17.08.2010
67. Children, Young People and Attitudes to Privacy
Recommendation 67–1 The Australian Government should fund a longitudinal study of the attitudes of Australians, in particular young Australians, to privacy.
Recommendation 67–2 The Office of the Privacy Commissioner should develop and publish educational material about privacy issues aimed at children and young people.
Recommendation 67–3 The Office of the Privacy Commissioner, in consultation with the Australian Communications and Media Authority, should ensure that specific guidance on the privacy aspects of using social networking websites is developed and incorporated into publicly available educational material.
Recommendation 67–4 In order to promote awareness of personal privacy and respect for the privacy of others, state and territory education departments should incorporate education about privacy, including privacy in the online environment, into school curriculums.
68. Decision Making by and for Individuals Under the Age of 18
Recommendation 68–1 The Privacy Act should be amended to provide that where it is reasonable and practicable to make an assessment about the capacity of an individual under the age of 18 to give consent, make a request or exercise a right of access under the Act, an assessment about the individual’s capacity should be undertaken. Where an assessment of capacity is not reasonable or practicable, then an individual:
(a) aged 15 or over is presumed to be capable of giving consent, making a request or exercising a right of access; and
(b) under the age of 15 is presumed to be incapable of giving consent, making a request or exercising a right of access.
Recommendation 68–2 The Privacy Act should be amended to provide that where an individual under the age of 18 is assessed or presumed to not have capacity under the Act, any consent, request or exercise of a right in relation to that individual must be provided or made by a person with parental responsibility for the individual.
Recommendation 68–3 The Privacy Act should be amended to provide that, in order to rely on the age-based presumption, an agency or organisation is required to take such steps, if any, as are reasonable in the circumstances to verify that the individual is aged 15 or over.
Recommendation 68–4 The Office of the Privacy Commissioner should develop and publish guidance for applying the new provisions of the Privacy Act relating to individuals under the age of 18, including on:
(a) the involvement of children, young people and persons with parental responsibility in decision-making processes;
(b) situations in which it is reasonable and practicable to make an assessment regarding capacity of children and young people;
(c) practices and criteria to be used in determining whether a child or young person is capable of giving consent, making a request or exercising a right on his or her own behalf, including reasonable steps required to verify the age of an individual;
(d) the provision of reasonable assistance to children and young people to understand and communicate decisions; and
(e) the requirements to obtain consent from a person with parental responsibility for the child or young person in appropriate circumstances.
Recommendation 68–5 Agencies and organisations that regularly handle the personal information of individuals under the age of 18 should address in their Privacy Policies how such information is managed and how the agency or organisation will determine the capacity of individuals under the age of 18.
Recommendation 68–6 Agencies and organisations that regularly handle the personal information of individuals under the age of 18 should ensure that relevant staff receive training about issues concerning capacity, including when it is necessary to deal with third parties on behalf of those individuals.
69. Particular Privacy Issues Affecting Children and Young People
Recommendation 69–1 Schools subject to the Privacy Act should clarify in their Privacy Policies how the personal information of students will be handled, including when personal information:
(a) will be disclosed to, or withheld from, persons with parental responsibility and other representatives; and
(b) collected by school counsellors will be disclosed to school management, persons with parental responsibility, or others.
Recommendation 69–2 The Ministerial Council on Education, Employment, Training and Youth Affairs should consider the handling of personal information in schools, with a view to developing uniform policies across the states and territories consistent with the Privacy Act.
70. Third Party Representatives
Recommendation 70–1 The Privacy Act should be amended to include the concept of a ‘nominee’ and provide that an agency or organisation may establish nominee arrangements. The agency or organisation should then deal with an individual’s nominee as if the nominee were the individual.
Recommendation 70–2 The Privacy Act shouldbe amended to provide for nominee arrangements, which should include, at a minimum, the following elements:
(a) a nomination can be made by an individual or a substitute decision maker authorised by a federal, state or territory law;
(b) the nominee can be an individual or an entity;
(c) the nominee has a duty to act at all times in the best interests of the individual; and
(d) the nomination can be revoked by the individual, the nominee or the agency or organisation.
Recommendation 70–3 The Office of the Privacy Commissioner should develop and publish guidance for dealing with third party representatives, including in relation to:
(a) the involvement of third parties, with the consent of an individual, to assist the individual to make and communicate privacy decisions;
(b) establishing and administering nominee arrangements;
(c) identifying and dealing with issues concerning capacity; and
(d) recognising and verifying the authority of substitute decision makers authorised by a federal, state or territory law.
Recommendation 70–4 Agencies and organisations that regularly handle personal information about adults with limited or no capacity to provide consent, make a request or exercise a right under the Privacy Act,should ensure that relevant staff are trained adequately in relation to issues concerning capacity, and in recognising and verifying the authority of third party representatives.