Agencies1 are required to comply with the Information Privacy Principles (IPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act).
Under IPP 11, agencies can only disclose personal information2 of one of the exceptions in IPP 11(1) applies. IPP 11(1)(a) allows personal information to be disclosed if the individual was aware that the disclosure was likely to occur.
(1) An agency having control of a document containing an individual's personal information must not disclose the personal information to an entity (the relevant entity), other than the individual the subject of the personal information unless—
(a) the individual is reasonably likely to have been aware or to have been made aware under IPP 2, or under a policy or other arrangement in operation before the commencement of this schedule, that it is the agency’s usual practice to disclose that type of personal information to the relevant entity
Under IPP 2, an agency has to give an individual specific information when collecting information directly from them. This includes:
These obligations are referred to as a 'collection notice'.
For IPP 11 (1)(a), the relevant obligation is whether the agency gave a collection notice that includes details about any entity it is the agency's usual practice to disclose the personal information they were collecting to.
If not, then the agency may not be able to rely on IPP 11(1)(a) to disclose the information.
For more information about collection notices refer to Collection Notices.
Agencies often hold large amount of personal information. This information is not always collected in a way that require the provision of a collection notice. It may not be collected from the individual, for example it may come from other people, entities or agencies, or it may pre-date the IP Act.
This information is not automatically excluded from IPP 11(1)(a). If an agency can establish that the individuals were likely to have been aware that it was the agency's usual practice to disclose their information when the agency collected it, it can form the basis of a disclosure under IPP 11(1)(a).
Individuals might have been aware or made aware of the disclosure by:
An agency must take care when relying on information given to an individual under a policy or other arrangement. If an agency cannot reliably determine whether the individual was advised of the possible disclosures it should not disclose information in reliance on IPP 11(1)(a).
Under IPP 11(1)(a), personal information can be disclosed if the individual was:
The phrase 'reasonably likely to have been aware' requires that the individual was reasonably likely to have known that the agency usually gave the personal information in question to the entity or an entity of a particular type.
This understanding could exist, for example, because it is common knowledge in the individual's community, because of the individual's longstanding relationship with the agency, or because they are part of an industry group that knows this information is routinely disclosed.
Reasonably likely to have been aware will generally arise in relation to information not collected directly from the individual.
When an agency collects information directly from the individual they must give them a collection notice, which will include information about any disclosures that will occur. This means that, when information is collected from the individual, the individual would generally be reasonably likely to have been made aware because of the collection not
The phrase 'reasonably likely to have been made aware' requires the agency to have taken active steps in relation to the individual, or in relation to a class of people of which that individual is part, eg people applying for a licence.
These steps could include:
It is not sufficient that the policy or other arrangement be made passively available to the general public, for example, on an agency's website. The agency must have taken active steps to bring it to the attention of that individual.
Care must be taken to ensure that the method by which the information is provided accords with the abilities of the individual. Provision must be made for the disabled or disadvantaged, or those who have difficulty reading.
If an agency has collected personal information at some point in the past, they cannot rely on IPP 11(1)(a) to disclose personal information by circulating a new policy or notice making people aware that they are now going to start disclosing it.
However, in some circumstances there is a short grace period where the collection notice or policy can be communicated after collection.
IPP 2 requires the collection notice to be given at the time of collection, but if that is not possible it can be given as soon as is practicable thereafter. The same is true where an individual has been made aware under a policy or other arrangement; it must be provided to the individual at the time of collection or as soon as is practicable thereafter.
Where the individual is likely to have been aware, however, rather than have been made aware, for example, by being informed by a community group passing on information from the agency, the awareness must have existed prior to or at the time of the personal information's collection.
At the time the personal information is collected it must be the usual practice of the agency to disclose personal information of that kind to the relevant entity.
Generally, it is an agency’s usual practice to disclose personal information if there is a standing arrangement or obligation under an Act or a regulation to provide that information.
If the disclosure is not the agency's usual practice, then the agency cannot rely on IPP 11(1)(a).
Refer to Collection notices for more information on ‘usual practice to disclose’.
Current as at: September 19, 2019