This document has been archived and is no longer in use by the Office.

A list of the Office's current publications is available on the publications page @ http://www.privacy.gov.au/materials

EXPLANATORY STATEMENT

 

Privacy Act 1988, Part VI

 

in regard to

 

Temporary Public Interest Determination No. 2005-1

 

and

 

Determination No. 2005-1A made under s.80B(3) giving general effect to Temporary Public Interest Determination No. 2005-1

 

 

This explanatory statement has been drafted for the purpose of fulfilling the Office of Privacy Commissioner''s obligations under s. 26(1) of the Legislative Instruments Act 2003.

 

1.           PURPOSE

 

The purpose of Temporary Public Interest Determination 2005-1 is to determine that the Applicant (a general practitioner in private practice) will not be committing a breach of National Privacy Principle 10 of the Privacy Act 1988 (the Privacy Act) in certain limited circumstances.  This is where the Applicant is collecting information about the Pharmaceutical Benefits Scheme (PBS) history of one of their patients from the Health Insurance Commission''s (HIC) Prescription Shopping Project Information Service (the Information Service) without the consent of that individual. 

 

In making Temporary Public Interest Determination 2005-1, the Privacy Commissioner also considered whether a claim to exclude the Applicant from the obligations imposed by National Privacy Principle 1 was valid.  For the reasons discussed below, the Privacy Commissioner dismissed this element of the application. 

 

Although it was not raised in the application, the Privacy Commissioner also considered whether the circumstances raised would require an exclusion from National Privacy Principle 2.  For the reasons discussed below, it is not necessary for this to be included in the Temporary Public Interest Determination.

 

The purpose of Determination 2005-1A is to give general effect to Temporary Public Interest Determination 2005-1 so that other organisations, in the same circumstances as set out in the application, may carry out the same act or practice as the Applicant without breaching National Privacy Principle 10 of the Privacy Act.

 

1.1                        Provisions for Public Interest Determinations

 

The Privacy Act provides a mechanism for dealing with matters where the public interest in protecting the privacy of individuals and other public interests need to be considered, and where in some circumstances the protection of privacy should be set aside to some degree. 

 

This mechanism is given effect through the Privacy Commissioner''s power to make a public interest determination.  The Privacy Commissioner may make a public interest determination setting aside the protection of the privacy of individuals by declaring that a specific act or practice of the organisation will not be a breach of the National Privacy Principles.  Or the Privacy Commissioner may make a public interest determination dismissing the application, thereby not setting aside the protection of the privacy of individuals.  

 

The Privacy Act also provides a method for dealing with urgent matters by giving the Privacy Commissioner the power to make a temporary public interest determination in certain circumstances.

 

The Privacy Commissioner may also make a further determination extending the effect of the public interest determination (or temporary public interest determination) from the act or practice of the Applicant to the same act or practice engaged in by any organisation.

 

Further information on the provision for making public interest determinations and temporary public interest determinations is provided below at Section 1.2: ''Authority for making these determinations''.

 

1.2         Authority for making these determinations

 

Temporary Public Interest Determination No. 2005-1 is made under s. 80A(2) of the Privacy Act.  Section 80A states:

80A  Temporary public interest determinations

(1) This section applies if the Commissioner is satisfied that:

(a)   the act or practice of an agency or organisation that is the subject of an application under section 73 for a determination under section 72 breaches, or may breach:

(i) in the case of an agency''an Information Privacy Principle; and

(ii) in the case of an organisation''an approved privacy code, or a National Privacy Principle, that binds the organisation; and

(b)   the public interest in the agency or organisation doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Principle or code; and

(c) the application raises issues that require an urgent decision.

(2)   The Commissioner may make a written temporary public interest determination that he or she is satisfied of the matters set out in subsection (1). The Commissioner may do so:

(a)   on request by the agency or organisation; or

(b)   on the Commissioner''s own initiative.

 

Determination 2005-1A, giving general effect to Temporary Public Interest Determination 2005-1, is made under s. 80B(3) of the Privacy Act, which states:

80B  Effect of temporary public interest determination

Giving a temporary public interest determination general effect

(3)   The Commissioner may make a written determination that no organisation is taken to contravene section 16A if, while that determination is in force, an organisation does an act, or engages in a practice, that is the subject of a temporary public interest determination in relation to that organisation or another organisation.

Effect of determination under subsection (3)

(4)   A determination under subsection (3) has effect according to its terms.

 

1.3         Application for a Public Interest Determination

 

On 2 February 2005, the Applicant applied under section 73 of the Privacy Act for a public interest determination under section 72 of the Privacy Act.  The Applicant is an organisation for the purposes of the Privacy Act in that the Applicant is a corporation or individual (s 6C) and provides a health service to another individual and holds health information; therefore, whether or not the organisation has an annual turnover of more than $3 million it subject to the Privacy Act (s 6D(4)(b)).

 

For the reasons explained below, the Privacy Commissioner used her discretion under s. 80A(2)(b) to make a temporary public interest determination and a determination that gives general effect to the temporary public interest determination for the maximum period provided under the Privacy Act (which is 12 months).

 

The Privacy Commissioner has decided to withhold the name of the Applicant.  This decision recognised that the Applicant is a general practitioner in private medical practice and disclosure of the Applicant''s name may constitute an unnecessary interference with their privacy.  The Privacy Commissioner also considered the particularly sensitive nature of the application and recognised that disclosure of the Applicant''s name could result in inferences being made about patients of the Applicant.

 

 

1.4         Relevant National Privacy Principles

 

On 21 December 2001 the Privacy Amendment (Private Sector) Act 2000 commenced, extending the Privacy Actto the private sector through the operation of ten National Privacy Principles (NPPs).  These principles govern the collection, use, disclosure and other handling of personal information.

 

Two National Privacy Principles were raised in the application for a public interest determination.  These are National Privacy Principles 1 and 10.  Although it was not raised in the application, the Privacy Commissioner also considered the relevance of National Privacy Principle 2.  These are dealt with in reverse order as the most significant issues relate to National Privacy Principle 10.

 

National Privacy Principle 10 concerns the collection of sensitive information, which is defined in s. 6 of the Privacy Act to include information about an individual''s health.  Sensitive information is a sub-class of personal information more generally; and it attracts greater protection under the Privacy Act given the sensitivity and intimacy of the information concerned.  This principle states that sensitive information cannot be collected by an organisation unless a prescribed exception applies.  These exceptions include where the individual consents (National Privacy Principle 10.1(a)) or where the collection is required by law (National Privacy Principle 10.1(b)).  The full text of National Privacy Principle 10.1 and 10.2 is provided at Section 5 of this explanatory statement (''Further Information'').

 

The effect of National Privacy Principle 10 upon the circumstances put forward by the Applicant is that the Applicant cannot collect health information about a patient from the Information Service unless the collection is permitted by one of these exceptions.

 

National Privacy Principle 1 concerns the collection of personal information generally (that is, sensitive and non-sensitive personal information).  This principle requires, amongst other things, that an organisation can only collect personal information where the information is necessary for one of the organisation''s functions or activities (National Privacy Principle 1.1) and collection must be by lawful and fair means (National Privacy Principle 1.2). 

 

The principle also requires an organisation to take reasonable steps to ensure that the individual is notified of certain things, including why the information has been collected and by whom.  These obligations exist whether the personal information is collected directly from the individual (National Privacy Principle 1.3) or from a third-party (National Privacy Principle 1.5).  The full text of National Privacy Principles 1.3 and 1.5 is provided in Section 5 of this explanatory statement (''Further Information'').

 

The effect of National Privacy Principle 1 upon the circumstances put forward by the Applicant is that the Applicant would be collecting information from a third-party (that is, the HIC) and would need to take reasonable steps to ensure that the individual is aware of certain things listed in National Privacy Principle 1.3, unless doing this would pose a threat to the life or health of any individual.

 

Although not expressly raised by the Applicant, the Privacy Commissioner also considered the relevance of National Privacy Principle 2.  This principle governs the use and disclosure of personal information (sensitive and non-sensitive) and states that an organisation may only use or disclose personal information for the purpose for which it was collected unless a prescribed exception applies.  These exceptions include, for example, where the use or disclosure is required or authorised by law (National Privacy Principle 2.1(g)) or where the individual has consented (National Privacy Principle 2.1(b)).

 

As discussed below in ''Reasons for making this determination'', National Privacy Principle 2.1(a) was considered relevant to the application.  The full text of National Privacy Principle 2.1(a) is provided in Section 5 of this explanatory statement.

1.5         Documents incorporated by reference

 

As required under s. 74(1) of the Privacy Act, notice of receipt by the Commissioner of the application is publicly available on the Office of the Privacy Commissioner''s website at http://www.privacy.gov.au/.  This notice includes a copy of the application for a public interest determination.

 

2.           REASONS FOR MAKING DETERMINATIONS

 

2.1         Background to Prescription Shopping Project Information Service

 

The HIC has advised the Privacy Commissioner that a purpose of the Prescription Shopping Project is to reduce the number of individuals who obtain PBS medicines in excess of their therapeutic need.  This purpose is also noted on the HIC website.[1]

 

As part of the Prescription Shopping Project, an Information Service has been developed so the HIC can disclose certain health information about an individual to a prescribed organisation (e.g. a person''s general practitioner), at the organisation''s request.  This would be information relating to whether an individual has been identified under the Prescription Shopping Project as a ''prescription shopper'' and if necessary information about the individual''s PBS history.

 

The HIC''s authority to disclose this information, as well as to perform certain other functions necessary to implement the Information Service, are provided by the HIC Determination made by the Minister for Health and Ageing.  The HIC Determination is Attachment A to the Temporary Public Interest Determination 2005-1.

 

Prescription shoppers are ''identified'' under the Prescription Shopping Project if they have met one or more of a number of prescribed criteria.  The Privacy Commissioner has been advised by the HIC that at any time there may be around 20,000 individuals identified by the Prescription Shopping Project.  This represents less than 1% of the PBS patient population.  The Information Service will only disclose information to organisations covered by the HIC Determination and only in regard to ''identified'' individuals, not all Australians.  Also, a prescribed organisation (i.e. a doctor) can only seek information from the Information Service about a current patient. 

 

Further information on the Prescription Shopping Project Information Service is available from the HIC website.[2]

 

The criteria used to ''identify'' an individual are, as defined in the HIC Determination:

 

a)            they have been supplied with PBS medicines prescribed by six or more different prescribers (excluding specialists) in a three month period;

 

b)            they have obtained 25 or more PBS items for target medicines in a three month period; or

 

c)            they have obtained 50 or more PBS items in a three month period.

 

The HIC has advised the Privacy Commissioner that there are three levels of information about an individual that can be disclosed by the HIC to a prescribed organisation. The three levels involve:

 

i)              the release of information by telephone, confirming that an individual is/is not identified in accordance with the Prescription Shopping Project criteria;

 

ii)             the release of information by telephone, confirming the total number of PBS medicines, and the total number of doctors involved in prescribing these PBS medicines, in relation to the individual during the most recent three month period; and

 

iii)           the release of hard copy information containing the full PBS medicines record for the individual for this 3 month period. 

 

Prescribers select the level of information they require.  Use of the service is voluntary and prescribers are not required to access the Information Service. 

 

2.2         Issues raised by the Applicant

 

In order to provide appropriate diagnosis, assessment and treatment of an individual, the Applicant has submitted that there may be occasion where there is a need to collect information through the Information Service.  The application relates to the practice of collecting this health information without obtaining the consent of the individual (i.e. the patient).

 

The Applicant envisages that collection would occur in the context of providing a health service to an individual, where the individual is suspected by the Applicant of seeking prescriptions for PBS medicines in excess of their therapeutic need, including where they may have a drug dependency.  The Applicant submits that such an individual may be unwilling, if asked, to provide their consent to the collection of health information from the Information Service, as this collection may disclose their status as an ''identified'' person in the Prescription Shopping Project.

                                                                                        

The Applicant submitted that it is impracticable to gain the consent of many drug dependent individuals for the following reasons:

 

a)            it is the Applicant''s experience that, in similar circumstances where it is necessary to obtain PBS medication or other health history, this group of patients is unwilling to provide accurate information or to consent to the Applicant sourcing the information reliably from elsewhere; and

 

b)            these individuals choose to leave the surgery rather than have their real histories revealed.  This results in the Applicant being denied the opportunity to arrange better care and treatment for these individuals.

 

The Applicant expressed concerns that the collection of health information from the Information Service may be in breach of National Privacy Principle 10, as the individual''s consent is not sought, nor do any other available exceptions seem to apply.

 

The Applicant submitted that the use of the Information Service may be critical in informing clinical judgements in relation to the Applicant''s patients.

 

The Privacy Commissioner noted that the Applicant has submitted that, in many cases, seeking consent from an individual for the collection of information from the Information Service will be entirely viable and appropriate.

 

2.3         Public interest considerations

 

Under s. 80A of the Privacy Act,the Privacy Commissioner may make a Temporary Public Interest Determination where she is satisfied that each of the following apply:

 

1)      an act or practice of an organisation that is subject of an application for a public interest determination breaches, or may breach, a National Privacy Principle;

 

2)      the public interest in the organisation doing the act or engaging in the practice outweighs to a substantial degree the public interest in adhering to the National Privacy Principle; and

 

3)      where the application raises issues that require an urgent decision.

 

Under s. 80B(2) of the Privacy Act, the effect of a determination is that the organisation is taken not to breach the specified National Privacy Principle.

 

In considering the application, the Privacy Commissioner took account a number of factors:

 

a)      the potential harm posed to those individuals whom the Applicant suspects are seeking PBS medicines either in excess of, or otherwise against, their therapeutic needs; if, in some cases, the Applicant is not permitted to collect health information from the Information Service without the consent of the individual;

 

b)      the nature of the public interest objectives which would be served by the proposed interference with privacy; and

 

c)      the need to balance competing interests contained in s. 29(a) of the Privacy Act.

 

For each of the two National Privacy Principles raised in the application and one other principle that was considered directly relevant, the Privacy Commissioner considered whether she was satisfied that the matters listed in s. 80A(1) applied. 

 

2.4         Consideration given to National Privacy Principle 10

 

Matter 1)    Does or may the act or practice breach National Privacy Principle 10?

 

The Applicant has submitted that, in the circumstances detailed in the application, consent cannot be relied on when collecting health information about an individual.  It is clear that collecting health information without an individual''s consent will constitute a breach of National Privacy Principle 10 unless another exception applies.  It does not appear that the circumstances detailed in the application would allow the Applicant to rely on any other exception.

 

In particular, the Privacy Commissioner has considered whether the Applicant could rely on National Privacy Principle 10.2(b)(ii), the terms of which are cited in the HIC Determination.  The scope of this exception is unclear and yet to be tested in court.  In the circumstances set out in the application, the Privacy Commissioner is satisfied that there may be a breach of the law should the Applicant claim to rely on this exception to collect health information without consent.

 

The Privacy Commissioner is satisfied that the act or practice described in the application would or may constitute a breach of National Privacy Principle 10.

 

Matter 2)    Does the public interest in allowing the Applicant to breach National Privacy Principle 10 outweigh to a substantial degree the public interest in adherence to the principle?

 

Generally, an individual''s right to be informed about the handling of their personal information, and especially their health information, and to have some measure of control over how their information is collected, is regulated by National Privacy Principles 1 and 10.  An individual may be harmed if their health information is handled without their consent or knowledge. 

 

In addressing a potential interference with privacy, it is necessary to balance other interests.  The other interests raised by the application include the possibility of an immediate and direct threat posed to an individual''s health. 

 

The Privacy Commissioner is satisfied that, in certain cases, there may be an unwillingness on the part of an individual to provide consent to the collection of information from the Information Service, where this would assist in determining the individual''s therapeutic needs.  If the Applicant cannot collect this information it may lead to serious and potentially life-threatening consequences in respect of the individual''s clinical management and welfare.

 

Accurate and reliable information regarding an individual''s health history including their medication history, underpins the clinical management of the individual.  The Privacy Commissioner accepts that some individuals may put their health and lives at risk in attempting to obtain PBS medication that is in excess of their therapeutic need.  It is likely that the Information Service may assist the Applicant in the appropriate diagnosis, assessment and treatment of such individuals.

 

The Privacy Commissioner also notes that while the collection of health information in the circumstances raised by the application may constitute an interference with an individual''s privacy, the information, once collected, will continue to be afforded protections offered by the Privacy Act.  For example, the Applicant will be prohibited by National Privacy Principle 2 from using or disclosing the health information for any other purpose unless permitted by the Privacy Act.  Similarly, obligations imposed by National Privacy Principles 4 and 6 will provide protections regarding the security of information collected and the individual''s access to it.

 

The Privacy Commissioner is satisfied that the public interest in the Applicant collecting health information from the Information Service outweighs to a substantial degree the public interest in the Applicant adhering to National Privacy Principle 10 in these circumstances.  This is because the information sought by the Applicant may immediately and directly affect the health care and treatment of an individual. The central public interest objective being served by this determination is the provision of quality health care to the individual and ultimately good public health outcomes for the community.

 

Matter 3)    Does the application raise issues that require an urgent decision?

 

The Applicant has submitted that the health of some individuals is at risk and that this risk could be lessened by information available through the Information Service.  The Applicant cannot currently collect this information without breaching, or potentially breaching, National Privacy Principle 10.

 

In the absence of a determination, the Applicant''s access to this government service may be restricted or prevented.  The Applicant will, or may, breach the Privacy Act in the immediate future if they need to use the Information Service.  This lends weight to the Privacy Commissioner''s view that the matter requires urgent consideration.

 

The Privacy Commissioner is satisfied that the matter is urgent as, in the absence of a temporary public interest determination made as soon as possible, the Applicant would or may be in breach of National Privacy Principle 10 when collecting health information from the Information Service.  Such a collection may be critical in informing the Applicant''s clinical judgement about one or more of the individuals the Applicant treats.

 

2.5         Consideration given to National Privacy Principle 1

 

Matter 1)    Does or may the act or practice breach National Privacy Principle 1?

 

The application also raises the Applicant''s obligations in respect of National Privacy Principle 1.  A collection by the Applicant, from the Information Service, of information about one of their patients is likely to be necessary for one of the Applicant''s functions (as required by National Privacy Principle 1.1) and, subject to the making of a determination, be lawful and fairly collected (National Privacy Principle 1.2).  Accordingly, there would be no breach of those elements of National Privacy Principle 1.

 

The Privacy Commissioner also considered whether the obligations under National Privacy Principles 1.3 and 1.5 (that is, to provide an individual with notice of certain things when collecting information about them) would impede the Applicant''s collection of information from the Information Service.

 

The Privacy Commissioner noted the obligations imposed by National Privacy Principle 1.5 may be met at or before the time of collection, or if that is not possible, as soon as practicable after the collection. 

 

In addition, it should be noted that National Privacy Principle 1.5 requires that the Applicant take ''reasonable steps'' to ensure that the individual is aware of certain matters; what is reasonable will depend on the circumstances at hand.  The principle also expressly provides that the Applicant does not have to inform the individual of the various matters listed in National Privacy Principle 1.3 if such notice would pose a serious threat to the life or health of any individual.

 

Accordingly, the Privacy Commissioner was satisfied that National Privacy Principle 1 did not impose obligations which do, or are likely to, prevent the Applicant from collecting information from the Information Service.  It follows therefore that the Applicant could collect information from the Information Service without breaching the law in this respect.

 

As the act or practice would not constitute a breach of National Privacy Principle 1, it is not necessary for the Privacy Commissioner to consider the further matters listed in s 80A(1).

 

2.6         Consideration given to National Privacy Principle 2

 

Matter 1)    Does or may the act or practice breach National Privacy Principle 2?

 

The HIC has advised that the Privacy Commissioner that if the Applicant contacts the Information Service, the Applicant must disclose personal information concerning the patient to determine the patient''s identity (specifically, name, Medicare number and date of birth). This appears to be a disclosure of personal information under National Privacy Principle 2.

 

National Privacy Principle 2 sets out the general rule that an organisation must only use or disclose personal information for the primary purpose of collection. Use and disclosure for a secondary purpose is not allowed except where such use or disclosure falls within the exceptions listed in National Privacy Principle 2.

 

As the Applicant is unlikely to have collected the individual''s identifying details initially for the primary purpose of disclosure to the HIC, the Privacy Commissioner considered the relevance of National Privacy Principle 2.1(a) to the application.  This exception permits a disclosure of sensitive information where it is directly related to the primary purpose of collection and it falls within the individual''s reasonable expectations.

 

The Applicant would contact the Information Service to assist in their clinical decision making relating to the individual''s presentation at the health service.  This purpose seems directly related to the primary purpose for which the relevant information was initially collected (to provide diagnosis, assessment, and treatment).  Thus, the disclosure of an individual''s identifying information to the HIC in these circumstances would be a directly related secondary purpose within the meaning of National Privacy Principle 2.1(a).

 

The Applicant must also be confident that the individual would reasonably expect the disclosure to occur.  The Privacy Commissioner notes that the HIC has committed to undertake communication strategies with providers (such as the Applicant) and patients to explain the purpose and functions of the Information Service.  This is consistent with the HIC''s functions under the HIC Determination to promote awareness of the Prescription Shopping Project.[3] 

 

The Privacy Commissioner formed the view that, insomuch as these communication strategies are effectively implemented by the HIC and organisations, including the Applicant, then individuals would reasonably expect their personal information to be disclosed to the HIC if an organisation uses the Information Service.

 

The Privacy Commissioner considers the Applicant could rely on National Privacy Principle 2.1(a) to ground the disclosure of an individual''s identifying information to the HIC for the purpose of using the Information Service.  Accordingly, it is not necessary to exclude the Applicant or organisations generally from the obligations imposed by this principle.

 

As the act or practice would not constitute a breach of National Privacy Principle 2, it is not necessary for the Privacy Commissioner to consider the further matters listed in s. 80A(1).

 

3.           OPERATION OF TEMPORARY PUBLIC INTEREST DETERMINATION 2005-1 AND DETERMINATION 2005-1A

These determinations have the effect of allowing organisations that are prescribed in the HIC''s Determination to collect information from the Information Service without the consent of the individual.  This collection will only occur for the reasons allowed in the HIC Determination. 

 

Temporary Public Interest Determination 2005-1 is a direct response to the application made on 2 February 2005, and will operate in the manner described above.  Determination 2005-1A provides general effect to Temporary Public Interest Determination 2005-1.

 

4.           CONSULTATION

 

A temporary public interest determination may only be issued when the matter requires an urgent decision; such circumstances generally limit the opportunity for public consultation.   

 

Due to the urgency of the matter at hand, only limited consultation has been conducted in this instance.  Through her Office, the Privacy Commissioner held discussions with the Department of Health and Ageing and the Health Insurance Commission.  These discussions were to seek further information on the scope and operation of the Information Service.

 

Through her Office, the Privacy Commissioner also consulted with the Information Law Branch and the Office of Legislative Drafting within the Attorney-General''s Department.  The nature of this consultation was on technical matters associated with drafting the determinations.

 

In the event that the application progresses and is to be considered for a public interest determination, section 75 of the Privacy Act requires that interested parties be invited to notify the Privacy Commissioner if they wish the Privacy Commissioner to hold a conference concerning a draft of the determination.  If interested parties request a conference, the Privacy Commissioner will conduct this consultative process, as required by section 76.

 

5.           FURTHER INFORMATION

 

The text of National Privacy Principles 1.3, 1.5, 2.1(a), 10.1 and 10.2 are provided below.

 

National Privacy Principles 1.3 states:

 

1.3 At or before the time (or, if that is not practicable, as soon as practicable after) an organisation collects personal information about an individual from the individual, the organisation must take reasonable steps to ensure that the individual is aware of:

(a) the identity of the organisation and how to contact it; and

(b) the fact that he or she is able to gain access to the information; and

(c) the purposes for which the information is collected; and

(d) the organisations (or the types of organisations) to which the organisation usually discloses information of that kind; and

(e) any law that requires the particular information to be collected; and

(f) the main consequences (if any) for the individual if all or part of the information is not provided.

 

National Privacy Principle 1.5 states:

 

1.5 If an organisation collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is or has been made aware of the matters listed in subclause 1.3 except to the extent that making the individual aware of the matters would pose a serious threat to the life or health of any individual.

 

National Privacy Principle 2 regulates the use and disclosure of personal information (whether sensitive or non-sensitive).  Relevantly, National Privacy Principle 2.1(a) states:

 

2.1 An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless:

(a) both of the following apply:

(i) the secondary purpose is related to the primary purpose of collection and, if the personal information is sensitive information, directly related to the primary purpose of collection;

(ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose;

 

National Privacy Principle 10 concerns the collection of ''sensitive information''. 

Relevantly, NPP 10.1 and 10.2 state:

 

10.1 An organisation must not collect sensitive information about an individual unless:

(a) the individual has consented; or

(b) the collection is required by law; or

(c) the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual, where the individual whom the information concerns:

(i) is physically or legally incapable of giving consent to the collection; or

(ii) physically cannot communicate consent to the collection; or

(d) if the information is collected in the course of the activities of a non-profit organisation''the following conditions are satisfied:

(i) the information relates solely to the members of the organisation or to individuals who have regular contact with it in connection with its activities;

(ii) at or before the time of collecting the information, the organisation undertakes to the individual whom the information concerns that the organisation will not disclose the information without the individual''s consent; or

(e) the collection is necessary for the establishment, exercise or defence of a legal or equitable claim.

 

10.2 Despite subclause 10.1, an organisation may collect health information about an individual if:

(a) the information is necessary to provide a health service to the individual; and

(b) the information is collected:

(i) as required by law (other than this Act); or

(ii) in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.

 

…

 

[1]http://www.hic.gov.au/providers/programs_services/pbs/prescription_shop.htm#about

[2]http://www.hic.gov.au/providers/programs_services/pbs/prescription_shop.htm#info_services

[3]Clause 8.