key privacy concepts - permitted general and health situations

Overview

Under the Information Privacy Act 2009 (Qld) (IP Act), agencies must comply with the Queensland Privacy Principles (QPPs).

The Key Privacy Concepts guidelines are intended to assist agencies by explaining important words and phrases used in the QPPs, the IP Act, and the Right to Information Act 2009 (Qld) (RTI Act).

Restrictions on collection, use and disclosure of personal information

QPP 3 regulates the collection by agencies of solicited personal information, including sensitive information. QPP 6 governs when an agency may use or disclose personal information.

QPP 3 relevantly provides that agencies may only collect ‘sensitive information’ with the consent of the individual concerned. Under QPP 6, agencies can only use or disclose personal information for a particular purpose for which the information was collected (the ‘primary purpose’).

Each of the above restrictions – on collecting sensitive information, and using or disclosing personal information – are subject to exceptions. These exceptions include where a ‘permitted general situation’, or a ‘permitted health situation’ applies. These ‘permitted situations’ contain a number of grounds, under which a given collection of sensitive information, or secondary use or disclosure of personal information, will be permissible.

Under QPP 6.2(c), all agencies can use or disclose personal information for a secondary purpose, in a permitted general situation.

Additionally, for health agencies only, QPP 6.2(d) allows a health agency to use and disclose, and QPP 3 to collect, health information in a permitted health situation.

Permitted general situations

The permitted general situations set out in schedule 4, part 1 of the IP Act apply to the collection of sensitive information and the use and disclosure of personal information by all agencies. They arise where:

• the agency reasonably believes that the collection, use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of an individual or to public health or safety and it is unreasonable or impracticable to obtain the individual's consent
• the agency has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the agency's functions or activities has been, is being or may be engaged in and reasonably believes that the collection, use or disclosure is necessary in order for the agency to take appropriate action in relation to the matter
• the agency reasonably believes that the collection, use or disclosure is reasonably necessary to assist an entity to locate a person who has been reported as missing and the collection, use or disclosure complies with a guideline in effect under chapter 3, part 2.
• the collection, use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim; or
• the collection, use or disclosure is reasonably necessary for the purposes of a confidential alternative dispute resolution process.

Permitted health situations

The permitted health situations set out in schedule 4, part 2 of the IP Act apply to the collection, use, and disclosure of health information.¹ Only health agencies can rely on a permitted health situation.

Provision of a health service

A permitted health situation arises where it is necessary to provide a health service to an individual and:

• the collection of health information is required or authorised under an Australian law, or the individual would reasonably expect the health agency to collect the information for that purpose
• the health information is a family medical history, social medical history, or other relevant information about the individual or another individual and it is collected from the individual receiving the health service or a responsible person for the individual; or
• health information is disclosed to a person responsible for an individual who cannot give or communicate consent because it is necessary to provide them with appropriate care or treatment or for compassionate reasons, and the disclosure is not contrary to the individual's wishes.

Research

A permitted health situation also arises where:

• health information is collected for public health or safety research or statistics, or the management, funding or monitoring a health service in the circumstances set out in schedule 4, part 2, section 3
• health information is used for public health or safety research or statistics, or the management, funding or monitoring a health service and it is impracticable to obtain consent; or
• health information is disclosed for public health or safety research or statistics, or the management, funding or monitoring a health service, it is impracticable to obtain consent, and the health agency reasonably believes the receiving entity will not disclose the health information or personal information derived from the health information.

The use or disclosure must be conducted in accordance with guidelines approved by the chief executive of the health department.

Refer to QPP 3 & 6 Health agencies – collection, use and disclosure of health information for more information.