Requirements of s72 of the Privacy Act

Under s72(2) of the Privacy Act, I am empowered to make a written determination where I am satisfied that:

(a) an act or practice of an organisation breaches, or may breach… a National Privacy Principle that binds the organisation; but

(b) the public interest in the organisation doing the act, or engaging in the practice, substantially outweighs the public interest in adhering to that… Principle.

Under s72(3) of the Privacy Act, the effect of such a determination is that the act or practice of the organisation will be taken not to contravene s 16A of the Privacy Act. That is, the act or practice will not be regarded as an act or practice that breaches an NPP.

Breach of National Privacy Principle 2.1

The applicant has sought an exemption from complying with NPP 2.1 and more specifically, NPP 2.1(e).

Under NPP 2.1, an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection, unless the individual (whom the information is about) has consented or a listed exception applies.

There may be some limited circumstances in which the applicant would be unable to rely on the exceptions to NPP 2.1 to disclose information in accordance with the information sharing arrangements outlined in the ISG.

In particular, I have considered the application of NPP 2.1(e). That principle provides that personal information can be disclosed without consent under NPP 2.1(e) where:

‘the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious and imminent threat to an individual’s life, health or safety;’ [emphasis added]

The applicant has identified that they are unable to rely on NPP 2.1(e) to make disclosures under the ISG where there is a serious, but not imminent, threat to a person’s life, health or safety. Insofar as the word ‘imminent’ is generally understood to mean ‘immediate’.

The main inconsistency between the circumstances in which information can be disclosed under the ISG and NPP 2.1(e), is that the ISG does not require serious threats to an individual to be imminent before a disclosure is made without consent, whilst NPP 2.1(e) requires that this threat must also be imminent.

The applicant has submitted that while a child or young person may not be at risk of immediate harm, it may be clear from the circumstances that there are reasonable grounds to believe that they are at risk of serious harm. The pattern of family interactions, behaviour of parents or guardians, peer relations or the social or physical situation of a child or young person, may put their future life, health or safety at risk of serious harm. The applicant considers that information sharing in these circumstances is necessary to enable effective and appropriate early intervention to occur to alleviate the potential for the serious harm to occur and reduce the seriousness of the threat. I accept the applicant’s view that in these circumstances, personal information cannot be disclosed under NPP 2.1(e).