{"id":"F2024L00393","name":"Privacy (Persons Reported as Missing) Rule 2024","slug":"privacy-persons-reported-as-missing-rule-2024","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":442344,"registerId":"F2024L00393-fast-fetch-1775957370974","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Privacy (Persons Reported as Missing) Rule 2024","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\n \n\nPrivacy (Persons Reported as Missing) Rule 2024\n\nI, Angelene Falk, Australian Information Commissioner, make the following rule under the Privacy Act 1988.\n\nDated 25 March 2024   \n\n[Signed]\n\nAngelene Falk\n\nAustralian Information Commissioner\n\n \n\n \n\n \n\nContents\n\n \n\nPart 1 — Preliminary\n\n1  Name\n\n2  Commencement\n\n2A  Authority\n\n3  Purpose\n\n4  Definitions\n\nPart 2 — Handling of personal information\n\n5  Collection of sensitive information by a locating entity\n\n6  Use or disclosure of personal information without the consent of the person reported as missing\n\n7  Collection, use or disclosure must not pose a serious threat to an individual\n\n8  Operation of this rule\n\n \n\nPart 1 — Preliminary\n\n1  Name\n\n  This instrument is the Privacy (Persons Reported as Missing) Rule 2024.\n\n2  Commencement\n\n (1)   Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n \n\n- Commencement information\n- Column 1 Column 2 Column 3\n- Provisions Commencement Date/Details\n- 1. The whole of this instrument The later of 1 April 2024; and The day after registration\n\n\nNote:          This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.\n\n(2)   Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.\n\n \n\n2A  Authority\n\n  This instrument is made under s 16A(2) of the Privacy Act 1988.\n\n3  Purpose    \n\n(1) The rule applies for the purposes of item 3 of the table in s 16A(1) of the Privacy Act 1988, which subject to conditions specified in the item in column 3 of the table, permits an APP entity to collect sensitive information, and use and disclose personal information for the purpose of locating a person reported as missing.   \n\n(2) The rule does not permit an organisation to use or disclose government related identifiers.\n\n4  Definitions   \n\n(1)  Unless this rule states otherwise, any word or expression used in this rule which is defined in the Privacy Act has the same meaning as in that Act.\n\n \n\n(2)  In this rule:\n\nchild: without limiting who is a child of a person, someone is a child of a person if he or she is a child of a person within the meaning of the Family Law Act 1975.\n\n \n\nfamily includes the following (without limitation):\n\n(a)    a de facto partner of the individual\n\n(b)    someone who is the child of the individual, or of whom the individual is the child\n\n(c)    anyone else who would be a member of the individual’s family if someone mentioned in paragraph (a) or (b) is taken to be a member of the individual’s family.\n\nlocating entity means:\n\n(a)    the Australian Federal Police\n\n(b)    a police force or service of a State or Territory\n\n(c)    the Australian Red Cross Society\n\n(d)    International Social Service Australia\n\n(e)    a Link-Up Service of a State or Territory, or\n\n(f)     the Department of Foreign Affairs and Trade.\n\n \n\nOffice of the Australian Information Commissioner means the agency established under section 5 of the Australian Information Commissioner Act 2010.\n\n \n\nperson reported as missing means an individual:\n\n(a)    who has been reported as missing to a locating entity\n\n(b)    whose whereabouts are unknown to the locating entity, and\n\n(c)    who is being sought by the locating entity because there are serious concerns for their safety and/or welfare or for the purpose of re-uniting them with their family\n\nbut does not include an individual who is being sought:\n\n(d)    in relation to legal matters, including but not limited to, debt, maintenance, support proceedings, wills, child custody, divorce or investigations into suspected criminal activity of the individual, or\n\n(e)    for the purpose of genealogical research.\n\nPrivacy Act means the Privacy Act 1988.\n\n \n\nRule means the Privacy (Persons Reported as Missing) Rule 2024.\n\n\n\n\nPart 2 — Handling of personal information\n\n5  Collection of sensitive information by a locating entity\n\n(1)                An APP entity may collect sensitive information under item 3 of the table in s 16A(1) about a person reported as missing if:\n\n(a)    the APP entity is a locating entity\n\n(b)    the APP entity reasonably believes that the collection is reasonably necessary to assist the entity to locate the person reported as missing\n\n(c)    the information that is collected is limited to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing, and\n\n(d)    rule 7 does not apply in relation to the collection.\n\n6  Use or disclosure of personal information without the consent of the person reported as missing\n\n \n\n(1) An APP entity may use or disclose personal information under item 3 of the table in subsection 16A(1) about a person reported as missing if:\n\n(a)    the use or disclosure of the information is in response to a request from a locating entity\n\n(b)    the APP entity reasonably believes that the use or disclosure is reasonably necessary to assist the locating entity to locate a person reported as missing\n\n(c)    in the case of a disclosure, the recipient of the information is a locating entity\n\n(d)    it is unreasonable or impracticable to obtain the consent of the person reported as missing to the use or disclosure of the information\n\n(e)    the information that is used or disclosed is limited to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing\n\n(f)     the use or disclosure is not contrary to any wish expressed by the person reported as missing of which the APP entity is aware, and\n\n(g)    rule 7 does not apply in relation to the use or disclosure.\n\n \n\n(2)  If an APP entity discloses personal information in accordance with subrule (1), the entity must make a written note of the disclosure.\n\n \n\n Note:  After a person reported as missing has been located, any subsequent use and disclosure of that person’s personal information must comply with the Australian Privacy Principles (APPs), particularly APP 6.\n\n7  Collection, use or disclosure must not pose a serious threat to an individual\n\n \n\nAn APP entity must not collect, use or disclose personal information about an individual under item 3 of the table in subsection 16A(1) if the APP entity reasonably believes that the collection, use or disclosure of the information would pose a serious threat to the life, health or safety of any individual.\n\n8  Operation of this rule\n\n \n\n(1) It is not the intention of this rule to affect the operation of other laws that make provision with respect to the collection, use and disclosure of the personal information of a person reported as missing.\n\n \n\nNote:  This includes Part VIA of the Privacy Act (Dealing with personal information in emergencies and disasters)\n\n(2)                Nothing in this rule is to be taken to require an APP entity to collect, use or disclose personal information.\n\n \n","sortOrder":0}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":3,"scope_assessment":{"changed":false,"description":"The legislation remains tightly focused on its original purpose. It implements the specific permission granted by section 16A(1) item 3 of the Privacy Act 1988, which was inserted to allow privacy exceptions for missing persons. The rule does not expand beyond this statutory mandate—it merely sets the operational conditions (which locating entities qualify, what safeguards apply, what purposes are permitted). The exclusion of legal matters, debt collection, criminal investigations, and genealogy research actually narrows the scope compared to a broad reading of 'locating a person reported as missing'."},"complexity_factors":["Short instrument: only 8 rules across 2 parts","Limited defined terms: 6 specific definitions plus incorporation of Privacy Act definitions","Simple conditional structure: most provisions use straightforward 'if (a), (b), (c)...' format without nested exceptions","Single cross-reference: primarily references section 16A of the Privacy Act 1988","Clear purpose limitation: information use restricted to 'make contact with, or offer proof of life'","Explicit exclusions: rule clearly states what is NOT covered (legal matters, criminal investigations, genealogy)","No delegated legislation or subordinate instruments referenced"],"plain_english_summary":"This rule creates narrow privacy exceptions so certain approved agencies can collect, use or receive sensitive and personal information without consent to locate missing people. It applies only to specified “locating entities” and lets other organisations share information when necessary to contact or verify that a person is alive. Strict safeguards limit purpose, forbid use if it would create a serious threat, require records, exclude non‑search aims, and restore normal privacy once the person is found."},"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":false,"description":"The rule implements the exception in item 3 of s 16A(1) of the Privacy Act by specifying who qualifies as a locating entity, what sensitive information may be collected, and conditions for use/disclosure without consent. It does not expand authority beyond that item, excludes government identifiers (s 3(2)), preserves other laws (s 8(1)), and places limits and recordkeeping obligations on APP entities."},"complexity_factors":["Defined list of locating entities (s 4) narrows who may act but requires entities to verify status before relying on the rule.","Multiple subjective legal standards: 'reasonably believes' and 'reasonably necessary' tests appear in ss 5(1)(b), 5(1)(c), 6(1)(b) and 6(1)(e), creating administrative discretion and case‑by‑case judgements.","Safety carve‑out: absolute prohibition where collection/use/disclosure would pose a 'serious threat' to life, health or safety (s 7) requires risk assessment and may limit operations in marginal cases.","Consent waiver conditions in s 6(1)(d) (unreasonable or impracticable to obtain consent) and the need to respect known contrary wishes (s 6(1)(f)) create evidential and procedural burdens.","Recordkeeping requirement for disclosures (s 6(2)) imposes a modest documentation compliance cost and audit trail obligation.","Scope constrained by reference to item 3 of s 16A(1) of the Privacy Act and an explicit ban on government identifiers (s 3(1)–(2)), so interplay with the Privacy Act and other laws (s 8(1)) must be navigated.","Limited subject‑matter scope (contact/proof‑of‑life only) reduces substantive complexity but increases frequency of judgement calls about what is 'limited to the extent reasonably necessary' (ss 5(1)(c), 6(1)(e))."],"plain_english_summary":"This Rule lets specified \"locating entities\" (AFP, state/territory police, Red Cross, International Social Service Australia, Link‑Up services, DFAT) and other APP entities collect certain sensitive information and use or disclose personal information without the missing person’s consent when reasonably necessary to locate them. The information must be limited to contact or proof‑of‑life details, must not include government identifiers, and must not be used where it would pose a serious threat. Entities must record disclosures and follow existing privacy laws."}},"importantCases":[],"_links":{"self":"/api/acts/privacy-persons-reported-as-missing-rule-2024","history":"/api/acts/privacy-persons-reported-as-missing-rule-2024/history","analysis":"/api/acts/privacy-persons-reported-as-missing-rule-2024/analysis","conflicts":"/api/acts/privacy-persons-reported-as-missing-rule-2024/conflicts","importantCases":"/api/acts/privacy-persons-reported-as-missing-rule-2024/important-cases","documents":"/api/acts/privacy-persons-reported-as-missing-rule-2024/documents"}}