Demographics and the QPPs

Agencies¹ are required to comply with the Queensland Privacy Principles (QPPs) in the Information Privacy Act 2009 (Qld) (IP Act) when dealing with personal information. Where demographics are personal information, their collection, use and disclosure must comply with the QPPs.

What are demographics?

Demographics are the statistics of a population or a section of a population.² Demographic data include a person’s age, gender, postcode, country of birth, indigenous status, occupation, disability status, language spoken or religious affiliation.

Collecting and analysing the demographics of an agency’s customers can be a useful tool to inform and guide policy development, service planning and quality improvement activities.

Personal and sensitive information

Personal information is any information about an identified individual or an individual who can reasonably be identified. Sensitive information is a specific kind of personal information, defined in schedule 5 of the IP Act.

Sensitive information has many similarities to demographic data, e.g., racial, or ethnic origin, religious beliefs or affiliations, and sexual orientation or practices, however demographic data will only be personal or sensitive information if it can be linked to an identifiable individual.

Generally, demographic data does not directly identify a specific individual.  However, there may be circumstances where an individual can reasonably be identified from the context or combination of demographic characteristics.

Refer to Key privacy concepts – personal and sensitive information for more information.

Collection of demographic data

If demographic data is not or cannot reasonably be linked to an identifiable individual, the QPPs do not apply. Where they are or can be, agencies must comply with QPP 3 and 5 when collecting it.

Under QPP 3, agencies can only collect personal information which is reasonably necessary for, or directly related to, one or more of the agency's functions or activities and it must not be collected unlawfully or unfairly. The agency should have a specific purpose in mind for the demographic information before collecting it. Collecting personal information the agency thinks may be useful at some time in the future is a potential breach of QPP 3.

If the personal information is sensitive information, it can only be collected if the individual consents or one of the situations listed in QPP 3.4 applies.  Wherever practicable, personal, and sensitive information must be collected directly from the individual it is about.

Under QPP 5, agencies must take reasonable steps to ensure individuals are aware of the relevant matters listed in QPP 5.2, including why the information is being collected.

Refer to QPP 3 – collection of solicited personal information and QPP 5 – what agencies have to tell people when collecting personal information for more information.

Is provision of demographic data optional?

Provision of demographic data will generally be optional. This is particularly important where the demographic data is sensitive information, which must, except in the QPP 3.4 circumstances, only be collected with consent.

If a form is used to collect personal information for one purpose and demographic data for another, it must clearly indicate what information will be used for which purpose and which information is optional. A practical approach is to provide the demographic questions in a separate area of the form, such as a feature box, table, or separate page.

Where provision of demographic data is optional, the form should include a statement that choosing not to provide it will have no adverse impact on the individual.

Refer to Key privacy concepts – consent for more information.

Use and disclosure of demographic data

If demographic data is not personal information, the QPPs do not apply. If the demographic data is personal information, use and disclosure of the data must comply with QPP 6. Analysis of demographic data and using the analysis to inform agency decisions is a use of personal information.

Under QPP 6, personal information, including sensitive information, can be used, and disclosed for the primary purpose of collection or for a secondary purpose:

• with the individual's consent,
• if it is related (or for sensitive information, directly related) to the primary purpose of collection and the individual would reasonably expect it to be used or disclosed for that purpose; or
• listed in QPP 6.2(b)-(g).

The purpose of collection included in the QPP 5 matters is the primary purpose of collection. Agencies will need to consider the primary purpose of collection and any secondary purpose when deciding if it can use demographic data which is personal information.

Refer to Key privacy concepts – use and disclosure and the QPP 6 guidelines for more information.