Information published by the individual

Queensland government agencies¹ must comply with the privacy principles in the Information Privacy Act 2009 (Qld) (IP Act) when dealing with personal information. There are exceptions to this requirement, however, including where an agency is dealing with personal information an individual has published about themselves.

What is personal information?

Personal information is any information about an individual whose identity can be reasonably ascertained. Companies do not have personal information and neither do deceased people.²

What are the privacy principles?

The privacy principles set out how an agency must manage the personal information it holds. They include the Queensland Privacy Principles (QPPs) and the rules about overseas disclosure in section 33.

The self-publication exception

Section 28 of the IP Act allows an agency to not comply with the prescribed privacy principles for:

• personal information published by the individual it is about
• personal information provided by the individual it is about to someone else for the purpose of publication; and
• any information related to or connected with the information published or provided by the individual

What does publishing mean?

Publishing is defined in the IP Act as: publishing to the public by way of television, newspaper, radio, the internet or other form of communication. This definition is not exhaustive and would include personal information:

• given in an interview
• sent to a newspaper in a letter to an editor
• included in an Instagram post; or
• uploaded to a Facebook profile, wall, or timeline

When applying section 28, the agency must be able to confirm that the personal information was published, or given to be published, by the individual themselves. An agency cannot rely on these sections in relation to personal information, for example, uploaded to Facebook by the individual's friends, or acquired by a reporter from the individual's family or through covert surveillance methods.

Related to or connected with

Sections 28 only apply to the actual personal information, or to personal information related to or connected with, the published or provided information. For the information to be 'related to or connected with' there must be a sufficient link between the information published or provided to be published and the information the agency is dealing with.

Prescribed privacy principles under sections 28

Sections 28 only covers certain privacy principles. It allows agencies to deal with the above personal information without having to comply with or consider:

• QPP 6, which governs the use and disclosure of personal information; and
• QPP 10.2, which requires agencies to ensure personal information in accurate, complete and relevant before using or disclosing it.

Applying sections 28

Agencies should:

• identify the specific personal information that was published or provided for publication
• identify who published or provided it
• identify when, where, and how the information was published or provided for publication
• identify how the personal information in question is directly connected with the information which was published or provided to be published
• identify which of the privacy principles in section 28 are relevant; and
• make a decision whether or not to rely on section 28.

When deciding whether to rely on these sections, an agency should also consider the possible ramifications for the individual if the agency does not comply with the specified privacy principles.