The Information Privacy Act 2009 (Qld) (IP Act) contains privacy principles which set out how Queensland government agencies are to collect, manage, use and disclose personal information.1
Personal information is defined very broadly in section 12 of the IP Act and it includes any information or opinion in any form, whether true or not, about an identifiable person.
The privacy protections in the IP Act apply to individuals regardless of age. Children have personal information that is individual to them and independent to their information as part of a family unit. Agencies are obligated to comply with the privacy principles whenever they deal with a child’s personal information.
As far as possible, children should make decisions concerning the government’s dealing with their personal information themselves. However, the IP Act recognises that children may not have the capacity to understand and make decisions concerning their personal information and makes provision for a parent to make these decisions on their behalf.
A ‘child’ is defined in section 45 of the IP Act as an individual who is under 18 years of age. The same section defines ‘parent’ as the child’s mother or father or a person otherwise exercising parental responsibility, including a guardian, and a person who, under Aboriginal or Torres Strait Islander tradition or custom, is regarded as a parent of the child.
The IP Act does not set an age at which children can be presumed to have the capacity to make decisions about their personal information. Wherever possible, agencies should assess whether an individual under the age of 18 has capacity on a case-by-case basis. As a general principle, a child has the capacity to make decisions when he or she has sufficient understanding and maturity to understand what is being proposed.
Section 196(1)(b) of the IP Act states that in relation to a child’s privacy, the ‘child’s parent is able to do anything that the child could do if the child were an adult.’ There are two areas in which section 196 will usually be invoked – where the child’s agreement is sought and privacy complaints involving the child.
There are three areas in the privacy principles where the child’s agreement may be sought. The first is where an agency wishes to use the personal information of a child for a different purpose than that for which it was obtained (secondary use) – Information Privacy Principle (IPP) 10(1)(a).
The second is where an agency wishes to disclose the child’s personal information to a third party – IPP 11(1)(b).
The third is where an agency transfers the child’s personal information outside Australia – section 33(a) of the IP Act. This will usually arise in the context of an online posting, for example, on a website, in an email to someone overseas or on a social networking site.
Agencies do not always need to seek the consent of a child to use their personal information for a secondary purpose, disclose it to another entity or transfer it out of Australia. There are other exemptions to the privacy principles which agencies may be able to rely on and an agency is not obligated under the privacy principles to favour agreement.
If an agency wishes to obtain the agreement of a child, consideration should be given to obtaining it from the child themselves rather than their parents.
Section 164(1)(a) of the IP Act provides that an individual can complain about an act or practice of an agency in relation to the individual’s personal information that is a breach by the agency of their obligation to comply with the privacy principles.2
Under Chapter 5 of the IP Act, an individual can make a complaint that the agency has failed to comply with the privacy principles when dealing with the individual’s personal information. This capacity extends to children and agencies should assist children to exercise their privacy complaint rights.
Where possible, the child should make their own privacy complaint. The subject matter of the complaint may be information about which the parent has no knowledge and which the child may not want the parent to know. Even if the parent has been involved, the child will have more knowledge of the subject matter of the complaint than the parent.
A parent cannot make a complaint about a breach of a child’s privacy independently of the child. Section 196 sets out an agent relationship. This means that the parent is acting on behalf of their child rather than stepping into the child’s shoes. The definition of ‘privacy complaint’ in section 164 of the IP Act means that if the child does not want to pursue a privacy complaint, the parent cannot act contrary to their wishes.
Daniel is kicked off the school football team because he refused to attend practices. A new editor of the school’s newsletter, unfamiliar with their privacy obligations, publicises Daniel’s replacement on the team and mentions Daniel’s lack of commitment. Daniel’s mother feels that this reflects poorly on her parenting skills and lodges a privacy complaint on Daniel’s behalf. However, when the school contacts Daniel to discuss his complaint, he states that he didn’t care about the newsletter because the report was true and ultimately he is happy that he is no longer on the team.
The privacy complaint system is remedial in nature. Any measures of redress that are sought from the agency directly, through OIC’s mediation process or orders issued in the Queensland Civil and Administrative Tribunal (QCAT) are to remedy damage suffered by the child. While a parent may feel aggrieved that their child’s privacy has been breached, a parent cannot pursue their own compensation claims through their child’s complaint.
Similarly, consideration should be given to the ‘damage’ suffered by the child as a consequence of their privacy being breached. While a particular breach of privacy may have social and economic consequences for an adult, there may be lesser consequences for the same breach with a child. However, the converse can also be the case.
For these reasons, even though a parent may pursue a privacy complaint on behalf of their child, it is preferable that the child’s voice be heard as much as possible.
For more information about applications by and for children see the Guideline: How to make an access application on behalf of a child and other OIC guidelines, or contact the Enquiries Service on 07 3234 7373 or email email@example.com.
Current as at: July 30, 2012