Agencies are required to comply with the Information Privacy Principles (IPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act). IPP 11 provides that personal information must not be disclosed outside the holding agency unless one of the exceptions applies.
This guideline explains the circumstances in which an agency can disclose personal information because the individual was told that the disclosure was likely to occur.
(1) An agency having control of a document containing an individual's personal information must not disclose the personal information to an entity (the relevant entity), other than the individual the subject of the personal information unless—
(a) the individual is reasonably likely to have been aware or to have been made aware under IPP 2, or under a policy or other arrangement in operation before the commencement of this schedule, that it is the agency’s usual practice to disclose that type of personal information to the relevant entity
Reasonably likely to have been aware or to have been made aware
The phrase 'reasonably likely to have been aware' requires that the individual was reasonably likely to have known that the agency usually gave the personal information in question to the entity or an entity of a particular type.
The phrase 'reasonably likely to have been made aware' requires that:
- the individual was reasonably likely to have been given a collection notice under IPP 2 by the agency when the personal information was collected
- where relying on a policy or other arrangement, they were reasonably likely to have been made aware by the agency of its existence and content at the time of collection.
It is not sufficient that the policy or other arrangement simply be made available to the general public, for example, on an agency's website. The agency must have taken active steps to bring it to the attention of that individual.
Care must be taken to ensure that the method by which the information is provided accords with the abilities of the individual. Provision must be made for the disabled or disadvantaged, or those who have difficulty reading.
Where the personal information is being collected from the individual concerned, IPP 2 requires that a notice be provided. Where it is collected from a third party a collection notice is not required. However, an agency will have difficulty relying on this IPP where the information was collected from a third party.
From when must the individual have been aware?
Under IPP 2, the time at which the individual has to be given the collection notice is at the time of collection, or, where that is not possible, as soon as is practicable thereafter.
The same is true where an individual has been made aware under a policy or other arrangement. The policy or other arrangement must be provided to the individual at the time of collection or as soon as is practicable thereafter.
Where the individual is likely to have been aware of the practice through some other means, for example, by being informed by a community group communicating information from the agency, the awareness must have existed prior to or at the time of the personal information's collection.
It is not sufficient for an agency to, having collected personal information at some point in the past, disseminate a policy or advertise that personal information of that kind will be disclosed to the relevant entity.
If, after the personal information was collected, an agency decides to introduce a new practice of regularly disclosing the information, it cannot bring that disclosure under IPP 11(1)(a). It will have to rely on one of the other exceptions in IPP 11(1).
Collection notice or under a policy or other arrangement
Collection notices under IPP 2
Understanding the privacy principles – collection notices explains what constitutes a valid collection notice under IPP 2. If a notice given when collecting personal information does not comply with IPP 2 it unlikely to be sufficient to trigger IPP 11(1)(a).
A policy or other arrangement
The privacy principles apply to information that was collected before the IP Act came into effect.
This means that agencies may hold significant collections of personal information that were collected without providing a collection notice under IPP 2. This does not necessarily mean, however, that the people from whom it was collected were not advised that their information might be disclosed to people or bodies outside the agency.
If an agency can establish that people were told their information would be disclosed when it was collected, then that can form the basis of a disclosure under IPP 11.
Individuals might have been aware or made aware of the disclosure by:
- information on a form
- by information contained in correspondence sent to the person
- verbally, by officers of the agency who were collecting it (though there should be some verifiable evidence in case a privacy complaint is made, such as a file note)
- if the information was supplied in response to the request to the general public, by advertising or notices that called for the information or invited people to provide it.
An agency must take care when relying on information given to an individual under a policy or other arrangement. If an agency cannot reliably determine whether the individual was advised of the possible disclosures it should not disclose information in reliance on IPP 11(1)(a).
Usual practice to the relevant entity
At the time the personal information is collected it must be the usual practice of the agency to disclose personal information of that kind to the relevant entity.
Refer to Understanding the privacy principles – collection notices for information on the meaning of ‘usual practice to disclose’. Generally, it is an agency’s usual practice to disclose personal information if there is a standing arrangement or obligation under an Act or a regulation to provide that information. If the disclosure is not a regular disclosure, then the agency cannot rely on IPP 11(1)(a).
Current as at: June 19, 2013