17.08.2010
65.22 NPP 10.3 currently provides an exception for the collection of health information without consent where necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety. NPP 2.1(d) provides an exception for the use or disclosure of health information without consent where necessary for research, or the compilation or analysis of statistics, relevant to public health or public safety. Section 95 of the Privacy Act provides an exception from the IPPs for acts done by agencies ‘in the course of medical research’.
65.23 Despite the differences between the exceptions in the NPPs and the exception in relation to the IPPs, the general intention clearly is to limit the exceptions to the field of health and medical research. The OPC Review recommended that the Australian Government consider whether there was a need to permit the use and disclosure of personal information for research that does not involve health information.[25]
65.24 The Council of Europe Committee of Ministers has recognised that the public interest in a range of research areas—including, but not restricted to, health and medical research—may outweigh the public interest in maintaining privacy protections.
Any exception to that rule [that where sensitive personal information is collected for statistical purposes, it should be collected in non-identifiable form] can only be justified by major public interest, as where statistical information is needed to contain epidemics, combat the evil of drug taking, investigate the scale and pattern of sexual assaults on minors or develop aid to social groups in difficulty. Such examples, to which many more might be added, relate to matters which affect society’s essential interests and in which the state has responsibilities. In such cases the guarantees on protection of sensitive data must be adapted to the objective information needs arising from the public interest.[26]
65.25 Canadian privacy legislation allows private sector organisations to use or disclose personal information without consent where it is for ‘statistical, or scholarly study or research’.[27] Canadian privacy legislation also allows public sector agencies to disclose personal information to any person or body for ‘research or statistical purposes’ in specified circumstances.[28]
65.26 The Data Protection Act 1998 (UK) also allows data to be processed for ‘research purposes’—which includes statistical or historical purposes—so long as the data are not processed: to support measures or decisions with respect to particular individuals; or in such a way as to cause, or be likely to cause, substantial damage or substantial distress to the data subject. The results of the research are not to be made available in a way that would identify the data subjects.[29]
65.27 The Privacy Act 1993 (NZ) allows the use and disclosure of personal information for ‘statistical or research purposes’, so long as it is not published in a form that could reasonably be expected to identify the individuals concerned.[30]
65.28 The Information Privacy Act 2000 (Vic) allows state agencies to use and disclose personal information where necessary for ‘research, or the compilation or analysis of statistics, in the public interest’.[31] The Personal Information Protection Act 2004 (Tas) has a similar provision.[32]
65.29 The ALRC asked a number of questions in the Issues Paper, Review of Privacy (IP 31),[33] about expanding the existing research exceptions in the Privacy Act to include other types of personal information or other fields of research. In DP 72, the ALRC proposed that the Privacy Act should be amended to extend the existing arrangements relating to health and medical research to cover human research more generally.[34]
Submissions and consultations
65.30 The OPC expressed support for allowing the collection, use and disclosure of personal information—rather than just health information—for health and medical research, and for research relevant to public health or public safety. This was on the basis that such research may be advanced by the linking of health information with other forms of personal information. However, the OPC did not support expanding the existing arrangements to cover human research more generally.[35]
65.31 The OPC submitted that the public interest in health-related research was likely to be greater than the public interest in other social research. The OPC was also concerned that the proposed extension would lead to the use of personal information for research ‘in areas that may be unforeseen, unexpected and potentially undesirable’.[36] The Australian Privacy Foundation would support the proposed extension only on the basis that the public interest test, discussed below, was maintained in its current form.[37]
65.32 Where the public interest in a particular research proposal outside the health and medical field was likely to outweigh the public interest in maintaining the level of protection provided by the privacy principles, the OPC suggested that a PID should be sought in relation to the proposal.[38] To date, two such PIDs have been granted by the Privacy Commissioner:
PID 5—Disclosure of personal information contained in homicide files in the ACT to the Australian Institute of Criminology (AIC) for research purposes;[39] and
PID 8—Disclosure of personal information contained in certain Commonwealth Director of Public Prosecution files that relate to serious incidences of fraud, dishonesty and deception to the AIC for research purposes.[40]
65.33 The AIC submitted that a great deal of criminological research requires access to personal information collected by police, courts, correctional agencies, regulatory bodies and health service providers in the course of their duties. Because consent to use and disclose this information for research purposes is not built into the collection of the information, it is difficult to conduct research using the information within the existing provisions of the Privacy Act. The AIC highlighted the delay and resources involved in applying for a PID, and expressed support for extending the regime in the Privacy Act to allow such research to proceed without the need to seek a PID.[41] On the issue of public interest, the AIC stated:
Criminological research does have a profound impact on individuals and the community … Research into practices and programs can … reduce the likelihood of re-offending with consequent reductions in the number of victims of crime … Much of the research undertaken by the AIC is of this nature and has the potential through its contribution to evidence-led policy, to reduce crime and crime-related harms resulting in significant positive outcomes for the community.[42]
65.34 Other agencies and organisations also expressed support for expanding the research exceptions to cover research other than health and medical research. National Legal Aid noted that it holds significant amounts of personal information that is in demand for social and legal research. It stated that:
We believe that ethically informed and regulated research has an essential role to play in addressing issues of disadvantage, and promoting informed policy on criminal law enforcement. However it is important to reconcile the sometimes competing priorities of researchers and research subjects in a way that does not sacrifice one to the other or undermine the autonomy and dignity of the most disadvantaged groups.[43]
65.35 The Australian Bureau of Statistics (ABS) noted that:
More generally, through its work on health and social statistics, the ABS is aware that the community expects its information to be used effectively both at the point of service provision for the individual, and also in research for the public good. In balancing privacy against public benefit of research, there is a need to recognise this broad, but not necessarily vocal, community support for using information to achieve better social outcomes.[44]
65.36 The CSIRO noted that it can be difficult to draw a clear line between ‘health’ and ‘non-health’ information and ‘health’ and ‘social sciences’ research. It stated that researchers are increasingly seeking to integrate health and non-health personal information in order to answer complex research questions. For example, it noted that health and educational experiences—in combination rather than separately—are fundamental to outcomes for children and youth.
We believe that extending the federal privacy principles to allow agencies and organisations to collect non-health related sensitive information for purposes including research and statistics is highly desirable. This is because researchers are seeking to address increasingly complex questions involving health and lifestyle information, for example to determine how environmental factors influence genetic predisposition to disease.[45]
65.37 The Western Australian Department of Health agreed about the difficulties involved in distinguishing health and medical research from other research, and noted that social indicators are increasingly being used to understand health outcomes.[46] The Australian Federal Police (AFP) noted the importance of research in the criminal justice field, and pointed to PID 5 as an example of this.[47]
65.38 The Government of South Australia expressed support for expanding the arrangements to include social science research, as well as criminological research.
Social science research on key social issues is of critical importance to the community. There is a growing recognition of the importance of evidence-based practice in the social services and the use of research and evaluation in improving policy and service planning. Robust research, based on quality data, is required to provide the necessary evidence and directions for dealing with significant social issues, such as child abuse, family violence or homelessness. Data held by government and NGOs can contribute to better understanding of such issues and the development of effective solutions. Whilst obtaining individuals’ consent would be desirable it is often not possible, particularly from those clients who are highly transient and harder to engage, are in a non-voluntary relationship (for example, child protection) or in the case of large-scale studies (such as population-based data matching).[48]
65.39 There was strong support among other key stakeholders—including the NHMRC, the Australian Research Council, DOHA, the Commonwealth Ombudsman and a number of Australian Universities—for expanding the Privacy Act arrangements to include other fields of research so long as safeguards, similar to those currently in place in relation to health and medical research, were applied.[49] While expressing support for expanding the arrangements to include human research more generally, a few noted the additional burden this was likely to place on HRECs.[50]
ALRC’s view
65.40 There is no in-principle reason to limit the arrangements for research under the Privacy Act to health and medical research. The ALRC notes that the research exceptions in other jurisdictions, such as the United Kingdom, Canada and New Zealand, are expressed in broad terms. Other areas of research, such as sociology and criminology, have a strong public interest basis because of their potential to lead to evidence-based policy development and significant positive outcomes for the community. The Privacy Act should not be impede such research. Further, the ALRC recognises that research increasingly involves multi-disciplinary approaches, that non-health information is often crucial to health and medical research and that, in any event, it is sometimes difficult to define what amounts to health and medical research and what does not.
65.41 The ALRC notes that the National Statement and its oversight mechanisms, such as review by HRECs, apply to all human research—that is, research ‘conducted with or about people, or their data or tissue’. The existing regime in relation to health and medical research under the Privacy Act relies to a certain extent on the safeguards provided by the National Statement and, in particular, on review of research proposals by HRECs. Those safeguards can be applied to research more generally. The ALRC recommends below that any research that proposes to use personal information in a way that is inconsistent with the model UPPs should be subject to HREC review.[51] In order for such research to proceed, an HREC will have to be satisfied that the public interest in the research outweighs the public interest in maintaining the level of privacy protection provided by the UPPs.
65.42 In addition, the Privacy Act can, and should, include a range of limits and safeguards, discussed below, to ensure that personal information is used without consent for research purposes only in appropriate circumstances, for example:
where the research cannot be undertaken using personal information that does not identify individuals;
it is unreasonable or impracticable to seek individuals’ consent to the collection, use or disclosure of their information; and
the research is conducted in accordance with rules issued by the Privacy Commissioner.
65.43 The ALRC recommends, therefore, that the Privacy Act be amended to extend the arrangements relating to the collection, use and disclosure of personal or health information in health and medical research to include the collection, use and disclosure of personal information in human research more generally.
Recommendation 65-2 The Privacy Act should be amended to extend the arrangements relating to the collection, use or disclosure of personal information without consent in the area of health and medical research to cover the collection, use or disclosure of personal information without consent in human research more generally.
[25] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), rec 60.
[26] Council of Europe—Committee of Ministers, Explanatory Memorandum to Recommendation No R(97)18 of the Committee of Ministers to Member States Concerning the Protection of Personal Data Collected and Processed for Statistical Purposes (1997), [85(b)].
[27]Personal Information Protection and Electronic Documents Act 2000 SC 2000, c 5 (Canada) ss 7(2)(c); 7(3)(f).
[28]Privacy Act RS 1985, c P-21 (Canada) s 8(j).
[29]Data Protection Act 1998 (UK) s 33.
[30]Privacy Act 1993 (NZ) s 6.
[31]Information Privacy Act 2000 (Vic) sch 1, IPP 2(c).
[32]Personal Information Protection Act 2004 (Tas) sch 1, PIPP 2(c).
[33] Australian Law Reform Commission, Review of Privacy, IP 31 (2006), Questions 4–13, 4–32, 8–26.
[34] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 58–2.
[35] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.
[36] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.
[37] Australian Privacy Foundation, Submission PR 553, 2 January 2008.
[38] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.
[39] Privacy Commissioner, Public Interest Determination 5, effective 14 December 1991.
[40] Privacy Commissioner, Public Interest Determination 8, effective 26 August 2002.
[41] Australian Institute of Criminology, Submission PR 461, 12 December 2007. For example, the application for PID 8 was lodged on 7 January 2002, signed by the Privacy Commissioner on 22 March 2002 and tabled in Parliament on 26 August 2002.
[42] Ibid.
[43] National Legal Aid, Submission PR 521, 21 December 2007.
[44] Australian Bureau of Statistics, Submission PR 96, 15 January 2007.
[45] CSIRO, Submission PR 176, 6 February 2007.
[46] Department of Health Western Australia, Submission PR 139, 23 January 2006.
[47] Australian Federal Police, Submission PR 186, 9 February 2007.
[48] Government of South Australia, Submission PR 187, 12 February 2007.
[49] Government of South Australia, Submission PR 565, 29 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; National Prescribing Service, Submission PR 547, 24 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Federation of Community Legal Centres (Vic), Submission PR 509, 21 December 2007; Australasian Compliance Institute, Submission PR 419, 7 December 2007; University of Western Sydney Human Research Ethics Committee, Submission PR 418, 7 December 2007; University of Newcastle, Submission PR 413, 7 December 2007; Australian Government Department of Health and Ageing, Submission PR 273, 30 March 2007; Australian Bankers’ Association Inc, Submission PR 259, 19 March 2007; Commonwealth Ombudsman, Submission PR 202, 21 February 2007; Government of South Australia, Submission PR 187, 12 February 2007; CSIRO, Submission PR 176, 6 February 2007; Queensland Council for Civil Liberties, Submission PR 150, 29 January 2007; AAMI, Submission PR 147, 29 January 2007; Confidential, Submission PR 143, 24 January 2007; Centre for Law and Genetics, Submission PR 127, 16 January 2007; Insolvency and Trustee Service Australia, Submission PR 123, 15 January 2007; National Health and Medical Research Council, Submission PR 114, 15 January 2007; Australian Research Council, Consultation PC 181, Canberra, 22 October 2007.
[50] Office of the Health Services Commissioner (Victoria), Submission PR 518, 21 December 2007; University of Western Sydney Human Research Ethics Committee, Submission PR 418, 7 December 2007; National Health and Medical Research Council, Submission PR 397, 7 December 2007.
[51] Recs 65–8, 65–9.