Agencies1 are required to comply with the Information Privacy Principles (IPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act).
Under IPP 11, agencies can only disclose personal information2 of one of the exceptions in IPP 11(1) applies. IPP 11(1)(a) allows personal information to be disclosed if the individual was aware that the disclosure was likely to occur.
(1) An agency having control of a document containing an individual's personal information must not disclose the personal information to an entity (the relevant entity), other than the individual the subject of the personal information unless—
(a) the individual is reasonably likely to have been aware or to have been made aware under IPP 2, or under a policy or other arrangement in operation before the commencement of this schedule, that it is the agency’s usual practice to disclose that type of personal information to the relevant entity
Collection notice or under a policy or other arrangement
Collection notices under IPP 2
Under IPP 2, an agency has to give an individual specific information when collecting information directly from them. This includes:
- why it is being collected
- any legal authority for the collection
- any entity it is the agency's usual practice to disclose it to; and
- anyone that entity will disclose it to.
These obligations are referred to as a 'collection notice'.
For IPP 11 (1)(a), the relevant obligation is whether the agency gave a collection notice that includes details about any entity it is the agency's usual practice to disclose the personal information they were collecting to.
If not, then the agency may not be able to rely on IPP 11(1)(a) to disclose the information.
For more information about collection notices refer to Collection Notices.
A policy or other arrangement
Agencies often hold large amount of personal information. This information is not always collected in a way that require the provision of a collection notice. It may not be collected from the individual, for example it may come from other people, entities or agencies, or it may pre-date the IP Act.
This information is not automatically excluded from IPP 11(1)(a). If an agency can establish that the individuals were likely to have been aware that it was the agency's usual practice to disclose their information when the agency collected it, it can form the basis of a disclosure under IPP 11(1)(a).
Individuals might have been aware or made aware of the disclosure by:
- information on a form
- information contained in correspondence sent to the person
- verbally, by officers of the agency who were collecting it (though there should be some verifiable evidence in case a privacy complaint is made, such as a file note)
- if the information was supplied in response to the request to the general public—by advertising or notices that called for the information or invited people to provide it.
An agency must take care when relying on information given to an individual under a policy or other arrangement. If an agency cannot reliably determine whether the individual was advised of the possible disclosures it should not disclose information in reliance on IPP 11(1)(a).
Reasonably likely to have been aware or to have been made aware
Under IPP 11(1)(a), personal information can be disclosed if the individual was:
- reasonably like to have been aware the disclosure would occur; or
- reasonably likely to have been made aware that the disclosure would occur.
Reasonably likely to have been aware
The phrase 'reasonably likely to have been aware' requires that the individual was reasonably likely to have known that the agency usually gave the personal information in question to the entity or an entity of a particular type.
This understanding could exist, for example, because it is common knowledge in the individual's community, because of the individual's longstanding relationship with the agency, or because they are part of an industry group that knows this information is routinely disclosed.
Reasonably likely to have been aware will generally arise in relation to information not collected directly from the individual.
When an agency collects information directly from the individual they must give them a collection notice, which will include information about any disclosures that will occur. This means that, when information is collected from the individual, the individual would generally be reasonably likely to have been made aware because of the collection not
Reasonably likely to have been made aware
The phrase 'reasonably likely to have been made aware' requires the agency to have taken active steps in relation to the individual, or in relation to a class of people of which that individual is part, eg people applying for a licence.
These steps could include:
- giving the individual a collection notice, or giving them the opportunity to view, read, or listen to it, when collecting their personal information
- ensuring collection notices are present on application and other forms that are available to individuals
- if relying on a policy or other arrangement that informs individuals of the disclosure that will occur—ensuring that the individual was reasonably likely to have been aware of its existence and content when their personal information was collected.
It is not sufficient that the policy or other arrangement be made passively available to the general public, for example, on an agency's website. The agency must have taken active steps to bring it to the attention of that individual.
Care must be taken to ensure that the method by which the information is provided accords with the abilities of the individual. Provision must be made for the disabled or disadvantaged, or those who have difficulty reading.
From when must the individual have been aware?
If an agency has collected personal information at some point in the past, they cannot rely on IPP 11(1)(a) to disclose personal information by circulating a new policy or notice making people aware that they are now going to start disclosing it.
However, in some circumstances there is a short grace period where the collection notice or policy can be communicated after collection.
IPP 2 requires the collection notice to be given at the time of collection, but if that is not possible it can be given as soon as is practicable thereafter. The same is true where an individual has been made aware under a policy or other arrangement; it must be provided to the individual at the time of collection or as soon as is practicable thereafter.
Where the individual is likely to have been aware, however, rather than have been made aware, for example, by being informed by a community group passing on information from the agency, the awareness must have existed prior to or at the time of the personal information's collection.
Usual practice to disclose to the relevant entity
At the time the personal information is collected it must be the usual practice of the agency to disclose personal information of that kind to the relevant entity.
Generally, it is an agency’s usual practice to disclose personal information if there is a standing arrangement or obligation under an Act or a regulation to provide that information.
If the disclosure is not the agency's usual practice, then the agency cannot rely on IPP 11(1)(a).
Refer to Collection notices for more information on ‘usual practice to disclose’.
- 1 In this guideline, agency includes Ministers and bound contracted service providers to the agency, but does not include health agencies as health agencies must comply with the National Privacy Principles.
- 2 Any information or opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
Current as at: September 19, 2019