Dr Richard Chadwick
Australian Competition and Consumer Commission
Via email firstname.lastname@example.org
Dear Dr Chadwick
Submission by the Australian Privacy Commissioner on the ACCC’s draft determination on Medicines Australia Limited’s application for re-authorisation
Thank you for the opportunity to comment on the ACCC’s draft determination, which proposes to grant conditional authorisation to edition 18 of Medicines Australia’s Code of Conduct for five years.
Reporting ‘transfer of value’ information under the Privacy Act
Paragraphs 119 and 120 of the draft determination refer to advice I gave to Medicines Australia in May 2014. This advice related to the ability of pharmaceutical companies under the Privacy Act 1988 to disclose personal information relating to transfers of value made to healthcare professionals.
To ensure that paragraphs 119 and 120 accurately and clearly reflect my advice and how the Privacy Act applies in these circumstances, I suggest that a number of small changes could be made to those paragraphs so that they read as follows:
119. Medicines Australia sought the advice of the Australian Privacy Commissioner on the above issues on 8 April 2014. The Privacy Commissioner responded on 15 May 2014. With respect to the reporting of personal information relating to transfers of value made to individual healthcare professionals, the Privacy Commissioner advised that such reporting appeared to would be a secondary disclosure of the information for a secondary purpose. and Therefore that the information could only be disclosed if one of the following an exceptions set out in Australian Privacy Principle 6 applied. The two relevant exceptions appeared to be:
- the individual consents to disclosure; or
- the individual would ‘reasonably expect’ the organisation to disclose the information for the secondary purpose and the secondary purpose is ‘related’ to the primary purpose of collection (for non-sensitive information).
120. The Privacy Commissioner also agreed with the view expressed by Medicines Australia that seeking consent would be ‘best practice’. However, the Commissioner noted that the proposed reporting could also fall within the second exception, and that it appeared the reporting could be considered to be ‘related’ to the primary purpose of collection as required by this exception.
Accordingly, I have no objection to the ACCC’s proposed authorisation condition requiring pharmaceutical companies to either obtain a healthcare professional’s consent, or give notice so that the healthcare professional would reasonably expect the disclosure, before making a transfer of value to that healthcare professional.
Centralised database to improve the accessibility of reporting data
Paragraphs 165-179 of the draft determination discuss options for improving the public accessibility of reporting data, and paragraph 178 indicates that Medicines Australia is actively investigating the development of a centralised database for this purpose.
The ACCC has invited comments on the practical issues for implementing such a database. I make the following two comments:
- The storage of personal information in a centralised database poses potential privacy risks, including due to the aggregation of personal information. I therefore recommend that Medicines Australia conducts a Privacy Impact Assessment (PIA) of this proposal. A PIA is a systematic assessment of a proposal or project that identifies the impact that it might have on the privacy of individuals. Conducting a PIA early in the scoping or design stage for this proposal will help to ensure that steps can be taken to manage, minimise or eliminate those privacy impacts. The OAIC’s Guide to undertaking privacy impact assessments provides further information on conducting PIAs.
- The possible use of unique identifiers is referred to in paragraph 171. Given this remains an ‘outstanding issue’, I reiterate my earlier advice to Medicines Australia that the adoption of a government identifier in these circumstances does not appear to comply with Australian Privacy Principle 9. For more information please see Chapter 9 of our APP guidelines.
I hope my comments assist the ACCC in finalising its determination. If you require any further information, please contact Andrew Solomon, Director of Health and Privacy Assessments, on [contact details redacted].
Australian Privacy Commissioner
14 November 2014
Was this page helpful?
If you would like to provide more feedback, please email us at email@example.com