Revised Explanatory Memorandum
(Circulated by authority of the Attorney-General, the Honourable Philip Ruddock MP)Schedule 1 - Privacy Act 1988
1. After Part VI
Part VIA - Dealing with personal information in emergencies and disasters
4. Item 1 inserts a new Part VIA in the Privacy Act.
Division 1 - Object and interpretation
5. The purpose of Part VIA is to enhance information exchange between Australian Government agencies, State and Territory authorities, private sector organisations, non-government organisations and others in the event of an emergency or disaster, when an emergency declaration is in force under the Bill.
6. The proposed amendments will establish a clear and certain legal basis for the management of the collection, use and disclosure of personal information about deceased, injured and missing individuals involved in an emergency or disaster.
7. Clause 80F sets out the object of Part VIA.
8. The effect of this clause is to establish that the overriding policy objective in Part VIA is to enhance the exchange of personal information in an emergency or disaster.
9. Clause 80G defines key terms in Part VIA.
10. Relevantly, a secrecy provision means a provision of the law of the Commonwealth, including a provision of the Privacy Act, that prohibits or regulates the use or disclosure of personal information generally, or in specified circumstances. A secrecy provision does not include a provision that authorises collection of information.
Clause 80H Meaning of permitted purpose
11. Clause 80H defines the meaning of a permitted purpose . This is relevant to clause 80P.
12. The effect of this clause is to limit the types of situations in which the collection, use and disclosure of personal information may be authorised under clause 80P.
13. A permitted purpose is a purpose that directly relates to the Commonwealth's response to an emergency or disaster in respect of which an emergency declaration under the Bill is in force. The word 'directly' was inserted as a result of Recommendation 1 of the Senate Standing Committee on Legal and Constitutional Affairs in its 2006 report on the Bill.
14. A permitted purpose has some temporal, physical or other connection to action taken by the Commonwealth in response to an emergency or disaster in respect of which an emergency declaration under the Bill is in force.
15. Subclause 80H(2) provides a list of purposes which may be construed as having a sufficient connection to the Commonwealth's response to an emergency or disaster. The list is intended merely as a guide and should not be interpreted to limit the generality of the definition in subclause 80H(1). The purposes listed are:
- •
- identification of individuals involved in the emergency or disaster;
- •
- assisting those individuals to obtain necessary services;
- •
- assisting with law enforcement in relation to the emergency or disaster;
- •
- coordination or management of the response to the emergency or disaster; and
- •
- ensuring people who are responsible (as defined in National Privacy Principle 2.5 of the Privacy Act) for individuals who are, or may be, involved in the emergency or disaster are appropriately informed of matters concerning the individual's involvement in the emergency or disaster, or the response to the emergency or disaster in relation to those individuals.
16. Importantly, paragraph 80H(2)(e) confirms that informing a person responsible (as defined in National Privacy Principle 2.5 of the Privacy Act) for the individual involved in the emergency or disaster of matters relevant to the individual's involvement in the emergency or disaster, is a permitted purpose under Part VIA.
A person responsible includes a parent, child and spouse. Paragraph 80H(2)(e) addresses the concern that people, such as relatives, could be denied information regarding the welfare of family members because of concerns about the application of the Privacy Act. This provision makes it clear that a disclosure to a relative or person nominated by the individual to be contacted in case of emergency is permissible in the circumstances contemplated in Part VIA.
Division 2 - Declaration of emergency
Clause 80J Declaration of emergency - events of national significance
17. Clause 80J enables either the Prime Minister or the Attorney-General to make an emergency declaration, if the conditions listed in clause 80J are satisfied.
18. An emergency declaration has the effect of triggering the operation of Part VIA, which otherwise would not operate.
19. The preconditions to the making of an emergency declaration in paragraph 80J(a) are:
- •
- an emergency or disaster has occurred; and
- •
- the emergency or disaster is of a kind which would make it appropriate that personal information be exchanged; and
- •
- the emergency or disaster is of national significance (for the reasons listed in paragraph 80J(c)); and
- •
- the emergency or disaster has affected at least one or more Australian citizens or permanent residents.
20. The words emergency and disaster are not defined in the Bill and therefore have their ordinary meaning. This ensures flexibility in the operation of the Bill, as the types and circumstances of emergency or disaster are too numerous to allow for sensible definition.
21. The note attached to clause 80J makes it clear that an emergency declaration under clause 80J is made solely for the purpose of triggering the operation of Part VIA. An emergency declaration does not have any effect under any other legislative or non-legislative scheme relating to emergencies, such as that relating to emergency management. An emergency declaration is a self-contained mechanism in the Bill which is not linked in any way to other declarations.
Clause 80K Declaration of emergency - events outside Australia
22. The effect of clause 80K is that when the conditions in subclause 80K(1) are satisfied, a declaration of an overseas emergency may be made by either:
- •
- the Prime Minister; or
- •
- the Attorney-General in consultation with the Minister for Foreign Affairs.
23. An emergency declaration has the effect of triggering the operation of Part VIA, which otherwise would not operate.
24. The preconditions to the making of an emergency declaration in subclause 80K(1) are:
- •
- an emergency or disaster has occurred outside Australia; and
- •
- the emergency or disaster is of a kind which would make it appropriate that personal information be exchanged; and
- •
- the emergency or disaster has affected at least one or more Australian citizens or permanent residents.
25. The words emergency and disaster are not defined in the Bill and therefore have their ordinary meaning. This ensures flexibility in the operation of the Bill, as the types and circumstances of emergency or disaster are too numerous to allow for sensible definition.
26. The note attached to clause 80K makes it clear that an emergency declaration under clause 80K is made solely for the purpose of triggering the operation of Part VIA. An emergency declaration does not have any effect under any other legislative or non-legislative scheme relating to emergencies, such as that relating to emergency management. An emergency declaration is a self-contained mechanism in the Bill which is not linked in any way to other declarations.
Clause 80L Form of declarations
27. Clause 80L provides that an emergency declaration must be in writing and signed by the person making the declaration (who is either the Prime Minister or the Attorney-General).
28. Subclause 80L(2) provides that an emergency declaration must be published on the Attorney-General's Department Internet website and in the Gazette , so that it is publicly known that an emergency declaration has been made.
29. The effect of subclause 80L(3) is that an emergency declaration is not a legislative instrument within the meaning of section 5 of the Legislative Instruments Act 2003 . A legislative instrument is defined in section 5 of the Legislative Instruments Act. In general terms, a legislative instrument is a written document that is of a legislative character and is made in the exercise of a power delegated by Parliament. Requirements relating to registration, tabling, scrutiny and sunsetting of all Commonwealth legislative instruments are imposed under the Legislative Instruments Act. Subclause 80L(3) has been included to assist readers of the Bill, so that they are aware that the requirements imposed by the Legislative Instruments Act do not apply to an emergency declaration under the Bill.
30. The declaration is an administrative declaration which does not constitute a legislative instrument within the meaning of the Legislative Instruments Act. All the consequences of the declaration are set out in the Bill and there is nothing in the declaration itself that sets out new rules or imposes obligations.
Clause 80M When declarations take effect
31. Clause 80M provides that an emergency declaration has effect from the time at which it is signed. An emergency declaration will have prospective operation only.
Clause 80N When declarations cease to have effect
32. Clause 80N provides that an emergency declaration expires at the earliest of the following:
- •
- a time specified in the declaration; or
- •
- the time at which the declaration is revoked; or
- •
- 12 months after the declaration is made.
33. Clause 80N ensures that an emergency declaration does not operate indefinitely. A maximum period of 12 months applies for an emergency declaration. Clause 80N was revised as a result of Recommendation 2 of the Senate Standing Committee on Legal and Constitutional Affairs in its 2006 report on the Bill.
Division 3 - Provisions dealing with the use and disclosure of personal information
Clause 80P Authorisation of collection, use and disclosure of personal information
34. Clause 80P permits an entity (as defined in subclause 80P(7)) to collect, use or disclose personal information in the event of an emergency declaration. An emergency declaration under clause 80J or clause 80K must be in force for clause 80P to operate.
35. Subclause 80P(1) permits the collection, use or disclosure of personal information relating to an individual if:
- •
- the person, agency or organisation collecting, using or disclosing the information reasonably believes that the individual may be involved in the emergency or disaster; and
- •
- the collection, use or disclosure is for a permitted purpose (as defined in clause 80H).
36. Paragraphs 80P(1)(c) and 80P(1)(d) place special limits on the types of bodies to whom agencies, organisations and persons can disclose personal information under Part VIA.
37. Paragraph 80P(1)(c) enables agencies to pass relevant information to the bodies listed in paragraph 80P(1)(c). This enables agencies to perform their functions and provide assistance.
38. Subparagraph 80P(1)(c)(v) makes it clear that disclosure can occur to a person responsible (as defined in National Privacy Principle 2.5 of the Privacy Act) for the individual. A person responsible includes a parent, child and spouse.
39. Paragraph 80P(1)(e) makes it clear that disclosure to a media organisation is not permitted under Part VIA. If any disclosures need to be made to the media, they should be made in accordance with the normal operation of the Privacy Act.
40. Subclause 80P(2) ensures that an entity (as defined is subclause 80P(7)) is not liable for contravening a secrecy provision by using or disclosing personal information, where it is authorised to do so by subclause 80P(1), unless the secrecy provision is a designated secrecy provision (as defined in subclause 80P(7)).
41. Subclause 80P(3) ensures that an 3entity (as defined is subclause 80P(7)) is not liable for contravening a duty of confidence in respect of disclosing personal information, where authorised to do so by subclause 80P(1). An example of a duty of confidence is the common law duty of confidentiality to which banks are subject.
42. Subclause 80P(4) ensures that an agency does not breach an Information Privacy Principle in the Privacy Act in respect of the collection, use or disclosure of personal information, where it is authorised to do so by subclause 80P(1).
43. Subclause 80P(5) ensures that an organisation normally subject to the National Privacy Principles in the Privacy Act, does not breach either an approved privacy code or a National Privacy Principle in respect of the collection, use or disclosure of personal information, where it is authorised to do so by subclause 80P(1).
44. Subclause 80P(6) ensures that collection, use or disclosure of personal information can only occur by an officer or employee of an agency who is authorised to collect, use or disclose personal information.
45. Subclause 80P(7) defines the term designated secrecy provision to include secrecy provisions binding the Inspector-General of Intelligence and Security and the intelligence agencies. The term designated secrecy provision is used in subclause 80P(2). The Inspector-General of Intelligence and Security and most intelligence agencies are completely exempt from the Privacy Act. Other intelligence agencies are partially exempt in relation to their intelligence collection and analysis activities. It would not be appropriate to override secrecy provisions on the use and disclosure of information in legislation that applies to the Inspector-General of Intelligence and Security and the intelligence agencies. In addition, the Bill does not affect requirements on the collection of intelligence in legislation governing those agencies.
46. Subclause 80P(7) defines the term entity . This term is used in clauses 80P and 80R.
Clause 80Q Disclosure of information - offence
47. Clause 80Q creates an offence for unauthorised secondary disclosures. A secondary disclosure occurs when a person to whom personal information has been disclosed under Part VIA subsequently discloses that information. The penalty applying to this offence is 60 penalty units or one year imprisonment, or both.
48. The offence does not apply to a person responsible (as defined in National Privacy Principle 2.5 of the Privacy Act) for the individual involved in the emergency or disaster. A person responsible includes a parent, child and spouse. This ensures that a person with a close connection to the individual, such as a relative, is not penalised for passing on information regarding the welfare of the individual received under these arrangements. This reflects the policy that the Privacy Act does not generally apply to individuals, as distinct from agencies and organisations.
49. Subclause 80Q(2) authorises secondary disclosure of personal information received under Part VIA in prescribed circumstances. The offence provision therefore does not apply to those disclosures. The disclosures that are permitted are those:
- •
- made by an agency under an Information Privacy Principle in the Privacy Act;
- •
- made by an organisation under an approved privacy code or a National Privacy Principle in the Privacy Act;
- •
- permitted under clause 80P;
- •
- made with the consent of the individual to whom the information relates;
- •
- made to the person to whom the information relates;
- •
- made to a court; and
- •
- prescribed by the regulations.
50. The note attached to subclause 80Q(2) makes it clear that a defendant bears the evidential burden of establishing any of the exceptions listed in subclause 80Q(2). This is because of the operation of subsection 13.3(3) of the Criminal Code. It is appropriate for the defendant to bear the onus of proving these matters as they are matters that, by their nature, are peculiarly within the knowledge of the defendant.
51. Subsection 9.3(2) of the Criminal Code has the effect that the prosecution will not be required to establish that the person knew or was aware that the information was disclosed because of the operation of Part VIA - only that the information was disclosed. Consequently, subsection 9.3(1) of the Criminal Code will apply, and ignorance of, or mistake about, the law will not preclude criminal liability.
52. Clause 80R ensures that Part VIA of the Bill has a broad operation and is not limited by any other secrecy provision in a law of the Commonwealth unless that secrecy provision expressly excludes the operation of clause 80R.
53. Subclause 80R(2) makes it clear that Part VIA is intended only to permit , and not to compel persons, agencies or organisations to collect, use or disclose personal information in an emergency or disaster situation.
Clause 80S Severability - additional effect of Part
54. Clause 80S is intended to ensure that the Bill is given the widest possible operation consistent with Commonwealth constitutional legislative power.
Clause 80T Compensation for acquisition of property - constitutional safety net
55. It is not expected that any provisions in Schedule 1 of the Bill will result in an acquisition of property within the meaning of that expression in the Constitution. However, clause 80T is the standard constitutional safety net provision.