Dated 18 March 2002
This document is at http://www.privacy.org.au/Papers/SubmnOFPC0203.html
Thank you for your letter of 1 March, notifying us of this draft determination.
Please be advised that the Charter Council's issues relating to this application are not so serious as to warrant our calling for a conference, although we would be interested in attending if any other party has requested one.
We do however request that the Commissioner take into account the following points, in making his final determination, and in relation to the PID process more generally
We request that in your final determination, you explain more clearly why you agree with the CDPP that a PID is required to allow this research. This explanation should include a clarification of the `boundaries' of access to third parties - what criteria determine when access to a non-employee constitutes a disclosure (subject to IPP11) rather than a use (subject to IPP10, and potentially able to take advantage of exception (e) - directly related purpose). Presumably if the researcher were employed by the CDPP, (or even engaged as an independent contractor?), there would not be a `disclosure'? (We note that the AIC will not record the personal identifiers and that the access will take place on the premises of the CDPP).
Given the effort involved in processing a PID application, we suggest that the Commissioner should take the opportunity to give as much guidance as possible that could assist others to either avoid having to make an application, or expedite the process if it is unavoidable.
Given that access by researchers to personal information must be a common issue for many Commonwealth agencies, we suggest that the Commissioner consider issuing a determination of general effect under s.72(4) rather than confining it to the CDPP. If the criteria and conditions are sufficiently robust, as they appear to be in the draft determination, then with appropriate modifications the benefit of the application could accrue across the board. If the Commissioner were to pursue this, it would necessarily involve re-advertising a new draft determination, as it would have a much wider significance and potential interest.
We request that as a known interested party, the Australian Privacy Charter Council be notified directly of any future applications - we do not have the capacity to monitor the press for notices, or even to routinely monitor your web-site to be sure of noticing all new `events', even if they are included there in a timely fashion. We suggest that you could use your Privacy Connections channel (or a sub-set of it) to announce receipt of PID applications. A separate direct notice should also be issued when the Draft Determination is made. (We note that this was done in this case - and was the reason we became aware of the CDPP application.)
We request that applications be made available on your web-site as soon as practicable after receipt, so that interested parties can be considering the issues at the same time as you are preparing a draft determination. While there is no formal provision for comments or submissions before a draft determination is issued, consultation other than at a conference is implied by s.79(2), and we would have thought that it would help your consideration to know as early as possible if there are any major concerns.
Following on from our suggestion above, we suggest that the Commissioner routinely consider whether a determination of general effect under s.72(4) is desirable in response to all applications, and explain his decision in this respect in all draft determinations.
Nigel Waters
Convenor
Australian Privacy Charter Council
Go to the APF Home Page.
Created: 7 February 2003
Last Amended: 7 February 2003
APF thanks its site-sponsor: