PRIVACY LEGISLATION AMENDMENT BILL 2006 Explanatory Memorandum
PRIVACY LEGISLATION AMENDMENT BILL 2006
2004-2005-2006
THE PARLIAMENT OF THE COMMONWEALTH OF AUSTRALIA
HOUSE OF REPRESENTATIVES
PRIVACY LEGISLATION AMENDMENT BILL 2006
EXPLANATORY MEMORANDUM
(Circulated by authority of the Attorney-General,
the Honourable Philip Ruddock MP)
PRIVACY LEGISLATION AMENDMENT BILL 2006
OUTLINE
The Privacy Legislation Amendment Bill 2006 makes amendments to the
National Health Act 1953 and the Privacy Act 1988.
Schedule 1 makes amendments to the National Health Act and the Privacy Act
to facilitate the continued operation of Medicare Australia's Prescription
Shopping Information Service.
The Bill provides that the collection of health information for the purposes of
providing a health service does not breach the Privacy Act where this is
authorised by or under law. The amendment to the National Health Act will
provide that wherever disclosure is authorised by or under a health law or the
Medicare Australia Act 1973, it is deemed that the corresponding collection of
the health information is also authorised for the purposes of the Privacy Act.
The amendment to the Privacy Act will provide an additional exception to
National Privacy Principle 10.2(b)(i) that deals with the collection of sensitive
information. The amendment will permit medical practitioners to collect
health information, without initially obtaining the consent of the patient,
where the collection is authorised by or under law.
The amendments will, in particular, ensure that medical practitioners do not
breach the Privacy Act when they collect health information about an
individual from the Prescription Shopping Information Service (PSIS). The
PSIS was made available to registered prescribers on 31 January 2005 and is
currently supported by determinations issued by the Privacy Commissioner
which expire on 22 December 2006. The amendments will allow prescribers
to continue collecting health information from the PSIS past the expiration of
the determinations.
Schedule 2 amends the Privacy Act to implement some of the Australian Law
Reform Commission / Australian Health Ethics Committee (ALRC/AHEC)
recommendations in their report, Essentially Yours: The Protection of Human
Genetic Information in Australia.
The proposed amendments will amend the definitions of `health information'
and `sensitive information' in the Privacy Act to include genetic information,
and permit the disclosure of genetic information to genetic relatives in certain
circumstances.
FINANCIAL IMPACT STATEMENT
The Bill is not expected to have any financial impact.
PRIVACY LEGISLATION AMENDMENT BILL 2006
NOTES ON CLAUSES
Clause 1: Short Title
1. Clause 1 provides that the Act may be cited as the Privacy Legislation
Amendment Act 2006.
Clause 2: Commencement
2. This clause provides that the Bill, when enacted, will come into
operation on the day the Bill receives Royal Assent.
Clause 3: Schedule(s)
3. Clause 3 provides that each Act referred to in a Schedule is amended
or repealed in accordance with the applicable items in the Schedule concerned
and also provides any other item in a Schedule has effect according to its
terms.
4. Schedule 1 of the Act contains amendments to the National Health Act
and the Privacy Act relating to the collection of health information and
Schedule 2 contains amendments to the Privacy Act relating to genetic
information.
SCHEDULE 1 - AMENDMENTS RELATING TO THE COLLECTION
OF HEALTH INFORMATION
5. The amendments will ensure health information that is available
through the Prescription Shopping Information Service (PSIS) and similar
arrangements, where the disclosure of the health information is authorised by
or under a law administered by the Minister for Health and Ageing or the
Medicare Australia Act, is able to be collected by organisations without
breaching the Privacy Act.
6. Collection will only be permitted where this is necessary for an
organisation to provide a health service to the individual.
7. The amendments will also ensure that health information is able to be
collected by organisations where this is necessary to provide a health service
and collection of the information to provide the health service is specifically
authorised by or under law.
Amendment of the National Health Act 1953
Item 1 - After section 135AB
8. New section 135AC will provide that health information is able to be
collected by an organisation where this is necessary for the purposes of
2
providing a health service if the information is authorised to be disclosed by or
under a health law or the Medicare Australia Act.
9. A health law will include any law administered by the Minister for
Health and Ageing, who is responsible for the National Health Act, as well as
the Medicare Australia Act 1973.
Amendment of the Privacy Act 1988
Item 2 - Subparagraph 10.2(b)(i) of Schedule 3
10. This item amends subparagraph 10.2(b)(i) of the National Privacy
Principles (NPPs) by omitting "by" and substituting "or authorised by or
under" law.
11. NPP 10.2 currently provides that an organisation may collect health
information, without the consent of the individual, if the information is
necessary to provide a health service and the information is collected as
required by law (NPP 10.2(b)(i)). The amendment to NPP 10.2(b)(i) will
permit an organisation to collect health information, if the collection is
necessary to provide a health service, where the collection is required or
authorised by or under law.
12. This amendment will facilitate the continued operation of Medicare
Australia's Prescription Shopping Information Service (PSIS). Under the
Prescription Shopping Program, Medicare Australia identifies people who
may be obtaining certain Pharmaceutical Benefits Scheme medicines in excess
of therapeutic needs. The PSIS, which is a component of the Program, makes
this information available to registered prescribers who have contacted a
telephone service.
13. The Privacy Commissioner considered that the collection of
information from the PSIS would be in breach of NPP 10. However, to allow
the PSIS to go ahead the Privacy Commissioner issued temporary public
interest determinations to allow doctors to collect information under the PSIS
without breaching the Privacy Act.
14. Sections 80A and 80B of the Privacy Act give the Privacy
Commissioner the power to issue temporary public interest determinations in
which she may determine that an act or practice shall be disregarded for the
purposes of the Act where the act or practice might otherwise constitute a
breach of the Act. The Privacy Commissioner may make a determination only
if she is satisfied that the public interest in the agency or organisation doing
the act outweighs to a substantial degree the public interest in adhering to the
Act.
15. In making the determinations, the Privacy Commissioner indicated that
in the longer term the matter should be addressed by making changes to the
legislation to authorise the collection of such information by medical
practitioners.
3
16. A copy of the determinations is available from the Privacy
Commissioner's website at .
17. This amendment is also consistent with Recommendation 83 of the
Privacy Commissioner's report, Getting in on the Act: The Review of the
Private Sector Provisions of the Privacy Act 1988.
SCHEDULE 2 - AMENDMENTS RELATING TO GENETIC
INFORMATION
Amendment of the Privacy Act 1988
Item 1 - Subsection 6(1)
18. Item 1 amends subsection 6(1) of the Act by inserting a definition of
`genetic relative' into the Act. Genetic relative is defined to include another
individual who is related by blood to the first individual including a sibling,
parent or descendant. Although not expressly referred to, this definition
would also cover grandparents of the individual.
Item 2 - Subsection 6(1) (at the end of the definition of health information)
19. Item 2 amends the definition of health information in subsection 6(1)
of the Act by adding paragraph (d) to include genetic information.
20. This amendment will ensure that genetic information that is, or could
be, predictive of the health of an individual or a genetic relative of that
individual, will be treated as health information for the purposes of the Act.
Item 3 - Subsection 6(1) (at the end of the definition of sensitive information)
21. Item 3 amends the definition of sensitive information in subsection
6(1) of the Act by adding paragraph (c) to include genetic information about
an individual that is not otherwise health information.
22. This amendment will ensure that genetic information that is not, or
could not be considered, predictive of the health of an individual or a genetic
relative of that individual (such as the result of parentage or kinship tests) will
be treated as sensitive information for the purposes of the Act.
Item 4 - After section 95A
23. This item inserts new section 95AA which provides for guidelines for
NPPs about genetic information.
24. New subsection 95AA(1) allows the Privacy Commissioner to
approve, for the purposes of the NPPs, guidelines issued by the National
Health and Medical Research Council (NHMRC).
4
25. New subsection 95AA(2) provides that the Privacy Commissioner may
approve, by legislative instrument, guidelines issued by the NHMRC relating
to the use and disclosure of genetic information to a genetic relative of an
individual under new NPP 2.1(ea)(ii).
26. New subsection 95AA(3) provides that an application may be made to
the Administrative Appeals Tribunal for review of a decision of the Privacy
Commissioner to refuse to approve guidelines.
Item 5 - After paragraph 2.1(e) of Schedule 3
27. Item 5 adds new paragraph 2.1(ea) after paragraph NPP 2.1(e) in
Schedule 3 of the Act.
28. NPP 2.1 prohibits secondary uses or disclosure of personal information
unless one of the exceptions specified in NPP 2.1 applies. Currently, NPP
2.1(e) provides that an organisation must not use or disclose personal
information about an individual unless the organisation reasonably believes
that the use or disclosure is necessary to lessen or prevent a serious and
imminent threat to an individual's life, health or safety.
29. The ALRC/AHEC report noted that genetic information may reveal a
serious threat to an individual's life, health or safety, but not necessarily an
imminent threat due to the nature of the information.
30. New paragraph NPP 2.1(ea) permits the use or disclosure of genetic
information about an individual to a genetic relative in circumstances where
the genetic information may reveal a serious threat to a genetic relative's life,
health or safety, but not necessarily an imminent threat. Use or disclosure in
this instance must be done in accordance with relevant guidelines relating to
the use and disclosure of genetic information. Under new section 95AA the
guidelines will be issued by the NHMRC and approved by the Privacy
Commissioner.
31. This amendment will ensure that a medical practitioner is able to
disclose genetic information to a genetic relative where there is a serious risk
to the health of the genetic relative.
5