17 April 2018

Our reference: D2018/003653

Senator Slade Brockman
Chair
Senate Community Affairs Legislation Committee

By email: community.affairs.sen@aph.gov.au

Dear Senator Brockman

Social Services Legislation Amendment (Drug Testing Trial) Bill 2018

I welcome the opportunity for the Office of the Australian Information Commissioner (OAIC) to provide this submission to the Committee’s inquiry into the Social Services Legislation Amendment (Drug Testing Bill) Bill 2018 (the Bill).

The OAIC understands that the Bill will amend the Social Security Act 1991 and Social Security (Administration) Act 1999 to establish a two year drug testing trial in three regions for 5000 new recipients of Newstart Allowance and Youth Allowance from 1 July 2018.

Under the Privacy Act 1988 (Cth) (Privacy Act) a function of the Australian Information Commissioner and Privacy Commissioner (the Commissioner) is to examine a proposed enactment that would require or authorise acts or practices of an entity that might otherwise be interferences with the privacy of individuals, or which may otherwise have any adverse effects on the privacy of individuals.[1] The Commissioner also has the function of ensuring that any adverse effects of the proposed enactment on the privacy of individuals are minimised.[2]

The OAIC acknowledges the public policy objectives associated with this initiative including ensuring appropriate use of welfare payments and identifying people with drug misuse issues and assisting them to address those issues (as outlined in the Bill’s Statement of compatibility with human rights).

However, the OAIC believes it is essential that potential privacy impacts and safeguards are carefully considered in the development and conduct of drug testing trials given the potential adverse effects resulting from the mishandling of their personal information. This is particularly important in circumstances where government agencies can collect, use and disclose personal information on a compulsory basis, or where information is requested in exchange for access to essential government payments or services.

Drug test rules

The OAIC notes that the information handling provisions that relate to drug tests will be prescribed by a legislative instrument (the ‘drug test rules’) under proposed section 38FA of the Social Security Act 1991. In particular, proposed sections 38FA(f) and 38FA(h) provide that the rules can relate to confidentiality and disclosure of results of drug tests, and to keeping and destroying records relating to samples for use in drug tests, or to drug tests.

The OAIC considers these to be significant matters that have the potential to impact upon the privacy of individuals. The OAIC considers that provisions such as these relating to the collection, use or disclosure of personal information should be prescribed in primary legislation, rather than provided for in a rule making power. The use of rules to set personal information handling standards may mean that future expansions of these requirements (i.e. authorising more personal or sensitive information to be disclosed) are subject to less parliamentary oversight as they would be if contained in primary legislation. For this reason, it is preferable for such information to be specified, so far as practicable, in primary legislation.

However, should a rule making power be used for proposed sections 38FA(f) and 38FA(h), the OAIC’s suggests that the power be accompanied by:

  • an obligation to consult with the Australian Information Commissioner on any legislative instrument proposed to be made under proposed section 38FA that involves the handling of personal information, and
  • an obligation to have regard to any submissions made by the Australian Information Commissioner as a result of that consultation.[3]

Conducting a PIA

Given that the establishment of a drug testing trial will be underpinned by the sharing of individuals’ personal information, the OAIC has encouraged the use of a Privacy Impact Assessment (PIA)[4] to assess the potential privacy impacts of the trial and ensure that the personal information handling activities are accompanied by an appropriate level of privacy safeguards and accountability.

I note that the OAIC considers a PIA to be a valuable tool to assess the potential privacy impacts of a new initiative, and that, ideally, the PIA is conducted at an early stage to allow these issues to be considered in developing the policy and legislative proposal. The comprehensive identification of privacy risks through conducting a PIA at an initial stage of the development of a new initiative will assist in determining whether any proposed policy and legislative changes to support it are proportionate and necessary. This includes considering whether an appropriate balance is struck between the community’s expectations around personal information handling and the overall public policy objectives of the proposal.

I understand that the Department of Human Services and the Department of Social Services have committed to conducting a joint PIA for this measure to ensure that its implementation minimises privacy risks.

The OAIC is available to provide further information or assistance to the Committee as required.

Yours sincerely

Angelene Falk
Acting Australian Information Commissioner
Acting Privacy Commissioner

17 April 2018

Footnotes

[1] Section 28A(2)(a) of the Privacy Act 1988.

[2] Section 28A(2)(c) of the Privacy Act 1988.

[3] This is similar to the consultation provision under s 28(1A) of the National Cancer Screening Register Act 2016, which provides an obligation to consult with the Australian Information Commissioner before the making of rules that relate to privacy functions.

[4] A PIA is a systematic assessment of a project that identifies the impacts a project may have on the privacy of individuals, and sets out recommendations for managing, minimising or eliminating those impacts. More information about PIAs is available at: https://www.oaic.gov.au/agencies-and-organisations/guides/guide-to-undertaking-privacy-impact-assessments