There’s a rarely used part of the Privacy Act which agencies can apply to use, if they want to use personal information to tell affected individuals of an entitlement or to redress a wrong.

Under section 54, the Privacy Commissioner may authorise the collection, use or disclosure of personal information under circumstances which would otherwise breach the information privacy principles in the Act – if there is a clear benefit to the individual concerned.

Several years ago, a government agency investigated an anomaly in one of its practices in dealing with its clients. It realised that the practice was not permitted by the agency’s statute or by its policy and procedures.

The agency’s investigation found that several dozen people might have been affected by this unlawful practice. The agency decided the right thing to do was to redress this wrong with these former clients. It wanted to contact the affected individuals to offer monetary compensation for any distress caused. It also wanted to apologise individually for what happened, and to provide access to counselling services.

The agency was able to contact over half the individuals affected but had exhausted the contact details it held for the remaining people. The agency wanted to share some basic details about those people with a small number of other government agencies that it considered were most likely to hold more up to date contact details.

Principle 11

Principle 11 of the Privacy Act puts limits on the disclosure of personal information by agencies. Broadly speaking, an agency should not disclose personal information – unless one of the exceptions in the Act applies.

The agency concluded that none of the exceptions applied that would allow it to disclose the details of the individuals it was trying to locate, or for the other agencies to respond to the request for contact information. It sought the Privacy Commissioner’s special authorisation under section 54 of the Act.

Section 54

The agency made an application to the Commissioner under section 54(1)(b) of the Act, seeking authorisation to disclose the name and date of birth of the remaining individuals to a small number of other government agencies, and for those agencies to respond with any contact details they held for those individuals.

Section 54 acts as a safety valve, giving the Commissioner discretion to authorise agencies to collect, use and disclose information in exceptional but justifiable circumstances where the privacy principles exceptions do not afford enough flexibility.

Section 54(1)(b) says the Commissioner may authorise an agency to collect, use or disclose personal information if the Commissioner is satisfied, in the special circumstances, that the collection, use or disclosure involves a clear benefit to the individual concerned that outweighs any interference with the privacy of the individual.

The sole purpose that the agency sought the authorisation was to enable it to contact the individuals to assess whether they had been affected by this unlawful action. If they were subjected to the unlawful practice, the agency intended to offer financial compensation, an apology and free counselling services.

Commissioner’s authorisation

The Commissioner was satisfied the disclosure of information about the individuals offered a clear benefit to them and that this outweighed any likely interference with their individual privacy.

The Commissioner approved the application subject to a raft of conditions, including that it was a one-off use to be completed within six months, and that the information must be destroyed on completion of matching the data with the other agencies.

As an added precaution, because the context of this disclosure was extremely sensitive, the agency was only allowed to describe to the other agencies in broad terms the purpose for seeking contact details for the named individuals. The personal information relevant to this process would be held separately from the agency’s main administrative system and access restricted to only those staff dealing with the issue.

Finally, contact with the individuals must be made by phone, or in person by a senior official visiting an address - no letters must be sent. This was to reduce the possibility of an accidental data breach.

On completion of the exercise the agency has successfully contacted over half of the individuals to offer compensation and support. This was an excellent result for the agency and the contacted individuals. The result demonstrated the value of section 54 as an important safety valve to allow the Privacy Commissioner the discretion to support appropriate sharing of information in exceptional circumstances.

Image credit: Monarch butterfly on purple cornflower via Flickr (Public domain).

IPP11 - disclosure, IPP4 - manner of collection