pdf (610.35 KB)

Key recommendations

1. The Office strongly supports initiatives to improve responses to family violence and acknowledges the role of information sharing in meeting this objective.

2. The Office favours an approach that promotes a nationally consistent framework for the handling of personal information and supports measures to assist in achieving uniform and comprehensive privacy laws across Australia. In this respect the Office supports the proposed changes to sections 10D(4)(b) and 10H(4)(b) of the Family Law Act 1975 (Cth).

3. The following suggestions are intended to enhance privacy safeguards in the proposals.

• i. The development of guidance material may be beneficial in assisting family counsellors and dispute resolution practitioners to determine the seriousness of a threat before disclosing information. (Proposal 10-8)
• ii. The Office does not support modifications to the prohibition on disclosure to enable identifying information about adults to be published and suggests that other mechanisms to improve information sharing may be more appropriate. (Question 10-18)
• iii. The use or disclosure of personal information for the purpose of ensuring the safety of a victim of family violence or the wellbeing of an affected child in our view is too low a test and the disclosure of information should be limited to situations where there is a serious risk. (Proposal 10-12)
• iv. It may be useful for information sharing protocols to contain guidance on good privacy practice for all entities handling protection order and family violence information. (Proposal 10-14)
• v. The Office recommends developing a comprehensive privacy framework for any major new system that involves handing and sharing of personal information such as a national protection order database. (Proposal 10-15)
• vi. Privacy Impact Assessments should be conducted to help identify and address potential privacy issues associated with the development of a national protection order database. (Proposal 10-15)

Office of the Privacy Commissioner 

1. The Office of the Privacy Commissioner (the Office) is an independent statutory body whose purpose is to promote and protect privacy in Australia. The Office, established under the Privacy Act 1988 (Cth) (the Privacy Act), has responsibilities for the protection of individuals' personal information that is handled by Australian and ACT Government agencies, and personal information held by all large private sector organisations, health service providers and some small businesses.

Preliminary

2. The Office welcomes the opportunity to comment on the Australian Law Reform Commission and the NSW Law Reform Commission Consultation Paper for the joint Inquiry into family violence laws, Family Violence: Improving Legal Frameworks. The Office understands that the inquiry will consider the interaction in practice of state and territory family and domestic violence and child protection laws with the Family Law Act 1975 (Cth) (the Family Law Act) and relevant Commonwealth, state and territory criminal laws.

3. The Office strongly supports initiatives to improve responses to family violence. In the Office's view improved information sharing as part of an integrated response to family violence will assist the important public interest of protecting individuals from harm.

4. Our Office also recognises the sensitivity attaching to personal information that relates to family violence matters and the potential for an individual to be stigmatised, embarrassed or discriminated against as a result of the disclosure or inappropriate sharing of this information.

5. The Office considers that the challenge is to ensure that proposed initiatives contain appropriate privacy safeguards around individuals' personal information, while providing strong protection against potential harm from family violence.

6. The Office understands that in some circumstances, privacy rights will necessarily give way where there is a compelling public interest reason to do so. In these instances, the Office seeks to ensure that the least privacy intrusive solution is implemented.

7. Chapter 10 of the Consultation Paper considers ways to improve information sharing between courts, practitioners, relevant government agencies and other people and institutions involved in the family violence and family law systems, while protecting the privacy and safety of people involved in family violence litigation. The Office has made comments on the specific proposals in this chapter that relate to privacy.

8. The Office believes that national consistency is important for the regulation of personal information and supports measures to assist in achieving uniform and comprehensive privacy laws across Australia. It is important that proposals concerning information handling are consistent with the privacy law reform recommendations.[1]

9. The Office's comments reflect its view that the principles based approach of the Privacy Act provides the necessary flexibility to enable a balance to be achieved between information sharing and the protection of privacy in formulating responses to family violence.

10. Our detailed response below focuses on appropriate practices for handling and sharing sensitive information arising in family violence situations.

Comments on proposals and questions

Proposal 10-8

Sections 10D(4)(b) and 10H(4)(b) of the Family Law Act 1975 (Cth) should be amended to permit family counsellors and family dispute resolution practitioners to disclose communications where they reasonably believe that disclosure is necessary to prevent or lessen a serious threat to a person's life, health or safety.

11. Confidentiality provisions in the Family Law Act establish restrictions on the disclosure of information obtained in family counselling and dispute resolution. Communications made to these people must be kept confidential except in limited situations. Sections 10D(4)(b) and 10H(4)(b) currently provide an exception to enable disclosure of personal information to prevent or lessen a serious and imminent threat to a person's life or health.

12. These confidentiality provisions are consistent with the use and disclosure provisions in the Privacy Act. Whilst the Family Law Act provides specific provisions for the use and disclosure of personal information in a family law context, the Privacy Act provides a general framework for the handling of personal information and provides a model for the further consideration for the use and disclosure of personal information.

13. Under the Privacy Act, Information Privacy Principles 10.1 and 11.1 limit how agencies may use and disclose individuals' personal information and National Privacy Principle 2.1 limits how organisations may use and disclose personal information. There are exceptions to these principles, which in each case include where the individual consents to the use or disclosure[2] or where the use or disclosure is necessary to prevent or lessen a serious and imminent threat to an individual's life or health.[3]

14. Proposal 10-8 would remove the requirement to assess whether a disclosure is imminent as well as serious and would expand the circumstances in which disclosures could be made to include threats to the safety of any person.

15. In 2008 the Australian Law Reform Commission (ALRC) in its Report 108: For Your Information: Australian Privacy Law and Practice (ALRC Report) made a number of recommendations designed to enhance the national uniformity and consistency of privacy regulation in Australia including the introduction of a single set of privacy principles to apply across government agencies and private sector organisations.

16. The ALRC Privacy Report recommended that the new ‘use and disclosure' principle should include an exception allowing use or disclosure where an agency or organisation reasonably believes the use or disclosure is necessary to lessen or prevent a serious threat to an individual's life, health or safety.[4]

17. The Australian Government has accepted this recommendation in principle.[5] However, agencies and organisations will only to be permitted to rely on this exception after consent has first been sought, where seeking that consent is reasonable and practicable. This approach creates a presumption that agencies and organisations should consider seeking consent before using or disclosing personal information under the exception. This approach will also help to ensure that the individual maintains an appropriate degree of control over the use or disclosure of their personal information.

18. Given that this proposal is consistent with Recommendation 25-3 of the ALRC Privacy Inquiry our Office supports the proposed changes to sections 10D(4)(b) and 10H(4)(b) of the Family Law Act. The Office is generally supportive of adopting measures that promote a nationally consistent framework for the handling of personal information. In our view, reducing the threshold for disclosure without consent to serious threats to life, health or safety should enable disclosures to be made in appropriate circumstances, where it is not practicable and reasonable to obtain consent.

19. Our Office suggests that it may be beneficial to develop guidance material to assist family counsellors and dispute resolution practitioners in determining the seriousness of a threat. What constitutes a serious threat depends on the particular circumstances of each case. In our view, analysis of whether a threat is serious must involve consideration of the gravity of the potential outcome as well as the relative likelihood of the threat eventuating. The severity of the resulting harm to life, health or safety must be significant and demonstrable.

20. Family counsellors and dispute resolution practitioners seeking to apply this provision may, for instance, interpret ‘serious' as meaning ‘weighty or important', thus focusing on the severity of the consequences, without considering their likelihood. Guidance material would also assist counsellors and dispute resolution practitioners in understanding when disclosures can be made without consent and thereby promote confidence in making such disclosures.

Proposal 10-9

Sections 10D(4)(c) and 10H(4)(c) of the Family Law Act 1975 (Cth) should permit family counsellors and family dispute resolution practitioners to disclose communications where they reasonably believe that disclosure is necessary to report conduct that they reasonably believe constitutes grounds for a protection order under state and territory family violence legislation.

21. In line with Proposal 10-8 our Office considers that, where reasonable and practicable, family counsellors and dispute resolution practitioners should seek consent before using or disclosing personal information under such an exception. There is a clear expectation among many individuals that sensitive information obtained during counselling or dispute resolution will be afforded strong privacy protections and handled appropriately. Consent should be sought where the individual's expectations as to the disclosure of their information are doubtful or not known.

22. Where there is a serious threat to a person's life, health or safety, disclosure without consent will generally be warranted. Our Office considers that where conduct may constitute grounds for a protection order that it is likely that the threshold for disclosing information under the life, health or safety exception as outlined in Proposal 10-8 will probably be met. However, it may be beneficial to have a separate provision for this exception in the Family Law Act to make it clear to counsellors and dispute resolution practitioners that disclosure of personal information is authorised for this purpose.

Question 10-14

Should there be any other amendments to ss 10D and 10H of the Family Law Act 1975 (Cth) enabling the release of any other types of information obtained by family counsellors or family dispute resolution practitioners? For example, should the legislation permit release where it would prevent or lessen a serious threat to a child's welfare?

23. Our Office is unsure what further types of information would be disclosed under this exception that cannot be disclosed under the current framework and the amended life, health and safety exception proposed in Proposal 10-8. To enable further consideration of the proposal, the Office suggests that some examples be given of the types of circumstances in which disclosures might be made under such an exception.

24. In its submission to the ALRC Privacy Review, the Office expressed that the term ‘welfare' appears overly subjective and difficult to define.[6] Further, it is unclear whether a threat to a child's welfare might reasonably be addressed under other exceptions such as use or disclosure to prevent or lessen a serious threat to health or safety.

25. In our view, a serious threat to a child's welfare is likely to generally be encompassed within threats to health or safety. In assessing the seriousness of a threat the vulnerability and capacity of the individual concerned should also be taken into account. Where an individual lacks the capacity to make choices regarding their circumstances or is especially vulnerable, the serious threshold may be reached more readily.

Question 10-18

Should prohibitions on publication of identifying information about adults involved in protection order proceedings under state and territory family violence legislation be modified in one or more of the following ways to

(a) require the prohibition on disclosure to be activated by a court order;

(b) impose a requirement that the disclosure of identifying information must be reasonably likely to expose a person to risk of harm as a precondition for a court to issue an order prohibiting publication; and/or

(c) include an exception to prohibitions on publication for disclosure of pleadings, transcripts of evidence or other documents to police or other persons concerned in any court proceedings, for use in connection with those proceedings-for example, the exception set out in s 82(3)(a) of the Domestic and Family Violence Protection Act 1989 (Qld)?

26. Prohibitions on publication of identifying information about individuals involved in protection order proceedings are an important privacy protection. The Office recognises the sensitivity attaching to personal information that relates to protection order proceedings and the potential for an individual to be stigmatised, embarrassed or discriminated against as a result of the publication of identifying information.

27. It should be noted that in some instances, an individual's identity can be apparent from cumulative information and without the individual's name (particularly where the individual is from a small community). As such the Office agrees with the Commissions' view that limiting the public disclosure of information relating to protection order proceedings serves to protect the privacy interests of individuals and in particular, of children involved with proceedings.[7]

28. In our view, other mechanisms to improve information-sharing proposed in the Consultation Paper are more appropriate and limit disclosure of personal information to those who legitimately require it. The Office does not support modifications to the prohibition on disclosure to enable identifying information about adults to be published.

Proposal 10-11

Legislative privacy principles applying to the use and disclosure of personal information by Australian Government and state and territory government agencies should permit use or disclosure where an agency reasonably believes it is necessary to lessen or prevent a serious threat to an individual's life, health or safety, as recommended by the ALRC in the report For Your Information: Australian Privacy Law and Practice (ALRC 108).

29. As noted in Proposal 10-8, this proposal is consistent with the ALRC Privacy Report and has been supported in principle by the Australian Government. The Office believes that national consistency is important for the regulation of personal information and supports measures to assist in achieving consistent and comprehensive privacy laws across Australia.

30. Our Office considers this exception to be an appropriate measure and is supportive of the intention to move towards achieving a nationally consistent set of privacy principles for the Commonwealth, State and Territory public sectors, as well as the private sector.

Proposal 10-12 and Proposal 10-13

State and territory family violence legislation should authorise agencies in that state or territory to use or disclose personal information for the purpose of ensuring the safety of a victim of family violence or the wellbeing of an affected child.

Information-sharing provisions introduced pursuant to Proposal 10-12 should permit disclosure to, at least, relevant government officers in other jurisdictions and federal, state and territory court officers.

31. The Office supports a nationally consistent approach to information handling. It is our view that the approach suggested in Proposal 10-11 would enable sufficient information sharing to be entered into between agencies where such information sharing is warranted. In light of that the Office suggests that Proposals 10-12 and 10-13 are not required.

32. The overall object of the use and disclosure principles in the Privacy Act is to ensure that sensitive personal information is only disclosed without consent in specific and limited circumstances. A key advantage of principles-based regulation is its flexibility in application to different situations. The Office considers that the exceptions to the use and disclosure principles when ‘imminence' is removed will provide the necessary flexibility to enable agencies to disclose information for the purposes of ensuring safety in family violence situations.

33. The Consultation Paper acknowledges that family violence can involve a continuum of controlling behaviour over a number of years, rather than the single serious incidents that are the focus of the relevant privacy exception.[8] Further, the Consultation Paper suggests that privacy laws impede necessary information sharing in this context.[9]

34. Our Office would suggest that the threshold test for relying on the life, health or safety exception in Proposal 10-11 may be met where a significant degree of harm is being caused through a series of incidents occurring over time. Guidelines developed by the Office provide that a 'serious' threat must reflect significant danger, and could include a potentially life threatening situation or one that might reasonably result in other serious injury or illness.[10] In the case of family violence involving controlling behaviour over a number of years, the degree of seriousness to allow disclosure of information may be considered to have been met where a series of incidents result in significant and demonstrable harm.

35. It should also be noted that threats to health under the exception are not limited to physical harm but would also include threats to an individual's psychological wellbeing. The exception may therefore be relied on to disclose information where there is the threat of serious psychological harm that may be experienced as a result of ongoing domestic violence or fear for safety.

Proposal 10-14

Courts that hear protection order proceedings in each state and territory should enter into an information-sharing protocol with the Family Court of Australia, Federal Magistrates Court, police, relevant government departments and other organisations that hold information in relation to family violence.

36. The Consultation Paper considers that information sharing protocols can clarify the situations in which information sharing is desirable and necessary, as well as the lawful boundaries of disclosure.[11] Having administrative arrangements in place may help communication and coordination between agencies in the state and federal systems as well as with relevant organisations.

37. Our Office understands that information sharing protocols formalise what information can be exchanged, to whom, and on what conditions within a legislative framework. Information sharing protocols are tools to support good practice and can help agencies and organisations understand their legislative obligations in handling personal information. It is important that such protocols do not stand alone or act as a substitute for the law but instead make known or clarify legislative requirements.

38. Given the importance of handling individuals' sensitive information appropriately and securely, the Office suggests that it may be useful for information sharing protocols to contain guidance on good privacy practice for all entities handling protection order and family violence information. Among other things, the guidance might identify appropriate security safeguards to ensure against loss or unauthorised access of a person's sensitive information. The Office also suggests that information sharing protocols should be publicly available and include information about any complaint handling processes. This would enhance public confidence in the handling of this sensitive information.

Proposal 10-15

A national protection order database should be established as a component of the Australian Government's commitment to the implementation of a national registration system for protection orders. At a minimum, information on the database should:

• include protection orders made under state and territory family violence legislation as well as orders and injunctions made under the Family Law Act 1975 (Cth); and
• be available to federal, state and territory police officers, federal family courts, and state and territory courts that hear protection order proceedings.

39. A national protection order database provides an opportunity for a formalised exchange of information relevant to proceedings involving family violence concerns.[12] The Australian Government also envisages that this scheme would allow protection orders to be enforced across state and territory borders.[13] The Consultation Paper suggests that CrimTrac may be a suitable agency to manage a national protection order database.[14]

40. CrimTrac is an agency with long standing experience in information management. It has existing infrastructure and information handling protocols that are appropriate for undertaking the management of a national protection order database. CrimTrac has in place a number of measures to ensure that personal information within its possession or control is handled in accordance with the agency's obligations under the Information Privacy Principles. CrimTrac systems have a number of safeguards to ensure the integrity and security of information held, and prevent unauthorised access or interference. Access to personal information is acquired on a 'need to know' basis and audit logs of accesses and disclosures are continuously maintained.[15]

41. Any proposal to create a new register or national database needs careful consideration from a privacy perspective. Our Office recommends developing a comprehensive privacy framework for any major new system that involves handing and sharing of personal information. The Office encourages building privacy into every aspect of a new system from the earliest stages of its conceptualisation.[16] The Office considers that a comprehensive framework for privacy protection for major new government initiatives that relate to the handling of personal information should be based on four key elements. These four elements are:

Design + Technology + Legislation + Oversight

• Fundamental system design, including system architecture and the parameters governing what information is collected, information flows and consent mechanisms. The Office considers that ensuring clarity and certainty about how individuals' personal information will be handled in relation to a national protection order database will lead to greater community trust in the handling of personal information by the agencies concerned.
• Technological measures, including, but not limited to, data security initiatives.
• Legislative measures, including defining the extent of the system, proscribing purposes that fall outside those functions, and introducing sanctions for misusing any aspect of the system. The Office considers that enabling legislation for a national protection order database should clear set out who can access the database and for what purpose.
• Oversight mechanisms that promote confidence in the system by assuring the community that the operation of the system is subject to stringent accountability measures, including provision for audit and independent complaint handling.

Privacy Impact Assessment

42. The Office would encourage the undertaking of a privacy impact assessment (PIA) as part of developing a national protection order database. A PIA is an assessment tool that describes in detail the personal information flows in a project and analyses the possible privacy impacts of the project. PIAs help ensure privacy is built into a project from the beginning and assist in building community trust in new proposals.

43. The overarching benefit of a PIA is that the identification and analysis of privacy impacts during a project's design phase can assist in determining the appropriate management of any potentially negative impacts. For example, a new national database raises different data security issues than those that exist for accessing such information via the records of the individual courts. Further, most states and territories have separate privacy obligations, so careful analysis is required to determine the inconsistencies that exist between the state or territory privacy law and obligations under the Privacy Act. A PIA could assist in identifying these issues and developing appropriate protections to manage them.

44. Ideally, a PIA should be conducted by an independent expert in privacy and conducting PIAs. Further information on PIAs can be found in the Office's Privacy Impact Assessment Guide.[17] The Office would welcome the opportunity to provide further advice and comment as part of the consultation process for a PIA.

[1] Australian Law Reform Commission Report 108: For Your Information: Australian Privacy Law and Practice

[2] See IPP 10.1(a), IPP 11.1(b) and NPP 2.1(b)

[3] See IPP 10.1(b), IPP 11.1(c) and NPP 2.1(e)

[4] Recommendation 25-3

[5] Australian Government First Stage Response to the ALRC Privacy Report available at http://www.dpmc.gov.au/privacy/alrc.cfm

[6] Submission to the Australian Law Reform Commission Review of Privacy Issues Paper 31 paragraph 246

[7] Consultation Paper, paragraph 10.189

[8] Consultation Paper, paragraph 10.221

[9] Consultation Paper, paragraph 10.196

[10] Privacy in the Private Health Sector (November 2001), page 25 available at http://www.privacy.gov.au/materials/types/guidelines/view/6517

[11] Consultation Paper paragraph 10.230

[12] Consultation Paper paragraph 10.245    

[13] Australian Government, The National Plan to Reduce Violence against Women Immediate Government Actions (2009)

[14] Consultation Paper paragraph 10.238

[15] CrimTrac, Privacy available http://www.crimtrac.gov.au/privacy/index.html at 21 May 2010

[16] The UK Information Commissioner has also commented on the importance of building in privacy in a recent report which notes that this ‘...approach will ensure that privacy controls are stronger, simpler to implement, harder to by-pass, and totally embedded in the system's core functionality:, Privacy by design, November 2008, p3, www.ico.gov.uk/about_us/news_and_views/current_topics/privacy_by_design.aspx

[17] Available at http://www.privacy.gov.au/materials/types/download/9509/6590