The Privacy Act and consent

15.14 Under National Privacy Principle (NPP) 10.3 of the Privacy Act, health information may be collected without consent for research purposes if obtaining consent is impracticable, de-identified information would not be suitable, and the collection is in accordance with guidelines issued by the NHMRC and approved by the Privacy Commissioner under s 95A of the Act (the s 95A Guidelines).^[25]

15.15 Under NPP 2.1(d), health information may be used or disclosed without consent for research purposes if obtaining consent is impracticable, the use or disclosure is conducted in accordance with the s 95A Guidelines and, in the case of disclosure, it is reasonably believed that the recipient will not disclose the information.^[26]

15.16 When a proposal for medical research would involve a breach of the Information Privacy Principles (IPPs), consent requirements may be waived in accordance with the s 95 Guidelines. The s 95 Guidelines apply to medical research that involves use or disclosure of personal information, typically without the consent of the person to whom it relates, where the information is held by a Commonwealth agency.

15.17 The Privacy Commissioner may approve s 95 Guidelines (in relation to the IPPs) and s 95A Guidelines (in relation to the NPPs) only where he or she is satisfied that the ‘public interest’ in research or in the use and disclosure of health information in accordance with the guidelines ‘substantially outweighs the public interest’ in maintaining adherence to the IPPs or the NPPs.^[27]

15.18 The s 95 and s 95A Guidelines provide that an HREC should not approve research that would otherwise breach the Privacy Act unless it considers that the public interest in the research outweighs to a substantial degree the public interest in privacy. Each set of guidelines provides a similar framework for weighing these interests.^[28] HRECs are directed to consider certain specified matters, including the value and public importance of the research, the likely benefits to the participants, whether the research design can be modified, the financial costs of not proceeding with the research, the type of personal information being sought, the risk of harm to individuals and the extent of possible breach of privacy.^[29]

15.19 Non-compliance with the s 95 Guidelines may lead to researchers being named in the NHMRC’s annual report or in a report to a Commonwealth agency or the federal Privacy Commissioner.^[30] Where the conduct of an organisation or agency is in breach of the Privacy Act, affected individuals may complain to, and have their complaints investigated by an adjudicator under an approved privacy code or by the federal Privacy Commissioner.^[31]

15.20 The s 95 and s 95A Guidelines do not apply to the collection, use and disclosure of health or other personal information in research by individuals or organisations that are not covered by the Privacy Act. For example, the Privacy Act does not apply to state public sector entities, including public teaching hospitals and associated research bodies, where such bodies are established for a public purpose under a law of a State.^[32]However, these organisations may be covered by state legislation.^[33]

15.21 As discussed in more detail in Chapter 21, a disclosure that is permitted by the Privacy Act may nonetheless breach the common law. While the Privacy Act permits the disclosure of patient health information to medical researchers without consent,^[34] disclosure may nevertheless breach a common law duty of confidentiality. The determination of an HREC that personal information can ethically be disclosed does not necessarily provide protection against an action for breach of confidence.^[35]