Submission to the Queensland Law Reform Commission

October 2006

• Submission to the Queensland Law Reform Commission
• The Privacy Act 1988
• Queensland Privacy Scheme
• The Guardianship and Administration Act 2000 (Qld)
• Tribunal decisions published on AustLII
• Review of the Privacy Act
• Endnotes

Comments provided by the Office of the Privacy Commissioner on the Queensland Law Reform Commission's Guardianship Review: Confidentiality in the Guardianship System: Public Justice, Private Lives

The Privacy Act 1988

1. The Office of the Privacy Commissioner1 (the Office) regulates the handling of personal information by Australian Government and ACT Government agencies and many private sector organisations, including all private sector health organisations, through the Privacy Act 19882 (the Privacy Act).

2. The eleven Information Privacy Principles3 (IPPs) in the Privacy Act impose obligations on Australian and Australian Capital Territory government agencies in the way they collect, store and secure information, allow individuals to access personal information about them or alter records, the accuracy and relevance of the information collected and under what specific circumstances information may be used or disclosed. Health information is regarded as a subset of personal information.

3. The ten National Privacy Principles4 (NPPs) impose obligations on the private sector, including all private health sector organisations, in the way they handle personal information. The NPPs contain specific principles related to the handling of health and other sensitive information, particularly as to its collection, use and disclosure.

4. Section 6 of the Privacy Act defines personal information as meaning

Information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent or can reasonably be ascertained, from the information or opinion.

5.Sensitive information is defined in the Privacy Act as information or opinion, that is also personal information, about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professions or trade association, membership of a trade union, sexual preferences or practices, criminal record or health information about an individual.

6. The Privacy Act does not regulate the way other States or Territory government agencies (including Queensland) handle personal information. Some States and Territories have their own privacy legislation or schemes.5

Queensland Privacy Scheme

7. Queensland has a Privacy Scheme6 that applies to Queensland State Government agencies and most Queensland statutory government-owned corporations. The regime, based on the Privacy Act IPPs, took effect in September 2001 and includes an Information Standard (IS42) and Privacy Guidelines. Some exemptions to IS42 apply including to Courts and tribunals (including the holders of office) with respect to their judicial and quasi-judicial functions only. The Queensland Privacy Scheme defines personal information as

any information that would allow an individual to be identified, for example, their name, age or physical characteristics.

The Guardianship and Administration Act 2000 (Qld)

8. The Guardianship and Administration Act 2000 (Qld)7 prohibits:

• the publication of information about a Tribunal proceeding (including matters contained in documents and the Tribunals' decisions and reasons; and
• the disclosure of the identity of a person involved in a Tribunal proceeding.

9. However, the Tribunal

may make an order permitting the publication of information about a proceeding or disclosure of a person's identity if it is satisfied that to do so would be in the public interest. For example, in a small number of cases, the Tribunal has used this provision to make orders, allowing the publication of de-identified tribunal decisions on the AustLII website.8

I note that not all decisions made by the Queensland Tribunal are published on the AustLII website.

Tribunal decisions published on AustLII

10. A random sampling9 by my Office of the Tribunal decisions published on AustLII shows that although they do not contain individual names, they contain a broad range of other personal information about individuals. This information includes age; gender; dates of incidents causing the impairment; how the incident may have occurred, e.g. motor vehicle accident; health information about the individual, e.g. whether they are suffering from dementia, stroke or other neurological impairment; how their impairment has affected them, testimony from others as to the form this impairment might take, either physically or behaviourally; information about their financial status; and (in one instance) a reference to racial origin. The published proceedings often include references to relatives of the impaired individual, including their relationship to the individual and their actions toward or on behalf of the individual concerned.

11. Taken in isolation, many of the examples of personal information listed above may not identify an individual with impaired capacity or those related to them. De-identification of personal information is not defined in the Privacy Act. However, the Privacy Act (as noted above), defines personal information as "information or an opinion about an individual whose identity is apparent or can reasonably be ascertained." (Italics mine.)

12. What constitutes personal information need not include such obvious identifiers as an individual's name or date of birth. It may include other information about the individual that can be linked to them through other information sources or by association or inference and the context in which the information is provided.

13. In the context of the guardianship proceedings, it is possible that the identity of many of the individuals involved may be determined or at least reasonably ascertained through the personal information provided in the published determinations, even where a name is not used to identify the individual. It is even more likely that identification will be able to be made if the individual concerned comes from a small town or from a particular ethnic or racial group or section of the community.

Striking a balance

14. As a community and as individuals we value our privacy. We try hard to strike a balance between meeting our personal needs and goals, and appreciating what others need or want to know about us. Privacy is valued, not only because it underpins our human dignity, but also because it gives us a measure of control in our everyday interactions as to how our personal information is handled in the wider world10.

15. Assessing whether matters arising from Guardianship proceedings are in the public interest presents challenges. This is particularly so where the matter concerns the disclosure of personal information, including sensitive health information, about an individual with impaired capacity. In striking a balance between what is in the public interest and the protection of that individual's personal information, privacy considerations should be a key concern.

16. When an individual suffers impaired capacity, this cannot mean that frameworks protecting their personal information should be any less robustly implemented on their behalf than those protecting an individual whose capacity is not impaired.

17. Rather, we may need to be more vigilant about the way the personal information (of those whose capacity is impaired) is handled, in order to avert any invasive impact on their privacy. This impact may, even with the best of intentions, expose to the wider, often critical public gaze, information about their health, family circumstances, finances or relationships that individuals who are not impaired would normally regard as being under their control or only to be used or disclosed in certain ways, for example, with their consent.

In the Public Interest

18. As noted in the Discussion Paper, each Australian state and territory has its own protective guardianship and administration legislation11 with tribunals and agencies having the necessary powers to achieve the legislation's goals. Generally speaking, there appears to be a prohibition on publication of information about proceedings in these jurisdictions except where:

• the Tribunal has the power to allow publication of de-identified information, or
• the Tribunal has the power to allow publication of both de-identified and other information, or
• the Tribunal has the power to allow the publication of identifying information (with publication of de-identified information otherwise permitted).

19. I note that in some states, however, even where the authority to publish de-identified or identified information about guardianship proceedings exists, that this does not appear to be the practice, even where issues such as public interest may be a factor.

20. It is pleasing that the explicit presumption in the current legislation is that publication will not occur. In reviewing the confidentiality provisions of the guardianship legislation and the approach it could take to the publication of Tribunal proceedings, the Commission might like to consider the following:

• that personal information leading to the identification of the individual may consist of more than the name of the individual. Other information about an individual may be sufficient to identify them depending on the context, even where the information is thought to be 'de-identified'.
• the issue of 'orders-only' publication, where warranted.
• limited publication or publication for limited use
• whether the obligations the Tribunal currently has, to protect the confidentiality of an individual, might be extended to more broadly include the protection of personal information (in whatever form) that might identify individuals with impaired capacity and others participating in Guardianship proceedings
• where publication of Guardianship proceedings on AustLII is being considered, whether public interest may be adequately served in a more "privacy aware" way. For example, by simply noting that various oral or written evidence related to the health, capacity and treatment of the individual has been presented to the Tribunal and considered in their decision but not actually including details in the published proceedings. Such a method would avoid disclosing potentially privacy-invasive personal information.
• the development of specific guidance to the Tribunal as to the narrowly-defined circumstances in which guardianship proceedings may be considered for publication in 'the public interest'. This guidance could usefully include ways to best protect the privacy of the individual and their personal information if publication of proceedings is thought to be necessary.
• where guardianship proceedings are to be published, whether limitations might be imposed as to how long they might remain on the AustLII website.

Review of the Privacy Act

21. The Office conducted a review12 of the Private Sector Provisions of the Privacy Act in 2005. Submissions to the review13 included comments on privacy issues from carers, guardians and entities such as the Australian Guardianship and Administration Committee and others whose responsibilities brings them into contact with individuals with impaired capacity. The Office acknowledges the many challenges facing individuals with impaired capacity and those in our community who care for them.

22. In the Report14 of the review, released in March 2005, section 7.5 includes discussion of the issues raised by submitters and a number of options are proposed in response. The Privacy Commissioner made two recommendations (section 7.6) in regard to individuals whose decision-making ability is impaired:

Recommendation 63 The Australian Government should consider, in order to ensure that the Privacy Act does not prevent individuals with a decision?making disability from receiving a range of utilities and other services, amending NPP 2 to permit the disclosure of non-health information to a class of persons the same, or similar, to that described in NPP 2.5, where an organisation considers the disclosure to be necessary for the management of the person's affairs in a way that their financial or other interests are secured or safeguarded. It would be appropriate to consider developing such an amendment in consultation with the Australian Guardianship and Administration Committee.

Recommendation 64 The Office will, in recognition that disclosures of health information under NPP 2 are appropriately permitted in law but may not occur in practice, develop further and more practical guidance.

23. The Senate Legal and Constitutional References Committee conducted its own inquiry into the Privacy Act and released its report15 in June 2005.

24. In January this year the Attorney-General, the Hon. Phillip Ruddock MP, announced that the Australian Law Reform Commission (ALRC) would undertake a comprehensive review of the Privacy Act.

25. The ALRC16 released a Privacy Issues Paper on 9 October 2006. Chapter 9 of this paper dealing with Children, Young People and Adults with a Decision-Making Disability may be of particular interest to the QLRC Review. More information about the ALRC review can be found on their website17.

26. The Privacy Commissioner encourages all interested parties to take the opportunity offered by the ALRC review of the Privacy Act to influence the shape of Australia's privacy legislation not only as it relates to individuals with decision-making disabilities, but in other areas which may be of privacy concern.

Endnotes

1 The Office of the Privacy Commissioner www.privacy.gov.au

2 The Privacy Act www.privacy.gov.au/law/

3 Information Privacy Principles www.privacy.gov.au/materials/types/infosheets/view/6541

4 National Privacy Principles www.privacy.gov.au/materials/types/infosheets/view/6583

5 State and Territory Privacy Laws www.privacy.gov.au/

6 Queensland Privacy Scheme www.justice.qld.gov.au/dept/privacy.htm

7 Guardianship and Administration Act 2000 (Qld) www.austlii.edu.au/au/legis/qld/consol_act/gaaa2000304/

8 Confidentiality in the Guardianship System: Public Justice, Private Lives 2006, 7.4, P140

9 Decisions accessed at the AustlII website www.austlii.edu.au/cases/qld/QGAAT on 10 October 2006

10 Privacy Impact Assessment Guide 2006 www.privacy.gov.au/materials/types/download/9256/6835

11 Confidentiality in the Guardianship System: Public Justice, Private Lives, Chapter 7

12 Review of the Private Sector Provisions of the Privacy Act 1988www.privacy.gov.au/materials/types/reports/view/6049

13 Submissions to the Review of the Private Sector Provisions of the Privacy Act 1988www.privacy.gov.au/

14 Getting in on the Act: Report of the Review of the Private Sector Provisions of the Privacy Act 1988www.privacy.gov.au/materials/types/reports/view/6049l

15 The Real Big Brother: Inquiry into the Privacy Act 1988. http://www.aph.gov.au/senate/committee/legcon_ctte/privacy/report/report.pdf.

16 Review of Privacy. ALRC Issues Paper www.austlii.edu.au/au/other/alrc/publications/issues/31/

17 Australian Law Reform Commission, Privacy. http://www.alrc.gov.au/inquiries/current/privacy/index.htm