Federal Register of Legislation - Australian Government

Primary content

Determinations/Other as made
This Determination permits a specific organisation to disclose and collect personal information to improve outcomes for children and young people at risk of serious harm.
Administered by: Attorney-General's
Registered 15 Feb 2012
Tabling HistoryDate
Tabled HR16-Feb-2012
Tabled Senate27-Feb-2012
Date of repeal 12 Mar 2014
Repealed by Privacy Public Interest (Enhancing Privacy Protection) Amendment and Repeal Determination 2014

 

 

 

 

 

 

 

 

Explanatory Statement

 

Public Interest Determinations No.s 13 and 13A

February 2012

 

 

 

 

 

 

 

 

 

 

 


Explanatory Statement

Public Interest Determinations No. 13 and No. 13A

This explanatory statement fulfils the Privacy Commissioner’s obligations under section 26(1) of the Legislative Instruments Act 2003 (Cth).[1]

It explains the scope and intended operation of two determinations issued under s 72(2) of the Privacy Act 1988 (Cth)[2] (the Privacy Act):

·         Public Interest Determination No. 13 (PID 13), and

·         Public Interest Determination No. 13A (PID 13A).

1.    Purpose and operation

Purpose

The purpose of PID 13 is to exempt UnitingCare Wesley Adelaide (the applicant) from complying with National Privacy Principles (NPP) 2.1 and 10.1, set out in Schedule 3 to the Privacy Act, in certain circumstances.

Consistent with s 72(4) of the Privacy Act, PID 13A gives general effect to PID 13 for other organisations in the same circumstances.

Provisions for Public Interest Determinations

The Privacy Act provides a mechanism for dealing with matters where the public interest in protecting the privacy of individuals needs to be considered in the context of other public interests, and where in some circumstances the protection of privacy should be set aside to some degree. 

This mechanism is given effect through the Information Commissioner’s power to make a public interest determination on the basis of an application made under s 73 of the Privacy Act for such a determination.  The Information Commissioner may make a public interest determination setting aside the protection of the privacy of individuals by declaring that a specific act or practice of the organisation will not be a breach of the NPPs. Alternatively, the Information Commissioner may make a public interest determination dismissing the application thereby not setting aside the protection of the privacy of individuals. 

Authority for making these determinations

The authority for the Privacy Commissioner to make the PIDs rests in:

·         s 72 in Part VI of the Privacy Act, and

·         s 12 of the Australian Information Commissioner Act 2010 (Cth) [3] (the AIC Act). 

The authority to make PID 13 is contained in s 72(2) of the Privacy Act. Section 72(2) states that the Commissioner may make a written determination about an organisation’s acts and practices if the Commissioner is satisfied that:

(a)   an act or practice of an organisation breaches, or may breach, an approved privacy code, or a National Privacy Principle, that binds the organisation, but

(b)   the public interest in the organisation doing the act, or engaging in the practice, substantially outweighs the public interest in adhering to that code or Principle.

PID 13A is made pursuant to s 72(4) of the Privacy Act, which states that:

The Commissioner may make a written determination that no organisation is taken to contravene s 16A if, while that determination is in force, an organisation does an act, or engages in a practice, that is the subject of a determination in relation to that organisation or another organisation.

Section 6 of the Privacy Act defines ‘Commissioner’ to mean ‘the Information Commissioner within the meaning of the AIC Act.

Section 12 of the AIC Act provides that the Privacy Commissioner may exercise the ‘privacy functions’ (which are defined in s 9(1)). The privacy functions include functions conferred on the Information Commissioner by the Privacy Act.

PID 13 and PID 13A have been made by the Privacy Commissioner. All requirements under Part VI of the Privacy Act, including notice of receipt and consultation requirements, have been met.

Application for a Public Interest Determination

The application was sought to enable implementation of the South Australian Information Sharing Guidelines for Promoting the Safety and Wellbeing of Children (SA Government 2008) (the ISG). These guidelines aim to improve early intervention outcomes by providing a consistent and structured framework for service coordination.

The application indicates a concern that, in the absence of a PID, the applicant will be unable to share personal information without consent in accordance with the ISG where children and young people are at risk of significant harm.

Relevant National Privacy Principles

The NPPs govern the collection, use, disclosure and other handling of personal information by private sector organisations.

Two NPPs were raised in the application: NPP 2.1 and NPP 10.1.

·         NPP 2.1 governs the use and disclosure of personal information and states that an organisation may only use or disclose personal information for the purpose for which it was collected unless a prescribed exception applies.  In particular, NPP 2.1(e) provides that personal information may be used or disclosed without consent where the organisation reasonably believes that it is necessary to lessen or prevent a serious and imminent threat to an individual’s life, health or safety.

·         NPP 10.1 concerns the collection of ‘sensitive information’. Sensitive information is defined in s 6 of the Privacy Act to include ‘health information’. NPP 10.1 prohibits organisations from collecting sensitive information unless a prescribed exception applies. Those exceptions include where the collection is required by law and, most relevantly, where the individual consents to the collection.

Documents incorporated by reference

The application that led to the making of PIDs 13 and 13A is available at: http://www.oaic.gov.au/news/consultations/PID_UnitingCare_Wesley/PID_application_unitingcare_wesley_adelaide.html 

The Privacy Commissioner's notice of receipt of the application (required by s 74(1) of the Privacy Act) is available at: http://www.oaic.gov.au/news/consultations.html#uniting_care_wesley

The South Australian Information Sharing Guidelines for Promoting the Safety and Wellbeing of Children (SA Government 2008) are available at: http://www.gcyp.sa.gov.au/wp-content/uploads/2009/09/INFORMATION-SHARING-GUIDELINES11.pdf

2.    Reasons for the decision

Issues raised by the applicant

In applying for a PID, the applicant submitted that the potential of the ISG to impact on effective early intervention is significant, where effective intervention relies on improved service coordination and collaboration between government agencies and non-government organisations. Service coordination is necessary as the services required to address the complex needs of high risk families rarely fall within the scope of a single provider. A complete understanding of co-existing issues is necessary to respond effectively and reduce the risk of harm to children and young people.

The applicant further submitted that it is not possible to undertake effective early intervention work if organisations are required to wait for a serious risk of harm to be imminent before information can be shared. Early intervention is considered by the applicant to reduce the risk and extent of harm that may be experience by children or young people. Information sharing as part of an effective early intervention response is therefore in the public interest and is likely to reduce social and financial costs.

Public interest considerations

In issuing PIDs 13 and 13A, the Privacy Commissioner took account of the matters raised in the application and the written submissions. Based on the available evidence presented by the applicant and submitters, the Privacy Commissioner considered on balance, that the public interest in permitting the relevant acts or practices substantially outweighs adherence to NPP 2.1 and NPP 10.1 in the relevant circumstances.  

A key determinant of public interest in this decision is that permitting the relevant disclosure and collection will enable the provision of coordinated human services to facilitate early intervention and ultimately, improved child protection outcomes.

In particular, the applicant noted that disclosure and collection of this type of information is used to improve service coordination and inform effective early intervention. Human services organisations support a number of essential aspects of life such as education, family support, housing and health. Information held by one of these organisations may hold significant importance for the work of another and a full picture of the circumstances of the child or young person and the adults they relate to may only emerge if these organisations can collect, use and disclose relevant personal information.

All the written submissions the Privacy Commissioner received identified that there is clear public interest in assisting families at risk through early intervention strategies to avoid circumstances deteriorating to a crisis situation. Anglicare SA noted in its submission that ‘identifying and responding to at risk children and their families, reduces the risk of harm to children and their possible entry into the state's child protection system.’

The applicant further suggested that the costs of failing to intervene early to support individuals and families at risk are substantial. This view that successful early intervention has long term benefits, both for individuals and the broader community was also reflected in the written submissions received.

In this regard, the written submissions suggested that social costs will continue to be considerable if the current limitations in sharing information about children and young people at risk continue to apply. Effective early intervention for at risk families can help to prevent issues like homelessness, mental illness, family violence, crime, neglect, poverty, social isolation, drug and alcohol abuse or gambling. It was also submitted that there will be financial costs and increased demands on acute service systems and the child protection system if the act or practice is not permitted.

The potential harm to individuals’ privacy was also a factor considered by the Privacy Commissioner. The applicant and submitters strongly identified that the framework provided by the ISG also provides a number of important safeguards to protect the interests of the individuals concerned, and particularly vulnerable individuals such as children and young people.

In particular, organisations implementing the ISG are required to develop an appendix detailing how the ISG will be applied in their organisation. Appendices form an attachment to the ISG and contain information about the organisation, case studies and resources to ensure employees and volunteers understand how to appropriately share information under the ISG in the context of their own work environment.

In making disclosures under PID 13 and PID 13A organisations must reasonably believe that disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of a child or young person up to the age of 18 years. The organisation will need to have reasonable grounds for its belief that the disclosure is necessary and that the threat is ‘serious’ according to the ordinary meaning of the word and in the context of any vulnerabilities of the individual concerned. Such considerations provide an important safeguard and will assist in ensuring that the potential for the proposed act or practice to harm the interests of individuals is minimised.

Accordingly, the Privacy Commissioner found that the public interest in permitting the practice in the circumstances specified in PID 13 substantially outweighed the public interest in maintaining the privacy protections of NPP 2.1 and NPP 10.1 in these circumstances.

In addition, the application more broadly highlighted the importance of coordination between relevant government agencies and organisations for effective early intervention. Each of the submitters addressed this issue and requested that a further determination be made to apply the determination generally to all relevant organisations. Accordingly, the Privacy Commissioner considered the application on the basis that these issues apply to all organisations that have implemented and comply with the ISG. For this reason the Privacy Commissioner made a separate determination (PID 13A) under s 72(4) of the Privacy Act, giving general effect to PID 13.

3.    Operation

PID 13 and PID 13A will remain in force for a period of 5 years from the date of commencement.

PID 13 applies directly to the applicant as an ‘organisation’ under the Privacy Act.

PID 13A applies to all other organisations in South Australia that have implemented and comply with the ISG, where those organisations use, disclose and collect information in the limited circumstances referred to under PID 13.

Implementation of the ISG necessarily includes the completion of an organisation specific appendix outlining the organisation’s protocols for sharing information in accordance with the requirements of the ISG.

4.    Consultation

Part VI of the Privacy Act requires the Commissioner to conduct consultation before making a PID. 

Section 74 of the Privacy Act requires the Commissioner to publish, in such manner as they think fit, notice of the receipt of an application for a PID.

Pursuant to s 74, on 10 October 2011, the Privacy Commissioner published on the website of the Office of the Australian Information Commissioner (the OAIC) a notice that an application had been received from UnitingCare Wesley Adelaide and copy of the application.

On 21 October 2011, the OAIC published a consultation paper inviting comments about the issues raised in the application, including any comments on the scope and nature of a PID. The OAIC also sought comment on the appropriateness of making a determination that gives general effect to the PID. That is, to allow other organisations that have implemented and complied with the ISG to perform the permitted act or practice in the same circumstances as the applicant.

 

The consultation paper was available on the OAIC website over a five week consultation period. All material was published in accessible and downloadable formats, and was available in hard copy on request.

The application and consultation were publicised:

·         by notation on the OAIC’s website

·         on the OAIC’s Twitter feed

·         through OAICnet, the OAIC’s email subscriber list

·         through the OAIC’s RDF Site Summary (RSS) feed

·         on the Australian Government online forum, GovDex, and

·         through the South Australian Council for Social Service fortnightly e-Bulletin.

The OAIC also directly contacted the following stakeholders by email to inform them that the consultation was taking place, and to invite submissions:

·         the members of the OAIC’s Privacy Advisory Committee,

·         the members of the Privacy Authorities Australia network, and

·         31 key privacy, government and non-government community service organisations.

The OAIC received nine written submissions in response to the consultation paper from a range of sectors, including affected non-government organisations, State government departments and peak non-government organisation representative bodies for social and community services. The submissions are available on the OAIC website.[4]

All nine submissions were highly supportive of the application and the proposed PID. Additionally, all nine submissions supported the generalising of the determination and stressed the importance of it applying to similar organisations.

5.    Statement of Compatibility with Human Rights

This Statement of Compatibility with Human Rights has been prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

PID 13 and 13A are compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Objectives of PID 13 and PID 13A

The central public interest objective being served by PID 13 and 13A is the provision of coordinated human services to facilitate early intervention and ultimately, improved child protection outcomes.

PID 13 and PID 13A enable the disclosure and collection of personal information, in limited circumstances, for the purposes of lessening or preventing a serious threat to the life, health or safety of a child or young person.

Human rights implications

Under s 29 of the Privacy Act, in performing their functions or exercising their powers, the Privacy Commissioner must, amongst other things:

(a)             have due regard for the protection of important human rights and social interests that compete with privacy…

The Preamble to the Privacy Act makes clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the International Covenant on Civil and Political Rights (ICCPR). Specifically, article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence. However, the right to privacy is not absolute and there may be circumstances in which the guarantees in article 17 can be outweighed by other primary considerations, such as the protection of the rights of children and families.

With respect to the rights of children, article 24 of the ICCPR provides that:

Every child shall have, without any discrimination as to race, colour, sex, language, religion, national or social origin, property or birth, the right to such measures of protection as are required by his status as a minor, on the part of his family, society and the State.

In addition to the rights enjoyed by all persons under the ICCPR, the Convention on the Rights of the Child (CRC) sets out child-specific needs and rights. The CRC encompasses civil, political, economic, social and cultural rights for children as well as provisions regarding their care and protection. A number of articles of the CRC are of particular relevance in the context of a consideration of measures that aim to improve outcomes for children through effective early intervention. Relevantly, the CRC recognises that children everywhere are entitled to the right:

  • to survival[5]
  • to develop to the fullest[6]
  • to protection from harmful influences, abuse and exploitation,[7] and
  • to participate fully in family, cultural and social life.[8]

Under the CRC, the best interests of children must be the primary concern in making decisions that may affect them.[9] The principle of best interests of the child applies to all actions concerning children and requires active measures to protect their rights and promote their survival, growth, and well-being.

Privacy is a right that must be appropriately balanced against other competing rights, including the rights of children and families. It is considered that the acts or practices authorised by PID 13 and PID 13A advance the protection of human rights and the rights of children. To the extent that they may also limit human rights, those limitations are reasonable and proportionate.

Conclusion

PID 13 and 13A are compatible with human rights because they advance the protection of human rights and to the extent that they may also limit human rights, those limitations are reasonable and proportionate.

 

 



[5] Convention on the Rights of the Child, 20 November 1989, [1991] ATS 4, (entered into force generally on 2 September 1990), article 6

[6] Ibid, article 6

[7] Ibid, article 19

[8] Ibid, articles 9, 16, 17, 27, 28

[9] Ibid, article 3