p o s t:	GPO Box 1196 
	Sydney NSW 2001 
e m a i l: 	enquiries@privacy.org.au 
w e b : 	www.privacy.org.au 

	

3 April 2009

In response to the Queensland Government’s consultation drafts of the Right to Information Bill, Right to Information Regulation and Information Privacy Bill 

Submission by the Australian Privacy Foundation

About the Australian Privacy Foundation 

1.	The Australian Privacy Foundation is the main non-governmental organisation dedicated to protecting the privacy rights of Australians. Relying entirely on volunteer effort, the Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians. The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions. The Foundation uses the Australian Privacy Charter as a benchmark against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see www.privacy.org.au 

General comments on the consultation

2.	We welcome the initiative of the Queensland Government in publishing the consultation drafts and associated materials for public comment.  

3.	The proposed reform is long overdue as Queensland is one of the few Australian States that lack privacy law in the form of legislation. The Australian Privacy Foundation encourages the reform of Queensland’s information privacy and freedom of information regime. However, at the same time, the proposed reform contains several areas of concern to us.

The importance of looking forward, not backward

4.	The timing of the reform is unfortunate in the sense that the Federal approach to privacy regulation has been the subject of extensive scrutiny, with the result of the Australian Law Reform Commission proposing far-reaching changes to the existing privacy regulation.

5.	For Queensland to base its approach on a more than 20 year old Federal initiative, and in particular the Information Privacy Principles in s14 of the Privacy Act 1988, seems short-sighted. Indeed, if the Federal Government adopts legislation reflecting all, or some, of the changes proposed by the Australian Law Reform Commission, Queensland’s law would immediately by out of sync with the Federal approach.
 
6.	The better approach is for Queensland to base its Information Privacy legislation on the Unified Privacy Principles recommended by the Australian Law Reform Commission, subject to attention to some significant deficiencies in those principles (see Appendix 1). That way, Queensland would emerge as an Australian leader in privacy protection, rather than merely catching up to what the Federal Government did more than 20 years ago.

A change of scale is a change of kind

7.	The proposed reform seeks to address two areas of fundamental importance for a working democratic society. We generally welcome the FOI reforms, as effective FOI complements information privacy rules as tools of accountability for public sector agencies. In some situations, however, society’s right of accessing information and the individuals’ right to privacy are in direct competition. This will be the case in any instance of one person or organisation seeking access to another person’s personal information. 

8.	It is crucially important that the proposed reform strikes a good balance between these two competing interests. In striking this balance, attention must be given to how digitalisation of information has changed the possibilities for individuals and organisations seeking access to information.

9.	While we recognise the value of a system allowing for online FOI applications, we also envisage that this increased convenience will lead to an increase in FOI applications. It is of great importance that an increase in the number of application does not result in a lowering of the standard of protection of individuals’ privacy. In other words, steps must be taken to avoid a scenario where the fact that agencies receive a greater number of FOI applications result in less care being taken in assessing any privacy implications of each of those applications.

Information Commissioner Model

10.	We welcome the proposed integration of implementation and oversight in an office of Information Commissioner with two deputies responsible respectively for Freedom of Information and for Information Privacy.  We note that the Commonwealth has just released its proposals for similar structural reform, and that the model appears to work well in the UK and Canada.  We question, however, whether the Privacy Commissioner being a member of the staff of the Information Commissioner is compatible with the provision for separate appointment as a statutory officer.  We submit that further consideration is needed of the relationship and of issues of independence and accountability.  

11.	We welcome the provision for national advertising of the positions of all three Commissioners and consultation with the Parliamentary Committee about appointment.  We believe further consideration should be given to the provision allowing for re-appointment – there are strong arguments for non-renewable appointments to these sorts of position to reinforce independence and robust performance of the functions in the face of many pressures from entrenched interests.

Powers and functions

12.	We welcome the range of powers and functions that will be given to the Information Commissioner and delegated to the Privacy Commissioner (IP Bill Chapter 4).  In particular, the powers to conduct reviews of systemic privacy issues, to conduct compliance audits and to issue compliance notices, are essential complements to the complaint mediation function. 

13.	We are concerned that the power to grant waivers from compliance with the Principles (Chapter 4 Part 5) are too great and do not incorporate any requirement for public consultation.  Given that the power will in effect be to modify the law, we submit that procedures and safeguards modelled on those in the Commonwealth Privacy Act for Public Interest Determinations be included.  

14.	We support the proposed model for handling privacy complaints (IP Bill Chapter 5), with the Privacy Commissioner charged with mediation but QCAT dealing with unresolved matters. While we have not been able to review this Chapter in detail, this model appears similar to those operating in NSW and Victoria. While this has many advantages over the current Commonwealth model of Privacy Commissioner Determination without appeal rights, it will be important to avoid some of the related problems that have arisen in those States. We refer to the discussion of these issues in the submission by the Cyberspace Law and Policy Centre to the ALRC on enforcement of privacy laws and the role of Commissioners.

15.	We recommend that a number of additional powers, responsibilities and
functions discussed by the Cyberspace Law and Policy Centre in its
ALRC submission 'Promoting and enforcing privacy principles: an
analysis of ALRC proposals for the role of the  Privacy Commissioner'
should be adopted in the Queensland Bill, so that it more
closely equates to Australian and international best practice. Some
of these are good features of the existing Commonwealth Privacy Act,
although capable of improvement as the submission details. The
additional powers, responsibilities and functions that we recommend
are:

(i) The Commissioner to be required to publish summaries of
significant mediated complaints (with complainants anonymised),
according to publicly declared criteria of significance. This is
necessary for there to be sufficient transparency in the complaint
mediation function, and for it to provide sufficient feedback to both
complainants (and their representatives) and agencies as to how the
principles are being applied. It is a necessary part of responsive
regulation. (See Submission 5.2)

(ii) The Commissioner and the Tribunal to be able to receive and deal
with representative complaints, based on the model in the Privacy Act
1988. This power is missing from existing State legislation.

(iii) A Court to be given the power to issue injunctions to enforce
compliance with the privacy principles, without requirements of
standing. This power is found in s98 Privacy Act 1988. It would
complement the power to issue compliance notices, and it is valuable
that there be such an alternative avenue of enforcement. (See
Submission 5.3)

Privacy Principles

16.	As noted above, we suggest that rather than the proposed IPPs in Schedule 3 to the IP Bill, Queensland adopts a set of best practice principles based on the ALRC’s UPPs, with the additional refinements suggested in the attached submission by the Cyberspace Law and Policy Centre.  The Foundation supports the Centre’s submission in this regard, and attaches it as Appendix 1.

17.	To the extent that Queensland seeks to adopt any of the principles in Schedule 3 to the current IP Bill, we make the following specific comments:

•	The limitation of all the collection principles (IPPs 1-3) to where personal information is ‘… collected for inclusion in a document or generally available publication’ is an unnecessary and undesirable complication, which leaves some collection practices unregulated.
•	The limitation of some collection principles (IPPs 2 and 3) to where personal information is requested either from the individual concerned (IPP2) or from the subject or any other person (IPP 3) is an unnecessary and undesirable complication, which leaves some collection practices unregulated.
•	The requirement for notice in IPP2 omits some key matters included in equivalent principles in most other privacy laws, such as the right of access and functional contact details (the inclusion of these matters in IPP 5 is not in itself sufficient).
•	The exception to the requirement for notice for emergency services (IPP 2(5)) seems unnecessarily detailed, with arguably too many overlapping tests.  We suggest that the practical needs of emergency services are adequately addressed by the generic ‘reasonable steps’ qualification in IPP2.
•	There is no requirement relating to notice where information is collected from third parties.
•	The data quality requirements when collecting (IPP3) omit important criteria including accuracy and ‘not misleading’ which are found in the equivalent principles in other jurisdictions (the inclusion of these tests in IPP 7 is not in itself sufficient, as that principle deals only with ongoing maintenance, not initial collection).
•	There is no disposal/retention principle, commonly incorporated in the security principle in other jurisdictions.
•	The exceptions to the use and disclosure principles for ‘… threat to the life, health, safety or welfare of an individual, or to public health, safety or welfare’ (IPPs 10(1)(b) and 11(1)(c) have been expressly modified to require that the threat be only ‘serious’  and not also ‘imminent’.  While this is acceptable for ‘threats to … of individuals’, it is far too wide an exception when applied to general threats to ‘public health, safety or welfare’.  See the Cyberspace Centre submission at Appendix 1 for further explanation.
•	The exception to IPP11 which allows disclosure solely on the basis that the individual has been ‘made aware’ (11(1)(a)) fundamentally undermines the limiting objective of the principle. It is indefensible and has not been included in the ALRCs recommended use and disclosure principle UPP2 – it should not be included in the Queensland principles. 
•	The exceptions to the use and disclosure principles for ‘…authorised or required under a law’ (10(1)(c) and (11(1)(d)) should be amended to read ‘…required or specifically authorised…’. See the Cyberspace Centre submission at Appendix 1 for further explanation.
•	The directly related’ exception to the Use principle (10.1(e)) needs an additional test ‘and within the individual’s reasonable expectation (as in proposed UPP 5.1)
•	There are no principles covering anonymity/pseudonymity or identifiers, both of which are covered by the newer generation of privacy laws e.g. the NPPs and the proposed UPPs.  The Queensland principles should cover these matters. 
•	We note that instead of a cross border transfer principle, the Bill deals with transfers outside Australia in Chapter 2 Part 3.  While we commend the intention behind this Part, we draw attention to the criticisms of the ALRC’s proposed UPP 11 in Appendix 1, and submit that further consideration of a cross border transfer provision is required.
•	The Summary document issued with the draft Bill states that ‘[the Bill] clarifies that agencies have the discretion to determine when it is reasonably necessary to disclose personal information.’   If this is just a commentary on the ‘reasonable grounds’ criteria included in several of the exceptions, then we have no difficulty with the clarification.  If however it is intended that this be an additional ground for disclosure (we cannot see this in the Principles) then we would strongly oppose it as giving too much discretion.

18.	The IP Bill includes a version of the current Privacy Act NPPs to apply to the Health Department.  Apart from the obvious flaw that to achieve the stated objective any separate regime should apply to all health information rather than just to one agency, we strongly submit that Queensland should instead adopt the national health privacy regime currently being devised by COAG and relevant Ministerial Councils in response to the ALRC report.

Other issues

19.	Under the proposed scheme in the IP Bill Chapter 2 Part 4, government agencies will be obliged to require contracted service providers to comply with the privacy principles through a contract. Furthermore, where an agency fails to do so, but should have done so, any breach of the privacy principles will become the responsibility of the contracting agency. 

20.	While we welcome this approach, it is too limited. An agency should always remain responsible for privacy violations where it uses a contracted service provider. In other words, where a contracted service provider misuses personal information, or otherwise acts contrary to the privacy principles, the aggrieved person should have the right to take action against both the contracted service provider and the relevant agency that contracted with the contracted service provider.

21.	This alternative approach would ensure that the aggrieved person has an avenue of redress even where the contracted service provider, for example, has gone out of business.  It would also help ensures that complainants are not left stranded while agency and contractor argue about responsibility.

22.	The Summary Document refers to a proposed ‘blanket’ exemption of law enforcement agencies from collection, use and disclosure principles, although we do not see this in the expected place (IP Bill Schedule 2).  Such a blanket exemption is unnecessary and undesirable.  Such agencies should only be exempt from any aspect of these principles to the extent that compliance would seriously compromise the performance of their functions.  The NSW privacy legislation has been seriously compromised by overly-generous exemptions. The ALRC considered the Commonwealth Act exemptions in detail and has recommended that all exemptions be specifically targeted and justified.  We commend this approach to the Queensland government. 
 
23.	We support the application of any Queensland privacy law to local government. 

24.	We support the inclusion of an offence of ‘unlawful access’ in clause 177 of the IP Bill.

Conclusion

25.	Unfortunately, due to time restraints, we have only been able to comment on a selection of issues. The fact that we have not commented upon a particular issue should not been seen as us agreeing, or disagreeing, with that particular part of the proposed reform.  In particular, we have not considered in detail the access and correction arrangements and mechanisms in Chapter 3 of the IP Bill (which appear sound), and the exempt categories of documents in Schedule 1 (which may unnecessarily broad – see our comments above about the need for exemptions to be specifically targeted).

For further information contact: 

Dr Dan Svantesson, (07) 5595 1418
Vice-Chair
E-mail: enquiries@privacy.org.au
APF Web site: http://www.privacy.org.au 

Appendix 1:  Cyberspace Law & Policy Centre Submission to the Australian Government  on the UPPs
Also at http://www.cyberlawcentre.org/ipp/publications/CLPC%20Submission%20on%20UPPs%20final.pdf