Privacy (Persons Reported as Missing) Rule 2024

The instrument deploys a small set of legal concepts and qualifiers that determine when and how privacy protections may be relaxed to facilitate locating a person reported as missing. The principal concepts, as defined or used in the rule text, are: locating entity, person reported as missing, reasonably necessary, reasonably believes, sensitive information, and serious threat. The rule also invokes the framework of the Privacy Act by reference to item 3 of the table in s 16A(1) and by cross-referencing the APPs for subsequent uses and disclosures (s 3(1); note after s 6(2)).

Locating entity is a closed list in s 4: the Australian Federal Police, State or Territory police forces or services, the Australian Red Cross Society, International Social Service Australia, State or Territory Link‑Up Services, and the Department of Foreign Affairs and Trade. That definition determines who may exercise the collection power in s 5 and who may receive disclosures under s 6(1)(c). The rule therefore channels the permitted exceptions to a specific cohort of public authorities and certain non-government organisations involved in tracing and family reunification.

Person reported as missing is a three-part factual definition in s 4: reported as missing to a locating entity; whereabouts unknown to that locating entity; and being sought by the locating entity because there are serious concerns for their safety and/or welfare or for reuniting them with their family. The definition explicitly excludes individuals being sought for legal matters, including debt, maintenance, support proceedings, wills, child custody, divorce or investigations into suspected criminal activity, and individuals sought for genealogical research (s 4(c)-(e)). This exclusion restricts the permitted scope to welfare- and safety-driven searches rather than civil or investigative purposes.

Reasonably necessary and reasonably believes are the standard qualifiers appearing throughout s 5 and s 6. The rule uses them to limit both the factual predicate for the permitted action and the quantity or scope of information that may be handled. For example, s 5(1)(b) requires the APP entity to reasonably believe the collection is reasonably necessary to assist in locating; s 5(1)(c) limits the information to what is reasonably necessary to make contact with or offer proof of life. Those phrases impose proportionality and evidential judgment requirements on the actor making or authorising the collection, disclosure or use.

Sensitive information is permitted to be collected by a locating entity under item 3 where the tests in s 5 are met. The rule does not redefine sensitive information; the reader must look to the Privacy Act for that statutory meaning. The permission is therefore notable because sensitive information is ordinarily subject to stricter handling under the APPs, but item 3 of s 16A(1) provides the statutory locus for an exemption when the rule’s conditions are satisfied.

Serious threat is the safety safeguard in s 7. An APP entity must not act under the rule if it reasonably believes the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual. The formulation extends the protective threshold beyond the person reported as missing to any individual, which can include family members, third parties, or the public. That assessment is a prohibition, not a permissive condition.

Two further operational concepts appear in the instrument: government related identifiers are explicitly excluded from the rule’s permission (s 3(2)), and written records are required when a disclosure is made under s 6 (s 6(2)). Additionally, the rule signals its intended relationship to other law by stating it is not intended to affect other laws that make provision for collection, use and disclosure, and it cites Part VIA of the Privacy Act (emergencies and disasters) as an example (s 8(1) note).

The rule reaches a defined set of actors and categories of information. Primary actors empowered by the rule are the locating entities named in s 4: the Australian Federal Police; State and Territory police forces and services; the Australian Red Cross Society; International Social Service Australia; State and Territory Link‑Up Services; and the Department of Foreign Affairs and Trade. These entities may be the ones to collect sensitive information under s 5 where the stated conditions are met. The Office of the Australian Information Commissioner is referenced in the definitions (s 4) and is the agency associated with the privacy regulatory framework, though the instrument itself does not set out enforcement detail.

Secondary actors affected are any APP entities holding personal information who might receive requests from locating entities and who may lawfully use or disclose personal information under item 3 (s 6(1)(a), (c)). That includes private businesses and non‑locating public bodies that are APP entities under the Privacy Act and that possess relevant information about a person reported as missing. The rule therefore directly involves private-sector custodians of personal data: telecommunication providers, financial institutions, social media platforms, health service providers, and others who are APP entities, insofar as they receive requests and meet the rule’s conditions. The rule requires those APP entities to make a written note of disclosures made under s 6(2).

Individuals affected include: persons reported as missing, whose sensitive and non-sensitive personal information may be collected, used or disclosed under the rule; family members and other associated persons (the rule’s definition of family is broad and includes de facto partners and children, s 4); and third parties whose information may be incidentally involved in locating activities. The rule explicitly excludes persons sought for legal matters or genealogical research from the definition of "person reported as missing" (s 4(d)-(e)), so parties seeking to use the locating mechanism for civil, maintenance, criminal, or genealogical purposes are outside the intended scope.

Organisational privacy officers, compliance teams, and records staff are affected in practice because the rule places decision-making and record‑keeping obligations on APP entities, including evaluating whether consent is impracticable, whether the disclosed information is limited to that reasonably necessary, whether any expressed wish of the missing person is contrary to the disclosure, and whether a disclosure would pose a serious threat to life, health or safety (s 6(1)(d)-(f); s 7).

Finally, the rule affects legal and operational relationships between locating entities and APP entities. Locating entities will be the recipients of disclosures and, in some cases, the applicants for information from other APP entities. APP entities must assess requests against the rule’s tests and have policies about when to rely on item 3 as the basis for collection, use or disclosure, and how to record and, where relevant, revert to the ordinary APP regime after the person is located (note after s 6(2)).

The instrument establishes a set of duties to be observed by APP entities and confers discretionary permissions rather than absolute rights. The central permissive rights are that an APP entity may, under item 3 of s 16A(1) as implemented by this rule, collect sensitive information (s 5) and use or disclose personal information (s 6) about a person reported as missing without the person’s consent, subject to the rule’s conditions. Those permissions are not unconditional rights; they are subject to multiple substantive and procedural duties that an APP entity must observe.

Duties and constraints on collection (s 5): Only an APP entity that is a locating entity may collect sensitive information under item 3 (s 5(1)(a)). The entity must reasonably believe the collection is reasonably necessary to assist locating the person (s 5(1)(b)). The collected information must be limited to what is reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing (s 5(1)(c)). Finally, collection must not be prohibited by the serious‑threat prohibition in rule 7 (s 5(1)(d); s 7).

Duties and constraints on use and disclosure (s 6): An APP entity may use or disclose personal information without the person’s consent only where the use or disclosure is in response to a request from a locating entity, the APP entity reasonably believes the use or disclosure is reasonably necessary to assist the locating entity, the recipient (for disclosures) is a locating entity, it is unreasonable or impracticable to obtain the missing person’s consent, the information used or disclosed is limited to what is reasonably necessary to make contact or offer proof of life, the use or disclosure does not contradict any wish expressed by the missing person that the APP entity is aware of, and the serious‑threat prohibition in rule 7 does not apply (s 6(1)(a)-(g).

Record-keeping duty (s 6(2)): If an APP entity discloses personal information under s 6(1), it must make a written note of the disclosure. This is an explicit, actionable procedural duty.

Safety duty (s 7): An APP entity must not act where it reasonably believes the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual. This is a prohibitory duty applying to all actors considering the rule’s permissions.

Limitations and prohibitions (s 3(2); s 8): The rule does not permit the use or disclosure of government related identifiers (s 3(2)). The rule is not intended to displace other laws dealing with collection, use and disclosure (s 8(1)), nor is it intended to compel any APP entity to collect, use or disclose information (s 8(2)). The note after s 6(2) additionally requires that any subsequent use and disclosure after the person has been located comply with the APPs, particularly APP 6.

Rights of the person reported as missing are limited in two ways set out by the instrument. First, their consent is not an absolute precondition for collection, use or disclosure under item 3 where the rule’s conditions are satisfied (s 5; s 6). Second, the rule protects any known expressed wish of the person reported as missing: the APP entity must not act in a way contrary to any wish expressed by the person of which it is aware (s 6(1)(f)). There is also an implied right in the prohibition at s 7 that can protect both the missing person and third parties from actions that would pose a serious threat.

Who decides? Decision‑making duties rest with the APP entity receiving the request or considering collection. That entity must form the reasonable belief and reasonable necessity judgments in s 5 and s 6, assess impracticability of consent, check for expressed wishes, and make the written disclosure note. Locating entities decide to seek and, where authorised, to collect sensitive information where they themselves are locating entities (s 5). The instrument does not create an independent administrative approval process or a requirement to seek authorisation from the Office of the Australian Information Commissioner before acting.

The instrument does not itself prescribe civil or criminal penalties or a bespoke enforcement regime. The text contains no provision imposing fines, imprisonment, or other sanctions within the rule. The rule is expressly made under s 16A(2) of the Privacy Act 1988 (s 2A) and operates as an instrument that specifies conditions under which item 3 in the table in s 16A(1) permits collection, use and disclosure. Any enforcement, compliance oversight or remedies for breaches arising from conduct under or contrary to the rule therefore sit within the broader statutory and regulatory framework of the Privacy Act 1988 and the Office of the Australian Information Commissioner, both of which are referenced in the instrument (s 4). The rule also references the APPs and the requirement that subsequent use and disclosure after a person is located must comply with the APPs (note after s 6(2)), which suggests that ordinary APP compliance mechanisms will become relevant once the specific locating purpose has been completed.

Because the instrument does not itself create penalties, the following implications follow directly from the text: the rule confers conditional permissions but does not provide a standalone enforcement mechanism or new sanctions; record-keeping duties are express (s 6(2)), and failures to comply with the APPs or the Privacy Act more generally may attract enforcement action under those statutes rather than under this rule. The rule also contains prohibitions,primarily the serious‑threat prohibition (s 7) and the prohibition on government related identifiers (s 3(2)),which an APP entity must observe. Non‑observance of those prohibitions would be a matter of non‑compliance with the instrument and the underlying Privacy Act regime.

Practically, APP entities exercising the permissions in the rule must therefore be aware that regulator attention and formal complaints would be assessed against the combination of item 3 (s 16A(1) of the Privacy Act), the conditions in this instrument (ss 5-7), and the general APP obligations that resume once an individual has been located (note after s 6(2)). The instrument itself places at least one discrete, enforceable obligation on APP entities: to make a written note of any disclosure made under s 6(1) (s 6(2)). Enforcement of that procedural obligation would be pursued under the existing Privacy Act framework.

The instrument states explicitly that it is not intended to affect the operation of other laws that make provision for the collection, use and disclosure of personal information (s 8(1)). The instrument gives one express pointer to Part VIA of the Privacy Act (Dealing with personal information in emergencies and disasters) as an example of legislation that remains operative alongside this rule (s 8(1) note). That acknowledgement clarifies that the rule is designed to sit within a broader statutory landscape rather than to displace existing legal regimes that address emergencies, disasters, or other specific circumstances.

The rule is made under the Privacy Act 1988 (s 2A) and applies for the purposes of item 3 of the table in s 16A(1) of that Act (s 3(1)). Its permissions therefore operate as a specific instance of the statutory exception in s 16A(1) where the Act contemplates that an instrument may prescribe conditions allowing APP entities to collect sensitive information and use or disclose personal information without consent. After the person reported as missing is located, the rule directs that any subsequent use or disclosure must comply with the APPs, particularly APP 6 (note after s 6(2)). That creates an interaction point: the temporary departure from APP constraints under the locating exception reverts to normal APP obligations once the immediate locating purpose has been completed.

The rule also interacts with the government‑identifier rules by expressly excluding government related identifiers from the permission in s 3(2). Organisations subject to other statutory obligations that require or regulate the use of government identifiers must therefore observe that this rule does not authorise such use or disclosure for locating purposes.

The instrument’s definitions may also interact with other laws. For instance, the definition of child refers to the Family Law Act 1975, thereby aligning the rule’s family‑related concept with established family law definitions (s 4). The locating‑entity list includes a Commonwealth agency, State and Territory police forces, and specified non‑government organisations; where those bodies are also subject to other statutory functions or confidentiality rules, those statutory duties remain in play, because the rule does not override other laws (s 8(1)). The rule’s prohibition in s 7 on acting where a serious threat would result may intersect with public safety or law enforcement obligations in other statutes; the instrument does not resolve such potential conflicts, it only signals that other laws remain effective.

Finally, the instrument does not remove an APP entity’s existing obligations under privacy law when it comes to post‑event handling of personal information. The reversion to APPs post‑location (note after s 6(2)) means that APP 6 (use and disclosure) and other APPs will govern retention, further disclosures, direct marketing, cross‑border transfers and other ordinary privacy duties once the locating purpose has been fulfilled. Organisations must therefore manage the transition from a locating exception to standard APP compliance.

The instrument contains a formal commencement table in s 2 that specifies how the instrument comes into force. The whole of the instrument commences on the later of 1 April 2024 and the day after registration (s 2(1) table). The front matter identifies the instrument’s date as 25 March 2024 and it is signed by the Australian Information Commissioner, Angelene Falk. Section 2(2) contains a technical note that information in column 3 of the commencement table is not part of the instrument and can be edited in any published version; the table’s note also states that it relates only to the provisions as originally made and will not be amended to deal with later amendments of this instrument (s 2 table and following note).

Beyond the original making of the rule, the instrument itself contains no amendment history entries, no transitional provisions for earlier instruments, and no citations of prior instruments to be repealed or replaced. It does not record any subsequent modifications. The rule asserts its authority under s 16A(2) of the Privacy Act 1988 (s 2A); any future amendment would require the same rule‑making mechanism under the Act.

Because the instrument is short and self‑contained, the amendment history in the text is limited to the formal commencement provision and the note about the table being as originally made (s 2). The instrument does not, for example, include sunset dates, staged rollouts, or staged amendments. Any later changes to the permitted scope, the list of locating entities, or procedural requirements would appear only if and when the instrument is amended by the Commissioner under the enabling provision in the Privacy Act.

Readers should therefore treat the rule as a standalone instrument, current from the commencement date stated, with no internal record of subsequent amendments in the text supplied. For operational compliance, entities should monitor the Office of the Australian Information Commissioner and the Commonwealth Gazette for any amendments or replacement instruments that would modify the permissions or obligations found in rules 5-8.

The instrument itself contains no references to cases, judicial decisions, or litigation. It does not cite any prior administrative decisions or court authorities within its text. The rule therefore has no internal litigation history recorded in the instrument. Any judicial testing of the rule’s application, interpretation of its standards, or challenges to actions taken under it would be matters for future litigation and are not recorded here.

Although the instrument is silent on litigation, the rule’s operative language contains standards that commonly give rise to disputes about fact and legal interpretation: "reasonably believes" (ss 5(1)(b), 6(1)(b)), "reasonably necessary" (ss 5(1)(b), 5(1)(c), 6(1)(b), 6(1)(e)), "unreasonable or impracticable to obtain the consent" (s 6(1)(d)), and "would pose a serious threat to the life, health or safety of any individual" (s 7). These are mixed fact and value judgments. In practice, such standards can be the subject of legal argument about the facts known to the actor, the process by which the actor formed the belief, and whether the quantity and type of information were proportionate to the locating purpose.

Litigation could also engage questions about the rule’s relationship to other statutory duties, given s 8(1)’s statement that the rule is not intended to affect other laws dealing with collection, use and disclosure. Disputes may arise if an APP entity invokes this rule as a justification for a disclosure that another statute appears to restrict, or where exercising the rule produces conflicts with other legal obligations. Similarly, the requirement that any subsequent use or disclosure after the person has been located comply with the APPs (note after s 6(2)) could be a locus for legal argument about what constitutes the "subsequent" period, and whether certain post‑location handling remains within the scope of the locating purpose.

At present, however, the instrument records no cases or litigation. Any statements here about potential legal challenge are descriptive of the textual standards and their litigation‑prone character rather than claims that litigation has already occurred.

The rule is concise but contains several practical traps and friction points that APP entities, locating entities and data custodians should note precisely as stated.

1. Limited list of locating entities. Only the named bodies in s 4 qualify as locating entities. If an organisation claims to be a locating body but is not on the list, it cannot rely on the collection permission in s 5, and it cannot be a legitimate recipient of disclosures under s 6(1)(c). Confirm the requester is a listed locating entity before relying on the rule.

2. Narrow definition of "person reported as missing". The definition in s 4 requires that the person has been reported as missing to a locating entity, their whereabouts are unknown to the locating entity, and they are being sought because of serious concerns for safety and/or welfare or for family reunion. If the stated purpose is debt recovery, legal process, or genealogical research, the person does not fall within the definition and the rule’s permissions do not apply (s 4(d)-(e)).

3. "Reasonably necessary" limits both scope and fields. Both collection and disclosure are limited to information reasonably necessary to make contact with or to offer proof of life (s 5(1)(c); s 6(1)(e)). That is narrower than open-ended requests for entire records. Data custodians should map specific fields to those purposes and avoid handing over unrelated sensitive material.

4. "Reasonably believes" is a fact‑sensitive test. APP entities must form a reasonable belief about necessity and whether consent is impracticable. There is no prescribed template for that assessment in the rule. The absence of a procedural checklist means an APP entity that relies on an informal or undocumented belief risks post hoc scrutiny. The rule does require a written note of the disclosure (s 6(2)), but not of the internal assessment, so maintain contemporaneous decision records anyway.

5. Exclusion of government related identifiers. The rule explicitly does not permit the use or disclosure of government related identifiers (s 3(2)). Requests seeking Medicare numbers, tax file numbers, passport numbers or similar identifiers are not authorised by this rule.

6. The "serious threat" prohibition extends to any individual. Rule 7 prohibits collection, use or disclosure if it would pose a serious threat to the life, health or safety of any individual. That means an APP entity must assess risks not just to the missing person but to family, third parties and the public. A disclosure that would expose a hidden witness, for example, might be excluded under s 7.

7. Impracticability of consent. The disclosure route in s 6 requires that it be unreasonable or impracticable to obtain the missing person’s consent (s 6(1)(d)). The rule gives no exhaustive examples. Entities must be prepared to document why consent could not reasonably be obtained. The test is more than mere inconvenience.

8. Known expressed wishes of the missing person. If the APP entity is aware of an expressed wish of the missing person that is contrary to the proposed use or disclosure, the rule forbids acting contrary to that wish (s 6(1)(f)). That places an evidential onus on the APP entity to search for and respect any prior privacy preferences known to it.

9. Reversion to APPs after locating. Once the person is located, subsequent handling reverts to the APPs, especially APP 6 (note after s 6(2)). Organisations must ensure they switch to ordinary APP-compliant procedures for retention, further disclosure, cross-border transfers and deletion.

10. Disclosure-only recipients. The rule permits disclosures only to locating entities (s 6(1)(c)). A disclosure to a third party who is not a listed locating entity is not authorised by s 6. Verify the recipient’s status before making disclosures.

11. Recordkeeping narrow but necessary. The rule requires a written note of disclosures under s 6(2) but does not prescribe retention periods, audit trails, or formats. Practical compliance demands that organisations maintain a broader set of contemporaneous records than the rule expressly requires to demonstrate their reasonable belief and necessity assessments.

12. The rule is permissive, not compulsory. Section 8(2) states that nothing in the rule requires an APP entity to collect, use or disclose personal information. Organisations retain discretion to refuse requests and to choose to seek consent instead. That discretion is both an operational choice and a legal safeguard.

These gotchas are direct consequences of the instrument’s short, standards-based language. They create decision points where organisations must exercise judgement, document it, and be prepared to justify it under the broader Privacy Act framework.

The rule establishes a set of conditions and a small number of procedural duties; practical compliance requires policies, decision‑records, and operational workflows that map directly to the statutory tests.

1. Identify whether your organisation is a locating entity. If you are one of the bodies listed in s 4, you may be able to collect sensitive information under s 5. If you are an APP entity but not a locating entity, you may be asked to use or disclose personal information in response to a locating entity’s request under s 6. Determine your status and assign internal responsibilities to your privacy or compliance team.

2. Create a locating‑request intake procedure. For APP entities receiving requests under s 6, implement a procedure to validate the requester as a listed locating entity (s 4; s 6(1)(c)), to capture the stated purpose (must be locating a person reported as missing), and to assess whether the request falls within the rule’s permitted scope.

3. Assess "reasonably necessary" and document the assessment. The core statutory tests use "reasonably necessary" and "reasonably believes" (ss 5(1)(b), 5(1)(c), 6(1)(b), 6(1)(e)). For every collection, use or disclosure, document: the facts known to the decision‑maker, why the information requested is necessary to make contact or offer proof of life, and why less intrusive means are insufficient. Keep contemporaneous records that explain the proportionality analysis.

4. Check for government related identifiers and exclude them. The rule does not permit the use or disclosure of government related identifiers (s 3(2)). Build a verification step to flag and redact such identifiers from any disclosure.

5. Verify impracticability of consent. For disclosures under s 6 you must be satisfied that obtaining the person reported as missing’s consent is unreasonable or impracticable (s 6(1)(d)). Develop criteria and evidence standards for what qualifies as impracticable in your operational context, and maintain that evidence.

6. Search for and respect any expressed wishes. Before disclosing, check whether the organisation is aware of any expressed wish of the missing person contrary to the proposed action (s 6(1)(f)). This requires searching existing files, recorded preferences, and registrations.

7. Conduct a "serious threat" risk assessment. Rule 7 is prohibitory: do not act if you reasonably believe the collection, use or disclosure would pose a serious threat to life, health or safety of any individual. Require a safety escalation process to legal counsel or a senior privacy officer where the facts suggest any risk of threat, and document the assessment.

8. Limit disclosures to what is reasonably necessary. Both collection and disclosure must be limited to the information reasonably necessary to make contact or offer proof of life (ss 5(1)(c), 6(1)(e)). Maintain templates that map common locating objectives to specific information fields and avoid full record dumps.

9. Make the required written disclosure note. If you disclose personal information under s 6(1), make the written note the rule requires (s 6(2)). Build this into your disclosure workflow and retain the note as part of your compliance records.

10. Prepare for post‑location APP compliance. The note after s 6(2) requires that subsequent use and disclosure after locating must comply with the APPs, particularly APP 6. Have a process to identify when a person has been located, to transition handling from the locating exception to ordinary APP compliance, and to document that transition.

11. Training and delegation. Train front‑line staff, privacy officers and legal teams on the limited scope of the locating permissions, the exclusion of government identifiers, the need to document reasonable belief and necessity, and the safety considerations under s 7. Delegate decision authority to appropriately senior staff with clear escalation paths.

12. Records retention and audit readiness. The rule requires only a written note on disclosure, but effective compliance will need retention of internal assessments, evidence of impracticability of consent, safety assessments under s 7, copies of redacted disclosures, and logs showing the requester’s identity and status as a locating entity. Ensure retention policies align with broader APP obligations once the person has been located.

13. Liaison with locating entities. Because the rule channels actions to and from named locating entities, establish points of contact and agreed procedures with those bodies for authenticating requests, securing urgent disclosures, and confirming when a person has been located so the APP duties reset.

14. Legal review for edge cases. For requests that push the boundaries of "reasonably necessary," involve sensitive or ambiguous fields, or raise safety risks, obtain legal review prior to disclosure. Document the legal advice and the facts that informed the decision to disclose or withhold.

15. Policy statements. Update your privacy policy and internal privacy manuals to note that, in narrow circumstances, the organisation may use or disclose personal information to locating entities under item 3 of s 16A(1) as implemented by this rule, but that such disclosures are limited, documented, and subject to safety checks and APP compliance once the person is located.

Following these steps aligns organisational practice with the rule’s textual requirements (ss 5-8) and reduces the risk of non‑compliance with both the instrument and the broader APP regime that resumes after the locating purpose has concluded.