Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.

Privacy Act & codes


Health information must usually be collected from the person the information is about. But sometimes it is all right to collect information from other people instead - for instance, when:

  • getting it from the person concerned would undermine the purpose of the collection
  • it’s necessary so a public sector body can uphold or enforce the law
  • the person concerned authorises collection from someone else.

Full rule

(1) Where a health agency collects health information, the health agency must collect the information directly from the individual concerned.

(2) It is not necessary for a health agency to comply with subrule (1) if the agency believes on reasonable grounds:

(a) that the individual concerned authorises collection of the information from someone else having been made aware of the matters set out in subrule 3(1);

(b) that the individual is unable to give his or her authority and the health agency having made the individual’s representative aware of the matters set out in subrule 3(1) collects the information from the representative or the representative authorises collection from someone else;

(c) that compliance would:

(i) prejudice the interests of the individual concerned;

(ii) prejudice the purposes of collection; or

(iii) prejudice the safety of any individual;

(d) that compliance is not reasonably practicable in the circumstances of the particular case;

(e) that the collection is for the purpose of assembling a family or genetic history of an individual and is collected directly from that individual;

(f) that the information is publicly available information;

(g) that the information: 

(i) will not be used in a form in which the individual concerned is identified;

(ii) will be used for statistical purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or

(iii) will be used for research purposes (for which approval by an ethics committee, if required, has been given) and will not be published in a form that could reasonably be expected to identify the individual concerned;

(h) that non-compliance is necessary:

(i) to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences;

(ii) for the protection of the public revenue; or

(iii) for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or 10 (i) that the collection is in accordance with an authority granted under section 54 of the Act.

Note: An action is not in breach of this rule if it is authorised or required by or under law: Privacy Act, section 7(4).