What is the process of protecting peoples private or sensitive

6.88 ‘Sensitive information’is a sub-set of personal information and is given a higher level of protection under the NPPs. The IPPs do not refer to sensitive information and agencies are required to handle all information, including sensitive information, in accordance with the IPPs. The principles recommended for handling sensitive information, and their extension to agencies, are discussed further in Chapter 22.

6.89 ‘Sensitive information’ is defined in the Privacy Act to mean information or an opinion about an individual’s:

• racial or ethnic origin;
• political opinions;
• membership of a political association;
• religious beliefs or affiliations;
• philosophical beliefs;
• membership of a professional or trade association;
• membership of a trade union;
• sexual preferences or practices; or
• criminal record.

6.90 ‘Sensitive information’ also includes health information[98] and genetic information about an individual that is not otherwise health information.[99]

6.91 ‘Sensitive information’ is subject to a higher level of privacy protection than other ‘personal information’ handled by organisations in the following ways:

• ‘sensitive information’ may only be collected with consent, except in specified circumstances. Consent is generally not required to collect ‘personal information’ that is not ‘sensitive information’;[100]
• ‘sensitive information’ must not be used or disclosed for a secondary purpose unless the secondary purpose is directly related to the primary purpose of collection and within the reasonable expectations of the individual;[101]
• ‘sensitive information’ cannot be used for the secondary purpose of direct marketing;[102] and
• ‘sensitive information’ cannot be shared by ‘related bodies corporate’ in the same way that they may share other ‘personal information’.[103]

6.92 Similar classes of personal information are included in the definitions of ‘sensitive information’ in the Victorian, Tasmanian and Northern Territory privacy legislation.[104] Health information is not included in the definition of ‘sensitive information’ in Victoria because it is covered separately by the Health Records Act 2001 (Vic). The Privacy and Personal Information Protection Act 1998 (NSW) does not include a definition of sensitive information.

6.93 The Council of Europe Convention and OECD Guidelines do not specifically address sensitive information. Indeed, the Explanatory Memorandum to the OECD Guidelines expresses the view that ‘it is probably not possible to identify a set of data which are universally regarded as being sensitive’.[105]

6.94 Article 8 of the EU Directive deals with ‘special categories of data’, which are defined as ‘personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life’. Article 8 prohibits the processing of this kind of information without consent except in specified circumstances and allows Member States to prohibit processing such data even with the consent of the data subject. The EU Directive also refers to ‘sensitive data’ but does not define the term.[106]

6.95 Sensitive information is provided with additional protection in the Privacy Act for a number of reasons. Information relating to race or ethnic origin, political or religious beliefs, trade union membership and sexual orientation, for example, is highly personal and may provide the basis for unjustified discrimination. In addition, this sort of information is likely to be necessary for the functions and activities of agencies and organisations in very limited circumstances. Health information, genetic information and criminal record information also is highly personal and has the potential to give rise to unjustified discrimination against individuals.

6.96 In IP 31, the ALRC asked whether the existing definition of ‘sensitive information’ was adequate and appropriate.[107] The major issues raised by stakeholders in response were: information made sensitive by context; financial information; and biometric information.

Information made sensitive by context

6.97 In its submission to the Inquiry, the NHMRC stated that:

it is extremely difficult to establish the categories of information which universally would be considered ‘sensitive’ either because of the nature of the information, the context in which it is handled or the views of the person to whom the information relates.

We note that the Personal Information Protection and Electronic Documents Act 2000 (Canada) does not define ‘sensitive information’ and that the Model Code allows an organisation discretion in determining whether information is sensitive. We also note that the sensitivity of certain categories of information may vary between cultures and individuals.[108]

6.98 The Canadian Personal Information Protection and Electronic Documents Act 2000 states that:

Although some information (for example, medical records and income records) is almost always considered to be sensitive, any information can be sensitive, depending on the context. For example, the names and addresses of subscribers to a newsmagazine would generally not be considered sensitive information. However, the names and addresses of subscribers to some special-interest magazines might be considered sensitive.[109]

6.99 The NHMRC suggested that the categories of information included in the definition of ‘sensitive information’ might be amended by regulation to provide some flexibility.[110] The CSIRO suggested that sensitive information should include ‘culturally sensitive data’ or other data deemed to be sensitive by the data provider.[111]

6.100 The Queensland Government Commission for Children and Young People and Child Guardian noted that:

For instance, a health practitioner receiving information relating to the abuse or neglect of a child may consider this information to be health information, and hence deal with it under the specific health privacy regime. However, if the same information is received by a child welfare practitioner it is not likely to be considered purely health information. The classification of child abuse information thus appears to depend not only on its nature, but also the context in which it is received.[112]

6.101 DLA Phillips Fox, however, suggested that:

Introducing more subjective criteria (such as the sensitivity of the information taking into account surrounding circumstances) would:

• result in greater uncertainty of application; and
• reduce the ability of organisations to implement broad guidelines for the treatment of categories of information so as to ensure compliance with the NPPs (and equivalent state and territory requirements).[113]

ALRC’s view

6.102 The ALRC recognises that personal information can become more or less sensitive because of the context in which it is considered and notes that this can apply to almost any personal information. The definition of ‘sensitive information’, however, should not be amended to include information made sensitive by context. On balance, the existing approach of listing categories of information as sensitive provides greater certainty. This is important because the Privacy Act imposes stringent requirements for handling sensitive information.

6.103 In particular, the Privacy Act and the model UPPs provide that sensitive information should generally be collected with consent and should be used only for the purpose for which the information was collected or a directly related secondary purpose. This regime is significantly different to the regime regulating the handling of other personal information, which can be collected without consent and used and disclosed for a broader range of purposes. It is important to be clear about what information is covered by the more stringent requirements.

Financial information

6.104 A number of stakeholders suggested that sensitive information should include financial information,[114] while others described consumer credit information as sensitive.[115] The OPC stated that:

Community attitudes research undertaken by the Office in 2001 and 2004 has indicated that individuals consider financial information to be very sensitive. In both community attitudes surveys, financial information was the top response for individuals when rating what types of information they were most reluctant to provide to organisations.[116]

6.105 Legal Aid Queensland, however, noted in its submission:

That obtaining consent as the primary criteria for the release of financial information fails to recognise the inherent disparity in the bargaining positions of consumers and corporations.[117]

6.106 A number of other stakeholders were of the view that financial information should not be included in the definition of ‘sensitive information’.[118]

ALRC’s view

6.107 Financial information should not be included in the definition of ‘sensitive information’ in the Privacy Act. Financial information is sensitive in some respects and does require appropriate handling, for example, appropriate security. Financial information has a number of characteristics, however, that sets it apart from the categories of information currently included in the definition of sensitive information. In particular, it does not relate to the physical attributes or personal beliefs of the individual in the same way as other information currently defined as sensitive.

6.108 In addition, agencies and organisations often have a legitimate interest in an individual’s financial information, for example, in relation to providing credit. Such information is necessary to the functions and activities of agencies and organisations in order to protect the interests of all parties to transactions. The Privacy Act already recognises that personal information relating to credit can be prejudicial and should only be collected, used and disclosed in appropriate circumstances. The Act provides a range of safeguards in relation to credit reporting that are discussed in detail in Part G. It is important to note, however, that these safeguards are not the same as the safeguards provided in relation to ‘sensitive information’. For example, the credit reporting provisions do not require consent for the collection of credit information.

Biometric information

6.109 Biometric information can be ‘personal information’ for the purposes of the Privacy Act in some circumstances, that is, where an individual’s identity is apparent or can reasonably be ascertained from the information.[119] A number of stakeholders suggested that biometric information, like genetic information, should be accorded the higher protection provided by the Privacy Act in relation to ‘sensitive information’.[120]Concern has been expressed that biometric technologies, such as facial recognition technologies, may be used to identify individuals without their knowledge or consent,[121] and that biometric information could reveal other sensitive personal information, such as information about a person’s health, racial or ethnic origin or religious beliefs.[122]

6.110 The Biometrics Institute describes the nature of biometric technology as follows:

Biometric technology involves the storage and use of unique personal information to verify the identity of an individual. These unique identifiers are based on personal attributes such as fingerprints, DNA, iris, facial features, hand geometry, voice etc. Even a photograph could be described as one of the lower levels of biometric recognition.[123]

6.111 As discussed in Chapter 9, in a typical biometric system a biometric device, such as a finger scanner, is used to take a biometric sample from an individual. Data from the sample are then analysed and converted into a biometric template, which is stored in a database or an object in the individual’s possession, such as a smart card. Later biometric samples taken from the individual can then be compared to the stored biometric template to identify the individual (identification, or one-to-many matching) or to attempt to verify that an individual is who he or she claims to be (verification, or one-to-one matching).

6.112 Recognising some of the special sensitivities around the use of biometric technology, the Biometrics Institute, in consultation with the OPC, has developed a privacy code to regulate the handling of biometric information.[124] The code binds private sector organisations that apply to become Code Subscribers and whose applications are approved by the Biometrics Institute Board. To date, only four organisations have elected to be bound by the Code.

6.113 The Biometrics Institute Privacy Code includes a number of Supplementary Biometrics Institute Privacy Principles. One of the additional principles is similar in scope to the protection provided for ‘sensitive information’ by NPP 2.1(a):

Secondary analysis or function creep of biometric information collected for purposes such as authentication or identification is not permitted without express free and informed consent. For example biometric information collected for the purposes of authentication and identification shall not be used to examine that information in search of genetic patterns or disease identification without express free and informed consent.[125]

6.114 In its submission to the Inquiry, the Health Informatics Society of Australia noted that:

Sensitive information by definition relates to those areas where prejudices can prevail, eg sexual preferences, political or religious beliefs, criminal records, etc. The concern individuals have over the way that other parties might act based on the knowledge gained from genetic information puts this into the sensitive information category. Furthermore, biometric information can be considered sensitive since it is fixed and unlike a password or PIN cannot be reset once it has been inappropriately released.[126]

6.115 The OPC expressed the view that

all biometric template information should be covered by the stricter provisions in the Privacy Act for sensitive information. However, it may be impractical and undesirable for all biometric samples to be included under the definition of sensitive information, especially where there is no intention to use the sample for biometric matching or identification. For example, it would be difficult and overly burdensome to require consent every time a photograph of a person (technically a biometric sample) is taken.

The Office takes the view that sensitive information provisions should only apply to: (a) biometric samples collected for the purpose of biometric matching or biometric identification; and (b) biometric template information.

The Office notes however that biometric samples—if they were to fall outside this definition of sensitive information—may still be covered by the Privacy Act as personal information and therefore achieve legislative protections. Furthermore, as noted in IP31 (at IP31 paragraph 11.46) there may be instances where a biometric sample reveals sensitive information about an individual such as health information and will thus be defined as sensitive information under the Privacy Act.[127]

Discussion Paper proposal

6.116 In DP 72 the ALRC proposed that the definition of ‘sensitive information’ be amended to include: biometric information collected for the purpose of automated biometric authentication or identification; and biometric template information.[128] There was significant support for this proposal.[129]

6.117 A small number of stakeholders did not support the proposal.[130] The Australian Government Department of Defence did not support extending the definition of ‘sensitive information’ to include biometric template information.[131]

6.118 Professor Michael Wagner, of the National Centre for Biometric Studies at the University of Canberra, noted in correspondence to this Inquiry that biometric templates contain ‘all the salient information necessary to authenticate or identify a person’ and that ‘this will potentially include sensitive information related to age, gender, [and] health’. He stated that:

Biometric templates are not essentially different from the original biometric information. Therefore I believe that both original biometric information and biometric templates should equally be treated as sensitive and protected correspondingly.[132]

ALRC’s view

6.119 The definition of sensitive information should be amended to include certain biometric information. Biometric information shares many of the attributes of information currently defined as sensitive in the Privacy Act. It is very personal because it is information about an individual’s physical self. Biometric information can reveal other sensitive information, such as health or genetic information and racial or ethnic origin. Biometric information can provide the basis for unjustified discrimination.

6.120 The ALRC recognises that requiring consent to collect all biometric information may be impracticable. For this reason, the ALRC has limited the type of biometric information to be included in the definition of sensitive information—namely, biometric information collected for use in automated biometric verification and identification systems and biometric template information. This recommendation is intended to address the most serious privacy concerns around the handling of biometric information, for example, that such information may be used to identify individuals without their knowledge or consent.

6.121 The provisions of the Privacy Act relating to sensitive information do not currently apply to agencies. In Chapter 22, the ALRC recommends that the requirements in the model UPPs dealing with ‘sensitive information’ apply to both agencies and organisations.[133] The ALRC also recommends broadening the circumstances in which sensitive information may be collected without consent to include collection ‘required or authorised by or under law’ to meet concerns raised by agencies.[134] Where biometric information is to be collected by agencies, for example, for inclusion in automated biometric verification or identification systems, such as the ‘SmartGate’ automated border processing system,[135] such collection should be carried out on the basis of consent, or as required or authorised by or under law.

Sexual orientation and practices

6.122 In DP 72, the ALRC also suggested that the reference to ‘sexual preferences and practices’ in the definition of ‘sensitive information’ be changed to ‘sexual orientation and practices’.[136] This was on the basis that the term ‘sexual orientation’ is consistent with language used in recent federal legislation[137] and state and territory anti-discrimination and human rights legislation.[138] It also reflects modern usage. A number of stakeholders expressed support for this change.[139]

Recommendation 6–4 The definition of ‘sensitive information’ in the Privacy Act should be amended to include:

(a) biometric information collected for the purpose of automated biometric verification or identification; and

(b) biometric template information.

Recommendation 6–5 The definition of ‘sensitive information’ in the Privacy Act should be amended to refer to ‘sexual orientation and practices’ rather than ‘sexual preferences and practices’.