Reaction to the reform proposal

Support for reform

8.66 The proposal to extend the coverage of the Privacy Act to identifiable genetic samples received broad support in submissions and consultations.^[70] The Centre for Law and Genetics summarised the position as follows:

There is some academic support for the view that genetic samples are information, or, more likely, that they are records containing information. On this basis, samples would be interchangeable with the information they contain. Technologies such as bioinformatics are firmly establishing the linkage between computer technology and genetic technology and it is likely that human tissue samples will, over time, be seen increasingly as living databases of information. However, this stage has not yet been reached and the argument remains speculative. There is sufficient uncertainty about this argument at the present time to justify clarification through amendment of [the Privacy Act].^[71]

8.67 The New South Wales Health Department stated that:

We are in an age where health information is stored and accessed using technological means such as electronic health records, or encrypted data from which information is potentially derivable. It is therefore appropriate to consider an identifiable sample similarly, ie, not only as the source of genetic information but also as the information itself since it is technologically accessible.^[72]

8.68 The Office of the Victorian Privacy Commissioner stated that:

In the present—and particularly in the likely future—a bodily sample is personal information and should be so defined. While a bodily sample and the genetic data derived from it will almost always be health information, it will also be personal information with relevance to matters other than health. Proper privacy protection in relation to genetic information should not fail for any individual through the narrowness of a definition.^[73]

8.69 Similarly, the Office of the Health Services Commissioner Victoria expressed the opinion that ‘samples are health information and this should be made clear in legislation’.^[74] The Australian Privacy Charter Council agreed that the Privacy Act should ensure that bodily samples from which identity can be ascertained are covered by the terms ‘personal information’ and ‘record’ and noted

[w]e cannot see any particular difficulties in relation to the complaints and enforcement aspects of the Privacy Act … , or with the relationship with other laws dealing with bodily samples …^[75]

8.70 However, other submissions expressed a range of reservations about the efficacy of the proposed reforms, possible duplication or complexity resulting from the interplay between an amended Privacy Act and other laws dealing with bodily privacy or the handling of body parts, and possible adverse consequences for existing practices involving the collection and handling of genetic samples.^[76] These issues are addressed below.

Efficacy of reform

8.71 The OFPC raised concerns about whether the inclusion of ‘bodily samples’ within the definition of ‘personal information’ and ‘record’ in the Act is justified by the genetic properties of the sample, and whether this is an example of unwarranted genetic exceptionalism.^[77] The OFPC also questioned whether, given that use and disclosure of information derived from samples is covered by the Act, there is any need to bring all bodily samples within its coverage:

Since almost any body sample with cellular properties contains all of an individual’s genes, a body sample, however large or small, can be a ‘genetic sample’. If that bodily or ‘genetic sample’ is collected and perhaps stored in a refrigerator, the Act does not apply. At the moment any information, whether genetic or otherwise, contained in that bodily sample is derived from the sample, all ‘uses’ and ‘applications’ involving that information are covered by the Act. These include any subsequent uses or disclosures of that information. The reasoning which supports bringing all bodily samples within the coverage of the Act to protect the collection, and possibly the storage, of bodily samples may need to be re-visited.^[78]

8.72 However as discussed above, the potential regulatory benefits of reform are not limited to those relating to the collection and storage of samples, but extend to the transfer of samples (including to overseas jurisdictions), the promotion of transparency in organisational practices, and individual rights of access to samples.

8.73 Importantly, the Inquiry has not been able to identify any circumstances in which applying the principles contained in the Privacy Act to samples would lead to clearly undesirable consequences for legitimate existing practices, nor have such circumstances been clearly identified in submissions or consultations.^[79]

Information and bodily privacy

8.74 In DP 66, the Inquiry recognised that the proposed reform would represent a fundamental change to the coverage of the Privacy Act, extending it beyond information privacy as currently conceived.^[80] The OFPC suggested that problems may arise from blurring the distinction between ‘information privacy’ and ‘bodily privacy’, to the detriment of regulatory efficacy and public understanding of genetics.^[81]

8.75 In general, the views of the OFPC were not shared by other privacy regulators. For example, Privacy NSW submitted that privacy legislation need not be confined to the protection of personal information held in records:

With appropriate legislative reform, privacy laws could be further developed to provide the necessary legal protection for bodily privacy. Conversely, an attempt to maintain a clear demarcation between different types of privacy protection may be problematic in light of new technologies which involve the merging of biology, mathematics and computer science, namely, biometrics and bioinformatics. Such developments give rise to new forms of body templates or records which further blur the distinction between personal information and its source in individual humans, rendering the concepts of information privacy and bodily privacy inherently inter-related.^[82]

8.76 It is not the intention of the Inquiry to reform existing laws dealing with the protection of the individual’s person and their body parts. These existing laws include those dealing with physical violence and assault, the ownership or theft of body parts,^[83] and controls over the transplantation of organs or the donation of human tissue. The focus of the present recommendations remains on information privacy and on protecting genetic samples as an immediate source of personal information.

8.77 The Inquiry recognises that, as a consequence of its recommendations, aspects of bodily privacy may be imported into the Privacy Act. There are contexts in which human bodies or body parts are dealt with that have nothing to do with their potential as sources of genetic information. For example, after death bodies must be buried, interred or cremated. Bodies and parts of bodies may be subject to post-mortem examination, autopsy or coronial procedures. Body parts from living or dead individuals may be used in transplantation.

8.78 It is also possible to envisage circumstances in which a body part, from a living or dead individual, is preserved as a memento, or displayed as a curiosity or relic. Regulating the ways in which bodily parts may be used or transferred may be seen as extending the Privacy Act to protect against affronts to human dignity.

8.79 If the Inquiry’s recommendations are implemented, the handling of bodies and body parts in these contexts would be regulated by the Privacy Act, as well as by existing legislation that regulates specific aspects of the handling of bodies and body parts. These other laws include the Human Tissue Acts,^[84] and legislation relating to coronial procedures and the use of bodies in anatomy teaching and research.^[85]

Overlapping law

8.80 The Inquiry does not consider that this overlap would necessarily produce problems in practice. The additional legislation referred to above deals with the handling of bodies or body parts in specific contexts. In the language of the Privacy Act, these practices are ‘required or authorised by or under law’^[86] and may be taken into account in applying the NPPs.

8.81 Privacy NSW noted that privacy legislation often overlaps with other more specific forms of regulation. Privacy NSW was ‘not aware of any major or insuperable legislative inconsistencies which would arise if the Privacy Act were to be amended as proposed’.^[87]

8.82 The baseline standards provided by the Privacy Act can co-exist with more specific obligations with regard to the handling of bodily samples. For example, a New South Wales Department of Health report into the retention of tissue and organs following post-mortems has recommended that the Human Tissue Act 1993 (NSW) and the Anatomy Act 1977 (NSW) be amended to require all collections to be centrally registered and specific standards adopted for cataloguing, identification and recording of consent to retain samples.^[88] Such requirements would not conflict, but augment, the application of information privacy principles to bodily samples.

8.83 If coronial authorities transfer the possession of a body or body part to another organisation (without consent of the executor) this would constitute a criminal offence under coronial legislation.^[89] Similarly, the collection of bodily samples for research or transplantation without consent is an offence under the Human Tissue Acts.^[90] It is no objection that the same conduct might also give rise to a complaint of interference with privacy, if the NPPs were to be applied to bodily samples.

8.84 There may also be rare circumstances in which an extended Privacy Act would provide a remedy where no existing remedy exists—for example where an individual’s identifiable body part is put on display without consent (a modern manifestation of the ‘Buddha’s finger’ phenomenon).^[91]

8.85 If it were considered that Privacy Act coverage of bodily samples was undesirable in principle or for practical reasons—for example, because of the number and nature of complaints that might have to be dealt with by the OFPC—it would be possible to exclude certain matters from the ambit of the amended Act. For example, the handling of bodies in the course of post-mortem or coronial procedures or of body parts that have been surgically removed might be excluded from the application of the Act.

8.86 In particular, the Inquiry has concluded that the provisions of the NPPs, recast as proposed, appear capable of operating in harmony with the Human Tissue Acts.^[92]In this context, the Centre for Law and Genetics observed that:

There may be overlap between the provisions in the Privacy Act relating to bodily samples and other laws, including the Human Tissue Acts, the tort of invasion of privacy (should one be created in the future by the High Court), property law … etc. However, in our view the overlap does not create inconsistencies. It is important to provide adequate coverage with no gaps and therefore the fact that there may be overlap does not preclude the proposed extension of the Privacy Act.^[93]