Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Draft Privacy (Persons Reported as Missing) Rules 2014 consultation paper

pdfPrintable version242.02 KB

The Office of the Australian Information Commissioner (OAIC) is seeking comment on the draft Privacy (Persons Reported as Missing) Rules 2014.

The Rules apply for the purposes of item 3 of the table in s 16A(1) of the Privacy Act, and relate to the collection of sensitive information, and the use and disclosure by an APP entity of the personal information(including sensitive information) of a person reported as missing.

Background

The Privacy Amendment (Enhancing Privacy Protections) Act 2012 (Privacy Amendment Act) introduces a number of reforms to the Privacy Act 1988 (Privacy Act), which will commence on 12 March 2014. The Privacy Amendment Act introduces the Australian Privacy Principles (APPs), which will apply to both agencies and organisations (referred to as APP entities) and replace the National Privacy Principles and Information Privacy Principles which previously applied. The APPs outline the obligations of APP entities with regards to the handling of personal information.

Section 16A of the amended Privacy Act outlines seven permitted general situations (PGS). The existence of a PGS provides an exception to the general prohibition in the APPs against an APP entity collecting sensitive information about an individual (APP 3.4(b)), and the use and disclosure of personal information for a secondary purpose (APP 6.2(c)).[1]

Item 3 of the table of PGS at s 16A states:

An APP entity is permitted to collect, use or disclose personal information if:

  1. the entity reasonably believes that the collection, use or disclosure is reasonably necessary to assist any APP entity, body or person to locate a person who has been reported as missing; and
  2. the collection, use or disclosure complies with the rules made under subsection (2).

Subsection 16A(2) states:

The Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).

Draft Privacy (Persons Reported as Missing) Rules 2014

The draft Privacy (Persons Reported as Missing) Rules 2014 (the Rules) have been drafted for the purposes of the PGS in item 3. They have been drafted to take account of the matters outlined in the Explanatory Memorandum (EM) to the Privacy Amendment Act,[2] and the feedback that the OAIC received during preliminary consultation.

The draft Rules limit the scope of the PGS in item 3 of the table in s 16A(1), including in the following ways:[3]

  • an APP entity must only collect sensitive information if it is a locating body as defined in the Rules
  • the sensitive information that is collected by the locating body must be limited to the extent reasonably necessary to make contact with, or offer ‘proof of life’ of, the person reported as missing
  • an APP entity must only use or disclose the personal information of a person reported as missing in response to requests from a locating body
  • an APP entity must only use or disclose the personal information of a person reported as missing under the Rules where it is unreasonable or impracticable to obtain the individual’s consent (APP 6.2(a) also permits the APP entity to use or disclose the personal information with the individual’s consent)
  • where it is unreasonable or impracticable to obtain the consent of a person reported as missing, the use or disclosure of their personal information must not be contrary to any wish expressed by the person reported as missing of which the APP entity is aware, or could reasonably be expected to be aware
  • the personal information that is used or disclosed must be limited to the extent reasonably necessary to make contact with, or offer ‘proof of life’ of, the person reported as missing, and
  • an APP entity must not collect sensitive information, or use or disclose personal information if the APP entity reasonably believes that the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual.

Locating bodies

The entities listed as ‘locating bodies’ in the Rules are the key entities involved in locating persons reported as missing in Australia, or Australians missing overseas. Inclusion on the list of locating bodies is not an endorsement of the information handling practices or searching processes undertaken by these bodies. Broadly speaking, these listed locating bodies have the following characteristics in common:

  • Have acceptance as an authority for investigating or searching for persons reported as missing by the community of locating bodies and support groups for family and friends of missing persons.
  • Investigate or search for a person reported as missing triggered by a concern for their safety and wellbeing, or for the purpose of reuniting families.
  • Their information handling practices require that the locating body does not disclose information about an individual’s whereabouts to an individual or entity other than the person reported as missing, without the consent of the person reported as missing.

A locating body that is an APP entity will also need to comply with the APPs in relation to the handling of any personal information it collects under the permitted general situation in item 3 of the table in s 16A(1).

Consent

The Rules emphasise the importance of an individual’s control over their own personal information and their consent to its collection, use and disclosure. A person reported as missing may have exercised their free choice to disassociate themselves from friends and family for legitimate reasons, including removing themselves from harmful environments.

Nonetheless, the Rules recognise that, where a person is missing, it may not be reasonable or practicable for an APP entity to obtain their consent to a proposed use or disclosure of their personal information.

The Rules therefore limit the permitted general situation under item 3 of the table in s 16A(1) to circumstances in which:

  • it is not reasonable or practicable to seek the consent of the person reported as missing to the collection, use or disclosure of their personal information, and
  • the use or disclosure is not contrary to any known wishes of that individual.

Other issues to note

The draft Rules do not fetter any existing law or discretion an APP entity has not to collect, use or disclose personal information about persons reported as missing, including the provisions in Part VIA of the Privacy Act relating to the handling of personal information in emergencies and disasters, and secrecy or confidentiality provisions which may prohibit the use or disclosure of particular personal information.

The Rules make clear that an APP entity is permitted, but is not required, to collect, use or disclose personal information to assist in locating a person reported as missing.

The permitted general situation referred to in item 3 of the table in s 16A(1) and the Rules made for the purpose of item 3 may only be relied on to locate the person reported as missing. The permitted general situation/Rules do not permit sensitive information to be collected, or personal information to be used or disclosed after the person reported as missing has been found. An APP entity would need to rely on another exception to APP 3 or APP 6, such as obtaining consent, to collect, use or disclose personal information about an individual who has been located.

Guidance about the operation of the Rules

The Office of the Australian Information Commissioner will issue a Guide to the Rules which will outline how the Information Commissioner will interpret and apply the Rules when exercising functions and powers under the Privacy Act relating to the Australian Privacy Principles (APPs).

The Guide will be issued in early 2014, and will contain guidance about:

  • the scope of the Rules
  • key concepts used in the Rules, such as ‘locating body’, ‘person reported as missing’, ‘reasonably believes’, ‘reasonably necessary’ and ‘serious threat to the life, health or safety of any individual’
  • the type of personal information that may be collected, used or disclosed under the Rules, including factors to consider when determining whether personal information is reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing, and examples
  • factors that an APP entity should consider when determining whether it is ‘unreasonable or impracticable to obtain the individual’s consent’, including examples
  • when an entity will be aware, or reasonably be expected to be aware, of a wish of the person reported as missing not to use or disclose their personal information for this purpose, including examples
  • guidance for locating bodies that request personal information, including advice that a locating body could endeavour to make requests in a way that meets the needs of the APP entity to which a request is made, and consider discussing the requirements of an APP entity to which the locating body regularly makes requests
  • guidance for APP entities that receive a request, including advice that an APP entity that anticipates receiving a large number of requests could consider setting up processes to streamline the processing of requests, and discussing with locating bodies any needs they have in relation to the form in which requests should be made and the timelines that the locating body is working to.

Stimulus questions for public consultation

The OAIC has prepared the questions below to stimulate comments on the draft Rules. They are not intended to confine the issues that may be raised. You may wish to respond to some or all questions, or to raise other issues related to the Rules.

  1. Do the Rules clearly outline the circumstances in which an APP entity is permitted to collect sensitive information, and use or disclose personal information in accordance with the Permitted General Situation in item 3 of the table at s 16A of the Privacy Act?
  2. Do you consider that the Rules succeed in achieving a balance between assisting entities to handle personal information in a way that facilitates the location of persons who have been reported as missing, and the privacy interests of the missing individual?
  3. Do you consider that there will be any unintended consequences in the scope and operation of the Rules?

Draft Privacy (Persons Reported as Missing) Rules 2014

Footnotes

[1] An APP entity may collect personal information other than sensitive information if it is reasonably necessary for (or, for agencies, directly related to) the entity’s functions or activities. An APP entity would still need to comply with other APPs in handling any personal information.

[2] Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012

[3] These matters are listed in the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 as matters that the Information Commissioner’s Rules should address.