In April 2008 I wrote to the Australian government’s Office of the Privacy Commissioner seeking clarification on the full implications of the Privacy Act on private investigators because our experience has been that the majority of Australian investigators do not know what they can and cannot do since the NPPs in 2001.
Recently I received this response published in full except for intro and closing. If you are a private investigator anywhere in Australian, you’d be wise to review this information.
Either you knew it anyway, or you might be surprised to learn you’re breaching law. ed.
Privacy Act 1988 and Private Inquiry Agents
I refer to your email of 12 April 2008 to the Office of the Privacy Commissioner’s Enquiry Line. This email has subsequently been referred to the Policy Section. I apologise for the delay in responding.
We have noted the issues raised in your email and hope that the general advice provided below is of assistance.
The Office’s role in providing advice
Before addressing your email, I should make it clear that this office provides general advice, not legal advice. The comments I make in relation to your email should not be taken as limiting the ability of this office to investigate any privacy issues raised by the acts or practices of private investigators.
The general advice provided below recognises the principle-based approach taken by Parliament in enacting NPPS in 2001. In adopting this principle-based regulation, it was the intent of Parliament that organisations would be provided with the flexibility to determined how best to meet their obligations under NPPs in ways that meet the needs and circumstances of specific organisations. Accordingly, it is the office’s view that this principle-based approach to regulation comfortably accommodates many of the personal information practices that occur in a wide variety of organisations.
At the same time, the offices realises that, on occasion, there may be specific personal information handling practices that raise greater degrees of complexity. This may occur across a range of sectors, possibly including private investigators. In such cases, where advice is required on particular information handling practices, we suggest that organisations may need to seek detailed legal advice that takes into account the specific circumstances in question.
Application of the Privacy Act to private inquiry agents
The Privacy Act 1988 (Cth) (‘Privacy Act’) sets out 10 National Privacy Principles that apply to ‘organisations’ as defined in Section 6C of the Act. Organisation is a defined to included, among other entities:
- Business with turnover greater than $3 million;
- All private sector health service providers, regardless of turnover; and
- Any business that discloses personal information for a benefit, service or advantage and does not have either the consent of all the individuals concerned or the disclosure is not authorised or required by law.
In the office’s view, private investigators are likely to fall into the last of those categories listed above, in that, as the office understands it, the substantial business of such agents is to receive payment for collecting and then disclosing personal information to their clients. Accordingly, private inquiry agents are likely to be bound by the NPPs, regardless of turnover.
You have asked general questions as to whether private inquiry agents are able to collect and disclose personal information about individuals subject of inquiry. The Privacy Act permits personal information to be collected and disclosed, provided that such practices comply with NPPs.
Collection of personal information
In regard to the collection of personal information, NPP 1 requires, in broad terms, that:
- Personal information may only be collected where necessary for a function or activity of the organisation
- Collection must not be by unfair or unlawful means; and
- Where reasonable steps are taken to provide the individual to which the information relate with notice of various matters, such as who is the collecting the information and why.
The first requirement essentially prohibits the collection of personal information on unless it is necessary for a clearly defined purposes. Detailed advice on this is available in our Guidelines in the National Privacy Principles – the specific reference is available online at http://www.privacy.gov.au/publications/nppgl_01.html#npp1
In regard to the second matter, it should be noted that this notice obligation is subject to the ‘reasonable steps’ qualification. In some cases, it may be reasonable to take no steps to provide the individual with notice. The office has issued an information sheet which includes explanation of when it may be reasonable to not provide an individual with notices – see, Information Sheet 18 – 2003: Taking reasonable steps to make individuals aware that personal information about them is being collected, which is available at http://www.privacy.gov.au/publications/IS18_03.html
In regard to fair and lawful collection, advice on this has also been provided in the office’s Guidelines on the National Privacy Principles, specifically at http://www.privacy.gov.au/publications/nppgl_01.html#npp12
NPP 10 is also relevant to the collection of personal information. This principle prohibits the collection of ‘sensitive information’, which includes, among other things, information about an individual’s health, racial or ethnic background, religion, sexual preferences or practices and criminal record. However, there are exceptions to this prohibition, including where the collection is necessary for the establishment of a legal or equitable claim (see NPP 10.1(e)).
Use and disclosure of personal information
In regard to the disclosure of personal information, NPP 2 provides that personal information may only be used or disclosed for the purpose for which is was collected (the ‘primary purpose’) unless a specific exemption applies. Accordingly, a private investigator may disclose personal information for the primary purpose for which it was collected. This requires a private investigator to have clearly defined purpose for the initial collection of personal information, which is also consistent with the requirements of NPP 1.
Further advice on the exceptions to NPP 2 is available in the office’s Guidelines on the National Privacy Principles.
By complying with these principles, private investigators are able to collect, use and disclose personal information.
Access to personal information
In regard to your general question concerning whether an individual has access to personal information about them that is collected by a private investigator, NPP 6 establishes that individuals do have a general right to access such information. There are some exceptions to this rule and further information on these is available in our Guidelines on the National Privacy Principles, specifically at http://www/privacy.gov.au/publications/nppgl_01.html#npp6
Provision of further guidance material
Notwithstanding the general advice provided above, we note your concerns there may be confusion in the sector regarding the appropriate application of the NPPs, whether generally or in regard to specific practices. Where such uncertainty emerges, our office does have the discretion to provide more detailed and specific guidance.
Guidance of this type has previously been published that addresses a range of matters, whether going to a particular industry, or more widely. As cited in various places above, such guidance material may take forms including advisory guidelines, information sheets or ‘frequently asked questions’. This material is published on our website. For example, in recent times, the office has published an information sheet concerning the practice of scanning ID documents and a series of information sheets and FAQs relating to specific health sector issues.
While our existing work program does not provide for the development of such material specific to the private inquiry sector, we will give further consideration as to whether such guidance might be appropriate in the medium terms. If the office decides to produce such material, it is likely that it would be undertaken in consultation with a wider range of stakeholders, including the private inquiry industry.
Australian Law Reform Commission inquiry into privacy law
We also note that the Australian Law Reform Commission (ALRC) has considered issues relating to private investigators in its inquiry into privacy law. In its Discussion paper 72 released as part of this inquiry, the ALRC sought views on whether the Australian government should refer the matter of regulation in this industry to the Standing Committee of Attorney-General (SCAG). In our submission, we supported this approach. The ALRC provided the final report of its inquiry to the Australian government on 30 May 2008 and this report must be tabled and made public within 15 parliamentary sitting days. The office will review this report when it becomes available, including in regard to any recommendation made regarding the issues you raise and private investigators.
Etc.
Signed by the Deputy Director, Policy (name and contact info available).
ADENDUM
The ALRC report referenced above is important reading as traditionally 80% of recommendations by the Australian Law Reform Commission are mostly or partly adopted by government through policy or law changes. Therefore it's a fair guess that what the report recommend regarding privacy issues as they arise in the context of the work of a private investigator, will be implemented and will affect private investigation work throughout the whole spectrum of activities typically associated with private investigation.
Not meaning to make gloomy predictions, I must say I am glad I have retired from private investigations.
Michael Hessenthaler. ed.