QPP 5 - What to tell people when collecting personal information

Overview

All Queensland government agencies¹ must handle personal information in accordance with the Queensland Privacy Principles (QPP) in the Information Privacy Act 2009 (Qld) (IP Act).

This guideline is based on and includes material from the Australian Privacy Principle guidelines developed by the Office of the Australian Information Commissioner.

What is personal information?

Section 12 of the IP Act provides that personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information is true or recorded in a material format.

The individual does not need to be directly identified in the information for it to be personal information. It is sufficient if they can reasonably be identified by reference to other information.

Refer to Key privacy concepts – personal and sensitive information for more information.

QPP 5 – Informing individuals when collecting their personal information

When an agency collects personal information, QPP 5 requires it to take reasonable steps to inform the individual, or make them aware, of the matters listed in QPP 5.2 (referred to as QPP 5 matters).

Directly or from a third party

The obligation applies whether the agency collects personal information directly from the individual or from a third party.

Solicited or unsolicited

The obligation in QPP 5 applies to solicited personal information and to any unsolicited personal information which is not deidentified or destroyed under QPP 4.

Refer to QPP 3 – Collection of solicited personal information and QPP 4 – Dealing with unsolicited personal information for more information.

The QPP 5 matters²

Agencies that collect personal information must take reasonable steps to tell the individual, or make them aware of:

• the identity and contact details of the agency
• if the personal information is collected from someone other than the individual, or the individual may not be aware that it has been collected—the fact and circumstances of the collection
• whether the collection is required or authorised by or under an Australian law, including the name of the law or court/tribunal order including details of the order
• the purposes of collection
• the main consequences (if any) for the individual if the personal information is not collected
• the agency’s usual disclosures of this kind of personal information
• information about the agency’s QPP privacy policy including how to access and amend personal information held; and
• whether the agency is likely to disclose personal information to overseas recipients, and if practicable, the countries where they are located.

Identity and contact details and the QPP privacy policy

The most appropriate contact details will generally be the agency’s privacy officer or privacy team unless the collection relates to a project or other undertaking with a designated privacy contact. Agencies should consider creating a generic privacy phone number and/or email address, to ensure it remains accurate in the event of staff changes.

If the agency is communicating in writing with an individual, it can include a link to the QPP privacy policy. Where communication is verbal, the agency officer should explain how to find the policy on the website.

Fact and circumstances of the collection

Fact and circumstances of collection includes:

• the fact that agency is collecting, or has collected, the personal information
• if personal information was not collected directly from the individual—how, when, and from where it was collected.

Whether it was required or authorised by law or order

Collection of personal information does not need to be required or authorised by an Australian law or court/tribunal order. However, where it is, details of that law or order must be included in the QPP 5 notice or otherwise communicated to the individual as required by QPP 5. This includes:

• the name of the law, e.g., the Act, Regulation, or other instrument³ or details of the order; and
• the specific provision that covers the collection unless it is not practicable to do so.

The purposes of collection

This purpose of collection is the specific function or activity for which the agency is collecting the personal information—this is the primary purpose (or purposes). The primary purpose determines what the agency can do with the information and may also contribute to whether it can be used or disclosed for a secondary purpose.⁴

An agency should not collect personal information, whether from the individual or a third party, without a purpose that complies with QPP 3.⁵

The purpose needs to be clearly stated and not simply refer to a broad function of the agency. The aim is to provide enough information for the individual to understand why the information is being collected and what it will be used and/or disclosed for. However, there is no need to include information about internal purposes which are part of ordinary business practices, such as auditing, planning, or de-identifying personal information.

The amount of detail required will vary depending on the circumstances. If, for example, the individual is filing out an agency form, the form’s title may be sufficient to inform the individual of the purpose. Alternatively, a more detailed notice may be needed where the information being collected will be used for more than one purpose.

If the agency knows it is likely to use or disclose the personal information for secondary purpose, it should consider including them. This may assist with establishing the reasonable expectation required for use or disclosure under QPP 6.2(a).

Determining the purpose of collection

Where the agency collects personal information directly from an individual, the context will often make it clear why it is being collected, e.g., the individual provided it to apply for a specific service or is responding to questions as part of an investigation.

Where personal information is collected from a third party, identifying the function or activity for which the agency requires the information will assist in determining the purpose of collection.

When an agency is dealing with unsolicited personal information it has decided to retain under QPP 4,⁶ there will be no primary purpose of collection. Instead, the agency should consider why it has retained it and include that information when advising the individual of the QPP 5 matters.

Any consequences if the information is not collected

Individuals must be informed if there are any consequences for not providing their information to the agency. This will generally only be relevant where the agency is collecting personal information directly from the individual or from a direct representative of the individual, e.g., a parent or guardian, or when seeking the individual's consent to collect their personal information from a third party, e.g., a health care provider.

The agency does not need to list out every possible consequence, just the significant consequences that could be expected to result. If the individual can avoid or lessen those consequences, for example by only providing some information or a different kind of information, this should be explained.

Consequences for not providing information could include:

• the agency not being able to process an application for a licence, permit, allowance or concession
• the agency not being able to properly investigate or resolve an individual’s complaint; or
• the agency only being able to provide a lesser or different level of service.

Usual disclosure of information, including overseas disclosures

When collecting their information, agencies must inform individuals of any entity it will usually be disclosed to.

Agencies are not required to include details of every possible disclosure it can imagine occurring. The obligation only covers disclosures an agency knows will, or are highly likely to, occur, because that is what the agency usually does with this kind of personal information. This may be, for example, because of a standing arrangement or a legislative obligation. It is not an agency’s usual practice to disclose information if it only does so in response to irregular requests or exceptional cases.

If the entities to which the agency usually discloses personal information are located outside of Australia, the agency must include that fact, along with the countries they are located in.

Reasonable steps

QPP 5 requires agencies to take reasonable steps to tell individuals, or ensure they are aware of, the QPP 5 matters. What constitutes reasonable steps will vary depending on the circumstances, including:

• The sensitivity of the personal information collected. If an agency collects sensitive information as defined by the IP Act or information that would generally be seen as sensitive, it may need to take more rigorous steps.
• Any possible adverse consequences an individual could face as a result of agency collecting their personal information. The greater the risk of adversity, the more rigorous steps an agency may need to take.
• Whether the individual, due to their circumstances, could find the QPP 5 matters difficult to understand. Extra steps may be required to ensure they are aware of what they mean, e.g., translating them into other languages, providing a ‘plain English’ version, or offering them in different formats.
• The practicability, including time and cost involved. However, an agency cannot avoid their QPP 5 obligations just because it would be inconvenient, time-consuming or impose some cost to do so. Whether those factors make it unreasonable to take particular steps will depend on whether the burden is excessive in all the circumstances.

Some examples of reasonable steps an agency could take include:

• When collecting personal information directly from the individual on a form or website, clearly and prominently displaying the QPP 5 matters in the form or providing a readily accessible and prominent link to a QPP 5 notice.
• If an agency regularly collects personal information from individuals over the phone, having an automated message that explains the QPP 5 matters, or gives the individual the option to hear the QPP 5 matters, or giving staff who answer the phones a script they can use at the beginning of any calls.
• If an agency collects personal information verbally from individuals, whether over the phone or in person, having a brochure, fact sheet, template email or webpage that explains the QPP 5 matters and putting processes in place to ensure it is sent to the individual as soon as possible afterwards.
• If an agency uses a third party to collect personal information, ensuring the third party notifies or makes individuals aware of the QPP 5 matters on its behalf (e.g., as part of the contract)

When not taking any steps might be reasonable

The obligation in QPP 5 is not absolute. It only requires an agency to take reasonable steps to notify the individual of the QPP 5 matters that are reasonable in the circumstances. In some circumstances, there may be no reasonable steps an agency can take or no reasonable steps it needs to take, for example where:

• The agency knows that the individual is already aware that personal information is being collected, the purpose of collection and other QPP 5 matters relating to the collection.
• The agency has regularly collected the same kind of personal information from the same individual for the same reason and they were given a QPP 5 notice⁷ at the original collection. Note, however, that if circumstances change or a long period of time has elapsed since the original notice, meaning the individual may no longer be aware of relevant QPP 5 matters, the agency may need to give them a new QPP 5 notice or otherwise make them aware.
• Notification could pose a serious threat to the life, health, safety, or welfare of an individual or pose a threat to public health, safety or welfare, for example, where a law enforcement agency collects personal information from a confidential source as part of an investigation.
• Notification could jeopardise the purpose of collection or the integrity of the personal information collected and there is a clear public interest in the purpose of collection, for example, a law enforcement agency undertaking lawful covert surveillance of an individual in connection with a criminal investigation.
• Notification would be inconsistent with other legal obligations, for example, where doing so would breach a confidentiality or secrecy provision, violate legal professional privilege, or be a breach of confidence.
• An agency collects personal information about an individual who poses (or is alleged to pose) a risk of committing family violence and this collection is permitted by a legislated family violence information sharing scheme
• The impracticability of notification, including where the time and cost of doing so outweighs the privacy benefit of notification. For example: where an agency collects next of kin or emergency contact information, it would generally be reasonable for the entity to take no steps to notify the individual that it had collected personal information; or where an individual provides unsolicited personal information about a third party,⁸ e.g., as part of a complaint or dispute resolution process, it would generally be reasonable for the entity to take no steps to notify the third party, particularly if the agency won’t rely on it when investigating or resolving the matter.
• The personal information was provided by a third party and the agency does not have the individual’s contact details.

When to provide the QPP 5 matters

When collecting directly from the individual, agencies should take reasonable steps to inform the individual or make them aware of the QPP 5 matters before or when they collect personal information. This allows the individual to make an informed choice about whether to give their personal information to the agency.

If this is not practicable, or if the agency is collecting personal information from a third party, the reasonable steps should be taken as soon as practicable after the information has been collected.

For unsolicited personal information that the agency determines cannot be destroyed or deidentified under QPP 4, the reasonable steps should be taken as soon as practicable after the determination is made.

Examples of when it may not be practicable to take reasonable steps at or before the time of collection include where:

• urgent collection of the personal information is required and giving a notice or ensuring awareness would unreasonably delay the collection, for example, where there is a serious threat to an individual’s life or health or to public safety or in the context of providing an emergency service; or
• the medium through which personal information is collected makes it impracticable to provide a detailed QPP 5 notice or ensure awareness at or before the time of collection. For example, where personal information is collected by telephone, it may be impracticable to notify or ensure the individual is aware of all of the QPP 5 matters at the time of collection.

Whether there are any reasonably practicable steps is an objective test and an agency should ensure that it is able to demonstrate that there were none it could take. Conducting a privacy impact assessment is a useful mechanism to record those reasons. Options for providing early notification or ensuring awareness should, where practicable, be built into information collection processes and systems – for example, by including relevant information in standard forms and online collection mechanisms.

If notification does not occur before or at the time of collection, the agency must take reasonable steps to provide notification, or ensure the individual is aware, as soon as practicable after the collection. In adopting a timetable that is ‘practicable’, the agency can take technical and resource considerations into account. However, it will be up to the agency to justify any delay in notification.

How to provide the QPP 5 matters

An agency is not required to provide a formal QPP 5 notice. It can notify or make individuals aware of the QPP 5 matters using any appropriate method. This creates flexibility for agencies to provide this information in the way that best suits the agency, the individuals, and the circumstances of collection.

The QPP 5 matters can roughly be divided into:

• general information about the agency’s practices; and
• specific information about the personal information being collected.

Given this divide, agencies could consider meeting their obligations through a two-part process, e.g.:

• including brief notices on forms that cover the specific information being collected; and
• creating webpages and/or brochures that provide an expanded notice containing the QPP 5 matters, with the link included on, or the brochure included with, the form.

Refer to QPP 5 - Collection notices for more information.