In effect from: 23 January 2026

What are the permitted general and health situations

The permitted general and health situations are listed in schedule 4 of the IP Act. They allow agencies and health agencies to collect, use, and disclose personal information in the specified situations.

All agencies can rely on the permitted general situations. Only health agencies can rely on the permitted health situations.

Permitted general situations

Under Queensland Privacy Principle (QPP) 3.4 an agency can collect sensitive information without consent if a permitted general situation applies. Under QPP 6.2(c) an agency can use or disclose personal information for a secondary purpose if a permitted general situation applies.

Prevent a serious threat to life, health or safety (schedule 4, part 1(a))

An agency can collect sensitive information, or use and disclose personal information, to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, but only if it is unreasonable or impracticable to obtain the individual’s consent.

A serious threat

The threat the agency is trying to lessen or prevent by collecting, using or disclosing the information must be serious and it must be to an individual’s life, health, or safety or to public health or safety.

The likelihood of the threat occurring as well as the consequences if it materialises are both relevant when deciding if a threat is serious. A threat that could have dire consequences but is highly unlikely to occur would not generally constitute a serious threat. However, a potentially harmful threat that is likely to occur, but at an uncertain time, may be a serious threat, such as a threatened outbreak of infectious disease. This allows agencies to take preventative action to stop a serious threat from escalating before it materialises.

The individual whose personal information is being considered does not have to be the one facing the harm and the threat does not need to be to an identifiable person. It may be a threat of harm to be randomly inflicted, or inflicted on a class of people, so that it is impossible to identify a specific person against whom the threat is directed.

Health includes mental health; mere stress, aggravation, or inconvenience would not constitute serious harm, however the triggering of a serious stress-related disorder could. For public health or safety, this must be a real and serious threat to the general public, or a portion of it, such as an outbreak of disease, or a bushfire threatening a locality.

The threat does not have to occur in Queensland or even in Australia.  It may happen anywhere in the world.

Can collection/use/disclosure prevent or lessen the threat?

Agencies must reasonably believe that the collection, use or disclosure will prevent or lessen the threat. This will generally require a sufficient link between the collection, use or disclosure of the information and the prevention or lessening of the threat.

In the case of a disclosure, it would normally be to another agency or body with the capacity and authority to reduce or prevent the threat.

Necessary

Part of deciding if the collection, use or disclosure is necessary involves making an assessment about whether the harm can be lessened or prevented without the information, eg by de-identifying information before disclosure or collecting de-identified information.  If so, the collection, use or disclosure is not necessary.

It is not sufficient that an agency simply believes the threat exists. It must believe that the collection, use or disclosure of information is necessary to lessen or prevent that threat.  The following questions will assist agencies in making that determination:

  • Is the information being collected, used or disclosed with the intention of lessening or preventing the threat?
  • Is the information being collected, used or disclosed to manage the threat?
  • When disclosed, is the recipient in a position to act on the information to lessen or prevent the harm?
  • Will the proposed collection, use or disclosure reduce the threat?

Agencies considering collecting, using or disclosing information to reduce threats to public health or public safety may find it useful to discuss the threat in general terms (and whether the proposed collection, use or disclosure is likely to reduce the threat) with a relevant authority dealing with public health or safety, for example a health agency or the agency responsible for environmental health.

Prevent or lessen

For a threat to be prevented or lessened the collection, use or disclosure of information must allow the body collecting, using or receiving it to take steps they would not otherwise have been able to take to either remove or reduce it.

It must be more than a mere chance of reducing it, or a ‘just in case’ measure.

If the attempt to prevent or lessen the threat is unsuccessful it will not invalidate the collection, use or disclosure, as long as the belief that collecting, using or disclosing the information would do so was reasonable.

Unlawful activity or misconduct (schedule 4, part 1(b))

An agency can collect sensitive information without consent, or use and disclose personal information where the agency:

Appropriate action

The action an agency reasonably believes is necessary must be an appropriate action to take in relation to the matter. This will depend on:

  • the nature of the suspected unlawful activity or misconduct; and
  • the nature of the action the agency proposes to take.

Appropriate action could include investigating the unlawful activity or serious misconduct, taking disciplinary action in relation to the unlawful activity, reporting the activity to the police, the Crime and Corruption Commission, or another relevant person or authority.

If the agency reasonably believes it cannot effectively investigate the serious misconduct or unlawful activity without collecting, using or disclosing information, this permitted general situation will generally apply.

Related to the agency’s functions or activities

The unlawful activity or serious misconduct must relate to the agency's functions or activities. Generally, this will involve serious misconduct or unlawful activity undertaken by an agency’s employees.

If the unlawful activity or serious misconduct relates entirely to an employee’s private activities, eg the agency discovers the employee participated in illegal fishing while on holiday, or engaged in serious misconduct in their role as Treasurer of a private club, it cannot rely on this permitted general situation.

However, if the agency becomes aware that a non-employee, eg a contracted service provider, has engaged in serious misconduct or unlawful activity which relates to its functions or activities, the agency could rely on it.

Unlawful activity or serious misconduct

Unlawful activity generally means criminal activity, illegal activity, or activity prohibited or proscribed by law. It can include unlawful discrimination or harassment but does not include breach of a contract.

There is a crossover between unlawful activity and serious misconduct, which means in some instances an action may be both.

Serious misconduct refers to serious breaches of standards of conduct associated with a person’s duties, and includes:

  • corruption, abuse of power, or dereliction of duty
  • breach of obligations that would warrant the taking of enforcement action against the person
  • breach of trust
  • breach of discipline; or
  • other seriously reprehensible behaviour.

It does not include minor breaches or transgressions.

Whether the actions of an agency employee constitute serious misconduct will generally involve a failure to comply with relevant laws and standards, for example:

  • corrupt conduct under the Crime and Corruption Act 2001 (Qld)
  • misconduct under the Police Service Administration Act 1990 (Qld) or the Public Sector Act 2022 (Qld)
  • other conduct under section 91 of the Public Sector Act 2022 (Qld) where it is serious and improper
  • misconduct or corrupt conduct under the Local Government Act 2009 (Qld) or breach of a Code of Conduct issued under that Act.
  • a breach of the Public Sector Ethics Act 1994 (Qld) or of a Code of Conduct under that Act; or
  • a criminal offence.

Misconduct of this type may also be set out in agency or sector specific laws.

Missing persons (schedule 4, part 1(c))

An agency can collect sensitive information without consent, and use or disclose personal information if:

  • an agency reasonably believes that collection, use or disclosure is reasonably necessary to locate a person reported as missing; and
  • the collection, use or disclosure complies with a guideline issued by the Commissioner.

Commissioner’s guideline

Any collection of sensitive information, or use and disclosure of personal information to locate a missing person, must also comply with any OIC guidelines issued under chapter 3, part 2 of the IP Act.

If a guideline has not been issued, an agency cannot rely on this permitted general situation, however there will generally be other QPPs that an agency can rely on to collect, use or disclose information in these circumstances.

Person reported as missing

Person reported as missing means an individual:

  • who has been reported as missing to a locating body that does not know the individual’s whereabouts; and
  • who is being sought by the locating body because there are serious concerns for their safety and/or welfare or for the purpose of re-uniting them with their family.

Family includes:

  • someone who would be an eligible family member if the person was deceased
  • a de facto partner of the individual
  • someone who is the child or parent of the individual; and
  • anyone else who would be a member of the individual’s family if someone mentioned above is taken to be a member of the individual’s family.

Person reported as missing does not include an individual who is being sought:

  • in relation to legal matters, including but not limited to, debt, maintenance, support proceedings, wills, child custody, divorce or investigations into suspected criminal activity of the individual; or
  • for the purpose of genealogical research.

Locating body

A locating body means:

  • the Australian Federal Police
  • a police force or service of a State or Territory
  • the Salvation Army Family Tracing Service
  • the Australian Red Cross Tracing Service
  • International Social Service Australia
  • a Link-Up Service of a State or Territory; or
  • the Department of Foreign Affairs and Trade.

Impracticable or unreasonable to obtain consent

If the whereabouts of the person reported as missing are unknown to the agency, it will not be possible to obtain their consent.

If the agency knows the whereabouts or contact details of the person reported as missing, it must be satisfied that obtaining their consent is impracticable or unreasonable before relying on schedule 4, part 1, section 1(c).

Contrary to the wishes of the individual

Personal information must not be collected, used or disclosed under schedule 4, part 1, section 1(c) if the agency is aware of any wishes to the contrary which have been expressed by the individual.

Must not pose a serious threat to an individual

Agencies must not collect, use or disclose personal information under schedule 4, part 1, section 1(c) if there is a reasonable belief that doing so would pose a serious threat to the life, health or safety of any individual.

The minimum information required

Agencies must ensure they only collect, use or disclose information to the reasonably necessary extent to make contact with, or to offer proof of life of, the person reported as missing.

Alternative Dispute Resolution (schedule 4, part 1(d))

An agency can collect sensitive information without consent, or use or disclose personal information where the collection, use or disclosure is reasonably necessary for:

  • conducting a confidential alternative dispute resolution (ADR) process; or
  • the establishment, exercise or defence of a legal or equitable claim.

A confidential ADR process

ADR is not defined in the IP Act. It includes processes other than judicial determinations in which an impartial person assists people in a dispute to resolve the issues between them. The impartial person may have ADR related accreditation, but this is not required.

Examples of ADR processes include mediation, conciliation, facilitation, expert assessment, determination, or neutral evaluation.

Collection, use or disclosure for confidential ADR processes could include:

  • collection of sensitive information necessary for the conduct of the ADR
  • disclosure of personal information to an ADR provider
  • use or disclosure by an agency for the purpose of participating in the ADR; and
  • collection of sensitive information, or use or disclosure of personal information, by an agency in relation to a complaint of professional misconduct against an ADR practitioner.
The ADR must be confidential

The parties to the dispute and the ADR provider must be bound by confidentiality obligations. The obligations must prohibit the use or disclosure of personal information collected, used or disclosed for the ADR process for any other purpose, including in subsequent proceedings.

The confidentiality obligations may be imposed through binding agreements or legislative provisions.

A legal or equitable claim (schedule 4, part 1(e))

Agencies can collect sensitive information without consent and use or disclose personal information where it is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim.

It applies to claims being conducted in both courts and tribunals, and to both existing and anticipated proceedings. For anticipated proceedings, there must be a real possibility that they will commence, eg where the agency has sought or obtained legal advice about commencing proceedings.

Agencies are not required, and may not be permitted, to disclose personal information to a third party who requests it in connection with existing or anticipated legal proceedings. It will generally be difficult to establish that the disclosure is reasonably necessary in these circumstances.

Permitted health situations

A health agency can, under QPP 3.4(c) and QPP 6.2(d), collect, use or disclose health information for a permitted health situation. The permitted health situations are set out in schedule 4, part 2 of the IP Act.

Only health agencies can rely on a permitted health situation.

Provision of a health service

A permitted health situation arises where it is necessary to provide a health service to an individual and:

  • the collection of health information is required or authorised under an Australian law, or the individual would reasonably expect the health agency to collect the information for that purpose
  • the health information is a family medical history, social medical history, or other relevant information about the individual or another individual and it is collected from the individual receiving the health service or a responsible person for the individual; or
  • health information is disclosed to a person responsible for an individual who cannot give or communicate consent because it is necessary to provide them with appropriate care or treatment or for compassionate reasons, and the disclosure is not contrary to the individual's wishes.

Disclosing health information to a person responsible

Disclosure of health information by a health agency to a person responsible for an individual is permitted where:

  • a health professional is providing a health service to the individual
  • that individual is incapable of giving or communicating consent
  • the health professional is satisfied disclosure necessary for part of the individual’s health care or treatment, or for compassionate grounds; and
  • the disclosure is not contrary to any wish expressed by the individual before they became unable to give or communicate consent and the health professional is aware, or could reasonably be expected to be aware, of that wish.
Only the reasonably necessary amount of information can be disclosed.

Disclosure necessary for an individual’s care or treatment could include an occupational therapist telling a sibling, who provides care in the home, about aspects of an individual's current physical condition, to explain how to carry out certain personal care tasks.

Disclosure for compassionate reasons could include a doctor telling an individual's partner about an individual's injuries and prognosis following a car accident.

Disclosure against the individual’s wishes

In determining whether to disclose information to a person responsible, a health professional must consider whether this would be contrary to any known wishes of the individual.

A person responsible for the individual

As set out in schedule 5 of the IP Act, a person is responsible for an individual if the person is:

  • a parent of the individual; or
  • a child or sibling of the individual who a health professional believes has capacity; or
  • a spouse or de facto partner of the individual; or
  • a relative of the individual and a member of the individual’s household; or
  • a guardian of the individual; or
  • a person exercising an enduring power under an enduring power of attorney made by the individual that is exercisable in relation to decisions about the individual’s health; or
  • a person who has sufficient personal interest in the health and welfare of the individual; or
  • a person nominated by the individual to be contacted in case of emergency.

Whether someone is a 'person responsible' will depend on the nature of the relationship between the person and the individual. Depending on the circumstances, 'a person with sufficient personal interest in the health and welfare of the individual' could include a romantic partner, someone in a close relationship or friendship with the individual, a housemate, or a companion or carer of the individual.

Research

A permitted health situation also arises where:

  • health information is collected for public health or safety research or statistics, or the management, funding or monitoring a health service in the circumstances set out in schedule 4, part 2, section 3
  • health information is used for public health or safety research or statistics, or the management, funding or monitoring a health service and it is impracticable to obtain consent; or
  • health information is disclosed for public health or safety research or statistics, or the management, funding or monitoring a health service, it is impracticable to obtain consent, and the health agency reasonably believes the receiving entity will not disclose the health information or personal information derived from the health information.

The use or disclosure must be conducted in accordance with guidelines approved by the chief executive of the health department.

Print Page
Back to top