B23/1991 GUIDELINES FOR OBTAINING INFORMATION FROM INDIVIDUALS AND ORGANISATIONS INCLUDING OTHER DEPARTMENTS OR AGENCIES

DATE OF ISSUE:  17 May 1991

GUIDELINES FOR OBTAINING INFORMATION FROM INDIVIDUALS AND ORGANISATIONS INCLUDING OTHER DEPARTMENTS OR AGENCIES

CONTENTS — Para(s)

Introduction:              1-10

Implementation of the Privacy Act:              11-13

Past Practices:              14-15

Section 128 VEA and Section 30 SWP&AA:              16-18

Circumstances for use of S.128 VEA/S.30 SWP&AA:              19-21

Requests for Information by DVA:              22-34

Sensitivity Check:              22

Commercially Available/Public Information:              23

Overseas Requests:              24

S.128 VEA/S.30 SWP&AA Notices:              25

Notices to Third Parties:              26

Notices to Individual Concerned:              27

Client Identification on Notice:              28

Notice Checklist:              29

Pre-Notice Check:              29

Notice Check:              29

Phone Requests for personal information

to Commonwealth Departments or agencies:              30-32

Phone requests for personal information

to a veteran, dependant, other person or

organisation not being a Commonwealth

Department or agency:              33-34

Request for Verbal Evidence:              35-36

Failure to Comply with a Notice:              37

Obtaining Information from DSS:              38-47

Routine Clearance Information:              40

Mutual Debt Recovery:              40

Information Outside the Terms of

DSS S.19(4)(a) Certificate:              45

Authority to Obtain Information:              47

Advice to Providers of Information:              48

Requests to DVA by Commonwealth Departments

or agencies for information:              49-50

Delegations:              51-53

Payment for the Supply of Information:              54-55

Enquiries about this Instruction:              56

INTRODUCTION

1.On 14 November 1988, Central Office issued Departmental Instruction No.  B38/88.  Since that date the commencement of the Privacy Act 1988 on 1 January 1989 has necessitated amendments to that instruction.  The purpose of this instruction is to reflect those amendments and substitute DI No.  B38/88.

2.This instruction provides guidelines which specify a set of procedures for obtaining information under s.128 VEA and s.30 SWP&AA.  These procedures are designed to ensure that the Department uses its powers in a manner that conforms with the Information Privacy Principles (IPPs) in the Privacy Act.

3.Because of obligations under the Privacy Act most Commonwealth Departments and agencies will only provide information to DVA on the basis of a formal s.128 VEA or s.30 SWP&AA notice as the provision of information in that manner is specifically authorised by Principle 11(1)(d) of the Privacy Act.

4.Under the provisions of section 128 VEA and section 30 SWP&AA the Secretary of the Department or his delegate has the power to require any person to provide information and/or documents such as the Secretary or the delegate requires.

5.The Secretary or his delegate can obtain information from DVA clients themselves or from third parties such as employers, educational institutions, State Governments and authorities and Commonwealth Departments and agencies.  The information sought will usually be about the client but may also be about other persons whose circumstances are relevant to the client's entitlement or rate of payment such as a spouse or children.

6.Requests for information under s.128 VEA and s.30 SWP&AA should take the form of one of the notices on LAN and should be on Departmental letterhead paper.  The notice should also be signed by a delegate who has been delegated power under the relevant section and who is clearly identifiable by name on the notice.

7.S.128 VEA and s.30 SWP&AA provide the Secretary with a discretion he may exercise to obtain information.  These sections stipulate the manner in which the discretion can be exercised.  Failure to comply with Secretary's request for information attracts the sanctions provided for in those sections.

8.Like all other Commonwealth Departments and agencies DVA is subject to the provisions of the Privacy Act which governs all aspects of the handling of personal information including its collection, storage, usage and disclosure.  The Privacy Act only affects Commonwealth Departments and agencies and does not affect State or Local Government Departments or agencies, private organisations or individuals.

9.The Privacy Act does not prevent the Department from obtaining information under s.128 VEA or s.30 SWP&AA.  The collection of information other than in accordance with s.128 VEA or s.30 SWP&AA is not in breach of the Privacy Act provided the information is obtained in accordance with Principles 1, 2 and 3 of that Act.  Where a s.128 VEA or s.30 SWP&AA notice is not used it only means that there is no sanction on refusal to comply with the Departmental request.  Such sanction is contained in s.128 VEA and s.30 SWP&AA.

10.In construing IPP 1 it should be noted that "lawful purpose" means a purpose not prohibited by law.

IMPLICATIONS OF THE PRIVACY ACT

11.The Privacy Act 1988 is a law of the Commonwealth which governs the collection, storage, usage and disclosure of personal information by and from Commonwealth Departments or agencies.  Key provisions concerning the collection of information (Information Privacy Principles 1-3), the use of information (IPP 10) and its disclosure (IPP 11) provide that the collection, use or disclosure which is required and authorised by other legislation (such as s.128 VEA or s.30 SWP&AA) is not in breach of the IPPs.

12.IPPs contained in the Privacy Act establish a number of rules which must be followed when s.128 VEA or s.30 SWP&AA is invoked.

13.These principles make it incumbent upon officers having s.128 VEA or s.30 SWP&AA delegations to ensure that:

.Information must be collected for a lawful purpose and in a lawful manner;

.information must be collected for a purpose that is directly related to the Department's function; those purposes include the administration of the various entitlements under the VEA and SWP&AA;

.only information which is relevant and necessary for the purpose may be collected;

.client details must not be disclosed unnecessarily when information is being collected from a third party; only the minimum information necessary to identify the client should be given; where information is requested about another person who is not the client, e.g.  a spouse, it should not be necessary to identify the client at all {see para 28};

.information which is collected must be up-to-date and complete;

.where information is requested from a client, there are obligations to tell the client:

-the purpose for the request;

-the legal authority for the request; and

-any circumstances where that information is usually disclosed to another person;

.where information is requested from a third party about a client, the authority for the request should be given; a general purpose for the request can be included, i.e.  for purposes under the VEA (but nothing more);

.information collection should be done according to rules of fairness and common courtesy; Departmental codes of conduct should be followed by all staff; and

.information collection should not be unreasonably intrusive; on occasions sensitive information must be sought, but the department is obliged to take special care to keep the intrusion to an absolute minimum.

Attachment B sets out IPPs contained in the Privacy Act 1988.

PAST PRACTICES

14.In the past there have been many informal arrangements for obtaining information from other Commonwealth Departments and agencies, such as telephone liaison, staff searching another agency's microfiche etc.  Such arrangements can breach the Privacy Act and can, therefore, be illegal.  In practice the most effective way of limiting liability under the Privacy Act is to ensure that all information is obtained under valid s.128/s.30 notices.

15.The central feature of this instruction is to ensure that the collection and disclosure of personal information by DVA and as far as possible, by another agency or department from or to DVA is lawful.  That is, it is authorised by law and is consistent with the provisions of the Privacy Act.

SECTION 128 VEA AND S.30 SWP&AA

16.Section 128(1) VEA gives a power to the Secretary or his delegate to require a person (which includes an employee of a Commonwealth or State Government Department or agency) to provide DVA or the DVA officers specified in a s.128 notice with such information as the Secretary requires or to produce specified documents in the custody or control of the person or appear before a specified officer to answer questions {see paras 38-44 for special circumstances relating to DSS}.

17.Without limiting the generality of s.128(1), under s.128(2), the Secretary may require a person who is indebted to the Commonwealth, to provide details of the person's financial situation as required in the notice or provide specified documents or require a person to notify a change of address or require a third person to notify the whereabouts of, or financial situation of a person indebted to the Commonwealth.

18.Section 30 SWP&AA is similar to s.128.  In each case, a period of 14 clear days must be given to the person concerned to comply with the notice.  To specify the period "within 14 days" as is often the practice is a breach of the requirements of a valid notice under s.128 VEA and s.30 SWP&AA.

Circumstances requiring the use of s.128 VEA/s.30 SWP&AA Notices

19.Due to the obligations imposed by Information Privacy Principle 11 a s.128 VEA/s.30 SWP&AA notice should be served when seeking personal information from a Commonwealth Department or agency unless a specific consent from the person concerned can be provided.

20.Information may be sought from a veteran, dependant or another person or organisation not being a Commonwealth Department or agency by phone or in writing without the service of a s.128VEA/s.30 notice.  However, should the veteran, dependant, other person or organisation decline to provide the information or be suspected of providing false or misleading information then a formal notice should be served.

21.Where officers engage in collection of information they must be aware that they are acting as representatives of the Department which is defined as a "collector" under the Privacy Act.  The Privacy Act imposes responsibilities and duties on a "collector" and these are detailed in Information Privacy Principles 1, 2 & 3.

REQUESTS FOR INFORMATION BY DVA

Sensitivity Check

22.Before making a request for information the s.128 VEA/s.30 SWP&AA delegate must undertake the following sensitivity check:

.is the case a sensitive one or does it involve collecting sensitive information, e.g.domestic circumstances, separations, overpayments, investigations, where a client is known to have an intellectual disability, where a child or spouse has recently died, where the enquiries are about custody of children?

.if the case is sensitive would it be more appropriate to contact the person or agency providing the information to explain why it is needed, or to collect it by special means such as personal interview?

Commercially Available/Public Information

23.Where information is to be sought from a third party s.128 VEA or s.30 SWP&AA notices should not be used to obtain information which is readily available commercially or publicly.

Requests Overseas

24.Section 128 VEA or s.30 SWP&AA notices should not be used to collect information from persons or agencies outside Australia.  Enquiries should be made with the client for appropriate verification of circumstances.

S.128 VEA/s.30 SWP&AA Notices

25.Attachment C is a copy of a notice which should be used in circumstances where it is considered appropriate to require a person or Department to provide information or documents to DVA under sub-section 128(1) VEA/ss.30(1) SWP&AA).  Attachment D is a copy of a notice to be issued under s.128(2) VEA or s.30(2) SWP&AA.  These notices will shortly become available through the Local Area Network (LAN) in all Branch Offices.  In the meantime text given in these attachments should be used, where appropriate.

Notices to Third Parties

26.Where under ss.128(1) VEA or ss.30(1) SWP&AA, a notice is sent to a third party for collecting personal information that notice must comply with Information Privacy Principle 1 (IPP 1).  That is the delegate must ensure that:

.the personal information to be collected is for a lawful purpose related to the needs of DVA; and

.the collection is necessary for those needs.

Notices to Individual Concerned

27.Where under ss128(1) VEA or ss 30(1) SWP&AA, a notice is sent to the individual concerned, the delegate must comply with IPPs 1 and 2.  That is, the individual concerned must be aware of:

.the personal information to be collected is for a lawful purpose related to the needs of DVA; and

.the collection is necessary for those needs;

.the purpose for which the information is being collected; and

.any person to whom, or any body or agency to which the information might be passed on.

Client Identification on Notice

28.Where requests are made to third parties about clients, the minimum information to identify the client should be given.  Usually, this is the name only.  In some circumstances, it may be appropriate to provide a client's address or date of birth where the third party cannot identify the client by name only.  The s.128 VEA/s.30 SWP&AA delegate should ascertain the minimum information required to identify the individual concerned by checking with the third party before a notice is served.

Notice Checklist

29.This checklist summarises the main points of the procedures in these guidelines as follows:

.Pre-Notice Check:

-is the information needed and relevant to the purpose for which it is to sought?

-can the information be obtained by other means, e.g. client documents?

.Notice Check:

-is the notice on DVA letterhead paper?

-is the reason for the request given?

-is relevant sub-section of s.128 VEA/s.30SWP&AA quoted as the legal authority for the request?

-are the questions specific and do they clearly state what is required?

-does the notice provide a period of 14 clear days to respond to it?

-is the notice signed by a clearly identified officer delegated under s.128 or s.30 SWP&AA {whichever is relevant}?

-if the request is being made to a third party, does it disclose to the third party more than the minimum amount of information necessary to identify the client or other person from whom information is being sought?

-does the notice comply with the IPPs {see paras 26-27}?

Phone Requests for Personal Information to Commonwealth Department and Agencies.

30.Requests for information under s.128 VEA or s.30 SWP&AA can only be made in writing.  Requesting information by phone from a Commonwealth Department or agency is undesirable as the other Departments or agencies can only be sure of not breaching the Privacy Act by providing personal information pursuant to IPP 11 (1)(d),i.e.  the disclosure is required by or under law.  Evidence of a disclosure being required by or under law is conclusive when a request takes the form of the receipt of a s.128 VEA or s.30 SWP&AA notice.  However, once a written request has been made, officers may make a telephone call where it is considered necessary to expedite the processing of the written request.

31.Where an officer wishes to obtain information from a Commonwealth Department or agency by phone, the officer should enquire if they have a facsimile machine.  If such a machine is available, the officer should fax a s.128 VEA/s.30 SWP&AA notice to them and then contact them by phone to obtain the requested information.

32.Where a Commonwealth Department or agency does not have a facsimile machine, the officer should post the notice and may follow it by a phone call.

Phone Requests for Personal Information to a veteran, dependant, other person or

organisation not being a Commonwealth Department or Agency.

33.Where an officer is to obtain information from a first party, i.e.  the veteran, dependant, other person or organisation there is generally no need to make a written request unless the person or organisation refuses to provide the required information.

34.In order to ensure that a phone request to a veteran or dependant to obtain personal information is not contrary to the provisions of the Privacy Act, the following steps should be taken:

.an officer intending to make a phone call to a veteran or dependant shall ensure that the required information is necessary and could not be obtained from other sources;

.where a phone call becomes necessary, the officer making the call shall clearly identify himself or herself to the veteran or dependant by stating:

-his or her name and that he or she is from the Department of Veterans' Affairs (Central Office, Branch or Regional Office, as appropriate);

-the purpose of the phone call, the purpose for which information is being sought and (where the veteran or dependant is reasonably unlikely to be have been aware that information sought is usually passed on to a third party, e.g.  a Commonwealth agency or department) the likely disclosure of the information to a third party;

.where a veteran or dependant provides the required information, the officer concerned shall go over the collected information with the veteran or dependant before completing the call, to ensure that all details are accurate and also to thank the veteran/dependant for the co-operation and assistance;

.where a veteran or dependant cannot provide the required information immediately, the officer concerned shall either make an appointment with the veteran/dependant to phone again or advise the veteran/dependant to phone the officer concerned on the 008 number {in both cases the officer concerned shall give the veteran/dependant his or her own phone number};

.where a veteran or dependant does not wish to provide the required information over the phone, the officer concerned shall advise the veteran/dependant that he or she can write to the Department instead {in this case the officer concerned shall leave his or her phone number with the veteran/dependant};

.where a veteran or dependant refuses to provide the required information, the officer concerned shall advise the veteran/dependant that the Department has authority to  obtain information and will send a formal request in writing for information {in this case see paragraphs 25-29};

.in all cases the officer concerned shall conduct himself or herself with courtesy and respect for the veteran or dependant; and

.a file note recording details of a phone call concerning request for information shall be prepared in all cases.  Where it is requested, confirmation of the call in writing shall be provided to the veteran or dependant.

REQUEST FOR VERBAL EVIDENCE

35.The Secretary of the Department or those officers who have been delegated powers under s.128 VEA or s.30 SWP&AA also have the authority to require a person to appear before an officer of the Department to answer questions or verify information, on oath or affirmation.

36.Where a person is required to appear before an officer or attend an interview with an officer, of the Department in connection with a s.128 VEA or s.30 SWP&AA notice, the notice should specify the name of the Departmental officer who will meet with the person, the time of appointment and the place.  The notice must allow 14 clear days between the date of service of the notice and the date of the appointment.

FAILURE TO COMPLY WITH A NOTICE

37.Where a person fails or refuses to comply with a s.128 VEA or s.30 SWP&AA notice, the following steps should be taken:

.the officer who served the notice or another officer familiar with the notice should contact the person to ensure that the person has received the notice and understands what is required;

.if the required information is not provided and there is no doubt that the information is needed and cannot be obtained from any other source, a second notice should be sent to the person by certified mail and signed by a senior delegate;

.where an individual or organisation holding the required information or document in respect of a client, claims that providing the information or document would be in breach of their duty of confidentiality, the client should be approached to obtain the required information or document, or give authority for its collection {see para 47};

.if a Commonwealth agency or any other person or organisation refuses to comply with a notice, the matter should be referred to Assistant Secretary, Benefits Planning and Management in Central Office.

OBTAINING INFORMATION FROM DSS

38.For some time the Department has experienced problems with the Department of Social Security in obtaining certain information.  This occurred because of section 19 of the Social Security Act 1947 which is a secrecy provision in the Act and as a matter of course does not allow officers of DSS to disclose information to other Departments and organisations including DVA.

39.To comply with the provisions of the Social Security Act concerning disclosure of information to DVA, the Secretary of the Department of Social Security has issued a certificate under s.19(4)(a) of the Social Security Act to release information to this Department.  A copy of this certificate is at Attachment E.

40.In issuing the current s.19(4)(a) certificate, the DSS Secretary has certified that it is necessary in the public interest that officers of his Department divulge certain types of information held by DSS where the disclosure is to an officer of the Department of Veterans' Affairs.  In line with the provision of the certificate there are two main areas where DSS and DVA have agreed to exchange information.  These areas are:

(1)routine "clearance" information

(a)to detect or prevent dual payments where a client has entitlement from both Departments;

(b)to facilitate transfers between Departments; and

(c)for bereavement and joint assessments where one of a couple is a DSS client and the other is a DVA client; this would be on an individual case basis;

(2)information for mutual debt recovery purposes, where one Department is recovering a debt for the other Department.

41.It should be noted that DSS has not agreed to provide any information outside the above specific areas.  For example, the certificate does not cover the release of any information DVA may need to make a determination of a claim or application for a disability pension.

42.It should also be noted that there will be separate guidelines relating to data-matching exercises with other Departments, including DSS.

43.All requests to DSS should take the form of a s.128 VEA or s.30 SWP&AA notice, whichever is relevant.

44.Where DVA has not sent a s.128 VEA or s.30 SWP&AA notice to a Department (including DSS) and a DVA officer visits that Department to collect personal information about another person, the DVA officer must, at the time of that visit, provide to the Department a notice as specified at Attachment C or Attachment D, whichever is relevant.

Information Outside the Terms of DSS S.19(4)(a) Certificate.

45.As regards areas not covered by the s.19(4)(a) certificate (e.g.  overpayment investigation), it will be necessary to approach the person concerned directly before approaching DSS.  The person should be asked to supply the information needed, and/or asked to give the Department his or her authority to obtain the information from DSS.

46.The Department will request DSS Secretary to enlarge the scope of the certificate.  If this is done and DSS officers are able to disclose information to DVA officers about additional subjects (e.g.  medical reports etc), this instruction will be amended for your information.

Authority to Obtain Information

47.Where DVA decides to obtain a formal authority from the individual concerned to collect his or her personal information from DSS, the authority should be in the following terms:

"I hereby authorise the Department of Veterans' Affairs (DVA) to request and the Department of Social Security (DSS) to disclose to the DVA information specified in the accompanying request and held by the DSS".

ADVICE TO PROVIDERS OF INFORMATION

48.Where an officer of the Department obtains information from an individual or organisation, the officer should, bearing in mind IPP 2(e), advise the individual or organisation that information so obtained may be passed on to another Department or agency (see para 49 below).

REQUESTS TO DVA FOR INFORMATION BY A COMMONWEALTH DEPARTMENT OR AGENCY FOR INFORMATION

49.S.130 VEA authorises the DVA Secretary or another officer of DVA to provide any information obtained in the performance of his or her duties to the Secretary of another Commonwealth Department or to the head of a Commonwealth authority for the purposes of that Department or authority.

50.Before a DVA officer may provide information held by DVA to another Commonwealth Department or authority, the officer should satisfy him/herself that the officer from the other Commonwealth Department or authority is delegated to receive the information and that it is for the purpose of the other Department or authority.  In order that the DVA officer has evidence of compliance by the officer of the other Commonwealth Department or authority with this criteria it is desirable that the request for information be received by the DVA officer in writing.

DELEGATIONS

51.Delegations under s.128 VEA or s.30 SWP&AA are in Instruments of Delegation signed by the Secretary and are retained in Delegations Manuals.

52.A document setting out the current position numbers and classification levels of officers holding s.128 VEA and s.30 SPW&AA delegations is with each SPM(B).

53.Managers should ensure that only the relevant delegates sign notices under s.128 VEA or s.30 SWP&AA.  It is important to understand that a s.128 VEA or s.30 SWP&AA notice signed by an officer other than the delegate and used for the purposes of the relevant section can result in a breach of the Privacy Act.

PAYMENT FOR THE SUPPLY OF INFORMATION

54.Each of s.128 VEA and s.30 SWP&AA imposes a statutory obligation on an individual or organisation upon whom a notice has been served to provide the details requested in the notice.

55.There is no provision in either of the two Acts to pay for information collected by a s.128 VEA or s.30 SWP&AA notice and payment is not a condition of compliance.

ENQUIRIES

56.If there are any questions about this instruction, please contact either Mushtaq Butt on 06-2896739 or Warwick Moloney on 06-2896355.

DAVID MACKRELL

ASSISTANT SECRETARY

BENEFITS PLANNING & MANAGEMENT