DATE OF ISSUE: 02 November 1992
COMPLIANCE OF DEPARTMENTAL FORMS/STANDARD LETTERS WITH THE PRIVACY ACT 1988
Background
The Privacy Act 1988 (the Act) is concerned with protecting the personal information collected by Commonwealth Departments and Agencies.
2. The Department of Veterans' Affairs (DVA) must comply with the Act in all of its activities which involve personal information. DVA collects clients' personal information, the majority of which is collected by the use of Departmental forms. The Act has particular significance in this area.
3. As well as serving a collection function, Departmental forms also store information as forms are usually placed on relevant files. These forms may then be referred to over a number of years by DVA. The retention of forms also places responsibility on DVA under the Act, to ensure that the information stored is accurate, up-to-date and complete.
4. The use of the word "form" in this Instruction encompasses all written communications by the Department with Departmental clients or other third parties soliciting personal information. Such communications may be called forms, standard letters, claims, advices, applications, statements, consents, information sheets or questionnaires.
Related Departmental Instruction
5. DVA officers should acquaint themselves with Departmental Instruction B23/91, dated 17 May 1991: Guidelines for Obtaining Information from Individuals and Organisations other than Departments or Agencies.
DVA as a "collector" of information
6. As DVA uses Departmental forms to collect certain personal information from veterans and/or their spouses and dependants, it is a "collector" within the meaning of section 9 of the Act.
Information Privacy Principles
7. Section 14 of the Act provides the Information Privacy Principles (IPPs) which set the standard for the handling of personal information by Commonwealth departments and agencies. These IPPs are basically a set of eleven guidelines which govern the collection, storage and security, access, correction, use and disclosure of personal information about individuals.
DVA as a collector of personal information
8. IPPs 1 to 3 impose obligations on DVA as a collector of personal information. Collection must be fair and lawful. Only information which is necessary for the intended purpose of the Department should be collected. Reasonable steps should be taken to ensure that the information is relevant, up-to date-and complete. Where the information is obtained from the individuals concerned, they should be made generally aware about the purpose and authority for the collection and also about the information's usual uses and disclosures. The Department is also required to take reasonable steps to ensure that in collecting personal information, it is not unreasonably intruding into the personal affairs of the individual concerned.
9. IPPs 1 to 3 are set out in full below:
"Principle 1
Manner and purpose of collection of personal information
1. Personal information shall not be collected by a collector for inclusion in a record or in a generally available publication unless:
(a)the information is collected for a purpose that is a lawful purpose directly related to a function or activity of the collector; and
(b)the collection of the information is necessary for or directly related to that purpose.
2.Personal information shall not be collected by a collector by unlawful or unfair means.
Principle 2
Solicitation of personal information from individual concerned
Where:
(a)a collector collects personal information for inclusion in a record or in a generally available publication; and
(b)the information is solicited by the collector from the individual concerned;
the collector shall take such steps (if any) as are, in the circumstances, reasonable to ensure that, before the information is collected or, if that is not practicable, as soon as practicable after the information is collected, the individual concerned is generally aware of:
(c)the purpose for which the information is being collected;
(d)if the collection of the information is authorised or required by or under law - the fact that the collection of the information is so authorised or required; and
(e)any person to whom, or any body or agency to which, it is the collector's usual practice to disclose personal information of the kind so collected, and (if known by the collector) any person to whom, or any body or agency to which, it is the usual practice of that first-mentioned person, body or agency to pass on that information.
Principle 3
Solicitation of personal information generally
Where:
(a) a collector collects personal information for inclusion in a record or in a generally available publication; and
(b)the information is solicited by the collector;
the collector shall take such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is collected:
(c)the information collected is relevant to that purpose and is up-to-date and complete; and
(d)the collection of the information does not intrude to an unreasonable extent upon the personal affairs of the individual concerned."
Effect of IPPs 1 to 3 on Departmental forms
10. In order to comply with IPPs 1 to 3, Departmental forms must have the following characteristics:
(a)the person from whom the information is being sought must be generally aware of:
-the law under which the collection of the information is authorised or required;
-the purpose for which the information is being collected;
-the name of the person, body or agency to whom it is the Department's usual practice to disclose personal information;
(b)the collector must ensure that the information is relevant to the Departmental purpose for which it is being collected;
(c)the collector must ensure that information is up-to-date and complete; and
(d)the collector must ensure that the collection does not intrude unreasonably upon the personal affairs of the individual.
Impact on the drafter of Departmental forms
11. In order to comply with IPPs 1 to 3, the officer who is to prepare a Departmental form should ascertain the following before drafting a Departmental form:
(a)the Departmental purpose for which the information sought in the form is required;
(b)the legal authority under which the information is sought; and
(c)the names of the organisations (if any) to whom DVA usually discloses the information, and the reasons for such disclosure.
12. To satisfy the above requirements, the following is an example of the statement which should be included on all Departmental forms that request the provision of personal information:
"This information is sought pursuant to section ..... of the Veterans' Entitlements Act 1986 in order to assist the Department of Veterans' Affairs to ........ (state the purpose for which the information is being collected). This information may be disclosed to ...... (state to which Agency or body the information may be disclosed)."
13. It should be noted that Agencies or bodies to which personal information, collected through forms/standard letters or other means, may be disclosed include:
.the Department of Social Security and the Australian Taxation Office for the purposes of matching information;
.the Health Insurance Commission for treatment account payments;
.the various State or Local Government authorities to verify veterans'/dependants' eligibility for rebates or concessions relating to rates, electricity, transport, motor vehicles and ambulance ;
.doctors and/or hospitals to provide treatment.
DVA as a "record keeper"
14. Section 10 of the Act defines a "record keeper" to be an agency that is in possession or control of a record of personal information. According to this definition DVA is a record keeper.
IPPs which relate to DVA's role as a record keeper
15. The responsibilities of a record-keeper under the Privacy Act are set out in IPPs 4, 5, 6, 7, 8, 9, 10 and 11.
16. IPP 4 requires record keepers to protect personal information with reasonable security safeguards against loss, unauthorised access, use, modification, disclosure or other misuse. If it is necessary for the record to be given to a person who provides a service to the record keeper, (i.e. a consultant) then everything which is reasonably within the power of the record keeper must be done to prevent unauthorised use of the record.
17. IPP 5 requires record keepers to maintain an accessible record in the form of a register, of the kind of information held, the purposes for which the information is used, the controls which apply to its handling and details of how individuals may access their own files. This requirement is being met by the production of a Personal Information Digest.
18. Under IPPs 6 and 7 a person has, respectively, a right of access to, and correction of, personal information held by any agency, subject, of course, to exceptions contained in the Freedom of Information Act 1982, or any other law.
19. IPPs 8 and 9 require record keepers to check that information is accurate, up-to-date and complete prior to using it. Also, the use of information must be confined to the purposes for which it is relevant.
20. IPP 10 limits the use of personal information. Agencies may not use personal information for purposes other than those for which it was collected except:
.with the consent of the person;
.to prevent a serious and imminent threat to a person's life or health;
.as required or authorised by the law;
.where reasonably necessary for the enforcement of criminal or revenue laws; or
.for a directly related purpose.
21. Where the Department discloses personal information for the enforcement of criminal or revenue laws, or laws imposing a pecuniary penalty, a note to that effect must be put on the individual's file/record.
22. IPP 11 limits the disclosure of personal information outside an agency. The same exceptions apply as for IPP 10, with one addition: where the subject of the information is reasonably likely to be aware of the practice of disclosure.
Subsequent handling of forms by DVA staff
23. All staff should be aware that DVA's responsibilities under the Act do not end once the information contained in Departmental forms has been used for the purpose for which it was originally collected. Departmental forms are usually placed on file where they often remain for many years. As long as they remain on file and can be referred to by DVA, IPPs 4 to 11 inclusive must be observed by DVA staff.
24. When consulting information on file staff must have regard to IPPs 8, 9 and 10 in particular. In effect staff should first ask themselves: "Is this information accurate, up-to-date and relevant?" (i.e. are IPPs 8 and 9 complied with.) Staff should then ask themselves: "What do I want to use this information for?" (i.e. is the use consistent with IPP 10).
Time frame for collection of information
25. Quite often an Act will specify a time frame for the return of information from an individual. Staff should be aware of this when drafting forms or preparing accompanying letters. For instance, sub-paragraph 128(1)(a)(ii) of the VEA authorises the Secretary to require a document to be produced to DVA within a period "not being less than 14 days ..." after notice is given to a person. In such a case, 14 clear days must be nominated. To avoid confusion, where possible, a date should be nominated as well as quoting the relevant section of the particular legislation being relied upon.
26. Staff should also be aware that subsection 36(2) of the Acts Interpretation Act 1901 provides that where the last day of any period prescribed or allowed by an Act for the doing of anything falls on a weekend, public holiday or bank holiday, the thing may be done on the next working day.
Production of forms
27. Reference should be made to the Departmental Forms Guide issued in October 1991 and to the Central Office Forms Sub-Section for advice on the preparation of forms and their ongoing review.
28. Branch Office staff must not produce local versions of centrally procured ("D" series) forms. When considering the introduction of any new form, Branch Office staff should contact the Central Office Forms Sub-Section to ensure that there is not a national form which performs, or could be adapted to perform, the task required.
Clearance of forms by Central Office
29. All forms etc. are to be cleared by Central Office Forms Section and the Privacy Contact Officer. In this regard it should be noted that the Privacy Contact Officer can only clear a form if it includes the relevant information as outlined in paragraphs 11 to 13 (inclusive).
30. In the first instance a draft form should be submitted to Central Office Forms Section for clearance as to format. This section will clear the form to ensure:
(a) the format is acceptable;
(b) there is no existing form that could be adapted; and
(c) there is a record of the form held at Central Office should it be relevant to the requirements of other Branch or Regional Offices.
The draft form will then be cleared by the Central Office Privacy Officer.
Current forms
31. Branch Offices are requested to critically examine their locally produced current forms with a view to ascertaining whether, in the light of this DI, those forms are consistent with the relevant IPPs. As a preliminary check of such a form, the officer concerned should examine whether the form provides relevant information as outlined in paragraphs 11 to 13. If there is any doubt about a form, please contact one of the following contact officers for advice, as appropriate.
Enquiries
32. If there are any questions arising from this Instruction, please contact Warwick Moloney on (06) 289-6355 for benefits matters, Peter Morgan on (06) 289 6543 for format and design, and Colin Hassall on (06) 289-6208 for privacy matters.
Murray Harrison
Assistant Secretary
Planning and Management Branch
Benefits Program
_