23.07.2010
Extending the Privacy Act to deceased individuals
7.84 DP 66 asked whether the Privacy Act adequately deals with issues that may arise in relation to the genetic samples and information of deceased individuals.[93] A threshold question concerns the extent to which it makes sense to protect the privacy of deceased individuals through the application of information privacy principles. Logically, the privacy interests being protected can only be those related to surviving individuals or, more abstractly, to the memory of the deceased.[94]
7.85 The Privacy Act regulates the handling of personal information about individuals. Section 6 of the Act defines an individual as ‘a natural person’. The Privacy Act does not cover genetic information about deceased persons. An individual may only make a complaint under the Privacy Act in relation to an interference to his or her own privacy.
7.86 This position may be contrasted with that under New South Wales and Victorian health privacy legislation, which cover personal information about individuals who have been dead for not more than 30 years[95]—a period of protection that is consistent with the 30 year period after which government archival records are generally open to public access.[96]
7.87 In Victoria, the rights or powers conferred on individuals under the Health Records Act 2001 (Vic) are exercisable by a legal representative (executor or administrator) of the deceased individual.[97] New South Wales privacy legislation does not directly address the issue of obtaining consent in relation to deceased individuals.[98]
7.88 The AHMAC Draft National Health Privacy Code covers personal information about individuals who have been dead for not more than 30 years.[99] The consultation paper notes that there are
many situations where information may be sought on deceased persons, for example a health provider could receive requests for such information from relatives, friends legal representatives, the media and medical researchers. Some of these requests may be legitimate and appropriate, while others may be motivated by reasons unrelated to the interests of the individual involved.[100]
7.89 The Commonwealth Department of Health and Ageing noted that, because the genetic health information of a deceased person is also information about their family members or descendants, there may be an argument for protecting the genetic information long after a person’s death.[101] Other submissions suggested that the Privacy Act should be amended to cover genetic information about,[102] and samples from,[103] deceased individuals.[104]
7.90 The Inquiry believes that it is desirable that information privacy protection extend to genetic information about deceased individuals because of the implications that the collection, use or disclosure of this information may have for living genetic relatives. It appears preferable for representatives of the deceased to be able to consent to the collection, use or disclosure rather than to leave decisions about these matters outside the Privacy Act.
7.91 It would also be desirable for Commonwealth, state and territory privacy legislation to have consistent coverage in relation to information about deceased individuals. At present, where genetic information about a deceased individual is transferred between, for example, a Victorian clinical genetics service and a private sector clinical geneticist, the extent of privacy protection will change. While the clinical geneticist will be permitted under the federal Privacy Act to collect and disclose the information without the consent of the deceased’s legal representative, the Victorian service may not be able to do so.
Recommendation 7–6 The Commonwealth should amend the Privacy Act to provide that ‘health information’ includes information about an individual who has been dead for 30 years or less. These amendments should include provision for decision making by next-of-kin or an authorised person in relation to the handling of a deceased individual’s health information. (See also Recommendation 8–2 in relation to genetic samples.)
Access by genetic relatives
7.92 The Inquiry has been informed about situations in which individuals have been denied optimal medical care because of difficulty in obtaining access to the medical records of deceased relatives. The following example illustrates the problem:
The client is a 24 year old individual whose mother died at age 40 of bowel cancer and polyps. The father subsequently remarried and there was falling out between the children and the father so they have lost contact with him. They present for genetic advice. It is essential to know whether there were a few polyps or [whether] a condition known as Familial Adenomatous Polyposis was present. The histopathology would state this. The offspring are genetically related and therefore have a greater need for the information than the spouse who has ‘moved on’. In both the ACT and Queensland there is now a blanket rule in medical records departments to prohibit access without the executor’s permission. In the current case [the client] was not aware of who that was and now does not know whether annual colonoscopy or 3–5 yearly colonoscopy is necessary.[105]
7.93 If the law requires that access to genetic information about a deceased individual can be granted only with the consent of that person’s legal or other authorised representative, genetic relatives may still have problems in gaining access.
7.94 Whether or not privacy legislation applies to genetic information about deceased individuals, some rights in respect of genetic information may be exercisable by genetic relatives if they can show that the information is also ‘about’ them.[106] This is one implication of the shared or familial nature of genetic information. An individual’s genetic information is information about that individual, but it is also ‘about’ the individual’s immediate family, other genetic relatives, ethnic group, racial group, and ultimately humanity itself.
7.95 Under the existing provisions of the Privacy Act, it should be possible for an individual to argue that he or she has rights in relation to genetic information that is primarily about a genetic relative on the ground that the information is also, at least in part, ‘about’ the individual seeking to assert those rights (and identifies him or her).[107]
7.96 One advantage of differentiating between the familial and personal aspects of genetic information is that it assists in this analysis. In the example related above, the familial information is that the gene for Familial Adenomatous Polyposis is present in the family. This information is ‘about’ each family member. The mother’s genetic status, though it may be inferred from her death from bowel cancer, is personal—it is ‘about’ her. The father should not be permitted to withhold the familial information from the daughter who needs to know it in order to monitor her own health.
7.97 In some circumstances, the principles for fair information handling codified in the Privacy Act may provide a flexible basis for dealing with this issue without further amendment. For example, if the matter were tested, it may well be that the Privacy Commissioner or a court might find that a person has a right of access to familial genetic information about his or her deceased parents or siblings (on the ground that the information is also information ‘about’ the person seeking access), but no right of access to the same information about a deceased second cousin.[108]
7.98 However, in practice the need to show that the information is also identifying of the living genetic relative may constitute a barrier to the exercise of access rights. Therefore, other recommendations made in this Report are intended to ensure that first-degree genetic relatives are able to access genetic samples or information where such access is vital to their health. In Chapter 8 and Chapter 21 the Inquiry recommends that the Privacy Act be amended to provide individuals with rights to access genetic samples and familial information about their first-degree genetic relatives in certain exceptional circumstances.
[93] Australian Law Reform Commission and Australian Health Ethics Committee, Protection of Human Genetic Information, DP 66 (2002), ALRC, Sydney, Question 7–6. Related issues concerning individuals’ rights of access to the bodily samples of genetic relatives are also discussed in Ch 9.
[94] Note that, in Australia, no action lies for defamation of a deceased person, however distressing to living relatives or friends: J Fleming, The Law of Torts (9th ed, 1998) LBC Information Services, Sydney, 585. See also Australian Law Reform Commission, Unfair Publication: Defamation and Privacy (1979), Australian Government Printing Service, Canberra [99]–[102]. The Commission recommended that a person representing a deceased defamed person should be able to sue, but only where the publication is made within 3 years of death and only to obtain a correction, declaratory order or injunction (and not damages). A patient’s right to confidentiality continues after the patient’s death, so that a doctor may not reveal confidential information after death except with proper legal authority: L Skene and J Savulescu, ‘Who Has the Right to Access Medical Information from a Deceased Person? Ethical and Legal Perspectives’ (2000) 8(August) Journal of Law and Medicine 81, 82.
[95] New South Wales and Victorian health privacy legislation provides that the term ‘personal information’ ‘does not include information about an individual who has been dead for more than 30 years’: Health Records Act 2001 (Vic) s 3; Health Records and Information Privacy Act 2002 (NSW) s 5. The Victorian legislation also expressly provides that the Act applies ‘in relation to a deceased individual who has been dead for 30 years or less, so far as it is reasonably capable of doing so, in the same way as it applies in relation to an individual who is not deceased’: Health Records Act 2001 (Vic) s 95. ACT legislation also covers personal information about deceased individuals but has no 30 year limitation on coverage: See Health Records (Privacy and Access) Act 1997 (ACT) s 4 (definition of ‘consumer’); s 27. In the United States, federal health privacy regulations, effective on 26 February 2001, extend protection of protected health information about deceased individuals for as long as the covered entity maintains the information: Health Insurance Portability and Accountability Act 1996: Standards for the Privacy of Individually Identifiable Health Information 45 CFR Part 164 1996 (USA) s 164.502(f).
[96] For example, Archives Act 1983 (Cth) s 3(7).
[97]Health Records Act 2001 (Vic) s 95(2); s 3. See also Health Records and Information Privacy Act 2002 (NSW) s 8.
[98] Privacy NSW submitted amendments to the federal Privacy Act should include provisions for decision making, either by a next-of-kin or an authorised person, regarding the human tissue and health information of deceased individuals: Office of the Privacy Commissioner (NSW), Submission G257, 20 December 2002.
[99] Australian Health Ministers’ Advisory Council National Health Privacy Working Group, Draft National Health Privacy Code (2002), AHMAC, Canberra cl 1.
[100] Australian Health Ministers’ Advisory Council National Health Privacy Working Group, National Health Privacy Code (draft) Consultation Paper (2002), AHMAC, Canberra, 42.
[101] Commonwealth Department of Health and Ageing, Submission G313, 6 February 2003.
[102]Office of the Victorian Privacy Commissioner, Submission G266, 20 December 2002; Human Genetics Society of Australasia, Submission G267, 20 December 2002; I Turnbull, Submission G277, 21 December 2002; Office of the Privacy Commissioner (NSW), Submission G257, 20 December 2002; Department of Human Services South Australia, Submission G288, 23 December 2002; Office of the Health Services Commissioner Victoria, Submission G307, 17 January 2003.
[103] Office of the Victorian Privacy Commissioner, Submission G266, 20 December 2002; Office of the Privacy Commissioner (NSW), Submission G257, 20 December 2002; Department of Human Services South Australia, Submission G288, 23 December 2002; Office of the Health Services Commissioner Victoria, Submission G307, 17 January 2003.
[104] Extension of the Privacy Act to information about deceased individuals was opposed in some submissions: Queensland Government, Submission G274, 18 December 2002.
[105] K Barlow-Stewart, Correspondence, 18 July 2002.
[106] Commonwealth Attorney-General’s Department, Submission G158, 7 May 2002.
[107] A similar position may exist under the Data Protection Act 1998 (UK): G Laurie, Genetic Privacy (2002) Cambridge University Press, Cambridge, 253–254.
[108] Where it is held by public sector agencies, access to information about deceased individuals may also be sought under Commonwealth, state or territory freedom of information legislation. Similar balancing tests are applicable to FOI requests: eg Freedom of Information Act 1982 (Cth) s 41(1) states that ‘A document is an exempt document if its disclosure under this Act would involve the unreasonable disclosure of personal information about any person (including a deceased person)’.