[Home] [Help] [Databases] [WorldLII] [Feedback]
	Privacy Law and Policy Reporter

Standards and open procedures needed for Codes of Practice

Extracts from Graham Greenleaf's submission on the Discussion Paper

Codes of practice play a key role in the Discussion Paper's proposals, as they should. They provide the necessary degree of both detail and (through modifications) flexibility in the application of necessarily broad principles to very varying organisations and practices.

Standards for modification of codes of practice Codes of practice will fulfil the general `exemption' function currently played in the Act by `public interest determinations' (which are now to be restricted to `one off' situations).

Since codes of practice are disallowable instruments (and therefore subject to legislative veto), it is not unreasonable that they should be able to modify the operation of the IPPs.

However, the extent to which codes can modify the application of the IPPs needs to be made more clear, by spelling out the standards that the Commissioner must apply in determining a modification:

• In `prescribing standards that were more or less stringent than the IPPs' (the words of the Discussion Paper), such modifications should only be able to be made `within the general purpose of the IPP' (or some such wording). A code should not be able to be `more ... stringent' by effectively adding a new IPP, but it is reasonable that stricter standards of compliance with a general principle should be required in some contexts.
• In `exempting any action from an IPP' the position is different, because `exemptions' may effectively recognise that an IPP should have virtually no operation in some contexts because of competing public interest considerations. As with the existing s 72, the Commissioner should be required to be satisfied that `the public interest in the [organisation] doing the act, or engaging in the practice, outweighs to a substantial degree the public interest in adhering to that Information Privacy Principle'.

The proposal that codes of practice should not be able to `limit or restrict' access rights is an unnecessarily inflexible approach, provided a general right of mediated access is accepted (as explained below). It is hard to see why there could be any justification for a code limiting correction rights, so inflexibility here probably does not matter very much.

Procedures for codes of practice

• There is no procedure specified for anyone to formally request or require the Commissioner to issue a code of conduct. Anyone should be able to so request, include those who consider the Act is being used to unfairly withhold information from them (for example, researchers). Such formal requests should be public documents (except where confidentiality is justified on normal grounds), Generally the decision to act on a request (or requests) by proceeding to public notice of a proposed code should be in the discretion of the Commissioner. However, the Minister should be able to direct the Commissioner to proceed to that step where the Minister considers this is necessary. This would be an appropriate level of political intervention, as it is still up to the Commissioner what the code says, and up to Parliament to approve it.
• There is no mention of submissions concerning Codes being public documents (except where confidentiality is justified on normal grounds). They must be, particularly if any codes are to be issued without public hearings, or it will be unduly difficult for industry claims for exemptions to be criticised by public interest organisations (or vice versa).
• There is no mention of public hearings (such as a s 76 conference in the current Act). While it is not desirable that the Act be quite as prescriptive about Conferences as is Pt VI at present, it should at least explicitly authorise the Commissioner to provide an opportunity for oral submissions and argument wherever a proposed Code was of sufficient public significance to justify this.

Publicity (or the prospect of it) is some antidote against industry groups seeking to take undue advantage of their lobbying skills and ability to apply concentrated resources on processes.

Any more fundamental change so that Codes become issued by Regulations (ie Ministers) -- as in the ill-fated proposed Bill in NSW in 1994 -- destroys the whole process and removes it to the realm of political lobbying behind closed doors and special pleading open only to powerful lobby groups.

Urgent Codes

`One-off' exceptions (`Public interest determinations')

Special provisions concerning credit reporting (Pt IIIA etc)

Two policy objectives must be preserved in any proposals affecting Pt IIIA of the Act and associated sections (for example, s 18, s 18A):

(i) An appropriate balance of privacy interests in relation to credit reporting was exhaustively considered by Parliament in relation to the 1990 amendments to the Act, and there is no justification for change to those basic policy decisions. In effect, Parliament decided in detail what should be the content of a `code of conduct' for credit reporting. If it has imposed a somewhat more stringent standard than is now being imposed `across the board' on the private sector, that is of little account, as a code of practice may impose more stringent standards.

(ii) Provided that these Parliamentary-determined standards are preserved, there is no reason why the credit industry should be subjected to quite different procedures (including for remedies) than other parts of the private sector. To the extent that it is possible to bring credit reporting within the general approach to the private sector, this should be done.

These objectives could be reconciled by provisions that (i) allowed the Commissioner to develop a code of conduct which implemented the same legislative objectives as Pt IIIA; and (ii) made Pt IIIA not directly enforceable (but still extant as a legislative statement of objectives) once that code came into force, and allowed the Commissioner to revoke the existing s 18A Code.

In my view, if the substantive content of Pt IIIA is preserved, there is no need for the credit industry to be subject to different enforcement provisions from other private sector organisations. If the IPPs are generally to be enforced through civil rather than criminal sanctions, then credit information should have the same treatment.

Medical research guidelines -- repeal of s 95 proposed

Since the NH&MRC is not being given any general Code-making powers concerning medical records, it would seem an appropriate time to simply bring medical research within the normal provision for a Code of Practice. I suggest that s 95 be repealed and replaced by a provision which says that the Commissioner will issue a Code of Practice concerning medical research, and that the existing NH&MRC guidelines will cease to be of effect when this occurs.