Sydney University Press Law Books
|
|
[Home]
[Databases]
[WorldLII]
[Search]
[Feedback]
Sydney University Press Law Books |
|
Privacy legislation in Australia is experiencing interesting times. The Australian Law Reform Commission (ALRC) has published its Discussion Paper on its Review of Australian Privacy Law dealing with the potential amendment of the Commonwealth Privacy Act.[2] The ALRC review is the third review of the Act in the past three years, with additional reviews being performed by the Australian Office of the Privacy Commissioner (OPC).[3] In short, this is an area where considerable developments are being proposed and considered.
The Discussion Paper recommends significant changes both to the structure of Australian privacy legislation[4] and to the substantive obligations. Recommended changes to substantive obligations will impact research by imposing obligations regarding the privacy of deceased persons[5] and third parties whose information was not solicited,[6] and by imposing an obligation to ensure that the personal information they collect is relevant to the purpose for which it is collected.[7]
These developments should be taken seriously. Some researchers consider that the Privacy Act presents a significant obstacle in the conduct of research.[8] There is no doubt that, compared to untrammelled rights of access, the Privacy Act has resulted in higher research costs, lost opportunities, less effective research and sub-optimal quality of data. However, privacy legislation has the potential to be even more burdensome than it is, or even to prevent research from occurring. It is in researchers’ bests interests to understand how that might occur. These developments are important not just because they might have a chilling effect on research, but because they show that community acceptance of research – and researcher’s need to use personal information to obtain significant results - cannot be taken for granted.
The purpose of this chapter is to consider the political and legal landscape that surrounds privacy legislation and to argue that without a commitment by researchers to engage with the Australian society, privacy legislation will remain subject to change in this way.
The chapter will commence by conducting a brief tour of the politics of rights. Privacy legislation was enacted to meet a perceived need, and that perception is more important than the reality. The chapter will then examine how research takes place in accordance with privacy legislation. It is argued that, although research may occur without obtaining the consent of subjects, the exceptions are both less available than they are perceived to be, and do not advance the cause of research generally. Ultimately, however, the framework of privacy law itself provides researchers with significant opportunities to influence the regulatory environment within which they must operate. This can be done in a simple way: by adopting the rule-of-thumb that wherever consent can be obtained, it should be obtained.
The Privacy Act, and privacy legislation generally, protect information (whether true or not) from which a person’s identity can reasonably be ascertained. This type of information is known as ‘personal info-rmation’.
The Commonwealth Privacy Act was enacted following the demise of the ‘Australia Card’ proposal in 1988. That proposal failed due to significant public opposition to the idea of government collecting and controlling data relating to the activities of Australian citizens. The Act was created to meet a perceived need that privacy was a valid right, one that was endangered (whether actually or potentially) and one that needed to be protected.
Privacy legislation therefore exists within the politics of rights. By this phrase, I mean the discourse within society about what interests are worth protecting and how strong that protection should be. Inevitably, the politics of rights involves questions of balance. For example, the right to free speech must be balanced against the right not to be vilified because of one’s gender, sexual orientation, race or religion. The politics of any given right is a contest between differing views about when a generally acceptable balance is reached. Most importantly, the acceptability of any given balance can change. For example, Australian society generally acknowledges the right of individuals to seek compensation for personal injury, if that injury is caused by another person. Nevertheless, that right was severely curtailed during the recent tort ‘reforms’, because of the perception that compensation was being awarded too easily, in amounts that were excessive and in respect of losses that were properly the plaintiff’s personal responsibility.[9]
The best example of how the politics of rights may be used is the actions of the tobacco industry. Fifty years after evidence began to accumulate that showed the link between cigarette smoking and cancer, the tobacco industry is still able to function effectively in the manufacture and sale of their products.[10] Despite killing almost 20 000 Australians per year,[11] the tobacco industry’s actions go on almost completely unregulated.[12] This has occurred because the tobacco industry has been very effective in controlling the terms of the debate. Instead of concentrating on the public health, the tobacco industry has focussed on ‘the individual’s right to choose’. Instead of allowing the debate to be about the cost of healthcare, the tobacco industry has focussed on the perils of taxation and government bureaucracy.[13] Lastly, whenever regulation of the industry is proposed, the industry has suggested that this is simply a precursor to prohibition, which it blandly states ‘doesn’t work’.
What are the lessons for privacy in the politics of rights? First, simple messages with emotional appeal are very powerful. Prohibition and freedom are simple messages; so is ‘Big Brother’. Second, perception is more important than reality. If people believe that something is wrong, they will support measures to change it, even if nothing is ‘really’ wrong. Third, and most important, just because you are ‘right’ doesn’t mean you will succeed in achieving your goals.
It is therefore important to remember that all it takes is for a ‘privacy scare’ to occur, and politicians may see that it is in their best interests electorally to alter the privacy legislation to better protect the right of privacy. Politicians tend to infer society’s views on an issue from how that issue plays in the media.[14] If the media can frame a message in the right way, and this generates traction within the community, politicians will be tempted to introduce legislation to meet the perceived demand.[15]
Ultimately, researchers should acknowledge that all their actions fashion the regulatory environment in which they operate, not just those that are explicitly political.
Many researchers appear to take the stance that the OPC is part of a ‘privacy lobby’,[16] which stands in the way of progressive and necessary research; research the Australian society understands and with which it generally agrees. The attitude of the ‘privacy lobby’ is said not to be representative of the Australian public. The reality is that the stance taken by the OPC simply reflects their understanding of the attitudes of Australian society.[17] The relationship of those attitudes to privacy and research is somewhat ambivalent. Surveys commissioned by the OPC, the Commonwealth Department of Health and Ageing (DoHA) and by the National Health and Medical Research Council (NHRMC) report that anywhere between one third and two thirds of Australians are against the use of identifying information for research without the consent of the subject.[18] One fifth of individuals in one survey reported reluctance to provide their medical history or health information to any organisation.[19]
These attitudes exist even where research is accepted as important. In one survey, although 83% of respondents believed such research was critically or very important, 73% of respondents believed it was critically or very important to get consent for each research study.[20] Given such attitudes, the representations made by the OPC are at least as representative of the Australian community as those made by the researchers.
The best way to counter the representations is to address the community’s concerns.
The Privacy Act allows the collection, use and disclosure of health information that identifies an individual in five relevant circumstances:
1. with the individual’s consent;[21]
2. for a secondary purpose that is:2.1. directly related to the primary purpose; and
3. for research relevant to public health or public safety;
2.2. within the individual's reasonable expectations,[22]
4. for the compilation or analysis of statistics relevant to public health or public safety; or
5. for the management, funding or monitoring of a health service.[23]
Obtaining the subject’s consent can be inconvenient, difficult or impossible, depending on the size, timing, subject matter, importance and methodology of the research proposal. The population which forms the subject of the study may be dead, transient, remote or simply uncooperative. In many cases, researchers may consider that if consent is required, it is simply not worthwhile to perform the study. In such circumstances, many researchers will be tempted to try to bring their research within the exceptions to consent. However, there are a number of traps that mean that care should be taken.
The secondary purpose must be within the reasonable expectations of the individual who forms the subject of the research, not the expectations of the Human Research Ethics Committees (HREC) or the researcher. Researchers and HREC members form a relatively small subset of the population; one which is aware of the various uses to which health information could be put. As a rule of thumb, the rest of society can only ‘reasonably’ be considered to know what they have seen on television. For example, researchers and HRECs are aware that clinical review of a particular individual may take place within a health service, at conferences, or in the course of multi-site research into the effectiveness of a particular medical technology. By comparison, the rest of society probably only understands clinical review of a particular individual to take place within the health service, and probably only if an adverse event has occurred.[24]
The last three possible circumstances may only take place where other circumstances exist. These circumstances are where:
o the purpose cannot be served by the collection or use of de-identified information; and
o it is impracticable for the organisation to seek the individual’s consent to the collection; and
o the information is collected:• as required by law (other than the Privacy Act itself); or
• in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation; or
• in accordance with guidelines approved by the OPC.
The Guidelines published by the OPC provide that where collection, use or disclosure takes place for the purpose of research, that research must be approved by a HREC. HRECs may approve such research only if they consider that the public interest in the research substantially outweighs the public interest in maintaining the level of privacy protection provided by the privacy legislation. This occurs by taking into account:
o the value and public importance of the research;
o the likely benefits to the participants;
o whether the research design can be modified;
o the financial costs of not proceeding with the research;
o the type of personal information being sought;
o the risk of harm to individuals; and
o the extent of a possible breach of privacy.[25]
While the potential benefits of the research are often apparent, the potential detriment is not always clear. The detriment is, simply, that people will not trust their doctors. Without an assurance that their health information will remain private, people may not seek the health care they need, or may not provide a full medical history. This may in turn increase the risks to their own health and the health of others.[26] For example, the Cancer Council has recently stated that some cancer patients are too scared and embarrassed to seek help for their condition because of the stigma of smoking.[27] Again, HRECs should remember that they are part of a small portion of society that has both regular contact with doctors and a good understanding of the research that is conducted to supplement medicine.
Lastly, many researchers and doctors consider that the question of impracticability is one to be decided by the HREC. This is incorrect. Impracticability is a question of law. In the opinion of the OPC and the National Health and Medical Research Council (NHRMC), impracticability occurs where:
o the subjects are uncontactable due to death or relocation or part of a demographic group that is typically difficult to contact,
o the sheer number of records involved may cause logistical problems,
o the procedures required to obtain consent are likely either to cause unnecessary anxiety for those whose consent would be sought; or
o the objective of the investigation may need to be concealed from subjects in order to minimise various forms of bias.[28]
Note that this is a high barrier to overcome. Researchers and HRECs should be careful of being seen as too willing to allow research to occur without obtaining consent from the subjects of the research.
A strict reading of privacy legislation, therefore, imposes significant obstacles in the path of researchers seeking to use personal information. This is the intention behind the legislation: to make consent the ‘default’ option which researchers should consider first before seeking to utilise the exceptions set out above.
The short term goals of any researcher are the successful completion and publication of research. For health researchers, a long term goal is to promote health research as an essential part of ensuring that people get the best care possible. In such circumstances, obtaining consent directly from subjects (and not relying on the exemptions discussed above) has two significant benefits.
First, obtaining consent is the surest way to avoid litigation challenging research that takes place under an exception to the consent requirement. Such litigation will take place in the courts, and judges are more likely to be sympathetic to the discourse of rights than they will be to postulated future benefits of research. Court decisions are often published in the media, and may result in the imposition of financial penalties. Court decisions also serve to mobilise political forces, by making people think about social interactions in new ways.[29] Adverse judicial decisions therefore pose the most significant risk of a chilling effect on the conduct of research.
Second, the process of obtaining consent from a subject necessarily involves education. To provide informed consent, the subject must be made aware of the research that is occurring and the need for that subject’s participation in the research. This normalises research, and participation in research. Every person who is involved in research and who does not experience an intrusion into their privacy will be less taken in by the simple messages, like ‘Big Brother’, that may be used to undermine research. The longer the process of normalisation goes on, the less public concern will be reflected by the OPC and the rest of the ‘privacy lobby’. In other words, one of the primary beneficiaries of the consent process will be the research community generally. The assumption that privacy legislation is something to be tolerated is false, and is a dangerous assumption to make.
The ultimate message of this chapter is that regulatory regimes are not set in stone; the ALRC Discussion Paper is perfect evidence of the dynamic of review, discussion and amendment. Even with its frustrations, the current privacy regime cannot be taken for granted. Legislative change is as capable of making research harder as it is of making research easier.
Given this reality, researchers should consider how their actions will affect the long term viability of their discipline. Researchers should adopt the approach that, wherever consent can be obtained, it must be obtained. This approach is demanded by the law, but it also provides researchers with an opportunity to educate the public about the importance of health research. Simply by undertaking the process of education, researchers generate trust, because they show society that society’s views are taken seriously.[30] In the long term, this is the best way to ensure that research remains viable and legitimate.
Researchers living a one-grant-to-the-next reality may find these comments utopian. I acknowledge that taking a conservative approach to consent might reduce the possibility of significant research being undertaken. However, I am only advocating a general approach, and exemptions – though rare – may be justifiable. The only word of caution I have is this: what will the effect on research be if authorities start making grants contingent upon obtaining consent from all subjects?
[1] Consultant, Health Legal, PhD Candidate, University of Melbourne Law School. This chapter is based on a presentation given at the Legal Framework for e-Research Conference held 11 and 12 July 2007, Gold Coast, by the Queensland University of Technology Faculty of Law. The views expressed in this article are those of the author alone and do not necessarily reflect those of Health Legal.
[2] Australian Law Reform Commission, Review of Australian Privacy Law, Discussion Paper (September 2007 http://www.austlii.edu.au/au/other/alrc/publications/dp/72/ at 29 June 2008 (hereafter Discussion Paper).
[3] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005).
[4] The major changes proposed involve creating a single set of principles that would apply to both public and private sector organisations (see Discussion Paper, op cit n 2, Part D), and that federal privacy legislation override state and territory privacy legislation in relation to health services provided by the private sector (ibid, Part H).
[5] Ibid, Chapter 3.
[6] Ibid, Chapter 18.
[7] Ibid, Chapter 24.
[8] See, for example, Professor Fiona Stanley ‘Record Linkage – Public Good or Invasion of Privacy?’ (Paper presented at the 25th International Conference of Data Protection and Privacy Commissioners, Sydney Australia, 10 September 2003). See also the submission by Dr Richie Gun, Department of Public Health, University of Adelaide, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 21 December 2004.
[9] D Ipp, Department of Treasury, Canberra (2002) Review of the Law of Negligence.
[10] See R Kluger, Ashes to Ashes: America’s Hundred-Year Cigarette War, the Public Health and the Unabashed Triumph of Philip Morris (1996); R A Glantz and E D Blaback, Tobacco War (2000).
[11] B Ridolfo and C Stevenson, Australian Institute of Health and Welfare, (2001) The quantification of drug-caused mortality and morbidity in Australia, 1998 (Drug Statistics Series No 7) AIHW category no PHE29.
[12] N Gray ‘The Modern Cigarette, an Unregulated Disaster’ (2007) 187 (9) Medical Journal of Australia 502.
[13] Glantz S A & Balbach E D Tobacco War: Inside the California Battles (2000).
[14] Yanovitzky I ‘Effects of News Coverage on Policy Attention and Actions: A Closer Look at the Media – Policy Connection’ (2002) 29 (4) Communication Research 422.
[15] Kingdon R Agendas, alternatives and public policies (1984).
[16] Presentation of Professor F Stanley at the Legal Framework for e-Research Conference, 12 July 2007, Gold Coast.
[17] See Office of the Privacy Commissioner, Submission to the Australian Law Reform Commission's Review of Privacy - Issues Paper 31 (2007) [11], [41], [233], [345] etc.
[18] See Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005) 210–11; National Health and Medical Research Council, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 10 December 2004.
[19] See Office of the Privacy Commissioner, Community Attitudes to Privacy (2004) 6.2 <http://www.privacy.gov.au/publications/rcommunity> .
[20] L Damschroder, ‘Patients, privacy and trust: Patients’ willingness to allow researchers to access their medical records’ (2007) 64 Social Science and Medicine 223–35.
[21] Privacy Act 1988 (Cth) Sch 3, National Privacy Principle 10.1.
[22] Privacy Act 1988 (Cth) Sch 3, National Privacy Principle 10.2.
[23] Privacy Act 1988 (Cth) Sch 3, National Privacy Principle 10.3.
[24] Given the uncertainty associated with what the Australian population knows or perceives about research, e-Research and health research, there is an obvious need for further research. Hard research – as always – prevents speculation about the public’s views, which would necessarily be influenced by the speculator’s own perception of the importance of privacy. However, in the absence of such research, it is in researchers’ long term interests to adopt a conservative approach.
[25] National Health and Medical Research Council, Guidelines under Section 95 of the Privacy Act 1988 (2000) Guideline 3.2.
[26] Australian Government Department of Health and Ageing, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 10 December 2004.
[27] K Sikora, ‘Lung cancer our hidden killer’, Daily Telegraph, 12 July 2007.
[28] See Information Sheet 9: Handling Health Information for Research and Management <http://www.privacy.gov.au/publications/IS9_01.html> National Health and Medical Research Council, National Statement on Ethical Conduct in Research Involving Humans (1999) [14.4].
[29] See McCann M, Rights at Work (1992)
[30] Tyler T, Why People Obey the Law (1992)
AustLII:
Copyright Policy
|
Disclaimers
|
Privacy Policy
|
Feedback
URL: http://www.austlii.edu.au/au/journals/SydUPLawBk/2008/48.html