QPP 6 Use and disclosure for a related purpose

Overview

All Queensland government agencies must¹ handle personal information in accordance with the Queensland Privacy Principles (QPPs) in the Information Privacy Act 2009 (Qld) (IP Act).

This guideline is based on and includes material from the Australian Privacy Principle guidelines developed by the Office of the Australian Information Commissioner.

What is personal information?

Section 12 of the IP Act provides that personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether it's true or recorded in a material format.

The individual does not need to be directly identified in the information for it to be personal information. It is sufficient if they can reasonably be identified by reference to other information.

The personal information of one individual may also be the personal information of other individuals. OIC refers to this as mutual personal information, and examples include a marriage certificate, which contains personal information of both parties to a marriage, or a vocational reference that includes personal information about both the author and the subject of the reference.

Refer to Key privacy concepts – personal and sensitive information for more information.

Use and disclosure

An agency can use and disclose personal information for the reason it was collected (the primary purpose). An agency can only use or disclose personal information for a secondary purpose as set out in QPP 6.

Use and disclosure are both defined in the IP Act. Use and disclosure are both defined in the IP Act. Refer to Key privacy concepts – use and disclosure for more information.

QPP 6 – Use and disclosure for a secondary purpose

Under QPP 6.2(a), an agency can use or disclose personal information for a secondary purpose if the individual would reasonably expect it to use or disclose the information for the secondary purpose, and:

• for sensitive information, the secondary purpose is directly related to the primary purpose; or
• for all other personal information, the secondary purpose is related to the primary purpose.

Sensitive information

Sensitive information is a defined category of personal information. It includes any of the following:

• the individual’s racial or ethnic origin
• the individual’s political opinions
• the individual’s membership of a political association
• the individual’s religious beliefs or affiliations
• the individual’s philosophical beliefs
• the individual’s membership of a professional or trade association
• the individual’s membership of a trade union
• the individual’s sexual preferences or practices; or
• the individual’s criminal record.

It also includes health information held by a health agency.

Would the individual reasonably expect the secondary purpose

QPP 6.2(a) requires that the individual would reasonably expect their information to be used or disclosed for the secondary purpose.

The reasonably expects test is an objective one that has regard to what a reasonable person who was properly informed would expect in the circumstances. It’s a question of fact in each individual case and it’s the responsibility of the agency to be able to justify its conduct. The actual expectations of the individual are relevant, but they are not the final answer as to whether an individual would reasonably expect the use or disclosure.

The agency should consider whether an individual would reasonably expect it to use or disclose all their information for the secondary purpose or only some of it. For example, it would be unlikely that an individual would reasonably expect an agency investigating their complaint against a contractor to disclose the individual’s residential address to the contractor as part of its investigation. The individual would reasonably expect the entity to give the contractor only the minimum amount of personal information necessary to enable them to respond to the complaint.

Regardless of the individual’s reasonable expectations, the agency should only use or disclose the minimum amount of personal information necessary for the secondary purpose.

Examples of where an individual may reasonably expect their personal information to be used or disclosed for a secondary purpose include where:

• the individual makes adverse comments in the media about the way an agency treated them. In these circumstances, it may be reasonable to expect that the agency would respond publicly to these comments in a way that reveals personal information specifically relevant to the issues that the individual has raised²
• the agency notified the individual of the secondary purpose under QPP 5; or
• the secondary purpose is a normal internal business practice, such as auditing, business planning, billing or deidentifying personal information.

A secondary use or disclosure may be reasonably expected where the use or disclosure is inextricably linked to the primary purpose of collection. However, in some circumstances, despite the link between the primary and secondary purpose, the use or disclosure would not be reasonably expected.  For example, where an agency collects the contact details of an individual turning in a lost wallet, providing that information to the wallet's owner so the owner could thank the finder would not be a reasonably expected secondary purpose despite its link to the primary purpose.

Related or directly related to the primary purpose

QPP 6.2(a) is limited to using or disclosing personal information for a secondary purpose that is related or, for sensitive information, directly related to the primary purpose of collection.

What was the primary purpose

Under QPP 3, agencies can only collect personal information for an identified primary purpose. Determining if the proposed secondary purpose relates or directly relates to the secondary purpose requires the person making that determination to know what the primary purpose was.

If the individual the information is about was given a notice or information under QPP 5,³ it will assist in determining the primary purpose of collection.

If the individual was not given a notice or information under QPP 5, the agency will need to consider other information to determine the primary purpose, eg:

• the information itself
• the context in which the information was collected
• the entity the information was acquired from
• what the agency did with the personal information after it acquired it; and/or
• any legislation, policies, plans or schemes underpinning its acquisition and/or original use.

Related to

For personal information that is not sensitive information the secondary purpose only needs to be related to the primary purpose.

A related secondary purpose is one which is connected to or associated with the primary purpose. There must be more than a tenuous link.

Examples of where a secondary purpose is related to the primary purpose of collection include:

• for personal information collected for the primary purpose of collecting a debt, contacting the individual’s former neighbours to ask if they know where to locate them would be a disclosure for the secondary purpose of locating the individual, which is a related and reasonably expected secondary purpose
• for employee personal information collected for the primary purpose of administering their employment and included in their employee file, a related and expected secondary purpose would be using it as part of a workplace investigation into complaints by the individual about working conditions; or
• using personal information for the purpose of deidentifying it as required by QPP 11 is a related and reasonably expected secondary purpose.

Directly related to

Sensitive personal information can only be used or disclosed under QPP 6.2(a)(i) for a secondary purpose directly related to the primary purpose. This requires a stronger connection between the use or disclosure and the primary purpose of collection.

The contemplated secondary purpose must be directly connected to or associated with the primary purpose or arise in the context of the primary purpose. There must be a close relationship between the purpose of the use or disclosure and the purpose for which the personal information was obtained.

A directly related purpose can be sufficiently associated with the primary purpose even if it is not strictly necessary to achieve that purpose.

Examples of a secondary uses or disclosures which are directly related to the primary purpose include where:

• information obtained for the primary purpose of operating a program is used or disclosed for the purpose of monitoring, evaluating, auditing or managing that program
• information obtained for the primary purpose of investigating complaints is used or disclosed for the secondary purpose of conducting follow up surveys or reporting survey or investigation results to a relevant oversight body or responsible senior officer; or
• information obtained for the primary purpose involving payment of a fee or charge is used or disclosed for the secondary purpose of recovering or writing off the unpaid money.