When can I use the serious threat exception?

Under the Privacy Act, there is a general obligation not to use or disclose personal information, unless an exception applies.

One of the exceptions which permits the use or disclosure of personal information is where you believe that the use or disclosure is necessary in order to prevent or lessen the risk of a serious threat to someone’s safety, wellbeing or health.

To work out whether something qualifies as a ‘serious threat’ you should consider:

1. The likelihood of the threat being realised (how likely is it that this thing will actually happen?);                                                                                                          
2. The severity of the consequences if the threat is realised (how bad could it be if it does happen?); and                                                                                               
3. The time at which the threat may be realised (how soon will this thing happen?).  

If you want to rely on this exception, you should only disclose information to the person, body or agency which is able to do something to prevent or lessen the threat. You should also disclose only the information you need to in order to make it clear why you believe there is a serious threat. For example, if you think a child is at risk or is being harmed, you should report the case to someone who can help like a social worker or a relevant agency like the child's school or Police.  

In a another example, if you are dealing with a client, patient or employee who has made comments leading you to think they are going to badly hurt themselves or others, you can rely on this section to pass on information to Police so they can take appropriate steps to stop the person.

Updated December 2020