Question – COVID-19 Suspension of Personal Information Protection Act 2004
Questions by Hon Meg Webb MLC on 27 April 2020 answered for the Government by the Hon Elise Archer MP Attorney-General on 30 April 2020
The Personal Information Protection Act 2004 (PIPA) is the primary law protecting the privacy of Tasmanians when their personal information is handled by state public authorities. When the COVID-19 Act passed in March 2020, one of its effects was to suspend PIPA.
Given that PIPA already specifically permits Government to disclose personal information if necessary to “lessen or prevent a serious threat to public health”, please clarify more fully why the suspension of PIPA is required:
Question I. What is it precisely that health officials and police need to do with citizens’ personal information that they are prevented from doing by PIPA [Personal Information Protection Act 2004]?
ANSWER: The Tasmanian Government remains committed to improving the openness, accountability and transparency of the operations of Government in Tasmania.
We are in extraordinary circumstances at present. This is Tasmania’s first public health emergency response coordinated under the Emergency Management Act.
I wish to reassure Members and all Tasmanians that the PIP Act continues to apply to collection, use and disclosure of personal information, except in very limited circumstances during a state of emergency.
To clarify, the amendment to the Emergency Management Act 2006) by the COVID-19 Disease Emergency (Miscellaneous Provisions) Act 2020 provides that the Pl P Act does not apply to Section 60A of the Emergency Management Act, which is a very limited provision.
It applies to any state of emergency, and has even narrower application to emergencies not involving a major public health response such as COVID-19, as public health legislative powers would not be exercised significantly, or at all, in such emergencies.
The Second Reading Speech for the Bill at the time indicated the State Controller requested a provision be inserted to allow government agencies to share important information during the state of emergency.
For example, in our current emergency, government agencies may need to share information around COVID-19 test results, so it could then be relayed to the person who had been tested.
Due to its limited application to both emergency and public health legislation, it will have even narrower application in emergencies that do not involve significant collection of information under public health legislation (bushfires, for example).
While there are exceptions to the general principle of not using personal information without consent of the person, these may not fully address the scenarios presented by a state of emergency.
Under the current State of Emergency, the collection, sharing and use of relevant information between Tasmanian Government departments is essential to allow the State to effectively respond to and manage the public health risk arising from the spread of COVID- 19 in Tasmania.
The Public Health Act 1997 includes provisions for the Director of Public Health to allow disclosure of personal information collected under the Act if it is for the purpose of the management, detection, notification, treatment or prevention of the spread of a notifiable disease or notifiable contaminant; or managing a threat to public health or a likely threat to public health. COVID-19 is a notifiable disease in Tasmania under the Act.
The Department of Health is currently collecting personal information under the Act including the name, address, mobile number and email address from both confirmed COVID-19 cases and people identified as close contacts of COVID-19 cases. These data are stored in the DoH’s REDcap system, which is an online database that has recently been established to manage the State’s tracking of COVID-19 cases and close contacts.
The REDcap data is also combined with data from Department of Primary Industries, Parks, Water and Environment’s Travel Arrivals Card data and managed in the database that underpins Tasmania’s Emergency Management Common Operating Platform. A regular scheduled data extract is then provided for use by the Statewide Police Operations Centre to assign information to Police Districts for compliance checking purposes.
Other secrecy, privacy, or confidentiality provisions of other Acts such as the Public Health Act 1997 continue to apply at all times. In a state of emergency involving a pandemic, the Public Health Act 1997 in particular provides a specific framework for collection, use and disclosure of information relating to notifiable diseases (eg COVID- 19).
Tasmanians should be confident that The State Controller, Public Health Services and other relevant Tasmanian Government departments take the responsibility for maintaining data security seriously, while ensuring protocols are in place to enable effective and timely responses to the public health emergency.
Question 2. Was the suspension of PIPA necessary to pave the way for the COVID-19 Tracing App (“COVIDSafe”)
ANSWER: COVIDSafe is an example of information use that could operate under the PIP Act.
The COVIDSafe APP is a Commonwealth initiative based on voluntary participation and individual consent to the collection and use of information.
Question 3. Of the 10 privacy principles established in PIPA, have all 10 been suspended during the emergency period? If so, for each of the10 principles, what is the rationale for suspension?”
ANSWER: The PIP Act, including the privacy principles, operate as a whole. The PIP Act continues to apply to collection, use and disclosure of personal information; except in the circumstances as specified in section 60A of the Emergency Management
In the very limited circumstances where the PIP Act does not apply to certain information during a state of emergency, State Departments continue to ensure that they meet the privacy principles administratively to the greatest extent possible.
Question 4. Has the right to lodge a privacy complaint with the Tasmanian Ombudsman been suspended?”
ANSWER: Any person may still complain to the Ombudsman about an administrative action taken by a public authority under the Ombudsman Act I 9 78, such as the collection and use of their information for the purposes of the emergency.
For example, the Ombudsman can consider whether actions were contrary to law, unreasonable, taken for improper purposes, and so on.
Question 5. Will the suspension of PIPA be reactivated in the future for different emergencies, such as bushfires or floods?”
ANSWER: In times of emergency, urgent and unexpected circumstances can arise where there is a critical need to collect, use, and share information to mount a rapid and effective whole-of-government response. The amendment means that the PIP Act does not apply to a very limited range of information in very limited circumstances during a state of emergency.
Those circumstances refer to a state of emergency, and are not confined to the current COVID-19 related state of emergency.
Question 6. In the passage of the COVID-19 Act in March 2020, during the committee stage in the Legislative Council, I asked the government:
In terms of the circumstances in the current emergency that may lead to the disclosure, collection, exchange or use of relevant information between those agencies, where does that decision-making lie about when and where that can happen? Where will it be documented that it has happened? How will the Government be held accountable within the parameters of that, the extent of it and the details, at a later date?
A full answer to each part of this question was not received at the time and a commitment was given to provide an answer. As one has not been received to date, the question remains:
Question 6a. Who will be the decision-maker in regards to any sharing of personal information amongst government agencies?”
ANSWER: The State Controller; Director of Public Health; and Manager (Emergency Service Geospatial Infrastructure & Surveying (GIS)) – DPIPWE agreed on the parameters of data sharing between their respective departments, as required for the purposes outlined at question one.
Question 6b. Where will any decisions to share data amongst government agencies be documented?
ANSWER: Work is now underway through the State Control Centre to document the data sharing agreement through a Memorandum of Understanding.
Question 6c. What scrutiny and accountability mechanism will be in place in relation to those decisions?
ANSWER: Accountability mechanisms are inbuilt into the arrangements for each of the relevant systems that are housing personal information in relation to COVID-19.
Please further note: Notwithstanding the answers provided above during Question Time on 30 April 2020, during debate later in the evening on the COVID-19 Disease Emergency (Misc Provisions) Bill (no 2) 2020 the following statement was made by the Government during the summing up second reading speech to provide further information relating to PIPA:
The new section 60A inserted into the Emergency Management Act 2006 by the first COVID Emergency Act provides the provisions for the Personal Information Protection Act 2004 do not apply to the disclosure, collection, exchange, or use of certain information in very limited circumstances. The section does not suspend the provisions of the act entirely in regard to an emergency or at or outside of an emergency response. During an emergency, it only exempts the provisions of the act that apply to the disclosure, collection, exchange or use of relevant information for the relevant purposes by the relevant body or person. The personal information protection principles that do not relate to disclosure, collection, exchange or use in these circumstances, all still apply. Similarly, other provisions of the act, such as the complaints and investigation provisions, still continue to apply.
Principles 3, 4, 5 and 6 already apply. Similarly, the complaints and investigation provisions in Part 4 also continue to apply. With regard to the need for section 60A, the circumstances of the COVID-19 emergency are unique and unprecedented. This emergency is not constrained within Tasmania but is affecting all of Australia and also most of the world. It is also unusual in that it is a public health emergency that heavily involves agencies other than health in the responses.
As a consequence of these unique and unfolding circumstances, certainty was wanted for frontline workers who needed to share information between departments and with other states and the Commonwealth to ensure they were not acting in breach of the law. Information sharing may also include contact tracing. For example, if an individual returned from overseas and was subject to isolation requirement, that information would be passed to another department or to another state if the person left Tasmania so that isolation requirement could be enforced.
There are already exemptions in the act for sharing information, but given the immediate nature of the initial response and the genuine need to share personal information, the Government simply sought to protect frontline staff who were genuinely responding to an emergency requirement in the interest of public health and safety. The current emergency has highlighted the need for provisions of this nature and that it is better to have the provisions in place in advance of any future emergency than to try to implement legislative reform while we are in the middle of an emergency.
Further, the provisions only apply in the context of an emergency response under the act. This is not the case day to day. Consequently, there is no risk of the provision being utilised outside an emergency response under the act.
