Information published by the individual

Queensland government agencies^[1] must comply with the privacy principles in the Information Privacy Act 2009 (Qld) (IP Act) when dealing with personal information. There are exceptions to this requirement, however, including where an agency is dealing with personal information an individual has published about themselves.

What is personal information?

Personal information is any information about an individual whose identity can be reasonably ascertained. Companies do not have personal information and neither do deceased people.^[2]

What are the privacy principles?

The privacy principles set out how an agency must manage the personal information it holds. They include the Information Privacy Principles (IPPs), which apply to all agencies except health agencies, and the National Privacy Principles (NPPs), which apply to health agencies.

The self-publication exception

Section 28 (or section 32 for health agencies) of the IP Act allows an agency to not comply with the prescribed privacy principles for:

• personal information published by the individual it is about
• personal information provided by the individual it is about to someone else for the purpose of publication; and
• any information related to or connected with the information published or provided by the individual

What does publishing mean?

Publishing is defined in the IP Act as: publishing to the public by way of television, newspaper, radio, the internet or other form of communication. This definition is not exhaustive and would include personal information:

• given in an interview
• sent to a newspaper in a letter to an editor
• included in a tweet;
• uploaded to a Facebook profile, wall, or timeline

When applying section 28 or 32, the agency must be able to confirm that the personal information was published, or given to be published, by the individual themselves. An agency cannot rely on these sections in relation to personal information, for example, uploaded to Facebook by the individual's friends, or acquired by a reporter from the individual's family or through covert surveillance methods.

Related to or connected with

Sections 28 and 32 only apply to the actual personal information, or to personal information related to or connected with, the published or provided information. For the information to be 'related to or connected with' there must be a sufficient link between the information published or provided to be published and the information the agency is dealing with.

Prescribed privacy principles under sections 28 and 32

• Sections 28 and 32 only cover certain privacy principles. They allow agencies to deal with the above personal information without having to comply with or consider: IPP 8 or NPP 3, which require an agency to take reasonable steps to ensure that personal information is accurate, up to date and complete.
• IPP 9, which only allows the use of personal information which is relevant to the proposed use.
• IPP 10 and IPP 11 or NPP 2, which limits when an agency can use or disclose personal information.
• NPP 9(4), which requires the health agency to take reasonable steps to de-identify health information collected under 9(3) when it discloses it.

Applying sections 28 and 32

Agencies should:

• identify the specific personal information that was published or provided for publication
• identify who published or provided it
• identify when, where, and how the information was published or provided for publication
• identify how the personal information in question is directly connected with the information which was published or provided to be published
• identify which of the privacy principles in section 28 or 32 are relevant; and
• make a decision whether or not to rely on section 28 or 32.

When deciding whether to rely on these sections, an agency should also consider the possible ramifications for the individual if the agency does not comply with the specified privacy principles.