Australian Privacy Foundation
Submission to the Australian Law Reform Commission (ALRC) and AHEC Inquiry

Dated August 2002

This document is at http://www.privacy.org.au/Papers/SubmnALRC0208.html

Submission by the Australian Privacy Charter Council on ALRC Discussion Paper 66

Privacy advocacy groups combine

Please note that the Australian Privacy Foundation has recently subsumed the Australian Privacy Charter Council, which ceases to exist as a separate entity. The Charter Council made a submission on your earlier issues paper. The Council was an initiative of the Foundation in 1992, so we have come full circle - the Foundation has recently been registered as an unincorporated association and will continue to promote the Australian Privacy Charter as a benchmark for privacy protection (see www.privacy.org.au ) . Please replace the Charter Council with the Foundation in your contact database, using the email address privacy@privacy.org.au

General comments

The Charter Council welcomes the extremely thorough and comprehensive Discussion Paper. Regrettably we have not been able to do justice to the work you have put in.

It is difficult for the Foundation as a voluntary organization dependent on volunteer effort to do justice to such a major report with so many privacy implications. The comments which we offer below should not therefore be taken as a comprehensive response - we will need to rely on the three Privacy Commissioners and others to cover many of the points which we might like to comment on given greater resources.

As we have not had the resources to address all the questions you have posed, we would like to re-emphasise some of the key points made by the Charter Council in its March 2002 submission. These are:

• We reject the presumption that some existing uses of genetic information - in particular in law enforcement, are now so well established that they should not be challenged. While the Inquiry will rightly recommend safeguards for uses of genetic information, it should also, and firstly, critically examine all existing uses, and be prepared to recommend cessation of some uses if on balance the disadvantages and risks outweigh the benefits.
• One consequence of a proliferation of secondary uses could be serious damage to the primary purposes, and to the undoubted health benefits. If individuals fear that there might be adverse consequences in the future, they will be less inclined to agree to testing which could both benefit them directly and contribute to health research and knowledge.
• The importance of minimizing the amount of incidental genetic information that is recorded in connection with any particular application. If records of tests or analyses carried out for a particular purpose contain information which can subsequently be used for other tests or checks, then pressure will inevitably grow for those other uses, and the temptation to authorize such uses without the express consent of the individual will be considerable. If, in contrast, it is necessary to obtain a new sample to undertake any new tests or checks, then the safeguard of express consent is much easier to uphold.
• We consider it very important for the Inquiry to recommend strongly in favour of strict purpose-specific sampling and testing (although there may be some cases where speculative multiple tests may be of direct benefit to the individual).
• In order to maximize the effective control over testing by the individual concerned, samples should generally not be retained - only the results of the specific test. Any departure from this general principle needs to be very clearly justified.
• Wherever possible, genetic information should be held in a form in which the individual from whom it was derived is not identifiable. This should be possible in many areas of research. While there are obvious ethical issues about notifying individuals of potential detriment if they can be identified and contacted, these do not arise if there is no possibility of identification.
• There should be strict safeguards of the quality of genetic information. It may be appropriate to require the use of neutral accredited laboratories and analysts, rather than allowing `in-house' testing and analysis, where commercial or other pressures could be brought to bear inappropriately. An even for third party laboratories, there should be strict minimum standards.
• We are attracted to the idea of a standing committee or commission, properly resources and genuinely independent, to monitor developments, and to play an adjudicative role in relation to exceptional uses, retention, data linkage etc.

Comments on proposals and Answers to some of the specific questions

Proposal 3-1 - We support the establishment of a Human Genetics Commission, with the roles set out in subsequent proposals

Proposals 5-1 to 5-5 - We support the mandatory accreditation of genetic testing laboratories so as to promote high ethical standards and ensure safeguards. Unauthorised genetic testing should be criminalized.

Proposal 7-1 - We agree that there is an urgent need to harmonise the application of information privacy laws to health information, to eradicate the confusion that has already arisen from apparently overlapping privacy and health privacy laws.

Proposal 7-2 - The Privacy Act should be amended to expressly ensure that bodily samples from which identity can be ascertained are covered by the terms `personal information' and `record'. Section 4(2) of the NSW privacy law appears to provide an appropriate model to achieve this (Q.7-1) but the NSW Commissioner should confirm that it does so satisfactorily. We cannot see any particular difficulties in relation to the complaints and enforcement aspects of the Privacy Act (Q.7-2), or with the relationship with other laws dealing with bodily samples (Q.7-3)

NPP 9 of the Privacy Act should provide adequate controls over transfer of identifiable genetic samples to other jurisdictions (Qs.7-4, 7.5), but questions have been raised about the general adequacy of NPP 9 relative to equivalent provisions in other privacy laws. Concerns include the looseness of the exceptions which allow organizations exporting personal information to make their own assessment (NPP 9 (a) and (f)), and the lack of an express role for the federal Privacy Commissioner in giving guidance on adequacy of other jurisdictions. A better model might inorporate a pro-active role for the Commissioner along the lines of that included in the NSW privacy law (s.19, PPIPA).

The Privacy Act does not currently provide any protection for information about a deceased person (it is not `personal information') (Q.7-6). Given that there will be continuing privacy implications for surviving relatives from genetic samples from a person who subsequently dies, privacy protection remains important. But this may well be adequately covered by the Privacy Act provided that the definitions of personal information and record are adequately amended.

Proposal 7-3 - This seems a sensible amendment to ensure that all personally identifiable genetic information is subject to the `sensitive data' provisions of the Privacy Act.

Proposal 7-4 - This amendment is essential - the privacy risk with genetic information is in no way related to the `size' of the holder. Attention should also be paid to the other exemptions - certainly the employee record exemption should not apply if genetic information is held (we agree with Proposal 30-1), and neither should politicians, political parties or the news media be exempt from controls over genetic information.

Another key point that is not mentioned in the Discussion Paper is the application of the `sensitive data' provisions of the Privacy Act. At present these apply additional controls only to the collection of sensitive information (NPP10), with some limited additional use controls in NPP2. We believe that the starting point should be a requirement for informed consent not only for collection, but also for all uses and disclosures. At present, an organization that collects sensitive information in accordance with NPP 10 can use and disclose that information in many ways that do not accord with the individual's expectations, by taking advantage of one of the many exceptions in NPP2.

Proposals 18-1 & 18-2 - These amendments to Privacy laws are acceptable, provided there is a corresponding requirement to notify/counsel the individual patient. We are not sure that proposals 18-3 and 18-4 will suffice in this regard as NH&MRC guidelines would not apply by law to many health professionals?

Proposal 19-1 - We understand that this has now been implemented in Public Interest Determinations 9 & 9A.

We believe that the Discussion Paper accepts too readily the arguments for use of genetic information in insurance (Chapter 24). As a general principle, we do not think that allowing insurers to differentiate the way they deal with individuals on the basis of their genetic makeup can be justified. Individuals have no control over their genetic inheritance, and the community as a whole should bear any risks that arise from genetic differences. The issue of inequality of information should be dealt with by monetary limits on the amount of life or health insurance that an individual can take out without agreeing to declare any genetic information already known to them.

Proposal 25-1 - Insurers should review their application and consent forms to make the intended use of any genetic information clear to applicants. As regards the `bundled consent' issue (Q.25-1) we do not see how insurers can be prevented from making consent for collection of genetic information a condition of certain categories of insurance once a policy decision has been made to allow insurers to take this information into account. However, this should not relieve them of the obligation to explain the use of genetic information separately, and in detail.

Proposal 25-2 - the recent PIDs 9 & 9A do not extend to the insurance context. We accept that a similar determination may be required if the insurance industry is to be allowed to use family medical histories (including genetic information) for underwriting purposes.

Chapters 27-30 - We support the Discussion Paper proposals in relation to Genetic Discrimination in Employment (Chapters 27-30).

Chapter 33 - We are uneasy about the use of genetic testing for kinship in Immigration (Chapter 33) as it could have the effect of creating a class of Australian residents about whom much more genetic information is known that the rest of the community. If such testing is to be allowed, we suggest that the genetic samples be destroyed soon after the specific tests have been carried out, to remove any temptation for other subsequent uses.

Chapters 35-38 - In relation Law Enforcement uses (Chapters 35-38) we believe that this is an area of use where strict controls are necessary to prevent misuse or unfair use. We attach a submission to the current Crimtrac Review which highlights some of our concerns in this area.

Proposals 36-39 - We strongly support Proposal 36-1 as it is entirely inappropriate to pretend that consent is being obtained in situations where suspects or convicts have no real choice. We also support Proposals 36-2 and 36-3 but these do not go far enough - we believe that volunteers should also be given prescribed information prior to any procedure - there is too much potential for community pressure on people to volunteer without being fully informed. To the extent that forensic uses continue to be allowed, we support all of the safeguards embodied in Proposals 36-4 to 36-14, and proposals 37-1 to 39-1 inclusive.

Navigation

Go to the APF Home Page.

Send an email to APF

Created: 7 February 2003

Last Amended: 7 February 2003

Sponsorship

APF thanks its site-sponsor: