pdf (124.83 KB)

REVIEW OF THE GUIDELINES UNDER SECTION 95 OF THE PRIVACY ACT 1988: JOINT SUMMARY

The protection of privacy in the conduct of medical research in Australia is facilitated through a combination of ethical and legal structures, including the Privacy Act 1988 (Privacy Act) and the framework of guidelines and approval processes provided through the National Health and Medical Research Council (NHMRC).

The conduct of medical research is important for providing information to help the community make decisions that impact on the health of individuals and the community. In some cases, such research involves personal information held by Commonwealth agencies. The Guidelines Under Section 95 of the Privacy Act 1988 (s. 95 Guidelines) operate where researchers propose medical research that will involve the use or disclosure of personal information by Commonwealth agencies that would otherwise breach an Information Privacy Principle of the Privacy Act. The s. 95 Guidelines provide a framework for Human Research Ethics Committees (HRECs) to review such research proposals and to weigh the public interest in medical research with the public interest in the protection of privacy.

The NHMRC issued revised s. 95 Guidelines in March 2000 and as required under the Guidelines, initiated a review of the adequacy and operation of the guidelines twelve months later.

To ensure a successful and thorough review of the s. 95 Guidelines, the Office of the Federal Privacy Commissioner (OFPC) and the Australian Health Ethics Committee (AHEC) – a principal committee of the NHMRC that advises on the functioning of HRECs – collaborated. Commonwealth agencies and HRECs were separately surveyed in a manner appropriate to their role and function within the framework of the s. 95 Guidelines.

From the responses to the two surveys, we have drawn a number of conclusions.

Overall, the s. 95 Guidelines are largely successful in facilitating medical research that requires the use or disclosure of personal information held by Commonwealth agencies, while protecting the privacy of individuals. For example, every agency surveyed reported that in each instance where a researcher approached the agency to release personal information in accordance with the s. 95 Guidelines, the researcher had obtained HREC approval prior to approaching the agency. This demonstrates that disclosures of information for medical research, outside those permitted by the Information Privacy Principles, are subject to appropriate ethical review.

Many HRECs reported that they consulted the s. 95 Guidelines in considering research proposals where it was not legally necessary to do so. This illustrates that the s. 95 Guidelines have become a useful reference for HRECs in making decisions about protecting privacy in the course of research.

A further positive outcome is that the review process itself has prompted both agencies and HRECs to clarify their procedures and obligations relating to the s. 95 Guidelines.

Through the s. 95 Guidelines, HRECs assume an important role under the Privacy Act in protecting the privacy of research participants. As a consequence, the reporting scheme from HRECs to AHEC, and from AHEC to the Privacy Commissioner, has an essential place in the regulatory framework established by the Privacy Act. The review process suggested that this reporting scheme could be further refined. AHEC subsequently improved the annual HREC compliance form, with the new form first used for the 2001-2002 reporting period. AHEC is also working to improve and standardise the information provided to HRECs by researchers, through the development of a National Application Form for ethical review of research involving humans.

From the review, it was clear that while the s. 95 Guidelines do not need to be used by the majority of HRECs, some HRECs have reason to use them relatively frequently. Some of these HRECs may benefit from further guidance relating to:

• when the s. 95 Guidelines must be applied;
• whether or not a research proposal relates to identifiable (or potentially identifiable ) information;
• identifying which Information Privacy Principle or Principles would be breached by the research; and
• how HRECs are to assess their capacity to decide on privacy issues.

In early 2002, AHEC, with contributions from OFPC, conducted a national series of privacy workshops for HRECs and the research community, to improve their knowledge and understanding of research and privacy issues, including, importantly, the s. 95 Guidelines framework.

In the course of this review, some Commonwealth agencies raised questions about the scope of the term “medical research” as it applies to research proposals under the s. 95 Guidelines. More generally, it appears that there is the potential for greater communication between agencies and HRECs that have approved research proposals, as well as between the agencies and the researchers, so that agencies can better understand the nature of the research proposal.

While the s. 95 Guidelines are working well, the review has highlighted issues deserving attention when the next opportunity arises for their revision. These matters are firstly the need to clarify the scope of the term “medical research,” and secondly to ensure that HRECs reviewing research proposals under the s. 95 Guidelines are registered with AHEC and comply with the National Statement on Ethical Conduct in Research Involving Humans .

In this context, and in line with NHMRC policy, we agree it will be important to review the s. 95 Guidelines in these terms during 2005, unless an earlier opportunity arises. Implementation of recommendations arising from the report of the inquiry into the protection of human genetic information, conducted by AHEC and the Australian Law Reform Commission, may provide such an opportunity, as may the scheduled review of the private sector provisions of the Privacy Act, in late 2003.

The current review has provided an opportunity to learn from experience, and to consider how processes can be refined, or changes implemented, so that HRECs, researchers, agencies, AHEC, and the OFPC, can better achieve the goal of ensuring medical research is conducted in a privacy-sensitive manner. We are pleased that the main finding of this review is that, generally speaking, the s. 95 Guidelines operate successfully.

Dr Kerry Breen

Chair, Australian Health Ethics Committee

Malcolm Crompton

Federal Privacy Commissioner

April 2003