This document has been archived and is no longer in use by the Office. A list of the Office's current publications is available on the publications page @http://www.privacy.gov.au/materials

PRIVACY ACT 1988 (PART VI) PUBLIC INTEREST DETERMINATIONS 9 AND 9A Explanatory Front Sheet

Background information on Public Interest Determinations

Public Interest Determinations (PIDs) enable the Privacy Commissioner to reduce the privacy protections of any one or more of the National Privacy Principles (NPPs). However, in order to issue a PID, the Privacy Commissioner must be satisfied of two matters: first, that an act or practice of an organisation breaches or may breach a NPP or a privacy code (a Code); and second, that the act or practice should nevertheless be allowed to continue, because the public interest in its continuation substantially outweighs the public interest in adhering to the NPP or Code. The Privacy Commissioner can issue a PID in response to an organisation's application, and can also choose to make a further PID expanding the effect of the original applicant's PID to organisations generally.

The effect of Public Interest Determinations 9 and 9A

The combined effect of PIDs 9 and 9A is to exempt providers of health services1 in certain circumstances from complying with NPP 10.1. In summary, under PIDs 9 and 9A, a health service provider may collect health information from a health consumer about a third party without the consent of the third party when both of the following circumstances are met:

• the collection of the third party's information into a consumer's social, family or medical history is necessary for ACHA Health (in the case of PID 9), or other health service providers (in the case of PID 9A), to provide a health service directly to the consumer; and

• the third party's information is relevant to the family, social or medical history of that consumer.

PIDs 9 and 9A do not reduce all of the privacy protections contained in the NPPs

PIDs 9 and 9A do not represent an exemption from all of the NPPs. NPPs 1 to 9 and NPPs 10.2 to 10.3 continue to apply to the handling of this type of information by organisations providing a health service. NPP 10.1 also continues to apply in all circumstances outside those covered by the PIDs. In addition, health service providers that collect third party information into social, family or medical histories will need to comply with the protections afforded under NPP 2.1(a), including that health service providers should ensure that a third party would reasonably expect any proposed uses or disclosures of their information.

The Commissioner has issued PIDs 9 and 9A for a period of 5 years, with a review of the Determinations to take place at 5 years from the effect of the Determinations, or sooner, if the Commissioner becomes aware of a matter incidental to or affecting the performance or operation of the Determinations.

For further information, talk to your peak health provider association or consumer association, or contact our Hotline on 1300 363 992, TTY 1800 620 241 (dedicated for people who are hearing impaired) or by email at privacy@privacy.gov.au .

.

1 Section 6 of the Privacy Act defines 'health service' as an activity performed in relation to an individual:

• to assess, record, maintain or improve the individual's health; or
• to diagnose the individual's illness or disability; or
• to treat the individual's illness or disability or suspected illness or disability;or
• the dispensing of a prescription drug or medicinal preparation by a pharmacist.

The Privacy Act applies to all private sector organisations that deliver these types of services, including all small health services that hold health information. The types of health services covered include traditional health service providers such as private hospitals and day surgeries, medical practitioners, pharmacists, and allied health professionals such as counsellors, as well as complementary therapists, gyms, weight loss clinics and many others.

PRIVACY ACT 1988 (PART VI) Public Interest Determination No. 9

Applicant:	ACHA Health
Nature of Application:	In the context of a health service provider collecting the social, family or medical history of an individual (a consumer) for the provision of a health service to that consumer: the collection of personal or health information about another individual (a third party) without obtaining the third party's consent or notifying the third party of the collection of the information.
National Privacy Principle Concerned:	National Privacy Principle 10.1 - "Sensitive Information".
Issued	15 October 2002
Tabled:	16 October 2002
Effective:	11 December 2002

DETERMINATION UNDER SECTION 72(4)GIVING GENERAL EFFECT TO PUBLIC INTEREST DETERMINATION 9

I, Malcolm Woodhouse Crompton, Privacy Commissioner, make the following determination under section 72(4) of the Privacy Act 1988.

No organisation is taken to contravene section 16A of the Privacy Act 1988 if, while Public Interest Determination (PID) 9 is in force, an organisation does an act, or engages in a practice, that is the subject of PID 9.

Dated this 15th day of October 2002

MALCOLM WOODHOUSE CROMPTON Privacy Commissioner

Statement of reasons under section 79(3) for Determination 9A

ACHA Health is a not-for-profit private hospital operator located in Adelaide, South Australia and is an "organisation" for the purposes of section 6C of the Privacy Act 1988 (the Privacy Act). ACHA Health has requested a Determination to enable the continuation of a practice that breaches or may breach National Privacy Principles (NPP) 10.1 and 1.5. The practice concerns the collection of third party 'sensitive information', (including 'personal information' and 'health information'), in the context of the collection of social, family or medical histories from health consumers "across all clinical settings" and by "all clinicians".

Public Interest Determination No. 9 is issued in response to ACHA Health's application of 19 December 2001. The details of that application, the process of consultation, findings, and relevant statutory provisions are set out in the Statement of Reasons attached to PID 9. Those Statement of Reasons also includes the Privacy Commissioner's consideration of matters relevant to section 72(2) (that is, that an activity of an organisation breaches or may breach an NPP or a privacy code (a Code) and, that the activity should nevertheless be allowed to continue, as the public interest in its continuation substantially outweighs the public interest in adhering to the NPP or Code).

In addition to applying for a Determination for itself, ACHA Health referred to the importance of a Determination applying to health service providers and health services generally. Further, a range of submitters argued that it is in the public interest that all providers of health services should be able to collect third party information without consent. The submissions noted that it is in the individual's best interests - that is, to enable a more accurate health assessment. If the information is not collected, it is further submitted, correct and accurate diagnoses and health outcomes will be compromised. The submissions argue that the benefits to health care and the public outweigh any disadvantages to third party individuals.

In Public Interest Determination No. 9, I determined that the public interest in continuing the activity of collecting third party information into the consumer's medical, social and family history where it is necessary to provide a health service directly to a consumer, substantially outweighs the interest in adhering to NPP 10.1 in those circumstances.

Conclusion

For the above reasons, and the reasons set out in detail in the Statement of Reasons attached to PID 9, I am of the view that, under section 72(4) of the Privacy Act, PID 9 should be given general effect to apply to all health service providers.

In written submissions received during the consultation process regarding the draft Determinations for PID 9 and PID 9A, a number of submitters discussed the matter of the period of time in which the Determination should remain in force. These submitters argued that if, following consultation on the draft Determinations, Determinations are made by the Privacy Commissioner, then they should be made to operate for a specific period only and should not be made for an indefinite period. Further, the Determinations should be subject to a review within a specified period. Conference attendees argued that, given that certain matters are only becoming clearer as the private sector gains more expertise in applying the NPPs, it would seem wise for the Determinations to be reviewed after a reasonable period of time.

In consideration of the above submissions, I have decided to issue this Determination for a period of 5 years, with a review of the Determination to take place at 5 years from the date of effect of the Determination, or sooner, if I become aware of a matter incidental to or effecting the operation or performance of the Determination.