Information sharing between agencies

30.126 Information flow to the federal family courts and the state and territory courts is important to ensure that the courts are making orders based on all the relevant information, and that the potential for inconsistent orders is minimised. It is also important that information is shared appropriately among relevant government agencies and private sector organisations—for example, private sector service providers, child protection agencies and the police—to ensure the safety of victims of family violence and their children.

30.127 In the following section, the Commissions examine the legislative framework that regulates the sharing of information among government agencies and private sector organisations—that is, privacy and secrecy laws—and consider what changes are necessary to allow information to flow in appropriate circumstances. Barriers to information sharing are not, however, always legislative in nature. Often the obstacles are cultural, or arise from an excess of caution based on a lack of understanding of the relevant rules, and the Commissions also consider ways to promote a culture of appropriate and effective information sharing.

Privacy laws

30.128 The handling of personal information is regulated by privacy legislation at the federal, state and territory level. The principal piece of federal legislation regulating privacy in Australia is the Privacy Act 1988 (Cth), which applies to Australian and ACT Government agencies and private sector organisations.^[143] The Act contains a set of 11 Information Privacy Principles (IPPs) that apply to government agencies, and 10 National Privacy Principles (NPPs) that apply to private sector organisations.

30.129 Of particular relevance to this Inquiry are IPPs 10 and 11, which impose limits on the manner in which Australian Government agencies use and disclose personal information. IPP 10 provides that a ‘record-keeper’ in an Australian Government agency who has possession or control of personal information shall not use the information for any other purpose unless:

the individual concerned has consented to use of the information for that other purpose;

the record-keeper believes on reasonable grounds that use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person;

use of the information for that other purpose is required or authorised by or under law;

use of the information for that other purpose is reasonably necessary for enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the protection of the public revenue; or

the purpose for which the information is used is directly related to the purpose for which the information was obtained.^[144]

30.130 IPP 11 governs disclosure of personal information. The exceptions in IPP 11 closely reflect those in IPP 10. Similar, but not identical, limitations on use and disclosure apply to many state and territory government agencies under state and territory privacy laws and administrative obligations.

30.131 Time for Action noted that privacy laws can contribute to a lack of communication and collaboration between government and non-government organisations, which impedes systems working together effectively:

While privacy laws generally allow the sharing of information between government agencies and other specified organisations where there is a serious and imminent threat to a person’s safety … many service providers report inconsistencies in the way privacy laws and principles are applied, suggesting the need for clarification of, and/or education for, relevant agencies about privacy laws and principles.^[145]

30.132 It appears from some reviews of child protection systems in Australia that there is confusion among agencies about the impact of privacy rules that has created obstacles to information sharing. In a recent report, the Victorian Ombudsman noted

a number of mistaken beliefs held by child protection staff about their responsibilities under the Information Privacy Act. Unfounded beliefs included that the department should not release the identity of reporters to Victoria Police when issues of physical and sexual abuse against children were alleged …

The department has not provided child protection workers with sufficient training, advice or resources to ensure an appropriate level of privacy compliance.^[146]

30.133 In NSW, the privacy principles in the Privacy and Personal Information Protection Act 1998 (NSW) and the Health Records and Information Privacy Act 2002 (NSW) have been modified with respect to government agencies (and some private sector entities) that participate in the Domestic Violence Intervention Court Model.^[147] The amending orders provide that government agencies that participate in the scheme are not required to comply with the Act in relation to the collection, use and disclosure of personal information about alleged perpetrators, victims and other family members. Agencies must, however, comply with codes of practice particular to the scheme.

30.134 Information sharing guidelines have been recommended as a way to clarify information sharing procedures between the relevant agencies.^[148] Numerous reviews have also recommended that specific training be provided to ensure that agencies and their officers understand what information may (or must) be shared, with whom and under what circumstances.^[149]

Proposed reform of the privacy principles

30.135 In its report on privacy, For Your Information: Australian Privacy Law and Practice (2008) (ALRC Report 108), the ALRC recommended that a uniform set of privacy principles should apply to private sector organisations and federal, state and territory government agencies.^[150] The ALRC expressed the view that the use and disclosure of personal information should be permitted:

• with the consent of the individual to whom the information relates;

• for a secondary purpose that is related to the primary purpose of collection—or, if the information is sensitive personal information, directly related to the primary purpose of collection—where the individual to whom the information relates would reasonably expect the information to be used or disclosed in that way;

• where the agency or organisation reasonably believes that the use or disclosure is reasonably necessary to lessen or prevent a serious threat to an individual’s life, health or safety; or public health or public safety;

• where the use or disclosure is required or authorised by or under law;

• where the agency or organisation reasonably believes that the use or disclosure is necessary for certain law enforcement and regulatory purposes, including ‘the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct’; and

• for research purposes.^[151]

30.136 Generally, personal information should be used and disclosed only for the purpose for which it was collected, that is, the primary purpose of collection or a related purpose. Where sensitive personal information is collected, it should only be used for the primary purpose of collection or a directly related purpose that the person would reasonably expect.

30.137 The information can be used for other purposes with the consent of the individual to whom the information relates. An example of information being used for another purpose with the consent of the individual is the NSW Police Yellow Card Referral Program. The Program requires police to ask victims of family violence at the time of an incident if they would like their details forwarded to a victim support agency for follow up. The Yellow Card is signed by the victim, indicating express consent for disclosure of their personal information. The Yellow Card is then forwarded to a support agency via a Domestic Violence Liaison Officer.

Serious threat to life, health or safety

30.138 In ALRC Report 108, the ALRC noted that all states and territories have laws in place that expressly allow or require disclosure of personal information in certain circumstances, for example, where a child is at risk of physical or sexual abuse. However, the ALRC also noted reports that sometimes a child was seriously injured or killed by a parent where disclosure of information about the parent’s behaviour to appropriate service providers could have helped to prevent the injury or death.^[152] Reviews into child deaths have also highlighted the need for increased collaboration and information sharing in order to protect children from serious harm.^[153]

30.139 The ALRC was concerned that the existing exception for the use and disclosure of information where necessary to prevent or lessen a serious and imminent threat to the life or health of an individual, was too narrow. In the ALRC’s view there were compelling policy reasons for information to be used and disclosed, for example, where a child’s life, health or safety was at risk of harm in the medium to long term, not only where the threat of harm was imminent. In such circumstances, agencies and organisations should be able to take early preventative action to stop a threat from escalating to the point of materialisation.

30.140 The ALRC recommended, therefore, that the requirement that the threat be imminent should be removed,^[154] noting that an analysis of whether a threat was ‘serious’ would involve consideration of the relative likelihood that the harm would occur, as well as the gravity of the potential outcome.

30.141 In June 2010, in response to these recommendations, the Australian Government released exposure draft Australian Privacy Principles for comment.^[155] The draft largely reflected the ALRC’s recommendations, including allowing the use or disclosure of personal information where an agency or organisation reasonably believes the use or disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health or safety, or public health or safety. In light of stakeholder concerns about the possible breadth of the exception, the exposure draft principles stated that this exception should only apply where it is unreasonable or impracticable to obtain the individual’s consent to the use or disclosure.^[156]

Required or authorised by or under law

30.142 Privacy principles across Australia also generally provide exceptions for the use and disclosure of personal information where it is required or authorised by or under law.^[157] The exposure draft Australian Privacy Principles provide for the use or disclosure of personal information where it is required or authorised by or under an Australian law, or an order of a court or tribunal.^[158] ‘Australian law’ is defined to include federal, state and territory legislation.^[159]

Family violence legislation

30.143 Some state and territory family violence laws include information-sharing provisions that are designed to ensure that the use and disclosure of relevant information does not contravene privacy laws on the basis that the use or disclosure is authorised by law.

30.144 Under the Tasmanian family violence legislation, for example, ‘personal information custodians’—within the meaning of the Personal Information Protection Act 2004 (Tas)—are permitted (but not required) to collect, use, disclose or otherwise deal with personal information where this is done in good faith for the purpose of furthering the objects of the Family Violence Act 2004 (Tas).^[160] Section 3 of that Act states the objects as follows: ‘In the administration of this Act, the safety, psychological wellbeing and interests of people affected by family violence are the paramount considerations’.

30.145 Section 70A of the Restraining Orders Act 1997 (WA) provides for ‘interested parties’ to share prescribed information if the parties agree that this is necessary to ensure the safety of a person who is the subject of a protection order or the wellbeing of a child who is affected by such an order. ‘Interested parties’ are defined as:

• the Commissioner of Police;

• the Chief Executive Officer of the agency assisting the Minister administering the Restraining Orders Act—presently the Attorney-General;

• the Chief Executive Officer of the agency assisting the Minister administering pt 8 of the Sentence Administration Act 2003 (WA)—presently the Minister for Corrective Services; and

• the Chief Executive Officer for child welfare.^[161]

30.146 ‘Prescribed information’ includes, among other matters:

• the name, address, telephone number, age and ethnicity and other details of the victim, a child of the victim, or a person bound by a protection order;

• a description of any offence relevant to the granting of the protection order and an abridged description of the circumstances of its commission;

• any information about the grounds on which the protection order was granted; and

• the status of the investigation and prosecution of any offence relevant to the granting of the protection order by a police officer.^[162]

30.147 Persons who provide information under s 70A ‘in confidence and good faith’ are protected from any civil or criminal liability, or breach of professional ethics or standards, in respect of the provision of the information.^[163]

30.148 In the ACT, a more restricted information-sharing scheme is established under s 18 of the Domestic Violence Agencies Act 1986 (ACT). This section enables police officers who suspect the past or future commission of a ‘domestic violence offence’ to disclose to approved crisis support organisations ‘any information that is likely to aid the organisation in rendering assistance to the person or to any children of the person’. Crisis support organisations are approved by the Minister pursuant to disallowable legislative instruments.

30.149 In some situations, agencies are required to share information relevant to family violence proceedings. For example, the South Australian family violence legislation requires South Australian Government agencies, and persons providing services to those agencies, to make available to police officers, on request, information that ‘could reasonably be expected to assist in locating a defendant to whom an intervention order is to be served’.^[164]

Child protection legislation

30.150 Currently, each state and territory child protection law provides for the exchange of information between police and the child protection agency, and between the police and other nominated persons or agencies, although there is great diversity in how these provisions are framed.^[165]

30.151 The Children and Young People Act 2008 (ACT), for example, permits information to be shared between ACT Policing, the child protection agency and other persons where it is in the best interests of the child or young person and for the purpose of performing a function under the Act.^[166] In NSW, the child protection agency is able to provide information to prescribed bodies and to request information from them where the information relates to:^[167]

• the safety, welfare and wellbeing of a particular child or young person or class of children or young persons;^[168]

• an unborn child who is the subject of a pre-natal report;

• the family of an unborn child the subject of a pre-natal report; or

• the expected date of birth of an unborn child that is the subject of a pre-natal report.^[169]

30.152 The list of prescribed bodies is extensive and includes: NSW Police; government agencies; schools; hospitals; fostering agencies; child care services; out-of-home care services; adoption agencies; and any other organisation which is responsible for or supervises the provision of health care, welfare, education, children’s services, residential services, or law enforcement, wholly or partly to children. The NSW child protection agency is also authorised to exchange information with certain Commonwealth agencies including the Family Court, the Federal Magistrates Court, Centrelink and the Department of Immigration and Citizenship.^[170]

30.153 The Act makes it clear that these provisions override any provision contained in any other law, including privacy law, which prohibits or restricts the disclosure of that information.^[171] A prescribed body therefore cannot refuse to release information to the child protection agency on the basis that the privacy law prohibits it from doing so.

30.154 In NSW and the Northern Territory, police and the child protection agency have a mutual obligation to share information on request where they believe that the information will assist the other in providing for the safety, welfare or wellbeing of the child to whom the information relates. The situation varies in other states and territories. The police are compelled to provide information at the request of the child protection agency in Queensland, South Australia, Tasmania and the ACT. Except for NSW and the Northern Territory, the child protection agency in other jurisdictions retains discretion as to whether to supply information to the police.

30.155 A shortcoming of the NSW information sharing provisions, identified by the Wood Inquiry, was the inability of human service and justice agencies (including the police), and those agencies and non-government agencies, to share information directly without needing to use the child protection agency as a hub.^[172]

30.156 This was addressed by the addition of a new Chapter 16A into the Children and Young Persons (Care and Protection) Act 1998 (NSW) that allows prescribed bodies to share information relating to the safety, welfare or wellbeing of children and young persons.^[173] The following principles apply to information sharing under this chapter:

(a) agencies that have responsibilities relating to the safety, welfare or well-being of children or young persons should be able to provide and receive information that promotes the safety, welfare or well-being of children or young persons,

(b) those agencies should work collaboratively in a way that respects each other’s functions and expertise,

(c) each such agency should be able to communicate with each other agency so as to facilitate the provision of services to children and young persons and their families,

(d) because the safety, welfare and well-being of children and young persons are paramount:

(i) the need to provide services relating to the care and protection of children and young persons, and

(ii) the needs and interests of children and young persons, and of their families, in receiving those services,

take precedence over the protection of confidentiality or of an individual’s privacy.^[174]

30.157 These provisions place a positive onus on prescribed bodies to take reasonable steps to coordinate decision making and delivery of services regarding children and young persons.^[175] Information sought by an agency must relate directly to that agency’s work in relation to the safety, welfare and wellbeing of a particular child or young person or class of children or young people.^[176] A prescribed body will be required to comply with a request for information when it believes this will assist the requesting body in providing for the safety, welfare and wellbeing of the child and/or young person to whom the information relates.^[177] Where there are inconsistencies between the Act and other legislation governing privacy, the provisions contained in Chapter 16A take precedence.^[178] The legislation does, however, place a number of limitations on the obligation to provide information. For example, a prescribed body is not required to disclose information if the agency believes it would impact on a criminal investigation or coronial inquest, endanger a person’s life or is not in the public interest.^[179]

30.158 As in NSW, Tasmanian child protection legislation also makes provision for the police to share information with an extensive list of prescribed agencies other than the child protection agency.^[180] In Queensland, the list is limited to the departments of health, housing and homelessness, community care services, accredited schools, persons providing services to children or families and the Mater Misericordiae Hospital.^[181]

30.159 In the Northern Territory, police can request information from a list of prescribed persons, including employees of government agencies, schools, health practitioners and hospitals where they are conducting an inquiry into a child’s physical, psychological or emotional wellbeing or a child protection investigation. The prescribed person must comply with the police request.^[182]

30.160 Information sharing guidelines are one mechanism to explain to agencies and organisations how legislative provisions operate and to clarify information-sharing procedures between the relevant entities.^[183] For example, guidelines can set down processes for requesting and providing information. As recommended in several reviews of child protection systems, they can also highlight the importance of sharing information (between police, the child protection agency and other relevant agencies) early in the investigation process.^[184]

Secrecy laws

30.161 While privacy laws impose obligations on agencies with respect to the handling of personal information, secrecy laws impose obligations on individual public service officers with respect to the handling of personal and other information held by government. Frequently, secrecy laws impose criminal sanctions for the unauthorised disclosure of government information.

30.162 In 2009, the ALRC conducted a review of Commonwealth secrecy laws, with a focus on the increased need to share information within and between governments and with the private sector.^[185] The ALRC recommended that Australian Government agencies should review Commonwealth secrecy offences to determine whether criminal sanctions are warranted for the unauthorised disclosure of government information.^[186] The ALRC also recommended that secrecy offences should generally include an exception for disclosures in the course of an officer’s functions or duties.^[187] This exception would ensure that where disclosures are required or authorised by or under another law—for example, state and territory family violence legislation or child protection legislation—or where an officer disclosed information in accordance with an information sharing protocol or memorandum of understanding, the officer would not breach the relevant secrecy law.

Shared databases

30.163 A number of reviews have identified the utility of shared information and data collection systems between, for example, police and child protection agencies.^[188] Several models exist both in Australia, such as the Client Relationship Information System in Victoria,^[189] and overseas.

30.164 A database called ‘Wellnet’ has been established in NSW to improve sharing of information about at-risk children between Child Wellbeing Units (CWUs), and to provide limited information about children and young people known to the child protection agency. There are CWUs in NSW Health, the NSW Police Force, the Department of Education and Training, and the Department of Human Services. Wellnet allows CWU officers to search for a child or young person to determine whether they are being case managed by the child protection agency or if other CWUs have received notification of concerns. The database also assists officers to better support vulnerable children and young people, allows cumulative risk to be recognised and reported, and records information about services required and/or provided to families, thereby assisting in the identification of service gaps.

30.165 As part of its ‘Every Child Matters’ program, the United Kingdom has established an online directory called ContactPoint, which contains basic information on every child in the nation and allows authorised practitioners in different services (including health, education, welfare and the police) to find out who else is working with the same child or young person. Its aim is to assist services to work together as a team and deliver more timely and coordinated support, and thus decrease service delivery duplication.^[190] Regulations outline what information can be held, who can (or must) provide the information, how long it can be retained, who can be granted access and how accuracy will be maintained.^[191] There are also ‘shielding’ provisions to hide the contact details of people who are at increased risk of significant harm, such as victims of family violence.

Consultation Paper

30.166 In the Consultation Paper, the Commissions sought feedback on whether privacy or secrecy laws were unduly impeding agencies from disclosing information which may be relevant to protection order proceedings or family law proceedings.^[192] The Commissions proposed that privacy principles at the federal, state and territory level should be amended, where necessary, to permit the use or disclosure of personal information where an agency reasonably believes it is necessary to lessen or prevent a serious threat to an individual’s life, health or safety—rather than a serious and imminent threat^[193]—as recommended by ALRC Report 108.^[194]

30.167 The Commissions also proposed that:

• state and territory family violence legislation should expressly authorise agencies to use or disclose information for the purpose of ensuring the safety of a victim of family violence or the wellbeing of an affected child;^[195] and

• state and territory child protection legislation should expressly authorise agencies to use or disclose information for the purpose of making accurate assessments of the needs of children and families and to ensure that appropriate programs are delivered in a timely and coordinated way.^[196]

30.168 The Commissions suggested a number of parties to whom information should be able to be disclosed under information sharing provisions.^[197] The Commissions also proposed the development of information sharing guidelines to assist agencies to understand their roles and responsibilities.^[198] Finally, the Commissions proposed the establishment of a shared database containing basic information about a child or family that authorised agencies could access to see which other agencies were dealing with a particular child or family.^[199]

Submissions and consultations

30.169 Stakeholders expressed support for amending privacy principles at federal, state and territory level to permit the use or disclosure of personal information where an agency reasonably believes it is necessary to lessen or prevent a serious threat to an individual’s life, health or safety.^[200]

30.170 There was general support for ensuring that family violence and child support legislation expressly allowed relevant agencies to exchange information, to keep children and families safe and to ensure timely and coordinated service provision.^[201] A number of stakeholders commented that careful consideration and consultation should occur in developing these provisions to ensure that they covered all necessary and relevant parties, in particular, non-government service providers such as family violence advocacy and support services;^[202] and independent children’s lawyers.^[203] A number of stakeholders commented that, in sharing information among government agencies and non-government service providers, it was important to ensure that the safety of victims and their families was not compromised by the inappropriate release of information.^[204]

30.171 The Sydney Women’s Domestic Violence Court Advocacy Service (WDVCAS) agreed, noting with approval s 18 of the ACT Domestic Violence Agencies Act, which allows police to share information with approved crisis support organisations where the police believe on reasonable grounds that a domestic violence offence has been, or is likely to be, committed. The information is shared to allow the organisations to provide assistance to the parties. WDVCAS also noted that the NSW Police Yellow Card Referral Program was a useful initiative that could be more widely used.^[205]

30.172 Guidelines were also seen as important to ensure that agencies understood their roles and responsibilities under information sharing laws.^[206]

30.173 The Office of the Privacy Commissioner expressed the view, however, that if privacy principles at the federal, state and territory level were amended as suggested above, this would allow agencies to share information in appropriate circumstances and that further provisions in state and territory legislation were unnecessary. The Office stated that:

Guidelines developed by the Office provide that a ‘serious’ threat must reflect significant danger, and could include a potentially life threatening situation or one that might reasonably result in other serious injury or illness. In the case of family violence involving controlling behaviour over a number of years, the degree of seriousness to allow disclosure of information may be considered to have been met where a series of incidents result in significant and demonstrable harm.

It should also be noted that threats to health under the exception are not limited to physical harm but would also include threats to an individual’s psychological wellbeing. The exception may therefore be relied on to disclose information where there is the threat of serious psychological harm that may be experienced as a result of ongoing domestic violence or fear for safety.^[207]

30.174 There was also support for shared child protection databases,^[208] although some stakeholders noted that the privacy concerns around such databases would need to be carefully managed.^[209] The Tasmanian Department of Premier and Cabinet stated that the development of a shared database in that jurisdiction was not a current priority.^[210]

Commissions’ views

30.175 As noted above, Time for Action identified privacy laws as one of the obstacles to an integrated and effective response to family violence. Many stakeholders consulted in this Inquiry agreed that they encounter difficulties sharing information because of actual or perceived limits imposed by privacy and secrecy laws.

30.176 Implementation of the model use and disclosure principle set out in ALRC Report 108 would address some of the issues identified. In particular, the Commissions recommend that Australian, state and territory governments ensure that the privacy principles applicable in each jurisdiction permit the use or disclosure of personal information where agencies and organisations reasonably believe it is necessary to lessen or prevent a serious threat to an individual’s life, health or safety. Given the high level of involvement of private sector service providers in the areas of family violence and child protection, this exception should apply to both government agencies and private sector organisations. The threat should not have to be imminent. Agencies and organisations should be able to share information in order to intervene early in family violence and child protection situations to prevent a serious threat from manifesting.

30.177 As noted above, in Secrecy Laws and Open Government in Australia (ALRC Report 112) the ALRC recommended that secrecy laws should generally include an exception for disclosures in the course of an officer’s functions or duties.^[211] The recommendations in ALRC Report 112 were limited to Commonwealth secrecy laws, because that was the extent of the terms of reference for that Inquiry. In the Commissions’ view, however, the principles underlying the ALRC’s recommendation that Commonwealth secrecy laws should include an express exception for disclosure in the course of an officer’s functions and duties establishes a principle of wider application.

30.178 If this approach were adopted by Australian, state and territory governments it would ensure that, where an officer disclosed information, for example, in accordance with the provisions of state and territory family violence or child protection legislation, or in accordance with an information sharing protocol or memorandum of understanding—discussed further below—the officer would not breach the relevant secrecy law. The Commissions therefore endorse the relevant recommendations in ALRC Report 112 in relation to Commonwealth secrecy laws,^[212] and recommend that state and territory governments consider amending secrecy laws that regulate the disclosure of government information to include an express exception to allow the disclosure of information in the course of an officer’s functions and duties.

30.179 The Commissions note the views of the Office of the Privacy Commissioner that the recommended amendment to the privacy principles to remove the ‘imminence’ requirement will be sufficient to ensure that information can be shared appropriately in the family violence and child protection contexts. The Commissions consider, however, that it would also assist those working in these areas to have an express provision allowing information to be shared to ensure the safety of victims of family violence, children and young people. In particular, the Commissions recommend in Chapter 20 that child protection legislation should authorise the disclosure to the police of the identity of a ‘reporter’ under the legislation in connection with the investigation of a serious offence alleged to have been committed against a child or young person; or where necessary to safeguard or promote the safety, welfare or wellbeing of a child or young person.^[213]

30.180 Where sensitive personal information is disclosed for a purpose other than the primary purpose of collection, this should generally be done on the basis of consent. As noted above, the NSW Police Yellow Card Referral Program is an example of this. It is also important for agencies and organisations to have a clear basis for sharing information in situations that do not necessarily involve a risk to safety, for example, in order to ensure timely and effective service delivery, or to ensure the wellbeing of a child, as opposed to the safety of a child.

30.181 Where seeking consent is not reasonable or practicable, legislative provisions should clearly indicate those agencies with which, and the specific circumstances in which, information can be shared, for example what information can be disclosed by the police to child protection agencies. Given the high level of involvement of private sector service providers in the areas of family violence and child protection, provision should also be made in legislation to allow information to be shared with specified private sector organisations in some circumstances. The Commissions note that the approach adopted in the ACT Domestic Violence Agencies Act—which allows police to share information with approved crisis support organisations in some circumstances—is one possible model.

30.182 Provisions such as this mean that information can be shared without breaching privacy laws, because the information sharing is ‘required or authorised by law’, and without breaching secrecy laws, where those laws include an exception for disclosure in the course of an officer’s functions or duties. The Commissions reiterate, however, that, as a general rule, information should only be used for the purpose it is collected or a related purpose that the individual would expect. Whenever reasonable and practicable, the person’s consent should be sought if the information is to be used or disclosed for a purpose other than the one for which it was collected, where the purpose is not related to the original purpose of collection and the person would not expect the information to be used or disclosed in this way.

30.183 The Commissions do not intend to specify the exact content of the information sharing provisions. Each jurisdiction will need to consider what information sharing arrangements are necessary and appropriate and, in particular, which private sector organisations should be included in the arrangements.

30.184 The Commissions note that databases in some jurisdictions facilitate the sharing of information between agencies working together, particularly in the area of child protection. Such databases provide a useful mechanism to help ensure that agencies are aware of the fact that other agencies are working with a particular child or family, and to prevent the duplication of services. It would be logical, for example, to establish a shared database where family violence or child protection legislation expressly provides for the disclosure of certain information from one agency to another, as discussed above. The Commissions note, however, that such databases raise significant privacy concerns. The Commissions recommend, therefore, that in developing any such databases federal, state and territory governments should ensure that appropriate privacy safeguards are put in place.

30.185 The Commissions’ recommendations set out below are intended to ensure that legislative provisions do not prevent the sharing of information in circumstances where there is a risk to an individual’s life, health or safety. In addition, the Commissions recommend that family violence and child protection legislation should clearly set out which agencies and organisations may use and disclose information and in what circumstances. This will provide clarity for individual officers and staff and will ensure that where information is shared it does not breach privacy or secrecy laws.