Generally, privacy law protects an individual's right to control the way in which their personal information is dealt. The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) achieve this by requiring agencies and organisations to be transparent with the ways in which they deal with information. In most circumstances, this means valid consent from individuals for collections, uses and disclosures of personal information is required. However, to achieve legitimate public interests, there are a number of exceptions to the requirement of consent.

Researchers who seek to collect health information for research, or to use or disclose health information which has already been collected for the secondary purpose of research must either:

• Collect, use and disclose de-identified information, which may be practically difficult and limit the utility of the information for research;
• Obtain consent from research participants; or rely on section 95 of the Privacy Act and comply with its associated guidelines (for Commonwealth agencies) to avoid a breach of the APPs for acts done in the course of medical research; or rely on the research 'permitted health situation' which requires compliance with the associated section 95A guidelines (for private organisations).

The accepted Privacy Act Review proposals

Stakeholders made submissions for reform in the area of research during the review of the Privacy Act. The proposals made in the Privacy Act Review relating to research have been accepted in the Government's response.

Proposal 14.1: Broad consent for the purposes of research – Agreed in Government response

Introduce a legislative provision that permits broad consent for the purposes of research: (a) Broad consent should be available for all research to which the research exceptions in the Act (and proposed by this chapter) will also apply. (b) Broad consent would be given for ‘research areas’ where it is not practicable to fully identify the purposes of collection, use or disclosure of personal or sensitive information at the point when consent is being obtained

Proposal 11.1 of the Privacy Act Review (which was accepted-in-principle by the Government) proposed that the definition of consent be amended to provide that it must be voluntary, informed, current, specific and unambiguous. The Privacy Act Review stated that the following details could be of assistance in interpreting the proposed relevant elements of consent:

• Current: "The purpose for which the personal information is being handled must be sufficiently linked to the consent that the individual provided."
• Specific:  "The consent must be sufficiently precise as to the purpose for which the individual is providing consent."

These two concepts of consent raise challenges where consent is being relied upon to authorise medical research, which may change in scope after the time when initial consent is sought. This is particularly relevant in emerging areas of research, where the opportunities for useful research areas evolve over time. Stakeholders expressed concern that the proposed approach to consent would be administratively burdensome (if repeated consents were required through the course of research) and would hamper research. This issue has been acknowledged in the Recitals to the GDPR. Recital 33 of the EU GDPR states:

It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.

Proposal 14.2: Consult on broadening scope of research permitted without consent – Agreed in Government response

Consult further on broadening the scope of research permitted without consent under the Privacy Act for both agencies and organisations.

The research exemptions that apply to the collection, use and disclosure of health information by private organisations without consent relate to research 'relevant to public health or public safety.' That term is not defined in the Privacy Act, but is defined broadly in the section 95A guidelines to include activities such as education, economics and technology. The section 95 guidelines similarly refer to a broad scope of the term 'medical research', including scientific understanding or knowledge.

In 2008, the ALRC recommended in its report (For Your Information: Australian Privacy Law and Practice For Your Information: Australian Privacy Law and Practice (ALRC Report 108) | ALRC ) that the research exemptions applying to health and medical research be extended to cover all human research. The ALRC commented that there "is no in-principle reason to limit the arrangements for research under the Privacy Act to health and medical research" and commented on the broad research exemptions in place in the UK, Canada and NZ.

The Privacy Act Review found that there was "merit to expanding the scope of the current research exemptions", noting that this would "recognise the public interest in the controlled further use of personal and sensitive information for other types of research that seek to contribute to society, as well as clarifying the application of the exceptions to basic and applied research." Reference was made to extending the exemptions beyond "human research" as recommended by the ALRC, to endeavours such as environmental and climate change research which hold broader benefit for humans.

Consultation will be undertaken by the Government on this topic.

Proposal 14.3: Consult on developing a single exception for research without consent – Agreed in Government response

Consult further on developing a single exception for research without consent and a single set of guidelines, including considering the most appropriate body to develop the guidelines.

In its 2008 report, the ALRC noted stakeholder concerns that the existence of two sets of guidelines gives rise to inconsistency and confusion, and the NHMRC's view at that time was that this was hindering the conduct of effective health and medical research. The ALRC reported that there was strong support for a single set of guidelines. The ALRC recommended that there be one set of 'Research Rules' issued by the Privacy Commissioner, to replace the guidelines issued under sections 95 and 95A issued by the NHMRC. There was some discussion in the ALRC's report as to whether the NHMRC or Privacy Commissioner would be best placed to issue combined guidelines.

The Privacy Act Review proposed that the combining of the research exemptions and guidelines be progressed to further consultation to reduce complexity for researchers and administrative burden for the NHMRC and Human Research Ethics Committees (HRECs).

We now await the drafting of the amendments to the Privacy Act to see how consent may be given for future research endeavours, and further consultation on the guidelines applying to research undertaken without consent.

We will continue to keep you updated as this complex and far-reaching journey progresses. If you would like to discuss this update, please contact us.