23.07.2010
7.70 The Privacy Act applies privacy protection to an individual’s ‘personal information’. The Act recognises that a subset of personal information is ‘sensitive information’, which due to its nature attracts some higher standards of privacy protection. ‘Health information’ is one type of ‘sensitive information’.
7.71 Genetic information is not specifically referred to in the Privacy Act. The Explanatory Memorandum to the Privacy Amendment (Private Sector) Bill 2000 (Cth) stated that the definition of ‘health information’ covered genetic information, while at the same time noting that the NPPs were not designed to address the unique privacy issues associated with the handling of genetic information.[78]
7.72 For the purposes of the private sector provisions, the Privacy Act creates a special category of ‘sensitive information’ and gives this a higher level of protection. Sensitive information is information or an opinion about an individual’s racial or ethnic origin; political opinion; political association membership; religious beliefs, affiliations or philosophical beliefs; professional or trade association membership; union membership; sexual preferences; criminal record; or is health information about an individual.[79]
7.73 ‘Health information’ is separately defined as
(a) information or an opinion about:
(i) the health or a disability (at any time) of an individual; or
(ii) an individual’s expressed wishes about the future provision of health services to him or her; or
(iii) a health service provided, or to be provided, to an individual;
that is also personal information; or
(b) other personal information collected to provide, or in providing, a health service; or
(c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances.[80]
7.74 There are differences in the way the Privacy Act treats personal information, health information and other sensitive information. Health and other sensitive information are provided higher levels of protection than ordinary personal information.[81] Generally, genetic information will receive the special protection afforded to sensitive information under the Privacy Act if it can be defined as health information or some other element of sensitive information, for example, if it constitutes information or an opinion about an individual’s racial or ethnic origin, their sexual preferences or their criminal record.
7.75 There are circumstances in which genetic information may not be health information, as defined in the Privacy Act. This may occur either because the information is not about health, disability or the provision of a health service (as in the case of parentage or forensic testing) or because it is not about the health or disability of an existing individual (as may sometimes be the case with genetic carrier testing, where the information is primarily about the health of future children).[82]
7.76 The Inquiry notes that some genetic information collected for criminal forensic purposes may fall within the definition of sensitive information if it is information about an individual’s criminal record but that a range of genetic information will remain outside the definitions of sensitive information and health information. The Attorney-General’s Department noted that the consequences of this gap include that commercial laboratories that currently offer parentage testing may be able to use genetic information for direct marketing purposes.[83]
7.77 Submissions indicated general support for amending the Privacy Act to ensure that all genetic information is treated as health information or other sensitive information under the Act.[84]
7.78 Some submissions referred to the definition used in the Health Records Act 2001 (Vic) and the Health Records and Information Privacy Act 2002 (NSW) as appropriate models.[85] The Victorian legislation defines health information to include
other personal information that is genetic information about an individual in a form which is or could be predictive of the health (at any time) of the individual or any of his or her descendants.[86]
7.79 The New South Wales legislation defines health information to include
other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of any sibling, relative or descendant of the individual.[87]
7.80 Both of these definitions would be broad enough to encompass genetic carrier testing. It is unclear whether the Victorian definition covers parentage, research or forensic testing information.[88] The New South Wales definition clearly would not cover such information because of the required connection with the provision of a health service. The AHMAC Draft National Health Privacy Code adopts the Victorian formulation[89] and is intended to include all genetic information, whether or not it has been collected in relation to the provision of a health service.[90]
7.81 The Inquiry is of the view that genetic information should receive the special protection afforded to health and other sensitive information under the Privacy Act. The existing definitions of health information and sensitive information do not provide that level of protection for all genetic information.
7.82 The Inquiry therefore recommends that the definition of health information in the Privacy Act be amended to make clear that it includes genetic information predictive of health, whether or not the information is collected in relation to the health of, or the provision of a health service to, the individual or a genetic relative.[91] In this recommendation, the word ‘predictive’ does not bear the technical meaning used in some clinical contexts,[92] but is chosen for the purpose of consistency with the existing legislative definitions referred to above. The term ‘genetic relative’ seems more appropriate than the Victorian or AHMAC formulations, which refer to ‘descendants’ of the individual and do not, therefore, encompass genetic information about an individual’s siblings.
7.83 An amendment to the definition of sensitive information is also necessary to cover genetic information derived from parentage or other identification testing that is not predictive of health.
Recommendation 7–4 The Commonwealth should amend s 6 of the Privacy Act 1988 (Cth) (Privacy Act) to define ‘health information’ to include genetic information about an individual in a form which is or could be predictive of the health of the individual or any of his or her genetic relatives. (See also Recommendation 8–2 in relation to genetic samples.)
Recommendation 7–5 The Commonwealth should amend s 6 of the Privacy Act to define ‘sensitive information’ to include human genetic test information.
[7] Australian Law Reform Commission and Australian Health Ethics Committee, Protection of Human Genetic Information, IP 26 (2001), ALRC, Sydney, Question 4–3.
[8] Human Genetics Society of Australasia, Submission G050, 14 January 2002.
[9] Office of the Privacy Commissioner (NSW), Submission G118, 18 March 2002.
[78] In the Senate, the Bill was amended to define ‘genetic information’ and to insert genetic information into the definition of health information. This amendment and other Senate amendments relating specifically to genetic information were not accepted by the House of Representatives. The reasons of the House for disagreeing with the Senates amendments included that it would be premature to accept the amendments proposed until the government had the benefit of the report of the present Inquiry: Commonwealth of Australia, Parliamentary Debates, House of Representatives, 5 December 2000, 1965 (Reasons of the House of Representatives for Disagreeing to the Amendments of the Senate presented by the Hon Darryl Williams Attorney-General). See also Senate Legal and Constitutional Legislation Committee, Provisions of the Privacy Amendment (Private Sector) Bill (2000), The Parliament of Australia, Canberra, 26–27.
[79] Privacy Act 1988 (Cth) s 6(1).
[80] Ibid s 6(1).
[81] Subject to some limited exceptions, NPP 10 requires consent for the collection of sensitive information: compare Ibid, NPP 1, which requires only that individuals be informed about various matters such as their access rights, the purposes of collection and to whom the organisation usually discloses information of that kind. The use and disclosure of sensitive information other than for the primary purpose of collection is more constrained than is the case with ordinary personal information—the secondary purpose must be directly related to the primary purpose: Privacy Act 1988 (Cth), NPP 2.1(a).
[82] Australian Law Reform Commission and Australian Health Ethics Committee, Protection of Human Genetic Information, IP 26 (2001), ALRC, Sydney [4.75]–[4.79].
[83] Commonwealth Attorney-General’s Department, Submission G158, 7 May 2002. Direct marketing is a permissible secondary use of personal information but not health information: Privacy Act 1988 (Cth) NPP 2.1(c).
[84] Commonwealth Department of Health and Ageing, Submission G150, 15 April 2002; Royal College of Pathologists of Australasia, Submission G144, 25 March 2002; Human Genetics Society of Australasia, Submission G050, 14 January 2002; New South Wales Genetics Service Advisory Committee, Submission G094, 25 January 2002; UnitingCare NSW & ACT, Submission G052, 14 January 2002; Office of the Federal Privacy Commissioner, Submission G143, 22 March 2002; Children’s Cancer Institute Australia, Submission G221, 29 November 2002; Haemophilia Foundation Victoria, Submission G201, 25 November 2002; Office of the Privacy Commissioner (NSW), Submission G257, 20 December 2002; Australian Biospecimen Network, Submission G238, 19 December 2002; Centre for Law and Genetics, Submission G255, 21 December 2002; Office of the Federal Privacy Commissioner, Submission G294, 6 January 2003; Commonwealth Department of Health and Ageing, Submission G313, 6 February 2003; Androgen Insensitivity Syndrome Support Group Australia, Submission G290, 5 January 2003; NSW Health Department, Submission G303, 13 January 2003; Australian Privacy Charter Council, Submission G304, 21 January 2003; Office of the Health Services Commissioner Victoria, Submission G307, 17 January 2003. AGSA opposed the proposed amendment on the basis that defining all genetic information as health information would lead to confusion: Association of Genetic Support of Australasia, Submission G284, 25 December 2002.
[85] Royal College of Pathologists of Australasia, Submission G144, 25 March 2002; Human Genetics Society of Australasia, Submission G050, 14 January 2002; New South Wales Genetics Service Advisory Committee, Submission G094, 25 January 2002; Commonwealth Department of Health and Ageing, Submission G150, 15 April 2002 (expressing the views of the AHMAC National Health Privacy Working Group).
[86]Health Records Act 2001 (Vic) s 3(1)(d). The Act came into effect from 1 July 2002.
[87]Health Records and Information Privacy Act 2002 (NSW) s 6(d).
[88] The Victorian definition refers to information in a form which ‘is or could be’ predictive of health. It may not require that the information be obtained for health-related purposes.
[89] Australian Health Ministers’ Advisory Council National Health Privacy Working Group, Draft National Health Privacy Code (2002), AHMAC, Canberra cl 1.
[90] Commonwealth Department of Health and Ageing, Submission G313, 6 February 2003; Australian Health Ministers’ Advisory Council National Health Privacy Working Group, National Health Privacy Code (draft) Consultation Paper (2002), AHMAC, Canberra, 18.
[91] And bodily samples from individuals whose identity is apparent or reasonably can be ascertained from the sample: See Ch 8.
[92] See Ch 10.