment Act 2006.[12]

Continuing application of the National Privacy Principles to information collected under this determination

I note that the privacy protection standards in NPPs 1 to 9[13] will continue to apply to protect the genetic relative’s information collected in these circumstances.

In particular, NPP 1.2 provides that information must be collected only by lawful and fair means and in a way that is not unreasonably intrusive. 

NPP 2 provides protection for the use and disclosure of the information collected. Under NPP 2, information collected in the circumstances covered by this TPID may generally only be used for the primary purpose of collection, such as to inform the patient’s genetic relative that they may be at risk of inheriting a condition.  Accordingly, if a practitioner collects the contact details of a genetic relative in the circumstances covered by this TPID, the Privacy Act would not permit the practitioner to use or disclose the contact details for any other purpose unless another exception in NPP 2.1 applies[14].

NPP 3 provides that an organisation must take reasonable steps to make sure that the information it collects, uses or discloses is accurate, complete and up-to-date.

For these reasons, as required by section 80A(1)(b), I am satisfied that the public interest in allowing the applicant to collect the contact details of a genetic relative in the circumstances set out in TPID 2009-1 substantially outweighs the public interest in adhering to NPP 10.1.

Consideration given to National Privacy Principle 2.1

The applicant also raises her obligations in respect of NPP 2, where the applicant has previously collected the contact details of a genetic relative of the patient.  In this situation, the applicant may wish to use these contact details for the secondary purpose of informing the consumer that they may be at risk of inheriting a genetic condition.

Under NPP 2.1, an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless the individual (whom the information is about) has consented or a listed exception applies.


Does the act or practice breach National Privacy Principle 2.1?

The circumstances where the applicant has previously collected the contact details of a genetic relative, may include where:

(1)     The contact details were provided by the patient in order for the applicant to contact their next of kin in case of emergency

On collection, the ‘next of kin’ contact details would constitute personal information collected for the purpose of being able to contact the relative about the patient in case of emergency, or for reasons relating to the patient’s health.  Recorded in this way, the contact details would generally be part of the ‘health information’ of the patient but would not be considered to comprise health information of the ‘next of kin’.

However, the contact details may become health information of the ’next of kin’ in circumstances where those details are associated with genetic information in the patient’s record and the ‘next of kin’ is a genetic relative.  This is because information about the genetic relative’s health can be inferred from the patient’s genetic information.

The applicant has submitted that it is impractical to gain consent from the genetic relative to use their contact details in these circumstances.   It does not appear that the circumstances detailed in the application would allow the applicant to rely on any other exception.

In particular, I have considered the application of NPP 2.1(a). This principle provides that information may be used or disclosed for a related secondary purpose within the reasonable expectations of the person to whom the information relates.  In the case of health information, the secondary purpose must be directly related to the primary purpose of collection.  In these circumstances, the applicant could not rely on NPP 2.1(a) as the information constitutes sensitive information and there would not be a direct relationship with the original purpose for which it was collected.

I have also considered the application of NPP 2.1(e)(i) which permits the use or disclosure of personal information if the organisation believes it is reasonably necessary to prevent a serious and imminent threat to an individual’s life, health or safety.  However, generally, the consequences of someone not knowing about a genetic predisposition to illness will not be a sufficiently imminent threat to their life, health or safety to justify disclosure.[15]

(2)          The genetic relative is a patient

Contact details for a genetic relative may be on the medical practitioner’s file as a result either of the genetic relative being a current patient of the medical practitioner, or because the genetic relative may have had some previous contact with the medical practitioner.  In these circumstances, the contact details would be considered to constitute health information - and therefore sensitive information - of the genetic relative, because the information is part of that person’s health record.

In the case of a current patient, the applicant may not be able to rely on NPP 2.1(a) as there may not be a direct relationship with the original purpose of collection of their contact details, for example, where the patient has sought treatment for a particular condition.

This would be even more so in the case of a genetic relative who is a former patient or has had some other contact with the practitioner in the past but who cannot be considered to have a current relationship with the practitioner.  This is because it would be difficult to establish that there was implied consent to use the contact details for this purpose, or that the use of the contact details is directly related to the original purpose of collecting them and within the genetic relative’s reasonable expectations.

It does not appear that the circumstances detailed in the application would allow the applicant to rely on any other exception.

I am satisfied that the act or practice described in the application would or may constitute a breach of NPP 2.1, as required by section 80A(1)(a).

Does the public interest in allowing the applicant to breach NPP 2.1 outweigh to a substantial degree the public interest in adherence to the principle?

The public interest considerations relating to secondary use of the contact details of a genetic relative are very similar to those outlined above in relation to collection (NPP 10.1).

I am satisfied that:

a)      it is impractical to obtain consent for the use of the genetic relative’s contact details in these circumstances and

b)     the central public interest objective being served by this determination is the provision of quality health care, and ultimately good public health outcomes for the community and

c)      the use of the contact details of the genetic relative(s) in circumstances where the applicant has a reasonable belief that this is necessary to lessen or prevent a serious threat to the life, health or safety of the genetic relative may contribute significantly to good health care on both respects outlined in (b).

I also accept that if the applicant were unable to use the contact details of a genetic relative in the circumstances covered by this TPID, she would be prevented from disclosing genetic information in accordance with the NPP 2.1(ea) and the section 95AA guidelines.  In my view, this would not be in accordance with the legislative intent of the Privacy Legislation Amendment Act 2006.[16]

Continuing application of the National Privacy Principles to information used under this determination

I note that the privacy protection standards in NPPs 1 and 3 to 10 will continue to apply to protect the genetic relative’s information used in these circumstances.

In particular, NPP 3 provides that an organisation must take reasonable steps to make sure that the information it collects, uses or discloses is accurate, complete and up-to-date.

For these reasons, as required by section 80A(1)(b), I am satisfied that the public interest in allowing the applicant to use the contact details of a genetic relative in the circumstances set out in TPID 2009-1 substantially outweighs the public interest in adhering to NPP 2.1.

Does the application raise issues that require an urgent decision?

As required by section 80A(1)(c), I am satisfied that the matter is urgent as, in the absence of a TPID or any other legislative protection, the applicant would or may be in breach of NPP 10.1 when collecting contact details of a genetic relative from publically available records or from the patient.  The applicant may also be in breach of NPP 2.1 when using contact details of a genetic relative which are already on the practitioner’s file.

I am satisfied that there is an urgent requirement to issue a TPID as an interim measure.  The Government has indicated in its response to the Australian Law Reform Commission’s review of privacy that it intends to amend the Privacy Act to permit the collection or use of a genetic relative’s contact details in these circumstances.

Generalising the effect of the determination

In addition to applying for a determination for herself, the applicant referred to the importance of applying the determination to medical practitioners generally.  The Privacy Commissioner TPID No. 2009-1 made under the Privacy Act has been made on the basis that these issues may apply to all organisations that provide a health service.  Accordingly I have made a separate determination, TPID 2009-1A, under section 80B of the Privacy Act to give general effect to TPID 2009-1.  



[3] The definition of ‘health information’ in section 6 of the Privacy Act is available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF

[4] Section 6 of the Privacy Act defines ‘sensitive information’ so as to include inter alia: health information about an individual. The definition of sensitive information is available at: http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF

[5] The ALRC and AHEC Inquiry concluded that there was a need to amend the Privacy Act to broaden the circumstances in which health professionals may use or disclose genetic information without consent.  The Inquiry considered that the requirement of NPP 2.1 (e)(i) that a threat be ‘serious and imminent’ was too restrictive in the context of genetic information, given that most genetic conditions will take time to manifest. See Essentially Yours: the Protection of Human Genetic Information in Australia, chapter 21, p10, available at: http://www.austlii.edu.au/au/other/alrc/publications/reports/96/

 

[8] Section 95AA guidelines, p 19.

[9] See Essentially Yours: the Protection of Human Genetic Information in Australia, chapter  21, available at:  http://www.austlii.edu.au/au/other/alrc/publications/reports/96/

 

[11] Under the Privacy Act, publicly available personal information falls within the definition of

personal information in section 6.  Therefore, the Privacy Act would apply, for example, if a practitioner takes information out of a telephone directory and enters it into their patient records. Section 6 of the Privacy Act is available at:  http://www.comlaw.gov.au/ComLaw/Legislation/ActCompilation1.nsf/framelodgmentattachments/1B0AD21B8A87AD58CA2576080018DAEF.

 

[12] The Explanatory Memorandum to the Privacy Legislation Amendment Act 2006, states that ‘This amendment will ensure that a medical practitioner is able to disclose genetic information to a genetic relative where there is a serious risk to the health of the genetic relative.’  Available at: http://www.austlii.edu.au/au/legis/cth/bill_em/plab2006310/memo_0.html

[14] Such as NPP 2.1(g) which permits secondary use or disclosure of personal information if it is required or authorised by or under law.

 

[15] This was the reason for the inclusion of NPP 2.1(ea) into the private sector provisions of the Privacy Act. However, NPP 2.1(ea) only applies to genetic information.

 

[16] The Explanatory Memorandum to the Privacy Legislation Amendment Act, states that ‘This amendment will ensure that a medical practitioner is able to disclose genetic information to a genetic relative where there is a serious risk to the health of the genetic relative.’  Available at: http://www.austlii.edu.au/au/legis/cth/bill_em/plab2006310/memo_0.html