Privacy and information sharing between agencies

Queensland government agencies¹ must manage personal information in compliance with the privacy principles in the Information Privacy Act 2009 (Qld) (IP Act). This includes when sharing personal information with other Queensland government agencies.

This guideline is intended to assist agencies that are not health agencies to share information with other agencies or health agencies in compliance with the privacy principles. Health agencies,² which are Hospital and Health Services and the Department of Health, should refer to Privacy and information sharing for health agencies.

What is an agency?

For the privacy principles, an agency is a department, local government, or public authority such as the Queensland Law Society, the Crime and Corruption Commission, and Queensland public universities.

What is personal information?

Personal information is any information about an individual who can reasonably be identified.³ All information that fits this definition is personal information, even if it does not seem sensitive or appears to be harmless, unimportant, or trivial.

If the information an agency wants to share is not personal information, the privacy principles do not apply.

Refer to What is personal information? for more information.

What are the privacy principles?

The privacy principles include the Information Privacy Principles (IPPs)—which set out the rules for how agencies collect, store, secure, verify, use and disclose personal information—and the rules about transferring personal information out of Australia.⁴

Sharing personal information generally involves one agency disclosing personal information to a third party;⁵ if that third party is another agency the privacy principles governing collection⁶ will apply to this agency.⁷ Sharing information with non-agency or third parties is not addressed in this guideline.

The privacy principles can support the necessary flow of personal information between agencies, but agencies must consider their privacy obligations before deciding personal information can be shared.

Failure to comply with the privacy principles can erode community trust and goodwill, cause distress and detriment to individuals,  and result in privacy complaints. Privacy complaints which are not resolved by the agency can be escalated to the Office of the Information Commissioner and subsequently to the Queensland Civil and Administrative Tribunal, which can be costly and time consuming.

If disclosure is prohibited by law

The privacy principles do not override provisions of other Acts that prohibit the disclosure of personal information.⁸ If information is subject to confidentiality or secrecy provisions, such as those in the Child Protection Act 1999 (Qld),agencies must refer to the relevant Act to determine if it can be shared.

Benefits of agencies sharing information

Each agency delivers services to the community in accordance with their specific responsibilities. Where these responsibilities overlap and/or interact information sharing between agencies can aid in the efficient and effective targeting of government resources, support, and services.

Information sharing can lead to better informed government decision making and streamline government processes, particularly where the individual would otherwise be providing the same information to related agencies. This can be especially beneficial where the information may be difficult or traumatic to retell.

It can also provide enhanced protections for vulnerable members of the community, such as victims of family violence, by allowing better collaboration between support agencies.

Planning for information sharing

The steps an agency takes when planning to share information will depend on whether it will be one-off or an on-going arrangement.

Ongoing, regular sharing of personal information should be governed by a written agreement⁹ that sets out the parameters of the arrangement, including the grounds on which the sharing is permitted, any limitations on access and use of that information, and a process to address situation where the agreement is not followed. Addressing the below issues in the agreement can assist in ensuring both the transferring and receiving agency meet their privacy obligations:

• Which officers will be involved in sharing the information before, during, and after? Generally, only officers who need to be involved in the process or subsequent use of the personal information should have access to the shared information.
• What is the nature of the information being shared? Is some or all of it sensitive or subject to specific security considerations?
• How is it being shared? This will often depend on the information's form, eg is it copies of paper or digital records or is partial/full access to an agency’s database being given?
• Is the sharing subject to audit or monitoring arrangements to ensure that the proposed objective is being/has been met and that only designated persons are involved in the process?
• Is there a timeframe for review of any long-term sharing arrangement?

Depending on the circumstances and information being shared, a privacy impact assessment (PIA) should be undertaken. A PIA will allow agencies to identify, assess, and manage any risks associated with the information sharing arrangement. Even if a PIA is not developed, assessing the risks associated with the intended information sharing can be an important part of privacy compliance.

One-off information sharing will generally not require a written agreement, but agencies need to consider their privacy obligations, decide whether sharing the information is appropriate, and document the disclosure.¹⁰

For both one-off and ongoing sharing, the disclosing agency and the collecting agency must ensure their compliance with the relevant privacy principles.

Sharing the information

As part of assessing any personal information sharing arrangement, agencies should identify:

• the purpose of sharing the information
• whether the sharing is authorised by an Act
• if disclosure is compliant with the privacy principles; and
• whether the sharing involve transferring it overseas.

A PIA can be useful for assessing and addressing these issues.

What is the purpose of the information sharing?

It is essential that both agencies understand and agree on the purpose of any proposed sharing of personal information. The purpose will determine whether the agency requesting it can do so without breaching the collection IPPs and assist the agency it was requested from to assess whether the personal information can be shared.

Is there an Act that requires or permits the sharing?

If an Act requires or permits the information to be shared, then the sharing will be authorised if it is done in accordance with any specific requirements in that Act.¹³ This may require agencies to assess the Act to ensure its provisions have been complied with.

Disclosure under IPP 11

Sharing personal information with another agency will generally involve disclosing it.¹⁵ Any disclosure of personal information must fall within the circumstances listed in IPP 11(1), which include:

• if the individual was given a notice under IPP 2 that the disclosure would occur
• with the individual's express or implied agreement
• to prevent a serious threat to an individual or the public
• to a law enforcement agency to fulfill one or more enforcement functions; and
• for public interest research.

Refer to the disclosure guidelines for more information.

Transferring information out of Australia

Any information sharing that requires personal information to be transferred out of Australia will need to comply with section 33. This includes where the individual has agreed to the transfer, the transfer is authorised or required by law, or is necessary to prevent a threat to an individual or the public.

For more information refer to Sending personal information out of Australia.

Sharing information in an emergency

The privacy principles provide the necessary flexibility to share information in emergencies and disaster events. This includes allowing personal information to be disclosed to assist in law enforcement activities and to be disclosed and transferred overseas to prevent harm to the public or an individual.

For more information refer to Privacy and managing disaster events, All agencies - Use or disclosure for law enforcement, and All agencies - Use or disclosure to prevent harm.

Other privacy considerations: quality, relevance, security

Agencies are required to take reasonable steps to ensure personal information is accurate, complete, not misleading and up to date.¹⁶ Agencies sharing personal information need to take these reasonable steps before providing it to another agency.

It is important that the information provided is limited only to what is necessary to fulfill the purpose for which the information is being shared¹⁷ and it must be secured appropriately based on its sensitivity.¹⁸

Privacy principle waivers

The IP Act allows for an agency's compliance with the privacy principles to be waived or modified where non-compliance is more in the public interest than compliance. These waivers can allow information sharing that would otherwise be a breach of the privacy principles, for example waiving the privacy principles to permit for information sharing between agencies to settle longstanding Aboriginal land ownership issues.¹⁹

Refer to Power of the Information Commissioner to waive or modify the privacy principles for more information.