Collecting and correcting personal information - Privacy Case Note - ‘XL’ and Comcare [2021] (Privacy) AICmr 29 (29 June 2021)
The Information Commissioner’s (IC’s) recent privacy determination in ‘‘XL’ and Comcare [2021] (Privacy) AICmr 29 (29 June 2021)’ (XL) has important implications for APP entities.
XL clarifies:
what steps will be ‘reasonable’ to ensure the accuracy of personal information collected by agencies under Australian Privacy Principle (APP) 10 in the Privacy Act 1988 (Privacy Act);
when agencies will be required to correct personal information under APP 13.1; and
what agencies must do to ‘respond’ to an individual’s correction request under APP 13.5.
This note highlights some key takeaways of the determination and their implications for agencies deciding how best to comply with their obligations under APP 10 and APP 13.
Background to the complaint
Comcare asked an independent medical expert (IME) to conduct a medical file review and prepare a report for a matter before the Administrative Appeals Tribunal (Tribunal).
The Complainant considered that parts of the report were inaccurate and asked Comcare to correct those parts of the report under APP 13. Comcare decided not to correct the information and provided reasons for their decision (albeit outside the required 30 days).
The Complainant then lodged a complaint with the Office of the Australian Information Commissioner (OAIC), submitting that Comcare interfered with his privacy:
under APP 10 by:
not taking reasonable steps to ensure that the report was accurate when Comcare collected it; and
not taking reasonable steps to ensure that the report was accurate before disclosing it to the Tribunal; and
under APP 13 by refusing to correct the inaccurate parts of the report.
Key takeaways
APP 10 - Inaccuracy does not mean interference
In the determination, the IC found that some of the information complained of in the IME report was factually inaccurate.
However, the IC found that a factual inaccuracy does not create an automatic interference with APP 10. The IC weighed up factors such as the sensitivity of the information, the nature of the APP entity, possible adverse consequences for the Complainant, and the practicability, including time and cost, when considering what steps (if any) would have been ‘reasonable’ for Comcare to take to ensure the accuracy of the Complainant’s personal information.
Ultimately, the IC found that the limited steps taken by Comcare to ensure that the information was accurate when collecting, using and disclosing the report were reasonable. In making this finding, the IC noted, in particular:
the context in which the report was commissioned, ‘where the IME is an impartial and independent expert and is obliged to follow AAT guidance’; and
the ‘informal’ nature of the AAT proceedings, in which ‘there are no rules of evidence’ and ‘it would have been open to the complainant to test and to make submissions about the accuracy’ of the report.
The IC’s reasoning makes clear the OAIC’s position that the steps agencies should take, if any, to ensure that the information they collect, use and disclose is accurate depends on the circumstances. Sometimes, especially where the information is being collected from a trusted source, limited to no steps will be reasonable.
Agencies should nonetheless consider whether they have sufficient processes in place to ensure that they are collecting, using and disclosing high quality personal information to prevent incidents from occurring. If there are questions about the accuracy or trustworthiness of the source of information, agencies are likely to need more rigorous processes for checking that information they collect is accurate, complete and up-to-date.
APP 13 - Accuracy in context and agencies’ Archives Act 1983 (Archives Act) responsibilities
Section 24 of the Archives Act prohibits entities from destroying, disposing of, damaging or altering a ‘Commonwealth record’ – a term understood to capture almost all documents held by Commonwealth agencies.
The IC considered the interaction of section 24 of the Archives Act with APP 13 and stated:
I accept that under the Archives Act, the respondent is obliged to retain the IME report without amendment. The IME report is a Commonwealth record being the property of a Commonwealth institution. A Commonwealth record, as a general rule, can only be destroyed or altered in accordance with s 24 of the Archives Act and it does not appear that the grounds for alteration are present in this case.
This finding confirms that, in the vast majority of cases, agencies are not able to correct or amend all copies of a document they hold. Agencies should be cognisant of their Archives Act obligations when responding to correction requests and may opt to correct a version of a document that will be used by the agency for administrative decision-making purposes (if they decide that correcting the document would be appropriate), whilst retaining an original copy to ensure they continue to comply with the Archives Act.
APP 13 – How to ‘respond’ to a correction request
In relation to APP 13.5, the IC expressed their view that:
… the requirement in APP 13.5(a)(i) to provide a ‘response’ to a correction request within 30 days after the request is made, is a requirement to provide a response as to whether the APP entity is minded to make the requested correction or refuse to make the correction.
The IC has confirmed their view that agencies are not required to provide reasons for their refusal within the 30-day timeframe but must do more than simply acknowledging the request. This provides important clarity for agencies managing APP 13 requests.
Next steps
If you would like advice on how this decision might affect your agency, please contact Geoff Adams via geoff.adams@adaptbl.com.au
Author: Georgie Hicks. Additional input from James Pratt.