QPP 3 and 6 - unlawful activity and serious misconduct

Overview

All Queensland government agencies must¹ handle personal information in accordance with the Queensland Privacy Principles (QPP) in the Information Privacy Act 2009 (Qld) (IP Act).

What is personal information?

Section 12 of the IP Act provides that personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether it's true or recorded in a material format.

The individual does not need to be directly identified in the information for it to be personal information. It is sufficient if they can reasonably be identified by reference to other information.

The personal information of one individual may also be the personal information of other individuals. OIC refers to this as mutual personal information, and examples include a marriage certificate, which contains personal information of both parties to a marriage, or a vocational reference that includes personal information about both the author and the subject of the reference.

Refer to Key privacy concepts – personal and sensitive information for more information.

Collection of sensitive information

An agency cannot collect sensitive information without consent unless one of the exceptions in QPP 3.4 applies.

Refer to QPP 3 – collection of personal information for more information.

Use and disclosure

An agency can use or disclose personal information for the reason it was collected (the primary purpose). An agency can only use or disclose personal information for a secondary purpose as set out in QPP 6.

Use and disclosure are both defined in the IP Act. Use and disclosure are both defined in the IP Act. Refer to Key privacy concepts – use and disclosure for more information.

Permitted general situations

Under QPP 3.4 an agency can collect sensitive information without consent, and under QPP 6.2(c) an agency can use or disclose personal information for a secondary purpose if a permitted general situation applies. The permitted general situations are listed in schedule 4, part 1 of the IP Act.

Collection, use and disclosure for unlawful activity or misconduct

An agency can collect sensitive information without consent, or use and disclose personal information where the agency:

• has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the agency's functions or activities has been, is being or may be engaged in; and
• reasonably believes that the use or disclosure is necessary for the agency to take appropriate action in relation to the matter.²

Reasonably necessary

The collection, use or disclosure must be reasonably necessary. Whether it is reasonably necessary is an objective test: would a reasonable person who is properly informed agree that the collection, use or disclosure is necessary. The onus lies with the agency to justify that the particular collection, use or disclosure was reasonably necessary.

This requires the agency to consider whether the collection, use or disclosure will actually assist in achieving the purpose. Generally the agency must:

• be satisfied that there is a link between the proposed collection, use or disclosure and the purpose; and
• establish that the link is sufficient to make the collection, use or disclosure of information reasonably necessary.

The information need not be essential or critical to the activity, but it must be more than just helpful or expedient.

It is important to take a practical approach when making this determination. If an agency cannot in practice effectively pursue or perform a function without collecting, using or disclosing information, collection, use or disclosure will generally be considered reasonably necessary for that function or activity.

However, if there are reasonable alternatives available, for example, if deidentified information would be sufficient for the function or activity, it will be more difficult to establish.

Agencies cannot solely rely on normal business practice in assessing whether collection, use or disclosure is reasonably necessary. The primary consideration is whether, in the specific circumstances, the collection, use or disclosure is reasonably necessary.

Appropriate action

The action an agency reasonably believes is necessary must be an appropriate action to take in relation to the matter. This will depend on:

• the nature of the suspected unlawful activity or misconduct; and
• the nature of the action the agency proposes to take.

Appropriate action could include investigating the unlawful activity or serious misconduct, taking disciplinary action in relation to the unlawful activity, reporting the activity to the police, the Crime and Corruption Commission, or another relevant person or authority.

If the agency reasonably believes it cannot effectively investigate the serious misconduct or unlawful activity without collecting, using or disclosing information, this permitted general situation will generally apply.

Related to the agency’s functions or activities

The unlawful activity or serious misconduct must relate to the agency's functions. Generally, this will involve serious misconduct or unlawful activity undertaken by an agency’s employees.

If the unlawful activity or serious misconduct relates entirely to an employee’s private activities, eg the agency discovers the employee participated in illegal fishing while on holiday, or engaged in serious misconduct in their role as Treasurer of a private club, it cannot rely on this permitted general situation.

However, if the agency becomes aware that a non-employee, eg a contracted service provider, has engaged in serious misconduct or unlawful activity which relates to its functions or activities, the agency could rely on it.

The function of an agency may be broadly defined under an Act and refined by Regulation, departmental or Council policy, Ministerial direction, government strategies or arrangements, or whole of government or whole of sector policies. Identifying an agency’s functions requires a consideration of the instruments that confer, describe, or apply to the agency’s responsibilities and obligations. These can include:

• Acts and subordinate legislative instruments
• the Administrative Arrangements Orders
• government decisions or Ministerial statements that announce a new government function
• the agency’s Publication Scheme; and
• the agency’s Annual Report.

The activities of an agency will be related to its functions and include incidental and support activities, such as human resource, corporate administration, property management and public relations activities.

When considering whether something falls within a function or activity of the agency, one starting point is to ask: 'can the agency legitimately do this' or 'is this within the agency's mandate'. This includes not just the agency's outward facing mandates, ie the functions it carries out for the community, but its inward facing ones, ie the functions it carries out with regards to its staff.

Unlawful activity or serious misconduct

Unlawful activity

Unlawful activity generally means criminal activity, illegal activity, or activity prohibited or proscribed by law. It can include unlawful discrimination or harassment but does not include breach of a contract.

There is a crossover between unlawful activity and serious misconduct, which means in some instances an action may be both.

Serious misconduct

Serious misconduct refers to serious breaches of standards of conduct associated with a person’s duties, and includes:

• corruption, abuse of power, or dereliction of duty
• breach of obligations that would warrant the taking of enforcement action against the person
• breach of trust
• breach of discipline; or
• other seriously reprehensible behaviour.

It does not include minor breaches or transgressions.

Whether the actions of an agency employee constitute serious misconduct will generally involve a failure to comply with relevant laws and standards, for example:

• corrupt conduct under the Crime and Corruption Act 2001 (Qld)
• misconduct under the Police Service Administration Act 1990 (Qld) or the Public Sector Act 2022 (Qld)
• other conduct under section 91 of the Public Sector Act 2022 (Qld) where it is serious and improper
• misconduct or corrupt conduct under the Local Government Act 2009 or breach of a Code of Conduct issued under that Act.
• a breach of the Public Sector Ethics Act 1994 (Qld) or of a Code of Conduct under that Act; or
• a criminal offence.

Misconduct of this type may also be set out in agency or sector specific laws.