QPP 3 and 6 - locate a missing person

Overview

All Queensland government agencies¹ must handle personal information in accordance with the Queensland Privacy Principles (QPPs) in the Information Privacy Act 2009 (Qld) (IP Act).

This guideline is based on and includes material from the Australian Privacy Principle guidelines developed by the Office of the Australian Information Commissioner.

What is personal information?

Section 12 of the IP Act provides that personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether it's true or recorded in a material format.

The individual does not need to be directly identified in the information for it to be personal information. It is sufficient if they can reasonably be identified by reference to other information.

The personal information of one individual may also be the personal information of other individuals. OIC refers to this as mutual personal information, and examples include a marriage certificate, which contains personal information of both parties to a marriage, or a vocational reference that includes personal information about both the author and the subject of the reference.

Sensitive information is a category of personal information defined in schedule 5 of the IP Act.

Refer to Key privacy concepts – sensitive and personal information for more information.

Collection of sensitive information

An agency must only collect sensitive information with consent unless one of the exceptions in QPP 3.4 applies.

Refer to QPP 3 – collection of personal information for more information.

Use and disclosure

An agency can use and disclose personal information for the reason it was collected (the primary purpose). An agency can only use or disclose personal information for a secondary purpose as set out in QPP 6.

Use and disclosure are both defined in the IP Act. Refer to Key privacy concepts – use and disclosure for more information.

Permitted general situations

Under QPP 3.4 an agency can collect sensitive information without consent, and under QPP 6.2(c) an agency can use or disclose personal information for a secondary purpose, if a permitted general situation applies. The permitted general situations are listed in schedule 4, part 1 of the IP Act.

Collecting, using or disclosing personal information to locate a missing person

An agency can collect sensitive information without consent, and use or disclose personal information if:

• an agency reasonably believes that collection, use or disclosure is reasonably necessary to locate a person reported as missing; and
• the collection, use or disclosure complies with a guideline issued by the Commissioner.²

Reasonably believes and reasonably necessary

Sensitive information can only be collected, and personal information can only be used or disclosed to locate a missing person if the agency reasonably believes that it is reasonably necessary. Agencies must have sufficient information to make that determination.

If the agency contemplating collection, use or disclosure for this purpose is not a locating body, its reasonable belief that collecting, using or disclosing personal information is reasonably necessary should be based on a request from a location body.

The onus will be on the agency to demonstrate that it reasonably believed that the collection, use or disclosure was reasonably necessary. They must ensure they have sufficient information to make that determination. Personal information must not be disclosed to a locating body just because they ask.

Whether collection, use or disclosure is reasonably necessary is an objective test: would a reasonable person who is properly informed agree that the collection, use or disclosure is necessary.

If there are reasonable alternatives available, for example, if deidentified information would be sufficient, it will be more difficult to establish.

Agencies cannot solely rely on normal business practice in assessing whether collection, use or disclosure is reasonably necessary. The primary consideration is whether, in the specific circumstances it is reasonably necessary.

Collection, use or disclosure will not be considered necessary where it is merely helpful, desirable or convenient.

Compliance with guideline issued by the Information Commissioner

Any collection of sensitive information, or use and disclosure of personal information to locate a missing person must also comply with any OIC guidelines issued under chapter 3, part 2 of the IP Act.

Person reported as missing

Person reported as missing means an individual:

• who has been reported as missing to a locating body that does not know the individual’s whereabouts, and
• who is being sought by the locating body because there are serious concerns for their safety and/or welfare or for the purpose of re-uniting them with their family.

Family includes:

• someone who would be an eligible family member if the person was deceased
• a de facto partner of the individual
• someone who is the child of the individual, or of whom the individual is the child
• anyone else who would be a member of the individual’s family if someone mentioned above is taken to be a member of the individual’s family.

Person reported as missing does not include an individual who is being sought:

• in relation to legal matters, including but not limited to, debt, maintenance, support proceedings, wills, child custody, divorce or investigations into suspected criminal activity of the individual; or
• for the purpose of genealogical research.

Locating body

A locating body means:

• the Australian Federal Police
• a police force or service of a State or Territory
• the Salvation Army Family Tracing Service
• the Australian Red Cross Tracing Service
• International Social Service Australia
• a Link-Up Service of a State or Territory; or
• the Department of Foreign Affairs and Trade.

Personal information must only be disclosed under schedule 4, part 1, section 1(c) to a locating body.

Impracticable or unreasonable to obtain consent

If the whereabouts of the person reported as missing are unknown to the agency, it will not be possible to obtain their consent.

If the agency knows the whereabouts or contact details of the person reported as missing, it must be satisfied that obtaining their consent is impracticable or unreasonable before relying on schedule 4, part 1, section 1(c).

It may be impracticable or unreasonable to obtain consent where, for example:

• the situation is urgent
• the individual cannot be contacted, eg they are in a remote location with limited ability to receive communications; or
• the inconvenience, time and cost involved in obtaining consent. However, it is not unreasonable or impracticable to obtain consent just because it would be inconvenient, time-consuming or impose some cost. Whether those factors make it impracticable to obtain consent will depend on whether the burden is excessive in all the circumstances.

Contrary to the wishes of the individual

Personal information must not be collected, used or disclosed under schedule 4, part 1, section 1(c) If the agency is aware of any wishes to the contrary which have been expressed by the individual.

Must not pose a serious threat to an individual

Agencies must not collect, use or disclose personal information under schedule 4, part 1, section 1(c) if there is a reasonable belief that doing so would pose a serious threat to the life, health or safety of any individual.³

The minimum information required

Agencies must ensure they only collect, use or disclose information to the reasonably necessary extent to make contact with, or to offer proof of life of, the person reported as missing.