The Information Privacy Act 2009 (Qld) (IP Act) contains a number of privacy principles which set out the rules for how personal information is to be collected, managed, used and disclosed by Queensland government agencies.1
Personal information is defined in section 12 of the IP Act. It is a broad definition that encompasses any information about an individual who can be identified directly from the information, or whose identity can be reasonably ascertained by reference to other information. Information does not have to be true, written down, sensitive or 'important' to be personal information.
Disclosure of personal information
Disclosure has a specific meaning in the IP Act.2 An agency discloses personal information if:
- it tells someone personal information or allows them to find it out, and
- that person didn't already know it or wasn't in a position to find it out on their own, and
- the agency won't have any control over what happens to the personal information.
Agencies should refer to the Disclosure Checklist for help determining if giving personal information to a third party is a disclosure.
The privacy principles only permit disclosure in certain circumstances. These include where:
- the individual has agreed to the disclosure
- it is authorised by law or necessary for law enforcement functions
- it is necessary to prevent a serious risk to an individual or the public.3
Complainants and investigations
Most agencies have responsibility for conducting investigations into breaches of the law. These investigations often begin because a member of the public (the complainant) supplies information to the agency by way of a complaint. Sometimes the complainant will want to know what the agency is doing about their complaint, how the investigation is proceeding and where it is up to, and the outcome of the complaint. In some circumstances, giving this information to a complainant will be a disclosure of personal information in breach of the privacy principles.4
Types of complaints
1. Complaints about an action or an event not linked to a specific person, eg 'someone has graffitied the public park'.
If the complaint is of the first type, an agency should be able to provide the complainant with some information about the investigation, as long as it is not information about, or information that might identify, the individual being investigated (or other individuals involved in the investigation, such as witnesses).
2. Complaints about the actions of companies, eg 'that restaurant has violated the health code' or 'XYZ Inc isn't paying superannuation'.
If the complaint is of the second type, an agency should be able to provide the complainant with some information about the investigation, as long as it is not information about, or information that might identify, a specific individual, because companies do not have personal information.
3. Complaints about an individual doing something they think is wrong, eg 'Bob's dog won't stop barking' or 'my neighbour has noxious weeds in his backyard'.
If the complaint is of the third type, the complainant knows the identity of the individual. This means that any information the agency gives the complainant about the investigation is automatically linked to the individual being investigated, even if the agency doesn't mention the individual's name. Telling the complainant information about the progress or outcome of the investigation will, in most circumstances, be a disclosure of personal information. Disclosure may only occur where it falls within one of the circumstances in the IP Act, such as the individual has agreed or it is necessary for law enforcement functions.
Investigations in the media
If someone who is being investigated speaks to the media about the investigation, or publishes their personal information related to the investigation in another way—such as in a letter to the Editor or on their blog—the agency may be able to speak more freely about the investigation. The IP Act provides for this situation,5 allowing the disclosure rules to be set aside for personal information related to or connected with personal information published6 by the individual. Agencies should refer to the Disclosure Checklist and the guideline7 for more information.
Managing complainant expectations
It is useful for agencies to manage the expectations of complainants. One way of doing this is to produce a pamphlet or information sheet which sets out:
- the process the agency follows when it receives a complaint
- how the investigation will be conducted
- the possible outcomes if the investigation finds that a wrongdoing has been committed, and
- to what extent the complainant can expect to be kept informed.
This could be made available on the agency's website and given to anyone who makes a complaint to the agency, so that complainants know what to expect when they make a complaint.
- 1 In this Guideline references to an 'agency' include Ministers and bound contracted service providers, unless otherwise specified. [up]
- 2 As defined in section 23 of the IP Act. [up]
- 3 See IPP 11(1) and NPP 2(1) (for health agencies) for a full list of the situations in which agencies can disclose personal information. [up]
- 4 This may not be the case where the complainant is also involved in the investigation, for example as a witness, and it is necessary to give them some information in order to get their statement. [up]
- 5 Section 28 for the IPPs and section 32 for the NPPs (for health agencies only). [up]
- 6 'Published' includes by way of television, newspaper, radio, the internet or other forms of communication. [up]
- 7 Guideline - "When do the privacy principles not apply - documents and entities"
Current as at: September 5, 2013