The public interest balance

65.59 In the second reading speech for the Privacy Amendment (Private Sector) Bill 2000 (Cth), the then Attorney-General, the Hon Daryl Williams AM QC MP, stated that:

The balance between the interests of privacy and the need to facilitate medical research was an issue that the Privacy Commissioner and the government looked at closely. The bill provides that, where information is collected for research purposes, it must be collected with consent or, where this is not practicable, in accordance with strict safeguards set out in the bill. In addition, researchers must take reasonable steps to de-identify personal information before the results of research can be disclosed.[71]

65.60 The Privacy Act requires the Privacy Commissioner to be satisfied before approving guidelines under ss 95 or 95A, that the public interest in the relevant research outweighs to a substantial degree the public interest in maintaining the level of privacy protection provided by the IPPs and NPPs.

65.61 The Section 95 and 95A Guidelines include a similar public interest test. Where research may breach the IPPs or NPPs, the Guidelines provide that the research must be approved by an HREC. Before approving a particular research proposal under the Guidelines, HRECs are required to consider whether the public interest in the research substantially outweighs the public interest in the protection of privacy.[72] In considering the public interest balance, HRECs are required to consider certain specified matters including:

  • the value and public importance of the research;

  • the likely benefits to the participants;

  • whether the research design can be modified;

  • the financial costs of not proceeding with the research;

  • the type of personal information being sought;

  • the risk of harm to individuals; and

  • the extent of a possible breach of privacy.

65.62 A number of stakeholders making submissions to the OPC Review argued that the Privacy Act and the Section 95 and 95A Guidelines fail to achieve an appropriate public interest balance. In his submission—the text of an address to the Australian Epidemiological Association—Dr Richie Gun of the Department of Public Health, University of Adelaide, discussed the particular difficulties faced by epidemiologists, and the problems he has faced in gaining access to data in cancer registries.

In Australia we are now in a uniquely advantageous position to carry out such research, as we have mandatory registration of cancers in every State and Territory. We therefore have almost complete enumeration of all invasive cancers occurring in Australia, with the potential to carry out epidemiological studies on cancer incidence equal to or better than anywhere else in the world. Unfortunately privacy laws are impeding access to cancer registry data, so that it is becoming increasingly hard to carry out the linkage of cancer registrations with exposure data.[73]

65.63 The OPC Review stated that:

There is considerable evidence that key researchers, especially epidemiological researchers, consider that the current balance between privacy and the public benefit of research is too heavily weighted in favour of individual privacy to the detriment of research. By gaining access to population data and data linkage, the research might considerably benefit disadvantaged groups that are currently under researched.[74]

65.64 The OPC Review went on to recommend that:

As part of a broader inquiry into the Privacy Act … the Australian Government should consider … where the balance lies between the public interest in comprehensive research that provides overall benefits to the community, and the public interest in protecting individuals’ privacy (including individuals having choices about the use of their information for such research purposes).[75]

65.65 In DP 72, the ALRC considered two situations in which the public interest currently must be weighed in relation to research—that is, where the Privacy Commissioner is approving research guidelines, and where HRECs are approving research proposals. The ALRC proposed that the Privacy Commissioner take primary responsibility for developing and issuing the Research Rules under the research exceptions to the UPPs.[76] The ALRC did not consider it necessary that the Privacy Commissioner should be required expressly to consider the public interest in developing these rules. In exercising his or her powers under the Privacy Act, the Commissioner is currently required to have regard to the matters set out in s 29, which include the balance of public and private interests.

65.66 In this Report, the ALRC recommends that the Privacy Act be amended to require the Commissioner, in exercising his or her powers, to have regard to the matters set out in the objects clause.[77] That clause, discussed in Chapter 5, expressly recognises that the right to privacy is not absolute and that the Privacy Act provides a framework within which to balance the public interest in protecting the privacy of individuals with other public interests. The Privacy Commissioner would be required to take these matters into account when developing the Research Rules.

65.67 In DP 72, the ALRC also proposed that, where an HREC was of the view that the public interest in a particular research proposal going forward outweighed the public interest in maintaining the level of privacy protection provided by the model UPPs, the research should be allowed to proceed. The ALRC noted that the public interest in protecting the right to privacy must be considered in the context of other rights and other public interests. The ALRC suggested that it is not the degree to which one public interest outweighs another—whether slightly or substantially—that should be at issue. Rather, the ALRC proposed that the test to be applied by HRECs should be whether the public interest in a particular research activity ‘outweighs’—rather than ‘substantially outweighs’—the public interest in maintaining the level of privacy protection provided by the UPPs.[78]

Submissions and consultations

65.68 The OPC submitted that the current public interest test was appropriate—that is, where research proposes to use identifiable personal information without consent, the public interest in the research must ‘substantially outweigh’ the public interest in the protection of privacy.[79] The OPC noted that, in general,

individuals expect to be given the opportunity to consent to the handling of their health information for research purposes. The section 95 and 95A mechanisms provide a way of ensuring that important health and medical research can be undertaken in circumstances where the community’s expectations around consent cannot be met. The mechanisms provide a sound framework of accountability and oversight of the handling of health information without consent.[80]

65.69 The OPC also noted that

privacy safeguards are necessary for research to remain effective. If individuals do not feel that their personal information is going to be appropriately protected, they may avoid treatment, or may supply partial or inaccurate information to the detriment of their clinical well-being and the ultimate quality of any research which may utilise their health information.[81]

65.70 DOHA submitted that:

The Department considers that the appropriate test for an HREC, considering a research proposal, is that the Committee must be satisfied that the public interest in the proposed activity ‘substantially outweighs’ the public interest in the protection of privacy … Health information collected in the delivery of healthcare services is subject to a legal duty of confidence. In order to comply with this duty, express consent would normally be required before health information was disclosed for research purposes. It would not appear sufficient to discharge this duty by ‘finely’ balancing the public interests. The balance should be ‘clearly’ in favour of the research.[82]

65.71 A number of other stakeholders also expressed support for maintaining the current public interest test.[83] Professor Thomson expressed the view that the ‘substantially outweighs’ test requires an unequivocal choice to be made and that this may add clarity to the decision-making process for HRECs.[84]

65.72 On the other hand, there was significant support for modifying the test to allow research to proceed where the public interest in the research outweighs the public interest in maintaining the level of privacy protection provided by the UPPs.[85] Support came from a diverse range of stakeholders including the Government of South Australia, PIAC, Medicare Australia, Privacy NSW, the AIC, the University of Western Sydney HREC, the NHMRC and the Australian Research Council.

65.73 The Office of the Health Services Commissioner in Victoria stated that the ‘current definition with the use of the words “substantially outweighs” has lead to ethics committees taking an overly conservative approach’, and suggested that the approach adopted in the draft National Health Privacy Code would be more appropriate.[86] NHPP 1 of the draft Code provides that research must be in the public interest in order for it to proceed, but that it must proceed in accordance with rules issued for the purpose.

65.74 The NHMRC was very clearly of the view that

the current requirement in the Privacy Act and the Section 95 and Section 95A Guidelines that the public interest in research ‘substantially outweighs’ or ‘outweighs to a substantial degree’ the public interest in maintaining the level of privacy protection provided by the IPPs and NPPs is unbalanced and is limiting the conduct of important health and medical research …

In undertaking an assessment for the purposes of determining the balance of public interests, an HREC routinely assesses a range of issues, which are detailed in [IP 31]. This assessment provides a robust framework and in our view protects the reasonable interests of individuals. It is clear that an assessment would not favour research that has the potential to cause significant harm to individuals.

We consider that a more appropriate and effective test that would accord with community sentiment would simply be that the balance of public interests favours the research proceeding.[87]

65.75 The Alfred Hospital Ethics Committee commented that any changes to the privacy rules governing research should aim to clarify and refine the public interest test. The Committee was generally supportive of the ALRC’s proposed approach in this area, including the removal of the term ‘substantially’ from the public interest test. The Committee found the term confusing and believed it led to inconsistent decision making.[88]

65.76 Professor Thomson noted that there was evidence that HRECs were not unduly constrained by the ‘substantially outweighs’ test. He quoted a 2004 NHMRC report which indicated that, of 60 medical research proposals considered under the Section 95 Guidelines, 58 were approved, and of 70 proposals considered under the Section 95A Guidelines, 64 were approved.[89]

65.77 The OPC suggested that, even if the current provisions were leading to overly conservative decision making by HRECs, an appropriate response would be greater education and training of HRECs. In addition, the OPC considered that

harmonising the existing provisions would also likely assist in simplifying HRECs decision making. Reducing any uncertainty about legal requirements may give HRECs greater confidence in applying the legal test. Conversely, a lack of certainty may promote a risk averse and conservative approach to decision making.[90]

ALRC’s view

65.78 The ALRC agrees with the OPC that harmonising elements of the current regime regulating the use of personal information in the research context should assist HRECs’ decision making. These issues are addressed by other recommendations in this Report, including the recommendations in Chapter 3, aimed at national consistency, and Recommendation 18–2 on the establishment of a single set of UPPs.

65.79 In considering the public interest test itself, it is important to keep in mind the other limits and safeguards that apply to research using personal information without consent under the Privacy Act. The existing provisions of the Act allow such research to proceed only on the basis that the research cannot be undertaken with information that does not identify individuals; it is impracticable to seek consent from those individuals; and the research is conducted in accordance with the Section 95 or 95A Guidelines. The recommendations in this Report would allow such research to proceed only where the research cannot be undertaken with information that does not identify the individual; it is unreasonable or impracticable for the agency or organisation to seek the individual’s consent; and the information is collected, used and disclosed in accordance with rules issued by the Privacy Commissioner.

65.80 The Section 95 and 95A Guidelines also require HRECs to consider: whether access to the information is restricted to appropriate personnel involved in the research; the procedures in place to ensure that personal information is permanently de-identified before the publication of results; and the procedures in place to ensure the security of the information and when it will be destroyed or returned to the original data custodian.[91] The ALRC anticipates that similar safeguards will be included in the Research Rules to be issued by the Privacy Commissioner.

65.81 The ALRC has carefully considered the divergent views on this important issue expressed in submissions and consultations. Chapter 1 examines the right to privacy in some detail and notes that the right is not absolute. The public interest in protecting this private right must be considered in the context of other rights and other public interests. In the ALRC’s view, it is not the degree to which one public interest outweighs another—whether slightly or substantially—that should be at issue. If, taking all relevant factors into account, the public interest in one course of action outweighs the public interest in another course of action, the appropriate course of action is clear. In particular—in the research environment where a range of other safeguards are in place—if the public interest in a particular research proposal going forward outweighs the public interest in maintaining the level of privacy protection provided by the privacy principles, then the research should be allowed to proceed.

65.82 The ALRC has recommended above that the areas of research and the kinds of personal information available to researchers should be broadened. The public interest test should be the same for all human research.

65.83 Recommendations 65–8 and 65–9, below, set out research exceptions to the ‘Collection’ and ‘Use and Disclosure’ principles. These exceptions require an HREC to review research that proposes to collect sensitive information without consent, or to use or disclose personal information without consent, and be satisfied that the public interest in the research activity outweighs the public interest in maintaining the level of privacy protection provided by Privacy Act. The Section 95 and 95A Guidelines include guidance for HRECs in considering the balance of public interests. It would be appropriate for the National Statement to include guidance for HRECs on this matter. The content of the rules to be issued by the Privacy Commissioner under the research exceptions, although not directed at HRECs, will also be of assistance.

Recommendation 65-4 The research exceptions to the ‘Collection’ principle and the ‘Use and Disclosure’ principle should provide that, before approving an activity that involves the collection, use or disclosure of sensitive information or the use or disclosure of other personal information without consent, Human Research Ethics Committees must be satisfied that the public interest in the activity outweighs the public interest in maintaining the level of privacy protection provided by the Privacy Act.

[71] Commonwealth, Parliamentary Debates, House of Representatives, 12 April 2000, 15749 (D Williams—Attorney-General).

[72] National Health and Medical Research Council, Guidelines under Section 95 of the Privacy Act 1988 (2000), Guideline 3.2; National Health and Medical Research Council, Guidelines Approved under Section 95A of the Privacy Act 1988 (2001), Guideline D.4.

[73] University of Adelaide, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 21 December 2004.

[74] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 210.

[75] Ibid, rec 60.

[76] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 58–1.

[77] Rec 46–3.

[78] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 58–4.

[79] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[80] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[81] Ibid.

[82] Australian Government Department of Health and Ageing, Submission PR 273, 30 March 2007.

[83] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Australian Nursing Federation, Submission PR 205, 22 February 2007; Department of Health Western Australia, Submission PR 139, 23 January 2006.

[84] C Thomson, Submission PR 454, 7 December 2007.

[85] Government of South Australia, Submission PR 565, 29 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; National Prescribing Service, Submission PR 547, 24 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Office of the Health Services Commissioner (Victoria), Submission PR 518, 21 December 2007; Australasian Epidemiological Association, Submission PR 473, 14 December 2007; Privacy NSW, Submission PR 468, 14 December 2007; Australian Institute of Criminology, Submission PR 461, 12 December 2007; University of Western Sydney Human Research Ethics Committee, Submission PR 418, 7 December 2007; National Health and Medical Research Council, Submission PR 397, 7 December 2007; Australian Research Council, Consultation PC 181, Canberra, 22 October 2007; Australian Government Department of Human Services, Submission PR 136, 19 January 2007; Centre for Law and Genetics, Submission PR 127, 16 January 2007; Queensland Institute of Medical Research, Submission PR 80, 11 January 2006.

[86] Office of the Health Services Commissioner (Victoria), Submission PR 153, 30 January 2007.

[87] National Health and Medical Research Council, Submission PR 114, 15 January 2007.

[88]General Ethical Issues Sub-Committee—Alfred Hospital Ethics Committee, Submission PR 531, 21 December 2007.

[89] C Thomson, Submission PR 454, 7 December 2007; National Health and Medical Research Council, Report of the 2002–03 HREC Annual Report Process (2004).

[90] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[91] National Health and Medical Research Council, Guidelines under Section 95 of the Privacy Act 1988 (2000), 3.3; National Health and Medical Research Council, Guidelines Approved under Section 95A of the Privacy Act 1988 (2001), D.5.