Privacy public interest determination guide

About the guide

This guide has been developed by the Office of the Australian Information Commissioner (OAIC) to assist agencies and organisations (known as APP entities) when they are considering applying for a public interest determination under Part VI of the Privacy Act 1988 (Privacy Act). The guide includes information about matters an applicant should consider when developing an application and the application process.

What is a public interest determination?

A public interest determination (PID) may provide that an act or practice of an APP entity that could otherwise breach an Australian Privacy Principle (APP), or a registered APP code that binds that entity, shall not be regarded as having done so (s 72(2)). An APP entity undertaking that act or practice will not be taken to have contravened s 15 of the Privacy Act (or s 26A if an APP code).

The power to make a PID is conferred on the Information Commissioner, and can also be exercised by the Privacy Commissioner.

The Commissioner can make a determination only if satisfied that the public interest in an APP entity performing an act or engaging in a practice, substantially outweighs the public interest in the entity adhering to the APP or registered code (s 72(2)(b)).

The Commissioner may make a temporary public interest determination (TPID) to operate for up to 12 months, if an urgent determination is required (s 80A). While a TPID is in force an application can be made and considered for a PID that will operate for a longer or indefinite period.

A PID and TPID can both provide that the determination will have general effect — that is, it will apply to acts and practices engaged in by APP entities that were not a party to the application (s 72(4) and s 80B(3)).

The Commissioner may dismiss an application for a PID if satisfied that it is frivolous, vexatious, misconceived, lacking in substance or not made in good faith (s 73(1A)).

PIDs and TPIDs are legislative instruments that are to be registered on the Federal Register of Legislative Instruments under the Legislative Instruments Act 2003 (Cth).

Consultation with the OAIC prior to making an application

Before preparing or submitting a PID application, an APP entity should contact the OAIC to discuss the issue. This will enable discussion about whether a PID application is necessary, and other ways the entity could undertake the act or practice without breaching the APPs or a registered code. Other matters that may be discussed, if a PID may be submitted, include the terms in which a PID may be made, the information to be included in the application, and a comparison of the proposed PID and previous determinations under the Privacy Act.

A PID application and the public interest test

Before making a PID, the Commissioner must be satisfied that the public interest in an entity doing an act or practice that could contravene an APP or registered code ‘substantially outweighs’ the public interest in complying with the APP or code.

An entity applying for a PID is expected to make a well-reasoned and convincing case that a PID is necessary, including by providing evidence that the ‘substantially outweighs’ threshold is met. Public interest issues that should be considered in preparing an application include:

• the objects of the Privacy Act set out in s 2A, which include promoting the protection of the privacy of individuals, balancing privacy protection with the interests of entities in carrying out their functions and activities, and achieving nationally consistent regulation of privacy and handling of personal information
• the importance of an entity being able to undertake the act or practice to which a determination would apply, and the public interest objectives that would be served by the act or practice being undertaken
• the impracticability of undertaking that act or practice in compliance with the APPs or a registered code, and the impact on the public interest if the proposed act or practice is not undertaken
• other options considered by the entity for doing the act or practice or complying with the APPs or a registered code. For example, the entity should first consider whether a change of systems or processes that would enable the entity to meet its purposes while still complying with the APPs or a registered code is practicable
• the potential for the proposed act or practice to adversely affect the privacy interests of individuals, and
• the extent to which the proposed act or practice may be inconsistent with an individual’s reasonable expectation of privacy.

The public interest in the APP entity doing the act or practice should be balanced against the public interest in complying with the APPs or a registered code. Evidence should be provided to show that those other public interests substantially outweigh affording the individual the privacy protections given by the APPs or a registered code.

Summary of determination process

The application process generally follows this sequence:

1. The applicant consults the OAIC and this guide before preparing an application.
2. The applicant prepares the application and submits the application to the OAIC indicating if the application raises an issue that requires an urgent decision.
3. The OAIC publishes a notice of receipt of the application. The notice of receipt will normally include a call for expressions of interest and/or submissions on the application.
4. Alternatively, the Commissioner may dismiss an application if it is frivolous, vexatious, misconceived, lacking in substance or not in good faith. If an application is dismissed at this early stage, the OAIC will publish a notice of dismissal.
5. The Commissioner, taking into consideration any submissions, will prepare a draft determination. This may either be to allow the act or practice or to dismiss the application.
6. The applicant and other interested persons are invited to notify the OAIC if they wish a conference to be held to discuss the draft determination — this may be combined with the notice of receipt.
7. If requested the OAIC will convene a conference to discuss the application and the draft determination.
8. The Commissioner will consider the application and all additional information collected through the consultation and conference process before making a final determination.
9. The determination will be registered with the Federal Register of Legislative Instruments (and is subsequently tabled in Parliament and subject to disallowance).

A detailed explanation of the PID process is found in the attached appendix.

Appendix

Stage 1 — The application

Who can make a public interest determination (PID) application

1 Only the APP entity proposing to act or to engage in a practice that constitutes a breach or a possible breach of an APP or a registered APP code relevant to that entity, may make a PID application. [1]

Have you consulted with the OAIC?

2 Before preparing a PID application in accordance with this guide, an entity is advised to consult with the OAIC to ensure that a PID is appropriate in the circumstances. Entities may also like to discuss with the OAIC options that could prevent the need for a PID, and the information and evidence required to compile an application.

What the application should include

3Generally an application should include the following information:

1. the legal name of the applicant and its contact details
2. identification of the specific APP/s or APP code provisions involved
3. a detailed and precise description of:
   1. the type(s) of personal information used in the act or practice
   2. what the act or practice involves
   3. the context in which that act or practice will take place
   4. the class of individuals to whom the act or practice relates, including the approximate number of individuals whose personal information may be involved in that act or practice
   5. any other agencies, organisations or bodies involved and their role in relation to the act or practice, and
   6. the anticipated nature, extent and frequency of the act or practice in question.
4. why non-compliance with an identified APP or APP code provision is necessary
5. detailed arguments demonstrating why the public interest in doing the act or practice outweighs, to a substantial degree, the public interest in adhering to the identified APP or APP code provision
6. alternative courses of action that have been considered that would not lead to a breach of an APP or registered APP code, with explanations as to why such alternatives are not feasible
7. information about other entities, or class of entities, that may be in a similar situation and should be included in a generalising determination if the PID application is made, and
8. if possible, a proposed draft determination.

Additional information about disclosure of personal information

4 Where an application relates to an act or practice which would constitute a breach of APP 6 and/or APP 8, or a related APP code provision, the application should also include:

1. the scope of the proposed disclosure
2. the names of agencies, organisations or bodies that will receive the information — distinction should be made between recipients covered by the Privacy Act and recipients not covered by the Privacy Act.
3. any safeguards that have or will be put in place to prevent further use and disclosure of the personal information by the recipient/s, specifically:
   1. assurances/agreements between the parties
   2. sanctions in case of a breach of the agreement, and
   3. security/access arrangements on the part of the recipient.
4. any additional information about the applicant and/or recipients information handling practices that might be relevant.

Exempt documents

5 Australian Government agencies must state whether any of the information or documents included in their application are considered exempt under Part IV of the Freedom of Information Act 1982 (FOI Act). The OAIC will only make these documents available to interested parties with the agency’s consent (s 74(2)).

Temporary public interest determinations

6 Where the matter is urgent the application for a PID may include a request that a temporary public interest determination (TPID) be made pending the full consideration of the main application.

7 The same public interest threshold applies to a TPID. The OAIC must be satisfied that the public interest in the APP entity doing the act, or engaging in the practice, substantially outweighs the public interest in adhering to the APPs or a registered APP code which binds that entity. The OAIC must also be satisfied that the application requires an urgent decision. However, as the public will not have had an opportunity to comment on the application the public interest test will be assessed on a prima facie basis.

8 A TPID can only be made for a period up to 12 months.

9 Where it is practicable and appropriate to do so, the OAIC will publish a notice of receipt of the application for a PID that requires urgent attention, prior to the issuing of a TPID.

10 Despite a TPID being made the OAIC will continue to process the PID application through its public consultation stages to determine if a longer term determination should be made or if the temporary determination should be ended early.

Stage 2: Notification

11. Notices of receipt, determination or dismissal of a PID application are published on the OAIC’s Public Interest Determination Register webpage. Where possible the full application and accompanying documents will be linked from the website notice. Where that is not possible a summary of the application and/or accompanying documents will be provided unless the information is exempt under the FOI Act or the applicant has requested, and the OAIC has agreed, to the material being kept confidential.

12 The OAIC has the ability to dismiss the application upon receipt if it considers that the application is frivolous, vexatious, misconceived, lacking in substance or not made in good faith (s 73(1A)). If the OAIC considers the application should be dismissed under one of these grounds the applicant will be given an opportunity to comment on the OAIC’s proposed dismissal.

13 A notice of receipt, where an application has not been dismissed, will request interested parties to make submissions and/or express their interest in the application.

Stage 3: Draft Determination

14 The Commissioner will prepare a draft of the determination that he or she proposes to make. The intention of this is to engage interested parties in consultation on the PID before the final determination is made.

15 The Commissioner may take into consideration any matter when making a draft determination. The draft determination will be accompanied by a discussion of the public interest arguments against which the determination has been assessed. A copy of the draft determination will be made available on the OAIC’s Public Interest Determination Register webpage and provided to all interested parties, including all parties who provided a submission or who have expressed interest in the PID application.

16 Persons/bodies that the OAIC considers have a real and substantial interest in the application will be invited to indicate if they wish a conference to be held in relation to the application. However, this may not include all those who expressed an interest in response to the notice of receipt of the application. Depending on the nature of the application the draft determination and invitation to request a conference may be notified at the same time as the initial application notice.

Stage 4: Conference

17 If a request is made within the period allowed for a conference to be held the OAIC will convene a conference.

18 The OAIC may vary the conduct of conferences according to the circumstances of the case and the nature of the application. In most cases, an informal tribunal approach will be adopted allowing the opportunity for all parties to put forward their case.

Attendance at a conference

19 An applicant may be represented by an officer or an employee at the conference. Any invitee, or interested person that the OAIC believes has a real and substantial interest in the application may attend the conference in person. The OAIC has the power to exclude a person from attendance at a conference in certain circumstances, for example where the person uses insulting language.

20 All representatives will be expected to have a direct operational knowledge of the act or practice in question and the authority to speak on policy issues.

21 Attendees are to provide a brief outline of their interest in the application and their position on the draft determination, to be discussed at the conference. The outlines will be made available, on request, to the other interested parties, together with a summary of the submissions received. The outlines will not necessarily be presented in person at the conference.

22 Generally, legal representation is not necessary. If an interested person wishes to be legally represented at the conference, they must seek the OAIC’s permission prior to the conference. This also applies if an interested person would like to bring to the conference an expert witness, or a person with direct operational experience.

Stage 5: Determination

23 After considering the submissions and anything said at the conference, if one was held, the Commissioner will make a final determination. The final determination will either identify the circumstances in which the act or practice can occur or it will dismiss the application.

24 While a determination allowing the act or practice is registered the APP entity will not be considered to have contravened s 15 of the Privacy Act (or s 26A if an APP code) if they undertake the act or practice.

25 The Commissioner may also extend a PID or TPID to other entities in a similar situation (by way of a determination that has general effect). A determination in this form allows other APP entities to act or engage in an act or practice that is the subject of the PID or TPID and not be considered to have contravened s 15 of the Privacy Act (or s 26A if an APP code). A determination with general effect may identify a class of entities to which it applies.