Queensland Law Reform Commission Guardianship Review Stage 1, Confidentiality in the Guardianship System: Public Justice, Private LivesSubmission to the Queensland Law Reform CommissionOctober 2006
Comments provided by the Office of the Privacy Commissioner on the Queensland Law Reform Commission's Guardianship Review: Confidentiality in the Guardianship System: Public Justice, Private Lives The Privacy Act 19881. The Office of the Privacy Commissioner1 (the Office) regulates the handling of personal information by Australian Government and ACT Government agencies and many private sector organisations, including all private sector health organisations, through the Privacy Act 1988 2 (the Privacy Act). 2. The eleven Information Privacy Principles3 (IPPs) in the Privacy Act impose obligations on Australian and Australian Capital Territory government agencies in the way they collect, store and secure information, allow individuals to access personal information about them or alter records, the accuracy and relevance of the information collected and under what specific circumstances information may be used or disclosed. Health information is regarded as a subset of personal information. 3. The ten National Privacy Principles4 (NPPs) impose obligations on the private sector, including all private health sector organisations, in the way they handle personal information. The NPPs contain specific principles related to the handling of health and other sensitive information, particularly as to its collection, use and disclosure. 4. Section 6 of the Privacy Act defines personal information as meaning Information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent or can reasonably be ascertained, from the information or opinion. 5.Sensitive information is defined in the Privacy Act as information or opinion, that is also personal information, about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professions or trade association, membership of a trade union, sexual preferences or practices, criminal record or health information about an individual. 6. The Privacy Act does not regulate the way other States or Territory government agencies (including Queensland) handle personal information. Some States and Territories have their own privacy legislation or schemes.5 Queensland Privacy Scheme7. Queensland has a Privacy Scheme6 that applies to Queensland State Government agencies and most Queensland statutory government-owned corporations. The regime, based on the Privacy Act IPPs, took effect in September 2001 and includes an Information Standard (IS42) and Privacy Guidelines. Some exemptions to IS42 apply including to Courts and tribunals (including the holders of office) with respect to their judicial and quasi-judicial functions only. The Queensland Privacy Scheme defines personal information as any information that would allow an individual to be identified, for example, their name, age or physical characteristics. The Guardianship and Administration Act 2000 (Qld)8. The Guardianship and Administration Act 2000 (Qld)7 prohibits:
9. However, the Tribunal may make an order permitting the publication of information about a proceeding or disclosure of a person's identity if it is satisfied that to do so would be in the public interest. For example, in a small number of cases, the Tribunal has used this provision to make orders, allowing the publication of de-identified tribunal decisions on the AustLII website.8 I note that not all decisions made by the Queensland Tribunal are published on the AustLII website. Tribunal decisions published on AustLII10. A random sampling9 by my Office of the Tribunal decisions published on AustLII shows that although they do not contain individual names, they contain a broad range of other personal information about individuals. This information includes age; gender; dates of incidents causing the impairment; how the incident may have occurred, e.g. motor vehicle accident; health information about the individual, e.g. whether they are suffering from dementia, stroke or other neurological impairment; how their impairment has affected them, testimony from others as to the form this impairment might take, either physically or behaviourally; information about their financial status; and (in one instance) a reference to racial origin. The published proceedings often include references to relatives of the impaired individual, including their relationship to the individual and their actions toward or on behalf of the individual concerned. 11. Taken in isolation, many of the examples of personal information listed above may not identify an individual with impaired capacity or those related to them. De-identification of personal information is not defined in the Privacy Act. However, the Privacy Act (as noted above), defines personal information as "information or an opinion about an individual whose identity is apparent or can reasonably be ascertained." (Italics mine.) 12. What constitutes personal information need not include such obvious identifiers as an individual's name or date of birth. It may include other information about the individual that can be linked to them through other information sources or by association or inference and the context in which the information is provided. 13. In the context of the guardianship proceedings, it is possible that the identity of many of the individuals involved may be determined or at least reasonably ascertained through the personal information provided in the published determinations, even where a name is not used to identify the individual. It is even more likely that identification will be able to be made if the individual concerned comes from a small town or from a particular ethnic or racial group or section of the community. Striking a balance14. As a community and as individuals we value our privacy. We try hard to strike a balance between meeting our personal needs and goals, and appreciating what others need or want to know about us. Privacy is valued, not only because it underpins our human dignity, but also because it gives us a measure of control in our everyday interactions as to how our personal information is handled in the wider world10. 15. Assessing whether matters arising from Guardianship proceedings are in the public interest presents challenges. This is particularly so where the matter concerns the disclosure of personal information, including sensitive health information, about an individual with impaired capacity. In striking a balance between what is in the public interest and the protection of that individual's personal information, privacy considerations should be a key concern. 16. When an individual suffers impaired capacity, this cannot mean that frameworks protecting their personal information should be any less robustly implemented on their behalf than those protecting an individual whose capacity is not impaired. 17. Rather, we may need to be more vigilant about the way the personal information (of those whose capacity is impaired) is handled, in order to avert any invasive impact on their privacy. This impact may, even with the best of intentions, expose to the wider, often critical public gaze, information about their health, family circumstances, finances or relationships that individuals who are not impaired would normally regard as being under their control or only to be used or disclosed in certain ways, for example, with their consent. In the Public Interest18. As noted in the Discussion Paper, each Australian state and territory has its own protective guardianship and administration legislation11 with tribunals and agencies having the necessary powers to achieve the legislation's goals. Generally speaking, there appears to be a prohibition on publication of information about proceedings in these jurisdictions except where:
19. I note that in some states, however, even where the authority to publish de-identified or identified information about guardianship proceedings exists, that this does not appear to be the practice, even where issues such as public interest may be a factor. 20. It is pleasing that the explicit presumption in the current legislation is that publication will not occur. In reviewing the confidentiality provisions of the guardianship legislation and the approach it could take to the publication of Tribunal proceedings, the Commission might like to consider the following:
Review of the Privacy Act21. The Office conducted a review12 of the Private Sector Provisions of the Privacy Act in 2005. Submissions to the review13 included comments on privacy issues from carers, guardians and entities such as the Australian Guardianship and Administration Committee and others whose responsibilities brings them into contact with individuals with impaired capacity. The Office acknowledges the many challenges facing individuals with impaired capacity and those in our community who care for them. 22. In the Report14 of the review, released in March 2005, section 7.5 includes discussion of the issues raised by submitters and a number of options are proposed in response. The Privacy Commissioner made two recommendations (section 7.6) in regard to individuals whose decision-making ability is impaired:
23. The Senate Legal and Constitutional References Committee conducted its own inquiry into the Privacy Act and released its report15 in June 2005. 24. In January this year the Attorney-General, the Hon. Phillip Ruddock MP, announced that the Australian Law Reform Commission (ALRC) would undertake a comprehensive review of the Privacy Act. 25. The ALRC16 released a Privacy Issues Paper on 9 October 2006. Chapter 9 of this paper dealing with Children, Young People and Adults with a Decision-Making Disability may be of particular interest to the QLRC Review. More information about the ALRC review can be found on their website17. 26. The Privacy Commissioner encourages all interested parties to take the opportunity offered by the ALRC review of the Privacy Act to influence the shape of Australia's privacy legislation not only as it relates to individuals with decision-making disabilities, but in other areas which may be of privacy concern. Endnotes1 The Office of the Privacy Commissioner www.privacy.gov.au 2 The Privacy Act www.privacy.gov.au/act/index.html 3 Information Privacy Principles www.privacy.gov.au/publications/ipps.html 4 National Privacy Principles www.privacy.gov.au/publications/npps01.html 5 State and Territory Privacy Laws www.privacy.gov.au/privacy_rights/laws/index.html 6 Queensland Privacy Scheme www.justice.qld.gov.au/dept/privacy.htm 7 Guardianship and Administration Act 2000 (Qld) www.austlii.edu.au/au/legis/qld/consol_act/gaaa2000304/ 8 Confidentiality in the Guardianship System: Public Justice, Private Lives 2006, 7.4, P140 9 Decisions accessed at the AustlII website www.austlii.edu.au/cases/qld/QGAAT on 10 October 2006 10 Privacy Impact Assessment Guide 2006 www.privacy.gov.au/publications/PIA06.doc 11 Confidentiality in the Guardianship System: Public Justice, Private Lives, Chapter 7 12 Review of the Private Sector Provisions of the Privacy Act 1988 www.privacy.gov.au/act/review/review2005.htm 13 Submissions to the Review of the Private Sector Provisions of the Privacy Act 1988 www.privacy.gov.au/act/review/reviewsub.html 14 Getting in on the Act: Report of the Review of the Private Sector Provisions of the Privacy Act 1988 www.privacy.gov.au/act/review/revreport.doc 15 The Real Big Brother: Inquiry into the Privacy Act 1988. http://www.aph.gov.au/senate/committee/legcon_ctte/privacy/report/report.pdf. 16 Review of Privacy. ALRC Issues Paper www.austlii.edu.au/au/other/alrc/publications/issues/31/ 17 Australian Law Reform Commission, Privacy. http://www.alrc.gov.au/inquiries/current/privacy/index.htm |