Public Interest Determination No. 10 - Collection of Family, Social and Medical Histories

View printable version of this page

Privacy Act 1988, Part VI

Relevant National Privacy Principle: National Privacy Principle 10.1

Effective: 11 December 2007 to 10 December 2011

Under s.72(2) of the Privacy Act 1988 (Cth) I, Karen Curtis, Privacy Commissioner, determine that I am satisfied that:

(1) Dr Tony Hobbs (Dr Hobbs) is an organisation for the purposes of section 6C of the Privacy Act; and

(2) Dr Hobbs has applied under section 73 of the Privacy Act for a Public Interest Determination in relation to the acts and practices set out in (3) below; and

(3) Dr Hobbs collects health information from an individual (a 'health consumer'), or from a person responsible* for the health consumer, about another individual (a ‘third party') in circumstances where:

• a) the collection of the third party's information into the health consumer's family, social or medical history is necessary for Dr Hobbs to provide a health service directly to the health consumer; and
• b) the third party's information is relevant to the health consumer's family, social or medical history; and
• c) Dr Hobbs collects the third party's information without obtaining the consent of the third party; and
• d) the third party's information is only collected from a person responsible for the health consumer if the health consumer is physically or legally incapable of providing the information themselves.

(4) the acts and practices set out in (3) above breach or may breach National Privacy Principle 10.1 in relation to the collection of the third party's information; and

(5) the public interest in Dr Hobbs doing the acts, or engaging in the practices, set out in (3) above substantially outweighs the public interest in adhering to National Privacy Principle 10.1 in those circumstances; and

(6) this determination should remain in force for a period not exceeding 4 years from 11 December 2007.

* ‘person responsible' has the same meaning as defined in National Privacy Principle 2.5 and 2.6.

Karen Curtis
Privacy Commissioner
6 December 2007

Dr Hobbs's application

On 21 August 2007, Dr Tony Hobbs applied under section 73 of the Privacy Act 1988 (Cth) (the Privacy Act) for a public interest determination (PID) to be issued under section 72 of the Privacy Act. Dr Hobbs is a general practitioner and obstetrician located in New South Wales.

Dr Hobbs has requested a determination to enable the continuation of a practice that breaches, or may breach, National Privacy Principle (NPP) 10.1.  The practice concerns the collection of information about a third party in the context of the collection of family, social or medical histories from health consumers "across all clinical settings and by all clinicians". 

Dr Hobbs notes that PID 9 and the associated PID 9A (which gives PID 9 general effect for other organisations in the same circumstances) currently permit the relevant acts or practices to occur in the stated circumstances without complying with NPP 10.1. NPP 10.1 prohibits the collection of sensitive information about an individual, in this case the third party, unless a prescribed exception applies.  PIDs 9 and 9A will expire on 10 December 2007. Dr Hobbs considers that the effect of the existing PIDs continues to be of "critical importance" for health service providers in providing best-practice assessment, diagnosis and care to patients. Dr Hobbs attests that the issues raised in support of the previous application, made by ACHA Health on 19 December 2001 for PIDs 9 and 9A, are still relevant.[1]

Dr Hobbs submits that the practice of the collection of family, social and medical history information of a health consumer is a fundamental part of the diagnosis and treatment regime for health service providers in relation to health consumers. Dr Hobbs refers to a "large body of evidence" supporting the collection of third party health information in the stated circumstances as detailed in the PID application of ACHA Health and "strongly supported" by submissions during the statutory consultation process in advance of the making of PIDs 9 and 9A.

Dr Hobbs also submits that fulfilling the requirement to obtain the consent of third parties to collect their information and notifying third parties of the collection of their information in this context is "clearly impractical" and "could compromise the health care of consumers".  Dr Hobbs also submits that the public interest is served by the efficient and accurate diagnosis of consumers by clinicians. 

Dr Hobbs asserts that the collection of personal information in the course of providing a health service occurs in an environment of maximum consumer privacy governed by professional codes of ethics and confidentiality. Dr Hobbs submits that clinicians are bound to treat this information confidentially whomever this information relates to.

Dr Hobbs notes that although a legislative amendment to the Privacy Act could address the issue of collecting third party personal information for medical histories (removing the need for further determinations), such an amendment is unlikely to occur before the expiration of PIDs 9 and 9A on 10 December 2007.

History of past Public Interest Determinations in relation to the collection of family, social and medical histories

On 19 December 2001, my predecessor received an application from ACHA Health, a private sector health service provider, for a determination under section 73 of the Privacy Act.  ACHA Health was concerned that the accepted practice of collecting family, social and medical histories during the course of providing a ‘health service'[2] may breach the National Privacy Principles which were then about to come into operation.

On 21 December 2001, in response to ACHA Health's application, two temporary determinations were issued on an urgent basis which were effective for 12 months from 21 December 2001. 

The temporary determinations were issued for a specific period that would enable ACHA Health and other health service providers to continue the practice of collecting third party information without the third party's consent - in the course of taking a health consumer's family, social or medical history - while broad consultation was undertaken on ACHA Health's application.   

After that consultation, two determinations (PIDs 9 and 9A) were issued effective for a period of 5 years from 11 December 2002.

The combined effect of PIDs 9 and 9A was to exempt health services providers from complying with NPP 10.1 in certain circumstances.  In summary, under PIDs 9 and 9A a health service provider could collect a third party's health information from a health consumer without the third party's consent when both of the following circumstances were met:

• the collection of the third party's information into a consumer's family, social or medical history is necessary for a health service provider to provide a health service directly to the consumer; and
• the third party's information is relevant to the family, social or medical history of that consumer.

After 10 December 2007, in the absence of a further determination, section 16A of the Privacy Act would require Dr Hobbs and other health service providers to comply with NPP 10.1 when collecting third party information in the course of collecting a health consumer's family, social or medical history.  This would generally require obtaining the consent of the third party.

I have previously acknowledged the clinical value of collecting family, social and medical history information, and recognised the widespread support for the activity in the health sector. In my 2005 Review of the Private Sector Provisions of the Privacy Act (the Office's Private Sector Review), I recommended that an appropriate amendment be made to the Privacy Act as a way of permanently addressing this issue.[3]

This issue is now also under consideration by the Australian Law Reform Commission (ALRC) in its review of privacy.[4]

Clarifying the extent of the determination to cover collection from a person responsible for a health consumer where the health consumer is physically or mentally incapacitated

During the course of receiving submissions on Dr Hobbs's application it became clear that there was some confusion amongst stakeholders as to whether PIDs 9 and 9A allowed collection of third party information from a relative or other person ‘responsible' for the health consumer, where the health consumer is incapable of providing the information themselves due to physical or mental incapacity.

In my Office's March 2007 submission to the ALRC Issues Paper 31, I again recommended amendment to the Privacy Act to give statutory effect to PIDs 9 and 9A.[5] In addition, that submission noted that there would also be merit in allowing the relevant collection from a person responsible for the health consumer, where the health consumer is incapacitated.  I note that the ALRC supported this clarification in its Discussion Paper 72.

I have now considered it appropriate to clarify this matter in PIDs 10 and 10A, to allow health service providers to collect third party information from a ‘person responsible' for a health consumer where the health consumer is incapacitated. The clarification is reflected in sub-paragraph 3(d). The definition of a ‘person responsible' for an individual is currently found in NPP 2.5 and 2.6. I intend that PIDs 10 and 10A reflect the NPP definition as for other terms used in these determinations.

Notice of receipt of Dr Hobbs's application

In September 2007, my Office published a Notice of Receipt of Dr Hobbs's application.  Information regarding Dr Hobbs's application, the existing Public Interest Determinations 9 and 9A and my Office's "Guidelines on Public Interest Determinations" were made available on my Office's website (http://www.privacy.gov.au/) and in hard copy on request.

The Notice of Receipt was also published in The Weekend Australian and the Canberra Times on 8 September 2007, in a special notice in the Commonwealth Gazette on 12 September 2007, and on my Office's website (http://www.privacy.gov.au/). 

In addition, a media release was issued on 6 September 2007, letters were sent to 85 stakeholder organisations, and notification by email was provided to members of the Office's Privacy Connections Network.

The majority of the 31 written submissions received were highly supportive of Dr Hobbs's application for a determination.  A small minority of submissions expressed qualified support with additional comments which were taken into consideration in the making of PIDs 10 and 10A.  No submissions opposed the application.

Submissions were received across a range of sectors including from peak health and other professional bodies, private sector health service providers, state and territory health departments, Commonwealth agencies, health and privacy regulators, medical indemnity insurers and consumer groups.

A number of submitters noted the high degree of public acceptance of family, social and medical histories being collected and the longstanding nature of the practices involved.  A number of submitters noted that they were unaware of any adverse effects of PIDs 9 and 9A since December 2002 and that permitting such acts or practices was consistent with legal requirements or guidelines in a number of state jurisdictions (either for the public or private sectors), for example, the Health Records and Information Privacy Act 2002 (NSW).  Importantly, several submissions also referred to the impracticality and added costs of gaining third parties' consent to collection in the circumstances.

The need to protect the confidentiality of both individual and third party information was also raised.  A number of submissions noted that professional codes of ethics and confidentiality apply to the handling of such information irrespective of whom the information is about.  Above all, the majority of submitters noted the continued importance of permitting the collection of such information for the adequate diagnosis, treatment and ongoing care of health consumers.

The Office understands that the existing PIDs 9 and 9A have been operating effectively since 2002.  No submissions to the Office's Private Sector Review criticised the content of PIDs 9 and 9A, and the Office has not received any complaints in relation to the existing PIDs.

As required under s 75(2A)(a) of the Privacy Act I sent a written invitation to the applicant, Dr Hobbs, to notify me whether or not the organisation wanted a conference to be held.  The applicant indicated that he wanted a conference to be held and that it would be appropriate to explore the proposed variation of PIDs 9 and 9A allowing PIDs 10 and 10A to explicitly permit collection of relevant health information about a third party for an individual's family, social or medical history when the individual receiving treatment is incapable of supplying that information themselves.  A number of other organisations indicated that they would be interested in attending a conference ‘if one were to be held'. 

The conference invitations contained a copy of the draft Determinations, an outline of the conference structure and greater detail relating to the issue of the collection of third party health information ‘from a person who is responsible for the individual'.

Pursuant to s 75(2A)(b), I issued invitations to 16 other agencies or organisations to attend the conference on the draft determinations.  Four organisations, including the applicant, attended the conference which was held on 29 October 2007 in Canberra.  The organisations represented were: the applicant, Dr Tony Hobbs, in his capacity as a general practitioner and obstetrician; the Australian General Practice Network; the Australian Institute of Health and Welfare; and the Aged and Community Services Association of NSW and ACT Incorporated.  Copies of all the public submissions were also made available at the conference.

In introducing the conference, I covered the purpose and process of the day's proceedings, the relevant provisions for a conference under the Act, the background to the existing PIDs 9 and 9A and the current Australian Law Reform Commission review of the Privacy Act.  I also briefed attendees once again on the submission that the Determination make explicit reference to collection of relevant third party health information from a ‘person responsible' for an individual when the individual themselves is incapable of providing that information.

As with the majority of the 31 written submissions, the conference attendees noted the effectiveness of the existing PIDs 9 and 9A and expressed the view that determinations of a similar effect should again be made.  The issue of collection of relevant third party health information from a ‘person responsible' was also discussed and the expansion of the exemption to explicitly allow for this activity was supported at the conference.

Under section 72(2) of the Privacy Act, I am empowered to make a written determination where I am satisfied that:

• (a) an act or practice of an organisation breaches, or may breach... a National Privacy Principle that binds the organisation; but
• (b) the public interest in the organisation doing the act, or engaging in the practice, substantially outweighs the public interest in adhering to that... Principle.

Under section 72(3) of the Privacy Act, the effect of such a determination is that the act or practice of the organisation will be disregarded for the purposes of section 16A of the Privacy Act. That is, the act or practice will not be regarded as an act or practice that breaches an NPP.

As set out in Dr Hobbs's application the acts or practices that are the subject of PIDs 10 and 10A involve the collection, by Dr Hobbs, of third party information from an individual, without the third party's consent, for inclusion in the individual's family, social or medical history, where that information is necessary to provide a health service to that individual.

The issue of whether such acts or practices would breach National Privacy Principle 10.1 was comprehensively dealt with in the decision by my predecessor when determining PIDs 9 and 9A.

I am satisfied that the proposed collection may breach NPP 10.1.

In determining the public interest test set out in section 72(2)(b) of the Privacy Act I have relied on the information in the current application, the submissions received in relation to that application and the views expressed at the conference held on 29 October 2007 into a draft of these Determinations.  In addition, I have taken into account that my Office has received no complaints about the operation of the existing PID 9 or 9A (though it is acknowledged that the nature of the practice involved may mean that third-parties are not aware that their information has been collected without their consent).

The reasons expressed in Dr Hobbs's application for a new Determination with similar effect to PIDs 9 and 9A focused on the importance of obtaining health consumers' family, social and medical histories in order to provide continued quality diagnosis and treatment services and health care.  Dr Hobbs's application also noted the impracticalities, inefficiencies and detriment to provision of quality health care if there was a requirement to obtain the consent of third parties in these circumstances. 

In considering whether the public interest in Dr Hobbs collecting health information of a third party, without consent, substantially outweighs the public interest in adhering to NPP 10.1 in the relevant circumstances, I have also made reference to the factors discussed below, which are taken from my Office's PID Guidelines.

The nature of the public interest objectives served by the proposed interference with privacy

A key determinant of public interest in this decision is that permitting the relevant collection accords with widely accepted health care practices which in turn allows for continuing, comprehensive and quality health care for consumers, and for better public health outcomes.  Dr Hobbs's application asserted that the issues previously raised by ACHA Health in support of PIDs 9 and 9A are "still of critical importance in the context of the collection of social, family or medical histories from health consumers across all clinical settings and by all clinicians".  In particular, the applicant noted that collection of this type of information is used to inform efficient and accurate patient diagnoses and treatment plans. 

The key issue of continuing to support best practice in patient care was echoed in almost all of the submissions received with a number offering specific examples of the health care situations in which this practice is critical.  For example, one submitter noted that, in the context of residential and community care, "the ability to deliver an appropriate service to a client is, in part, reliant on being able to ascertain their history."  Another submission supported the application on the basis that there is "a clear public interest in relation to the early diagnosis and treatment of inherited genetic conditions".

The public interest in collecting third party health information from persons ‘responsible' for incapacitated individuals was also raised, either directly or indirectly, in a small number of submissions.  Invitees to the conference were also asked to take account of this issue in considering the adequacy of the draft Determinations.  No opposition to this proposal was raised by any parties attending or invited to attend the conference while several invitees and all conference attendees endorsed the proposed addition regarding persons ‘responsible'.   

Following further consideration of this matter and discussions held at the conference on 29 October 2007 I am satisfied that the interests of health consumers will be served by allowing the collection of the relevant third party information from a ‘person responsible' for the individual when the individual is incapable of providing the information themselves.  Specific clinical examples of the need for this practice raised at the conference related to patients living with dementia or an intellectual disability.

The extent to which the proposed act or practice is inconsistent with an individual's reasonable expectation of privacy

The practice of collecting health consumers' family, social and medical histories for diagnosis, treatment and care - without the need to obtain third parties' consent - is widespread, considered best clinical practice, and generally known and accepted in the community.  Several submissions made specific reference to the high degree of consumer awareness regarding the importance of family, social and medical history information in facilitating accurate diagnosis and treatment. The perception that this practice is consistent with individuals' reasonable expectations is further demonstrated by the lack of complaints about the operation of PIDs 9 and 9A over the past five years and by the absence of any submissions opposing Dr Hobbs's application.

The potential for the proposed act or practice to harm the interests of individuals

The applicant and several of the submitters indicated that the confidential setting in which medical and allied health consultations occur supports the collection of relevant information about both the patients themselves and other relevant third parties.  Existing ethical protocols in the health sector mean that health information is collected in an environment of ‘maximum consumer privacy' governed by professional codes of ethics and confidentiality.  The context in which the information is collected therefore reduces the risk of harm to individuals through inappropriate disclosure of their sensitive information.  In addition, the terms of PIDs 10 and 10A (like their predecessors) limit collection to that which is both relevant and necessary to provide a health service directly to the health consumer.

The need to balance the competing interests contained in section 29 of the Privacy Act and the impact on the public interest if the proposed act or practice is not permitted

The submissions and comments made at the conference gave strong support for the effective and generally accepted operation of PIDs 9 and 9A in relation to these acts and practices since 11 December 2002.

Under section 29 of the Privacy Act, the Privacy Commissioner must, among other things:

• (a) have due regard for the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information (through the media and otherwise) and the recognition of the right of government and business to achieve their objectives in an efficient way; ...

In that regard, the following issues were raised in the course of Dr Hobbs's application and the written submissions:

• if the consent of relevant third parties were sought, this would be onerous, time consuming, costly, often impracticable and would not necessarily be given by the relevant third party
• if health consumer history information is not sought, the end result could be increased investigation and litigation in relation to medical negligence claims
• if the consent of third parties was required, this may cause unnecessary delay in providing health care to the consumer which may ultimately compromise health outcomes
• that the collection of family, social and medical history information is in the public interest and in the consumer's best interest as it can assist in obtaining a correct and accurate diagnosis and health outcome.

The impact on the public interest if the proposed act or practice is not permitted

Based on the clinical practice examples presented by Dr Hobbs, written submissions and at the conference, I am of the view that individual health assessment, diagnosis and care could be compromised if the proposed collection is not permitted.  Furthermore, requiring health and medical professionals to notify third parties of the collection of relevant health information in these circumstances, or to seek their consent would delay the health care delivery process in individual cases.  Also, as noted in submissions, if third party consent were routinely required, individual health care may be compromised where third parties do not provide consent. 

Furthermore, relying on a consent-based regime in these circumstances may have an impact on the efficient and effective running of medical businesses, in turn, risking reduced capacity to provide adequate and timely health care to the public. 

Conclusion on the public interest

On balance, having taken all of the above factors into consideration and in consultation with relevant stakeholders, I have found that the public interest in permitting the relevant acts or practices substantially outweighs adherence to NPP 10.1 in the relevant circumstances. In arriving at this conclusion, I particularly note the following:

• the public interest in permitting the relevant acts or practices in order to provide continuing, comprehensive and quality health care for consumers, and better public health outcomes
• the fact that the practice of collecting health consumers' family, social and medical histories for good health care and treatment without the need to obtain third parties' consent is widespread, considered best clinical practice and generally known and accepted in the community
• the need for efficient and effective running of health care services; and
• the effective and generally accepted operation of PIDs 9 and 9A in relation to these acts and practices since 11 December 2002.

I am of the view that the central public interest objective being served by this determination is that of the provision of quality health services to health consumers and ultimately safeguarding public health.  I am satisfied that family, social and medical history collection, including in settings such as counselling and therapeutic health services and residential and community aged care health services is central to good health care provision.

Continuing application of the National Privacy Principles to information collected under these determinations

Further, I note that the privacy protection standards in NPPs 1 to 9 and 10.2 to 10.3 will continue to apply to protect the third party's information once collected. This issue was raised in submissions on Dr Hobbs's application including by CHF and Queensland Health.

In particular, NPPs 1.1 and 1.2 ensure that information that is collected should be confined to that necessary to an organisation's functions or activities and be collected only by lawful and fair means and in a way that is not unreasonably intrusive. 

NPP 2 provides protection for the use and disclosure of the information collected under the determinations.  Under NPP 2 information collected may generally only be used or disclosed for the primary purpose of collection such as establishing an individual's family, social or medical history in order to provide a health service directly to the individual.  Exceptions do apply, for example, under NPP 2.1(a) information may be used or disclosed for a directly related secondary purpose within the reasonable expectations of the person to whom the information relates. Other limited exceptions are set out in paragraphs 2.1(b) and 2.1(d) to 2.1(h).  Overall, the remaining NPPs appear to provide adequately for the protection of information that may be collected under the determinations.

For all of these reasons I am satisfied that the public interest in allowing Dr Tony Hobbs to collect the information in question in the circumstances set out in Public Interest Determination 10 substantially outweighs the public interest in adhering to NPP 10.1.

Notifying third parties of the collection

I note that Dr Hobbs has included in his application a reference to notifying third parties of the collection of their information. He states:

"In the absence of a PID on this issue, NPP 10 would require health service providers to obtain the consent of third parties to collect personal and health information on these persons, and notify third parties of the collection of their information. This is clearly impractical and could compromise the health care of patients."

National Privacy Principle 1.5 requires an organisation to take reasonable steps to notify an individual of the collection of their information from another person (in this case, from the health consumer). My predecessor canvassed the issue of whether a separate exemption for NPP 1.5 was required in similar circumstances in PID 9.[6] I am of the same view that the requirement of NPP 1.5 for an organisation to take reasonable steps may mean, in some circumstances, mean that no steps need be taken to notify an individual of a collection of their information from another person; and consequently, no determination needs to be made in relation to that issue here.

In addition to applying for a determination for himself, Dr Hobbs referred to the importance of applying the determination to health service providers generally. My reasoning above has been developed on the basis that these issues apply to all health service providers and accordingly I have made a separate determination (PID 10A) under s 74(4) of the Privacy Act giving general effect to PID 10.

PID 10A applies to all organisations that provide a ‘health service' under the Privacy Act (health service providers), where those organisations collect third party information in the limited circumstances referred to under PID 10, in relation to Dr Hobbs.

Under s 6 of the Privacy Act, ‘health service' means:

• (a) an activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or the person performing it:
  • (i) to assess, record, maintain or improve the individual's health; or
  • (ii) to diagnose the individual's illness or disability; or
  • (iii) to treat the individual's illness or disability or suspected illness or disability; or
• (b) the dispensing on prescription of a drug or medicinal preparation by a pharmacist.

The Privacy Act applies to all private sector organisations that deliver these types of services, including all small health services that hold health information.  The types of health services covered include traditional health service providers such as private hospitals and day surgeries, medical practitioners, pharmacists, and allied health professionals such as counsellors, as well as complementary therapists, gyms, weight loss clinics and many others. 

Appendix A - Organisations and agencies that made written submissions on Dr Hobbs's PID application

• 1. An individual in their private capacity
• 2. Law Council of Australia
• 3. Department of Health and Community Services (Northern Territory)
• 4. Genetic Health Services and VCGS Pathology
• 5. Health Care Complaints Commission
• 6. Clinical Excellence Commission
• 7. Private Hospital Association of Queensland
• 8. Pharmacy Guild of Australia
• 9. Commonwealth Ombudsman
• 10. Aged and Community Services Association of NSW and ACT Incorporated
• 11. Dieticians' Association of Australia
• 12. Department of Defence
• 13. Australian Institute of Health and Welfare
• 14. Department of Health (NSW)
• 15. ACT Health Services Commissioner
• 16. Avant Mutual Group Ltd
• 17. Royal Australasian College of Surgeons
• 18. Australian Red Cross Blood Service
• 19. Consumers' Health Forum of Australia
• 20. Victorian Health Services Commissioner
• 21. ACT Health
• 22. Australian Government Department of Health and Ageing
• 23. Department of Human Services (Vic)
• 24. Queensland Health
• 25. Department of Health (SA)
• 26. Australian Medical Association
• 27. St John of God Health Care Inc.
• 28. Royal Australasian College of Physicians
• 29. Medicare Australia
• 30. Department of Health (WA)
• 31. Genetic Services Advisory Committee - NSW Department of Health

Appendix B - Organisations and agencies invited to attend a conference on the draft Determinations

• 1. Dr Tony Hobbs, general practitioner and obstetrician (the applicant)
• 2. Carers Australia
• 3. Private Hospital Association of Queensland
• 4. Pharmacy Guild of Australia
• 5. Aged and Community Services Association of NSW and ACT Incorporated
• 6. Australian Institute of Health and Welfare
• 7. Consumers' Health Forum of Australia
• 8. ACT Health
• 9. Australian Government Department of Health and Ageing
• 10. Australian Medical Association
• 11. Mental Health Council of Australia
• 12. Australian Privacy Foundation
• 13. Australian General Practice Network
• 14. Catholic Social Services Australia
• 15. Department of Defence
• 16. Australian Nursing Federation
• 17. Royal Australasian College of General Practitioners

Appendix C - Conference attendees

• 1. Dr Hobbs, general practitioner and obstetrician (the applicant)
• 2. Australian General Practice Network
• 3. Australian Institute of Health and Welfare
• 4. Aged and Community Services Association of NSW and ACT Incorporated

[1] The previous application, made by ACHA Health, is available at www.privacy.gov.au/publications/acha.pdf.

[2] The term ‘health service' is defined under s 6 of the Privacy Act, as set out below under ‘Organisations which PID 10A applies to'.

[3] See Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (March 2005), paragraph 9.18, ‘NPP 10 - Collection of Family History Information - Public Interest Determinations 9 and 9A', available at www.privacy.gov.au/act/review/review2005.htm#9_18

[4] See ALRC's website: http://www.alrc.gov.au/inquiries/current/privacy

[5] See Office of the Privacy Commissioner, Submission to the Australian Law Reform Commission's Review of Privacy - Issues Paper 31 (March 2007), question 8-13, available at www.privacy.gov.au/publications/submissions/alrc/c8.html#L21054. 

[6] See PID 9: http://www.privacy.gov.au/publications/pid9.html