National Privacy Principles

64.30 The NPPs, unlike the IPPs, specifically provide for the use of health information in research. NPPs 2 and 10 provide that health information may be collected, used and disclosed where necessary for research or the compilation or analysis of statistics, relevant to public health or public safety where:

  • the purpose cannot be served by the collection of information that does not identify the individual;[32]

  • it is impracticable for the organisation to seek the individual’s consent to the collection, use or disclosure;[33]

  • the information is collected, used and disclosed in accordance with guidelines approved under s 95A;[34]

  • in the case of disclosure—the organisation reasonably believes that the recipient of the health information will not disclose the health information, or personal information derived from the health information;[35] and

  • the organisation takes reasonable steps to permanently de-identify the information before it discloses it.[36]

64.31 Section 95A of the Privacy Act provides a similar mechanism to s 95. The current Guidelines Approved under Section 95A of the Privacy Act 1988[37] (Section 95A Guidelines) were issued in 2001.

[32]Privacy Act 1988 (Cth) sch 3, NPP 10.3(b).

[33] Ibid sch 3, NPPs 2.1(d)(i), 10.3(c).

[34] Ibid sch 3, NPPs 2.1(d)(ii), 10.3(d).

[35] Ibid sch 3, NPP 2.1(d)(iii).

[36] Ibid sch 3, NPP 10.4.

[37] National Health and Medical Research Council, Guidelines Approved under Section 95A of the Privacy Act 1988 (2001).