Your privacy rights in a pandemic

Queensland government agencies, including departments, councils, universities and public hospitals, must deal with your personal information in the way set out in the Information Privacy Act 2009 (Qld) (IP Act). Personal information is any information about someone that could reasonably identify them.

The IP Act requires agencies to protect your personal information and contains rules for when it can be used and disclosed—but it also makes allowances for serious situations like a pandemic. This information sheet sets out some common situations that have occurred during the pandemic and explains how agency privacy obligations apply in the context of a pandemic.

Do I still have the right to access my information during a pandemic?

Yes, you still have the right to apply to an agency for access to your information, but factors beyond the agency’s control may impact processing times. Please see Applying for documents during COVID-19 for more information.

If you want to access information from somewhere other than a Queensland government agency, you will need to speak directly to the organisation that holds the information. For some organisations, the Office of the Australian Information Commissioner (OAIC) may be able to help you.  You can contact the OAIC Enquiries Service on 1 300 363 992 or enquiries@oaic.gov.au. They also have a website at www.oaic.gov.au.

I’m employed by someone other than a Queensland government agency and have privacy concerns – who do I talk to?

Not all organisations are covered by privacy laws. The Commonwealth Privacy Act 1988 (Privacy Act) does not cover most small business (although some are covered; find a list here), however it does cover most large companies, Federal government agencies, and private health care providers. The OAIC oversees entities covered by Privacy Act and they have information about privacy during a pandemic available on their website.

If your employer is not covered by the Privacy Act you can still talk to them about your privacy concerns and try to resolve them.

I’ve made a claim for assistance to a Queensland government agency - what information can they ask for to assess the claim?

An agency can only ask for as much information as they genuinely need to assess your claim. One of the agency’s obligations under the IP Act is to explain to you why they are collecting information that they ask you for. If they haven’t explained why they need the information and you want to know more about why they’ve requested it, you should speak to them.

Sometimes in order to assess your claim, the agency may need to get information about you from someone else, such as another agency. In those circumstances the agency may ask for your consent. As part of this they should make sure you understand what information they want from the other person or agency and why. If they don’t tell you, you can ask them to explain.

I’ve been asked to give my name and contact details to a business or agency before they provide me with a service – isn’t that a breach of my privacy?

In a pandemic a Public Health Direction may be issued that require certain businesses such as cafes, restaurants, gyms, libraries and entertainment venues to request your personal information before you can receive a service. This can apply to both private businesses and government agencies. If a public health direction is in force, then its requirements must be complied with.

When a government agency collects your personal information in these circumstances, they must still comply with the requirements of the IP Act. You can read more about agency requirements to collect store and use this personal information during the pandemic here. Privacy: Collecting and storing personal information during COVID-19.

Government agencies’ dealings with your personal information that fall outside of the applicable obligations set out in a Public Health Direction are still subject to the requirements in the IP Act.

I think a Queensland government agency breached my privacy - what can I do?

If you believe that an agency has breached your privacy by failing to comply with the IP Act in relation to your personal information, you can make a privacy complaint to that agency.

You cannot make a privacy complaint about a breach of someone else’s privacy, unless you are a parent making a complaint on behalf of a minor child or you have authority to make a complaint on the other person’s behalf.

Please refer to this information sheet for assistance: How to make a privacy complaint - a guide for individuals.  

You are not required to start by making a formal complaint. Depending on the circumstances, you may be able to resolve the matter informally by contacting the agency’s privacy officer. Their details will generally be in the privacy footer or privacy tab on the agency website. During a pandemic, email will often be the best contact method, as agency staff may be working remotely.

More information?

If you need more information about the specific agency you are dealing with, you should contact them. If you need more information on general agency obligations under the IP Act, please contact the Office of the Information Commissioner’s Enquiries Service.

Current as at: March 9, 2021