I, Angelene Falk, Australian Information Commissioner, make the following rule under the Privacy Act 1988.
Dated 25 March 2024
[Signed]
Angelene Falk
Australian Information Commissioner
Contents
Part 1 — Preliminary
1 Name
2 Commencement
2A Authority
3 Purpose
4 Definitions
Part 2 — Handling of personal information
5 Collection of sensitive information by a locating entity
6 Use or disclosure of personal information without the consent of the person reported as missing
7 Collection, use or disclosure must not pose a serious threat to an individual
8 Operation of this rule
Part 1 — Preliminary
1 Name
This instrument is the Privacy (Persons Reported as Missing) Rule 2024.
2 Commencement
(1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
Commencement information
Column 1 Column 2 Column 3
Provisions Commencement Date/Details
The whole of this instrument The later of 1 April 2024; and The day after registration
Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.
(2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.
2A Authority
This instrument is made under s 16A(2) of the Privacy Act 1988.
3 Purpose
(1) The rule applies for the purposes of item 3 of the table in s 16A(1) of the Privacy Act 1988, which subject to conditions specified in the item in column 3 of the table, permits an APP entity to collect sensitive information, and use and disclose personal information for the purpose of locating a person reported as missing.
Section 1 - Privacy (Persons Reported as Missing) Rule 2024 - Privacy (Persons Reported as Missing) Rule 2024 | Zoe
(2) The rule does not permit an organisation to use or disclose government related identifiers.
4 Definitions
(1) Unless this rule states otherwise, any word or expression used in this rule which is defined in the Privacy Act has the same meaning as in that Act.
(2) In this rule:
child: without limiting who is a child of a person, someone is a child of a person if he or she is a child of a person within the meaning of the Family Law Act 1975.
family includes the following (without limitation):
(a) a de facto partner of the individual
(b) someone who is the child of the individual, or of whom the individual is the child
(c) anyone else who would be a member of the individual’s family if someone mentioned in paragraph (a) or (b) is taken to be a member of the individual’s family.
locating entity means:
(a) the Australian Federal Police
(b) a police force or service of a State or Territory
(c) the Australian Red Cross Society
(d) International Social Service Australia
(e) a Link-Up Service of a State or Territory, or
(f) the Department of Foreign Affairs and Trade.
Office of the Australian Information Commissioner means the agency established under section 5 of the Australian Information Commissioner Act 2010.
person reported as missing means an individual:
(a) who has been reported as missing to a locating entity
(b) whose whereabouts are unknown to the locating entity, and
(c) who is being sought by the locating entity because there are serious concerns for their safety and/or welfare or for the purpose of re-uniting them with their family
but does not include an individual who is being sought:
(d) in relation to legal matters, including but not limited to, debt, maintenance, support proceedings, wills, child custody, divorce or investigations into suspected criminal activity of the individual, or
(e) for the purpose of genealogical research.
Privacy Act means the Privacy Act 1988.
Rule means the Privacy (Persons Reported as Missing) Rule 2024.
Part 2 — Handling of personal information
5 Collection of sensitive information by a locating entity
(1) An APP entity may collect sensitive information under item 3 of the table in s 16A(1) about a person reported as missing if:
(a) the APP entity is a locating entity
(b) the APP entity reasonably believes that the collection is reasonably necessary to assist the entity to locate the person reported as missing
(c) the information that is collected is limited to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing, and
(d) rule 7 does not apply in relation to the collection.
6 Use or disclosure of personal information without the consent of the person reported as missing
(1) An APP entity may use or disclose personal information under item 3 of the table in subsection 16A(1) about a person reported as missing if:
(a) the use or disclosure of the information is in response to a request from a locating entity
(b) the APP entity reasonably believes that the use or disclosure is reasonably necessary to assist the locating entity to locate a person reported as missing
(c) in the case of a disclosure, the recipient of the information is a locating entity
(d) it is unreasonable or impracticable to obtain the consent of the person reported as missing to the use or disclosure of the information
(e) the information that is used or disclosed is limited to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing
(f) the use or disclosure is not contrary to any wish expressed by the person reported as missing of which the APP entity is aware, and
(g) rule 7 does not apply in relation to the use or disclosure.
(2) If an APP entity discloses personal information in accordance with subrule (1), the entity must make a written note of the disclosure.
Note: After a person reported as missing has been located, any subsequent use and disclosure of that person’s personal information must comply with the Australian Privacy Principles (APPs), particularly APP 6.
7 Collection, use or disclosure must not pose a serious threat to an individual
An APP entity must not collect, use or disclose personal information about an individual under item 3 of the table in subsection 16A(1) if the APP entity reasonably believes that the collection, use or disclosure of the information would pose a serious threat to the life, health or safety of any individual.
8 Operation of this rule
(1) It is not the intention of this rule to affect the operation of other laws that make provision with respect to the collection, use and disclosure of the personal information of a person reported as missing.
Note: This includes Part VIA of the Privacy Act (Dealing with personal information in emergencies and disasters)
(2) Nothing in this rule is to be taken to require an APP entity to collect, use or disclose personal information.