(2) The Commissioner shall not approve the issue of guidelines unless he or she is satisfied that the public interest in the promotion of research of the kind to which the guidelines relate outweighs to a substantial degree the public interest in maintaining adherence to the Information Privacy Principles.
(3) Guidelines shall be issued by being published in the Gazette.
(4) Where:
(a) but for this subsection, an act done by an agency would breach an Information Privacy Principle; and
(b) the act is done in the course of medical research and in accordance with guidelines under subsection (1);
the act shall be regarded as not breaching that Information Privacy Principle.
(5) Where the Commissioner refuses to approve the issue of guidelines under subsection (1), an application may be made to the Administrative Appeals Tribunal for review of the Commissioner's decision.
(1) This section allows the Commissioner to approve for the purposes of the National Privacy Principles (the NPPs) guidelines that are issued by the National Health and Medical Research Council or a prescribed authority.
Approving guidelines for use and disclosure
(2) For the purposes of subparagraph 2.1(d)(ii) of the NPPs, the Commissioner may, by notice in the Gazette, approve guidelines that relate to the use and disclosure of health information for the purposes of research, or the compilation or analysis of statistics, relevant to public health or public safety.
Public interest test
(3) The Commissioner may give an approval under subsection (2) only if satisfied that the public interest in the use and disclosure of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the NPPs (other than paragraph 2.1(d)).
Approving guidelines for collection
(4) For the purposes of subparagraph 10.3(d)(iii) of the NPPs, the Commissioner may, by notice in the Gazette, approve guidelines that relate to the collection of health information for the purposes of:
(a) research, or the compilation or analysis of statistics, relevant to public health or public safety; or
(b) the management, funding or monitoring of a health service.
Public interest test
(5) The Commissioner may give an approval under subsection (4) only if satisfied that the public interest in the collection of health information for the purposes mentioned in that subsection in accordance with the guidelines substantially outweighs the public interest in maintaining the level of privacy protection afforded by the NPPs (other than paragraph 10.3(d)).
Revocation of approval
(6) The Commissioner may, by notice in the Gazette, revoke an approval of guidelines under this section if he or she is no longer satisfied of the matter that he or she had to be satisfied of to approve the guidelines.
Review by AAT
(7) Application may be made to the Administrative Appeals Tribunal for review of a decision of the Commissioner to refuse to approve guidelines or to revoke an approval of guidelines.
(2) The agency must ensure that the Commonwealth contract does not authorise a contracted service provider for the contract to do or engage in such an act or practice.
(3) The agency must also ensure that the Commonwealth contract contains provisions to ensure that such an act or practice is not authorised by a subcontract.
(4) For the purposes of subsection (3), a subcontract is a contract under which a contracted service provider for the Commonwealth contract is engaged to provide services to:
(a) another contracted service provider for the Commonwealth contract; or
(b) any agency;
for the purposes (whether direct or indirect) of the Commonwealth contract.
(5) This section applies whether the agency is entering into the Commonwealth contract on behalf of the Commonwealth or in the agency's own right.
(a) make a record of, or divulge or communicate to any person, any information relating to the affairs of another person acquired by the first-mentioned person because of that person's office or employment under or for the purposes of this Act or because of that person acting, or having acted, for or on behalf of the Commissioner;
(b) make use of any such information; or
(c) produce to any person a document relating to the affairs of another person furnished for the purposes of this Act.
Penalty: $5,000 or imprisonment for 1 year, or both.
Note: This subsection and subsection (2) also apply to persons who were members of the staff of the Commission at any time before the separate Office of the Privacy Commissioner was established: see Part 3 of Schedule 1 to the Privacy Amendment (Office of the Privacy Commissioner) Act 2000.
(2) A person who is, or has at any time been, the Commissioner, or a member of his or her staff or is acting, or has at any time acted, for or on behalf of the Commissioner shall not be required:
(a) to divulge or communicate to a court any information relating to the affairs of another person acquired by the first-mentioned person because of that person's office or employment under or for the purposes of this Act or because of that person acting, or having acted, for or on behalf of the Commissioner; or
(b) to produce in a court a document relating to the affairs of another person of which the first-mentioned person has custody, or to which that person has access, because of that person's office or employment under or for the purposes of this Act or because of that person acting, or having acted, for or on behalf of the Commissioner;
except where it is necessary to do so for the purposes of this Act.
(3) Nothing in this section prohibits a person from:
(a) making a record of information that is, or is included in a class of information that is, required or permitted by an Act to be recorded, if the record is made for the purposes of or pursuant to that Act; or
(b) divulging or communicating information, or producing a document, that is, or is included in a class of information that is or class of documents that are, required or permitted by an Act to be divulged, communicated or produced, as the case may be, if the information is divulged or communicated, or the document is produced, for the purposes of or under that Act.
(4) Nothing in subsection (2) prevents a person being required, for the purposes of or under an Act, to divulge or communicate information, or to produce a document, that is, or is included in a class of information that is, or class of documents that are, required or permitted by that Act to be divulged, communicated or produced.
(5) In this section:
court includes any tribunal, authority or person having power to require the production of documents or the answering of questions.
produce includes permit access to.
(2) Without limiting the generality of subsection (1), the report shall include a statement of the performance of the Commissioner's functions under paragraphs 28(1)(a) and (f).
(2A) The report must also include a statement about the operation of approved privacy codes that contain procedures for making and dealing with complaints in relation to acts or practices that may be an interference with the privacy of an individual, including:
(a) action taken by adjudicators to monitor compliance with the codes; and
(b) details about the number of complaints made under codes, their nature and outcome.
(3) The Minister shall cause a copy of the report to be laid before each House of the Parliament within 15 sitting days of that House after the day on which he or she receives the report.
(2) Where:
(a) a person has refused or failed, or is refusing or failing, or is proposing to refuse or fail, to do an act or thing; and
(b) the refusal or failure was, is, or would be a contravention of this Act;
the Federal Court or the Federal Magistrates Court may, on the application of the Commissioner or any other person, grant an injunction requiring the first-mentioned person to do that act or thing.
(3) Where an application is made to the court for an injunction under this section, the court may, if in the court's opinion it is desirable to do so, before considering the application, grant an interim injunction restraining a person from engaging in conduct of the kind referred to in that subsection pending the determination of the application.
(4) The court may discharge or vary an injunction granted under this section.
(5) The power of the court to grant an injunction restraining a person from engaging in conduct of a particular kind may be exercised:
(a) if the court is satisfied that the person has engaged in conduct of that kind--whether or not it appears to the court that the person intends to engage again, or to continue to engage, in conduct of that kind; or
(b) if it appears to the court that, in the event that an injunction is not granted, it is likely that the person will engage in conduct of that kind--whether or not the person has previously engaged in conduct of that kind and whether or not there is an imminent danger of substantial damage to any person if the first-mentioned person engages in conduct of that kind.
(6) The power of the court to grant an injunction requiring a person to do a particular act or thing may be exercised:
(a) if the court is satisfied that the person has refused or failed to do that act or thing--whether or not it appears to the court that the person intends to refuse or fail again, or to continue to refuse or fail, to do that act or thing; or
(b) if it appears to the court that, in the event that an injunction is not granted, it is likely that the person will refuse or fail to do that act or thing--whether or not the person has previously refused or failed to do that act or thing and whether or not there is an imminent danger of substantial damage to any person if the first-mentioned person refuses or fails to do that act or thing.
(7) Where the Commissioner makes an application to the court for the grant of an injunction under this section, the court shall not require the Commissioner or any other person, as a condition of the granting of an interim injunction, to give any undertakings as to damages.
(8) The powers conferred on the court under this section are in addition to, and not in derogation of, any powers of the court, whether conferred by this Act or otherwise.
(a) that the conduct was engaged in by a director, employee or agent of the body corporate within the scope of his or her actual or apparent authority; and
(b) that the director, employee or agent had the state of mind.
(2) Any conduct engaged in on behalf of a body corporate by a director, employee or agent of the body corporate within the scope of his or her actual or apparent authority is to be taken, for the purposes of a prosecution for an offence against this Act, to have been engaged in also by the body corporate unless the body corporate establishes that the body corporate took reasonable precautions and exercised due diligence to avoid the conduct.
(3) Where, in proceedings for an offence against this Act, it is necessary to establish the state of mind of a person other than a body corporate in relation to particular conduct, it is sufficient to show:
(a) that the conduct was engaged in by an employee or agent of the person within the scope of his or her actual or apparent authority; and
(b) that the employee or agent had the state of mind.
(4) Any conduct engaged in on behalf of a person other than a body corporate by an employee or agent of a person within the scope of his or her actual or apparent authority is to be taken, for the purposes of a prosecution for an offence against this Act, to have been engaged in also by the first-mentioned person unless the first-mentioned person establishes that the first-mentioned person took reasonable precautions and exercised due diligence to avoid the conduct.
(5) Where:
(a) a person other than a body corporate is convicted of an offence; and
(b) the person would not have been convicted of the offence if subsections (3) and (4) had not been enacted;
the person is not liable to be punished by imprisonment for that offence.
(6) A reference in subsection (1) or (3) to the state of mind of a person includes a reference to:
(a) the knowledge, intention, opinion, belief or purpose of the person; and
(b) the person's reasons for the intention, opinion, belief or purpose.
(7) A reference in this section to a director of a body corporate includes a reference to a constituent member of a body corporate incorporated for a public purpose by a law of the Commonwealth, of a State or of a Territory.
(8) A reference in this section to engaging in conduct includes a reference to failing or refusing to engage in conduct.
(9) A reference in this section to an offence against this Act includes a reference to an offence created by section 5, 6, 7 or 7A, or subsection 86(1), of the Crimes Act 1914, being an offence that relates to this Act.
(a) required or permitted by this Act to be prescribed; or
(b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.
(2) Before the Governor-General makes regulations for the purposes of subclause 7.1A or paragraph 7.2(c) of the National Privacy Principles prescribing an organisation, identifier and circumstances, the Minister must be satisfied that:
(a) the agency or the principal executive of the agency (if the agency has a principal executive) has agreed that adoption, use or disclosure by the organisation of the identifier in the circumstances is appropriate; and
(b) the agency or the principal executive of the agency (if the agency has a principal executive) has consulted the Commissioner about adoption, use or disclosure by the organisation of the identifier in the circumstances; and
(c) adoption, use or disclosure by the organisation of the identifier in the circumstances can only be for the benefit of the individual concerned.