Queensland government agencies must comply with the privacy principles in the Information Privacy Act 2009 (Qld) (IP Act) when dealing with personal information. There are exceptions to this requirement, however, including where an agency is dealing with personal information an individual has published about themselves.
Personal information is any information about an individual whose identity can be reasonably ascertained. Companies do not have personal information and neither do deceased people.
The privacy principles set out how an agency must manage the personal information it holds. They include the Information Privacy Principles (IPPs), which apply to all agencies except health agencies, and the National Privacy Principles (NPPs), which apply to health agencies.
Section 28 (or section 32 for health agencies) of the IP Act allows an agency to not comply with the prescribed privacy principles for:
Publishing is defined in the IP Act as: publishing to the public by way of television, newspaper, radio, the internet or other form of communication. This definition is not exhaustive and would include personal information:
When applying section 28 or 32, the agency must be able to confirm that the personal information was published, or given to be published, by the individual themselves. An agency cannot rely on these sections in relation to personal information, for example, uploaded to Facebook by the individual's friends, or acquired by a reporter from the individual's family or through covert surveillance methods.
Sections 28 and 32 only apply to the actual personal information, or to personal information related to or connected with, the published or provided information. For the information to be 'related to or connected with' there must be a sufficient link between the information published or provided to be published and the information the agency is dealing with.
If the personal information was–
–the agency could rely on section 28 to disclose that personal information.
When deciding whether to rely on these sections, an agency should also consider the possible ramifications for the individual if the agency does not comply with the specified privacy principles.
These provisions should be used carefully and only after consideration has been given as to whether their use is in the public interest, for example, disclosure of directly related personal information in order to correct the public record, as opposed to being a way to address an individual in the public domain.
Current as at: September 19, 2019