Implications of the alternative view of existing coverage

8.102 This chapter has proceeded on the basis that a name or a coded name (by itself) is not ‘information about an individual’ for the purposes of the Privacy Act. As discussed above, another possible interpretation of the existing provisions of the Privacy Act is that a name, by itself, may constitute information about an individual. Therefore, labelled samples, in effect, may already have to be handled in accordance with the IPPs or NPPs (assuming that the organisation that holds them is covered by the Privacy Act). For example, by transferring a labelled sample, an organisation will also be disclosing information (the name of the individual) and will have to comply with NPP 2.

8.103 If this interpretation is correct the gaps in the privacy protection of genetic samples may be more limited than indicated in this chapter. However, problems would remain. The obligations in the IPPs and NPPs relate to the handling of the information, not the sample itself. This leads to illogical results. For example:

• Under NPP 1.3, an organisation collecting labelled samples would have to take reasonable steps to ensure that the individual is aware that his or her name has been collected for the purpose of labelling a sample, but would be under no obligation to inform the individual that a sample has been collected or about the purpose of collection or what will happen to it.
• Under NPP 2.1(b), when an organisation intends to use or disclose labelled samples for a secondary purpose, the organisation would have to obtain consent to the use or disclosure of the information on the labels, but not to the use or transfer of the samples themselves. For example, an organisation could seek and obtain consent from an individual to the disclosure of ‘your personal details and health information’ for research purposes without disclosing that the individual’s sample will also be transferred.
• Under NPP 6.1, an individual would have a right of access to the label on the sample, but not to the sample itself.
• A fundamental gap in coverage would remain in relation to the handling of samples that are not labelled but are identifiable by other means, for example by matching DNA profiles.