The Information Privacy Act 2009 (Qld) (IP Act) requires Queensland Ministers, departments, local government and public authorities (agencies)1 to handle personal information in accordance with the privacy principles. Personal information is defined very broadly and it includes any information or opinion in any form, whether true or not, about a person who is or can be identified.
Members of Parliament (MPs) often receive requests for help in dealing with agencies from their constituents1. As part of helping their constituent, the MP will often contact the agency for more information or to assist in resolving an issue.
If the agency talks to the MP about the constituent it will (in most cases) be disclosing personal information. Agencies are only allowed to disclose personal information in accordance with Information Privacy Principle 11 (IPP 11) or for health agencies, National Privacy Principle 2 (NPP 2).
Both IPP 11 and NPP 2 permit agencies to disclose personal information where the individual to whom the information relates has agreed to the disclosure. This agreement may be:
As a general rule, agencies should be cautious about relying on implied agreement because it requires the agency to make a judgement call about what an individual intends. However, while it is reasonable for an agency to rely on implied agreement when an MP contacts an agency in response to a request from the constituent, the agency may also wish to be provided with a copy of the constituent’s request.
In some circumstances a document signed by the constituent may expedite requests for information; an example document is provided at Appendix A.
Agencies and MPs should be aware that an individual’s agreement cannot override any law which prohibits the disclosure of information, for example the Hospital and Health Boards Act 2011 or the Child Protection Act 1999.
An agency must be satisfied that the constituent is who they say they are before giving their personal information to the MP. The agency may rely on the MP’s knowledge of the constituent or they may take independent steps to verify the identity of the constituent, for example by checking the personal information held in the agency’s records against the information provided by the MP.
In cases where the constituent is unknown to the MP the agency will need to undertake a formal verification process before the personal information is disclosed. While there is no obligation on MPs to verify a constituent’s identity, electoral office staff may take practical steps to verify that an unknown person is on the electoral roll for that district or carry out some kind of identification check in order to minimise delays in obtaining personal information from agencies.
It is the responsibility of the agency, not the MP or their electoral staff, to verify the identity of the constituent, but a document such as that in Appendix A may expedite requests for information.
The constituent’s agreement for the agency to disclose information extends only to the issue about which they contacted their MP; personal information given to the MP must be relevant to the constituent’s particular issue.
If the constituent contacted the MP in writing, providing a copy to the agency will help the agency identify the scope of the implied agreement. If the constituent’s contact with the MP was verbal, the scope of the implied agreement will be as set out in the MP’s contact with the agency.
An agency must not disclose the personal information of third parties when it provides information to the MP. The authority to disclose extends only to the personal information of the constituent who has contacted the MP. For example, if a sister contacts her MP complaining that her brother has been refused a driver’s licence, the agency cannot give the MP information about the brother unless the brother agrees.
Current as at: September 19, 2019