QPP 2 - dealing anonymously with an agency

Overview

All Queensland government agencies¹ must handle personal information in accordance with the Queensland Privacy Principles (QPPs) in the Information Privacy Act 2009 (Qld) (IP Act).

This guideline is based on and includes material from the Australian Privacy Principle guidelines developed by the Office of the Australian Information Commissioner.

What is personal information?

Section 12 of the IP Act provides that personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information is true or recorded in a material format.

The individual does not need to be directly identified in the information for it to be personal information. It is sufficient if they can reasonably be identified by reference to other information.

Refer to Key privacy concepts – personal and sensitive information for more information.

QPP 2 – anonymity and pseudonymity

QPP 2 provides that individuals must have the option of dealing with an agency anonymously or by pseudonym. However, an agency is not required to give individuals this option:

• if the agency is required or authorised under an Australian law or court or tribunal order to deal with identified individuals, who have identified themselves;
• where it is impracticable to deal with individuals who have not identified themselves or use a pseudonym.

Agencies should ensure that, where appropriate, individuals are made aware that they can deal anonymously or pseudonymously with the agency.

Anonymity vs pseudonymity

Anonymity

Anonymity means that the individual dealing with an agency cannot be reasonably identified, and the agency does not ask them for personal information or information that might identify them. The agency should not be able to identify the individual at the time of the dealing or subsequently.

Anonymous dealings include an unidentified individual telephoning an agency to make general enquiries or seek general advice or information or lodging an anonymous complaint using an online form.

Pseudonymity

Pseudonymity means that the individual gives the agency a name, term, or descriptor instead of their actual name (a pseudonym).

Examples include using an email address that does not contain the individual’s actual name, a username that a person chooses when creating an online account or filling out an online form, or a caller to an agency who identifies themself using something other than their name, e.g., a nickname or the name of a fictional character.

The use of a pseudonym does not mean that an individual cannot be identified, particularly if the individual uses a consistent pseudonym or their email or phone number has been used in identified agency interactions. A pseudonymous individual may also choose to divulge their identity or may volunteer identifying information where doing so is necessary to implement their request or transaction.

However, the object of QPP 2 is to give individuals the opportunity to deal with the agency without revealing their identity. Personal information should only be linked to a pseudonym where required or authorised by law or a court or tribunal order, it is impracticable for the entity to act differently, or the individual has consented to providing or linking the additional personal information.

Providing anonymous and pseudonymous options

Agencies should ensure that anonymous and pseudonymous options are available to individuals, and that individuals are made aware of this option.

This does not apply where:

• anonymity or pseudonymity is already the default option
• agencies are required or authorised to deal with identified individuals; or
• there is no practicable way for the individual to deal anonymously or pseudonymously with the agency.

The steps an agency should take to draw both options to the attention of individuals will depend on the nature of the dealing between the agency and an individual. One method is to include this information in the agency’s QPP Privacy Policy.² The privacy policy could set out:

• the circumstances in which an individual can deal anonymously or by pseudonym with the agency
• how the individual can deal anonymously or pseudonymously with the agency
• any potential negative consequences of dealing anonymously or pseudonymously with the agency, e.g., the agency cannot follow up on or provide outcomes for a complaint made anonymously; and
• the circumstances in which an individual cannot deal anonymously or pseudonymously with the agency and the reasons why they cannot.

If the agency has a procedure for managing pseudonyms and any linked personal information, this could also be included.

Other measures that can facilitate anonymous and pseudonymous dealing include:

• if the agency provides a facility on its website for online communication it can include a prominent statement advising individuals that they do not need to identify themselves when using it. This includes ensuring personal information fields in online forms are not mandatory.
• if telephone calls to the entity are routed through an automated message, informing callers in that message that they are not required to provide personal information
• if the agency solicits public submissions or comments, it could explicitly allow individuals to use a pseudonym that will be published, even if the individual’s name is supplied confidentially to the entity
• when otherwise dealing with an individual, if it can be conducted anonymously or pseudonymously the agency could advise the individual at the beginning of the dealing.

Where identification is authorised or required

An agency is not required to offer anonymous or pseudonymous option where it is authorised or required to deal with an identified individual. Generally, the authorisation or requirement must arise from a law, or orders from a court or tribunal,

If an agency is authorised to deal with identified individuals, the agency may have the discretion to allow the individual to be anonymous or pseudonymous. If the agency is required by law to deal only with identified individuals, there is no discretion.

The nature of any discretion, and whether it is appropriate to rely upon it, will depend on the source of the authority or requirement and the nature of the dealing.

Situations where an agency would only be able to deal with an identified individual include:

• processing an individual’s application for an identity document, licence, or approval
• processing a claim for, or paying a benefit to, an individual.
• providing assistance to an individual who has been diagnosed with a disease that must be recorded and notified under a public health law
• providing assistance to a suspected victim of child abuse, whose injury is covered by a mandatory reporting requirement.
• discussing the individual’s personal information with them
• processing access or amendment applications which include the individual’s personal information under the Right to Information Act 2009; or
• giving the individual administrative access to their personal information.

Where the agency can only deal with an identified individual, it should ensure it collects only the minimum amount of personal information required to meet its obligations. For example, if the individual is required to provide identification documents, the agency should determine if the requirement can be met by sighting the documents instead of taking a copy and putting procedures in place to do so. This aligns with QPP 3, which requires agencies to only collect personal information that is reasonably necessary for one or more of their functions or activities.³

Requiring identification where it is impracticable not to

Agencies are not required to allow anonymous or pseudonymous dealing where it is impracticable to deal with individuals who have not identified themselves.

It may be impracticable for an agency to deal with an individual who is not identified where, for example:

• the individual is making a complaint about how their case was handled or how staff of an agency behaved towards them. Without knowing who the complainant is, the agency would generally not be able to investigate and resolve it.
• an individual wants information or products posted or delivered; the agency will generally need to know the individual’s address but may not need their name
• the individual is seeking health care or a health service from the public health system.

In limited circumstances it may be open to an agency to rely on the impracticability exception where the burden of the inconvenience, time, and cost of dealing with anonymous or pseudonymous individuals, or of changing existing systems or practices to include the option of anonymous or pseudonymous dealings, would be excessive in all the circumstances. However, this would generally only be a transactional, rather than an ongoing or permanent justification.

Unless an entity is required or authorised to deal with individuals who have identified themselves, agencies are expected to design and maintain information collection systems that incorporate anonymous and pseudonymous options.

Where it is impracticable to facilitate anonymous or pseudonymous dealings, agencies must ensure they collect only the minimum personal information required for the dealing. This is consistent with the obligation in QPP 3.