PRIVACY ACT 1988 (PART VI)

Applicant:	The Commonwealth Director of Public Prosecutions (CDPP)
Nature of Application:	Disclosure of personal information contained in certain CDPP files that relate to serious incidences of fraud, dishonesty and deception to the Australian Institute of Criminology (AIC) for research purposes.
Information Privacy Principles Concerned:	Information Privacy Principle 11 - Limits on disclosure of personal information
Issued	22 March 2002
Tabled:	14 May 2002
Effective:	26 August 2002

PUBLIC INTEREST DETERMINATION

I, Malcolm Woodhouse Crompton, Privacy Commissioner, make the following determination under section 72 of the Privacy Act 1988.

Dated this twenty-second day of March, 2002

MALCOLM WOODHOUSE CROMPTON Privacy Commissioner

1. I am satisfied, in accordance with section 72 of the Privacy Act 1988, that:

   a. the disclosure, by the Commonwealth Director of Public Prosecutions (CDPP), of personal information to the Australian Institute of Criminology (AIC) pertaining to cases of serious fraud, dishonesty and deception, in the manner described in (2) breaches or may breach an Information Privacy Principle, namely Information Privacy Principle 11 - Limits on disclosure of personal information; and

   b. the public interest in the CDPP disclosing this information to the AIC in the manner described in (2) outweighs to a substantial degree the public interest in adhering to that Information Privacy Principle.

2. The CDPP will disclose personal information held in twenty-eight (28) completed case files relating to serious cases of fraud, dishonesty and deception where:

   a. the information will be used by the AIC solely for the purpose of conducting research into the nature and extent of serious fraud in Australia and New Zealand;

   b. the information disclosed will relate only to the categories of matters listed in Attachment A;

   c. the names of witnesses, suspects, offenders, victims and those acquitted of the crime will not be recorded by the AIC; d. access to the information shall be provided on CDPP premises exclusively and under CDPP supervision; e. the staff member of the AIC responsible for inspecting the information held by the CDPP shall have substantial prior experience in criminological research involving accessing sensitive data and be personally authorised to undertake the research by the Director of the AIC; f. the results of the research will be published in aggregate form to prevent the identification of individuals; g. the results of the research will be published in such a way as to prevent the information being used to inspire or to facilitate the commission of crime; and h. the personal information will not be disclosed to any other agency and organisation (including PricewaterhouseCoopers) or unauthorised AIC research officer.

Statement of reasons for determination under section 79(3)

 

Background The Commonwealth Director of Public Prosecutions (CDPP) in an application dated 7 January 2002 has, pursuant to s.73 of the Privacy Act (the Act), sought a Public Interest Determination (PID) under s.72 of the Act to allow the CDPP to engage in an act or practice that breaches or may breach Information Privacy Principle 11. The act or practice in question involves the disclosure of personal information to the Australian Institute of Criminology (AIC) for research purposes.

The CDPP applied for the PID for the following reasons:

1. The CDPP believes that such a disclosure would infringe Information Privacy Principle 11 as it involves the disclosure of personal information by permitting an officer of the AIC to inspect documents held in files maintained by the CDPP and to record the information in question.
2. The CDPP believes that it would be impracticable to gain the consent of individuals who might be affected by the disclosure.

The CDPP has been approached by the AIC for permission to inspect twenty-eight (28) of the CDPP's completed files relating to prosecutions involving charges of serious fraud, dishonesty and deception and to record certain information contained in those files.

The application advised that the AIC has informed the CDPP that it wishes to inspect the files in question for the sole purpose of conducting research into the nature and extent of serious fraud in Australia and New Zealand by compiling data extracted from completed prosecution files in the categories listed in Attachment A. Data is being gathered from every jurisdiction in Australia and New Zealand in order to publish a report and other papers that describe the nature and extent of serious fraud and how allegations of serious fraud are investigated, prosecuted and disposed of in the courts. The AIC, which is an agency and therefore bound by the Information Privacy Principles itself, has affirmed that all documents will be published in such a way that it will not be possible to identify any individuals whose information was collected from the CDPP files.

The research being conducted by the AIC is funded jointly by the AIC and by PricewaterhouseCoopers with each entity sharing intellectual property in the results of the research.

The application for a PID relates to the disclosure in the following circumstances of personal information contained in certain CDPP files:

a. the information will be used by the AIC solely for the purpose of conducting research into the nature and extent of serious fraud in Australia and New Zealand; b. the information disclosed will relate only to the categories of matters listed in Attachment A; c. the names of witnesses, suspects, offenders, victims and those acquitted of the crime will not be recorded by the AIC; d. access to the information shall be provided on CDPP premises exclusively and under CDPP supervision; e. the staff member of the AIC responsible for inspecting the information held by the CDPP shall have substantial prior experience in criminological research involving access sensitive data and be personally authorised to undertake the research by the Director of the AIC; f. the results of the research will be published in aggregate form to prevent the identification of individuals; g. the results of the research will be published in such a way as to prevent the information being used to inspire or to facilitate the commission of crime; and h. the personal information will not be disclosed to any other agency and organisation (including PricewaterhouseCoopers) or unauthorised AIC research officer.

Process The Office published a notice of the receipt of the application from the CDPP in accordance with section 74 of the Act. A notice was issued on the Office website, in the Commonwealth Government Gazette and in a national newspaper (the Australian). The Office also contacted approximately 85 agencies, organisations and people thought to have an interest in the application, inviting them to call a conference. An invitation was also issued on the website along with the draft of the Determination. No serious objections to the Draft Determination were raised and no request for a conference was made.

The Commissioner signed the Determination on 22 March 2002.

Draft Determination A draft of this Determination was agreed to by the Commissioner on Thursday, 28 February 2002. The draft was subject to consultation, as outlined above, with no serious objections being raised. As a result, there have been no changes made to the Determination.

The statement of reasons has been altered since the draft version was made available for comment. However, the only changes have been to make the legislative requirements for issuing a PID more explicit. There have been no significant changes to the reasons given for issuing the Determination.

The provisions of the Act which are relevant to this application Section 6(1) provides:

"personal information" means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

Section 16 provides:

An agency shall not do an act or engage in a practice that breaches an information privacy principle.

Section 72(1) provides:

(1) Subject to this Division, where the Commissioner is satisfied that:

(a) an act or practice of an agency breaches, or may breach, an Information Privacy Principle; and (b) the public interest in the agency doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Information Privacy Principle;

the Commissioner may make a written determination to that effect and, if the Commissioner does so, the fact that the act or practice breaches that Information Privacy Principle shall:

(c) if the agency does the act while the determination is in force; or (d) in so far as the agency engages in the practice while the determination is in force;

as the case may be, be disregarded for the purpose of section 16.

Information Privacy Principle 11.1 provides:

Limits on disclosure of personal information

1. A record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless:

(a) the individual concerned is reasonably likely to have been aware, or made aware under Principle 2, that information of that kind is usually passed to that person, body or agency; (b) the individual concerned has consented to the disclosure; (c) the record-keeper believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person; (d) the disclosure is required or authorised by or under law; or (e) the disclosure is reasonably necessary for the enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the protection of the public revenue.

Findings The findings on material questions of fact relating to the application are as follows:

1. The CDPP is an agency established under the Director of Public Prosecutions Act 1983 ("the DPP Act").
2. The functions of the agency are set out in section 6 of the DPP Act and include the following:

   a. to institute and carry on prosecutions on indictment for indictable offences against the laws of the Commonwealth; b. to institute and carry on proceedings for the commitment of persons for trial in respect of indictable offences against the laws of the Commonwealth; c. to institute and carry on proceedings for the summary conviction of persons in respect of offences against the laws of the Commonwealth; d. to assist a coroner in inquests and inquiries conducted under the laws of the Commonwealth; e. to appear in proceedings under the Extradition Act 1988 or the Mutual Assistance in Criminal Matters Act 1987; f. where the Director, with the consent of the Attorney General, holds an appointment to prosecute offences against the laws of a State-to-institute and carry on, in accordance with the terms of the appointment, prosecutions for such offences; g. to take, or co ordinate or supervise the taking of, civil remedies; h. to institute, carry on, or co ordinate or supervise the institution or carrying on of, proceedings for the recovery of pecuniary penalties under the laws of the Commonwealth; and i. to take proceedings under the Proceeds of Crimes Act 1987.

3. In handling personal information, the agency is required to comply with the Information Privacy Principles set out in section 14 of the Act.

4. Information Privacy Principle 11.1 limits the disclosure of personal information held by an agency to certain prescribed circumstances. It is the opinion of the CDPP that none of these circumstances apply to the disclosure practice in question, and therefore the CDPP would be in breach of Information Privacy Principle 11 if it were to make such a disclosure.

Requirements of section 72 Under section 72 of the Act, the Privacy Commissioner is empowered to issue a determination where he or she is satisfied that (i) an act or practice of an agency breaches or may breach an Information Privacy Principle, and (ii) the public interest in the agency doing the act or engaging in the practice outweighs to a substantial degree the public interest in adhering to that Information Privacy Principles. Under section 72(1) of the Act, the effect of such a determination is that the act or practice of the agency will be disregarded for the purpose of section 16 of the Act. That is, the act or practice will not be regarded as an act or practice that breaches an Information Privacy Principle.

Breach of an Information Privacy Principle The proposed disclosure of information involves the disclosure by the CDPP to the AIC of information from 28 of its case files relating to serious cases of fraud, dishonesty and deception. Information contained in those files may comprise information relating to witnesses, suspects, offenders, victims and those charged but not convicted. Under the proposed arrangement an officer of the AIC will be permitted to inspect those files and record certain information.

Information Privacy Principle 11.1 provides that a record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless certain specified circumstances, which are set out in paragraphs 11.1 (a) to (e), exist. Section 6(1) of the Act provides that personal information is information or an opinion whether true or not about an individual.

I am of the view that the proposed disclosure may involve the disclosure of personal information in terms of Information Privacy Principle 11.1 and that such disclosure does not come within paragraphs 11.1 (a) to (e). Accordingly, I am satisfied for the purposes of section 72(1)(a) of the Act the act or practice in question breaches or may breach Information Privacy Principle 11.

Public interest The CDPP submits that the information sought to be gathered by the AIC will enable an accurate understanding to be gained of the nature and extent of serious fraud in Australia and New Zealand. The CDPP submits that research in this level of detail has not been undertaken in Australia before and the results will be of benefit to the community in understanding why serious fraud occurs, in assessing the appropriateness of sanctions imposed on convicted offenders, in designing fraud prevention initiatives, and in determining the cost of fraud to the Australian community. In particular, knowledge of the motivations and rationalisations of offenders and the manner in which their offences were committed and detected, will provide guidelines for both law enforcement agencies and their investigatory bodies in responding to crimes of this nature. The community will also benefit from knowledge concerning individual vulnerability to victimisation of crimes of this nature that are currently being committed in Australia and New Zealand.

Having regard to the benefits to be gained by the community as a result of AIC's research I accept that there is significant public interest in the CDPP disclosing the information in question to the AIC.

The CDPP advises that the privacy interests of the offenders and more importantly, of the witnesses, victims and those individuals that have been acquitted of the charges of fraud are something that have been given due consideration. Consideration was given to whether the CDPP should cull or de-identify the file in regard to certain personal information before the files are inspected. However, the CDPP and the AIC advise that such steps would be unreasonably resource intensive and would likely impede the objects of the research.

According to the application, the staff member of the AIC responsible for inspecting the information held by the CDPP will have substantial prior experience in criminological research involving access to sensitive data and be personally authorised to undertake the research by the Director of the AIC. Furthermore, the authorised staff member will not record the names of witnesses, suspects, offenders, victims or those acquitted of the crime as part of the inspection, nor will their identities be obtainable from any of the published research.

The CDPP believes there is no other way in which the proposed research could be conducted as files maintained by complainants and other agencies, such as the police and the courts, do not contain the level of detail that is sought by the AIC in carrying out this research.

The proposed disclosure will relate only to completed files that have resulted in the offender being dealt with to finality in court proceedings. Disclosure will not be provided in respect to ongoing proceedings. This PID relates only to a discrete disclosure of personal information and does not apply to any ongoing activity.

I accept that having regard to the circumstances of the disclosure set out in (2) of my Determination the proposed disclosure of personal information will be strictly limited and controlled. In particular, I note that: the AIC officer who will access the files will have substantial experience in accessing sensitive material; that officer will not record the names of individuals; the personal information will not be disclosed to any other agency or organisation; and that the research will be published in a form to prevent the identification of individuals.

Bearing in mind the significant public interest in the CDPP allowing the AIC to access that information and having regard to the strict limits and controls set out in (2) of the Determination in relation to such disclosure I am of the view that the public interest in the proposed disclosure by the CDPP substantially outweighs the public interest in the CDPP adhering to Information Privacy Principle 11.

Conclusion For the purposes of section 72 of the Act I am satisfied that: (i) the proposed disclosure by the CDPP to the AIC of the information in question breaches or may breach Information Privacy Principle 11; and (ii) the public interest in the proposed disclosure in the circumstances set out in (2) of my Determination substantially outweighs the public interest in adhering to Information Privacy Principle 11 of the Act. Accordingly, the CDPP should be permitted to disclose, in personally identifiable form, information contained in relevant CDPP files under the circumstances described in (2) of the Determination.

Attachment A

Data Collection Criteria