External

Summary of Exceptions 10.1(d) and 11.1(e)

A use does not breach IPP 10.1 and a disclosure does not breach IPP 11.1 if the use or disclosure is reasonably necessary to enforce the criminal law or a law imposing a pecuniary penalty, or to protect the public revenue.

These exceptions should only apply to unusual uses or disclosures

The Privacy Commissioner considers that an agency should rely on positive authorities given by specific law wherever possible.

Application of 10.1(d) and 11.1(d) -Uses and disclosures for specific investigations

These uses and disclosures may involve either:

  • Comcare using or disclosing personal information about a particular person, reasonably believing it will safeguard one of the public purposes listed in the exceptions in a predictable way.

Example: If Comcare has clear evidence that a person is obtaining compensation entitlements under the SRC Act and under State legislation, it may disclose personal information such as the name of the person to a state authority to investigate the matter under this exception.  There must however, be very clear evidence, documented on the file, that the disclosure is necessary to enforce the criminal law or protect the public revenue.

  • disclosing personal information about a class of people who share a particular characteristic that is significant to the investigation.  This is likely to arise only in Police matters.

Meaning of “reasonably necessary”

To satisfy exceptions 10.1(d) and 11.1.(e), the disclosing or using agency must:

  • establish a link between the proposed use or disclosure and the relevant public interest (for example protecting the public revenue); and

  • establish that the link is strong enough to say that the use or disclosure is reasonably necessary to safeguard that public interest.

Judging whether the link is strong enough can be a difficult task and will depend on the circumstances of the case.

As a general rule, “reasonably necessary” implies that a use or disclosure need not be essential or critical to serving the public interest concerned (for example, enforcing the criminal law), but it must be more than just helpful or expedient.

Some factors relevant to whether it will be reasonably necessary include:

  • whether there are other practical and less intrusive measures available;

  • whether the potential harm to the public interest in question is sufficiently strong to outweigh the privacy interests of the people the information is about;

  • (for disclosures) who is to receive the personal information and whether and how the information is likely to be protected once it is disclosed.

If there is any doubt regarding the need for disclosure, Legal Services Group should be contacted.

Meaning of “to enforce a law imposing the criminal law”

“To enforce” the criminal law means:

  • the process of investigating a crime and prosecuting criminals; and

  • gathering intelligence about crime to support the investigating and prosecuting functions of law enforcement agencies.

You should only disclose personal information that is reasonably necessary to enforce the criminal law, to:

  • an organisation that has statutory responsibilities for investigating or prosecuting criminal offences;

  • a person or organisation that must be told the personal information so that they can help in the investigation or prosecution.

“Criminal law” means any Commonwealth, State or Territory law that makes particular behaviour an offence punishable by fine or imprisonment.

Meaning of “to enforce a law imposing a pecuniary penalty“

It is permissible to use or disclose information to enforce a law imposing a pecuniary penalty.

Laws imposing a pecuniary penalty (or “civil” or “administrative” penalty) are laws that:

  • impose penalties for breaches of Commonwealth laws that are not prosecuted criminally for example, many offences under the Taxation Administration Act 1953 come within this category; or

  • impose penalties as an administrative alternative to prosecution. Some penalties under the Customs Act 1901 come within this category.

These pecuniary penalties are recoverable as civil debts and so are distinguishable from fines imposed under the criminal law.  The penalty is a sum of money ordered to be paid by a Court which is equal to the value of benefits obtained by an offender as a result of the commission of a crime.

The law must be either:

  • a Commonwealth law; or

  • a law of a State or Territory that the Commonwealth has agreed to enforce.

Meaning of “to protect the public revenue”

Under exceptions 10.1 (e) or 11.1(e)  an agency may disclose personal information to protect the public revenue.

“Public revenue” means Commonwealth revenue although it may include State and Territory revenue in some contexts and includes the activities of the Australian Taxation Office.

The Privacy Commissioner has acknowledged that “protecting the public revenue” also extends to some aspects of administering Commonwealth assistance and payment programs.

Convictions

Personal information held by Comcare regarding a conviction ought not be disclosed unless it can be brought within one of the IPP 11 exemptions.

It is permissible to direct the inquirer to the Court reports regarding the conviction.

If information is released about a conviction where:

  • the individual was given a free and absolute pardon;

  • the conviction was quashed;

  • the conviction is spent ie. it is more than ten years since the date of the conviction, the sentence imposed was for less than 30 months and there have been no further offences in the last ten or five years and an exclusion does not apply.

The person releasing the information may have committed a crime under the Crimes Act 1901 (Cth).