Requirements of s72 of the Privacy Act

Under s72(2) of the Privacy Act, I am empowered to make a written determination where I am satisfied that:

(a) an act or practice of an organisation breaches, or may breach… a National Privacy Principle that binds the organisation; but

(b) the public interest in the organisation doing the act, or engaging in the practice, substantially outweighs the public interest in adhering to that… Principle.

Under s72(3) of the Privacy Act, the effect of such a determination is that the act or practice of the organisation will be taken not to contravene s 16A of the Privacy Act. That is, the act or practice will not be regarded as an act or practice that breaches an NPP.

Breach of National Privacy Principle 2.1

The applicant has sought an exemption from complying with NPP 2.1 and more specifically, NPP 2.1(e).

Under NPP 2.1, an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection, unless the individual (whom the information is about) has consented or a listed exception applies.

There may be some limited circumstances in which the applicant would be unable to rely on the exceptions to NPP 2.1 to disclose information in accordance with the information sharing arrangements outlined in the ISG.

In particular, I have considered the application of NPP 2.1(e). That principle provides that personal information can be disclosed without consent under NPP 2.1(e) where:

‘the organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious and imminent threat to an individual’s life, health or safety;’ [emphasis added]

The applicant has identified that they are unable to rely on NPP 2.1(e) to make disclosures under the ISG where there is a serious, but not imminent, threat to a person’s life, health or safety. Insofar as the word ‘imminent’ is generally understood to mean ‘immediate’.

The main inconsistency between the circumstances in which information can be disclosed under the ISG and NPP 2.1(e), is that the ISG does not require serious threats to an individual to be imminent before a disclosure is made without consent, whilst NPP 2.1(e) requires that this threat must also be imminent.

The applicant has submitted that while a child or young person may not be at risk of immediate harm, it may be clear from the circumstances that there are reasonable grounds to believe that they are at risk of serious harm. The pattern of family interactions, behaviour of parents or guardians, peer relations or the social or physical situation of a child or young person, may put their future life, health or safety at risk of serious harm. The applicant considers that information sharing in these circumstances is necessary to enable effective and appropriate early intervention to occur to alleviate the potential for the serious harm to occur and reduce the seriousness of the threat. I accept the applicant’s view that in these circumstances, personal information cannot be disclosed under NPP 2.1(e).

NPP 2.1(b) enables personal information to be used or disclosed where the ‘individual has consented to the use or disclosure’. While the ISG approaches information sharing from the general position that informed consent should be sought, the applicant submits that gaining consent to the disclosure may increase the risk of harm to a child or young person or is not possible in all circumstances. In these circumstances, the applicant would be unable to rely on NPP 2.1(b) to disclose the information under the ISG.

I have also considered the application of NPP 2.1(a). That principle provides that ‘sensitive information’[3], including ‘health information’, may be used or disclosed for a related secondary purpose if:

the secondary purpose is ‘directly related to the primary purpose of collection’, and
the person to whom the information relates would ‘reasonably expect the organisation to use or disclose the information for the secondary purpose’.

The primary purpose of collecting sensitive information from an individual should be interpreted narrowly, such as to assist an individual with a particular situation or to treat a particular condition. The context in which an individual gives information to an organisation will determine the primary purpose of collection and it should be recognised that individuals may want to access services in particular and limited ways.

A directly related purpose is one which is closely associated with the original purpose. Where the information to be disclosed constitutes sensitive information there needs to be a direct relationship with the original purpose for which it was collected. I consider that in certain circumstances, such as where information is collected for the purpose of assisting an individual, but disclosed for the purpose of assisting another individual, that the applicant may not be able to rely on NPP 2.1(a).

Further, while an individual may expect a human service organisation to provide them with information about other services that may be beneficial to them or their family, it may be beyond the individual’s reasonable expectations for sensitive information to be disclosed to another organisation without their consent for the purposes of providing services to a child or young person in their care.

As required by s 72(1)(a) of the Privacy Act, I am satisfied that the proposed disclosure may breach NPP 2.1.