The basic rule of IPP 2.1 is relatively straightforward: use and disclose personal information only for the purpose for which it was collected (the ‘primary purpose’).

However, IPP 2 allows the use and disclosure of personal information in certain circumstances for other purposes (‘secondary purposes’).

IPP 2 contains eight other instances where use or disclosure may be permitted for a secondary purpose. These are contained in IPPs 2.1(a)–(h). Seven of these envisage use or disclosure without consent.

The terms ‘use’ and ‘disclosure’ are not defined in the PDP Act.

The Macquarie Australian Dictionary defines ‘use’ as ‘employ for some purpose’. Examples of uses of personal information by an organisation include:

• a staff member of the organisation accessing and reading the personal information;
• the organisation making a decision based on the personal information;
• the organisation passing the personal information from one part of the organisation to another; and
• unauthorised access to the personal information by an employee of the entity.

The term ‘disclose’ takes its ordinary dictionary meaning: ‘opening something up to view or revealing it’. An organisation ‘discloses’ information where it releases the information out of its effective control and into the control of another organisation or person. The release may be a proactive release or publication, a release in response to a specific request, or an accidental or unauthorised release.

Accidental or unauthorised disclosures may also breach IPP 4 (Data Security).

As noted in Key Concepts, the IPPs apply only to personal information that is ‘recorded in any form’.¹

However, IPP 2 will apply to all disclosures of recorded personal information no matter how the disclosure occurs. For example, IPP 2 applies to verbal disclosures of personal information that also exists in a recorded form.

Personal information can be disclosed even though it remains in the possession or control of its original collector. For example, if a person from outside an organisation is permitted to read information held by an organisation on a computer screen, the organisation has disclosed the information to the person.

Internal information sharing within the same organisation or legal entity is considered use of information. In contrast, sharing information with another legal entity is disclosure. However, legal personality of an organisation can be confusing because many organisations in the Victorian public sector are closely related or may fall under the same portfolio department. Departmental portfolios are commonly comprised of distinct business units, statutory agencies and independent statutory offices. For example, a Department may have various business units, panels, commissions, boards and other entities carrying out many functions in diverse areas.

These individual entities may be separate ‘organisations’ under s 13 of the PDP Act. They will have different functions, which will impact on the types of personal information collected. These separate entities may also have other legal authorisations to collect personal information, for example, under their enabling legislation, and obligations of confidentiality that impact the entity’s authority to collect or disclose information.

Complicated organisational structures in the public service can make it difficult to determine whether a particular action is an internal use or external disclosure. In practice, the distinction is not significant because often the same requirements attach to both use and disclosure under IPP 2.

A disclosure by one body or entity will constitute a collection by the recipient body. Organisations, and entities within a departmental portfolio, should ensure they comply with both IPP 1 (Collection) and IPP 2 (Use and Disclosure) when they share personal information (while keeping in mind their obligations under other relevant IPPs).

IPP 2.1 permits use and disclosure for the primary purpose for which the personal information was collected. This is the ‘primary purpose’. The purpose for which information is collected can be inferred from or implicit in the circumstances of collection.³ Therefore, IPP 2.1 is linked to collection notices (issued under IPP 1.3), as organisations should have already explained the primary purpose of collection to the individual. This means organisations need to consider and define the specific function to activity for which they are collecting the information.

In Ng v Department of Education [2005] VCAT 1054 at [88]-[89], VCAT defined ‘purpose’ narrowly as ‘synonymous with the intent’ of collection and avoided a purely objective analysis of purpose as this will often be too wide. This means the primary purpose is even narrower still. In contrast, a number of recent VCAT cases listed below have shown the primary purpose may be defined widely. Further discussion of the meaning of ‘purpose’ is in Key Concepts.

Inadvertent disclosures may still be for a ‘purpose’. For example, disclosure might be for a purpose, but the information is sent to the wrong person. The inadvertent or accidental disclosure is still for that original purpose, despite the error.⁵

A statute might set a broad primary purpose, however, organisations themselves should avoid this because it will increase the likelihood of use and disclosure being found to be outside a more narrowly construed primary purpose. The following examples may help organisations to define and describe the primary purpose of collection.

• In Harrison v Victorian Building Authority (Human Rights) [2017] VCAT 108 [114], the primary purpose was the administration of complaints. The disputed disclosure fell within this primary purpose because the statutory complaints process in the Building Act 1993 (Vic) made it very clear to applicants their information would be disclosed.

• In Zeqaj v Victoria Police (Human Rights) [2018] VCAT 1733 [91], the use of personal information to assess a firearms licence was within Victoria Police’s primary purpose of collection: to preserve the peace, protect life and property, prevent the commission of offences and detect and apprehend offenders. This broad primary purpose was taken from the duties of police officers under the Victoria Police Act 2013 (Vic).

• In Taylor v Victorian Institute of Teaching (Human Rights) [2013] VCAT 1290 [137] to determine the primary purpose, VCAT considered the respondent’s privacy policy and express functions under the relevant Act. VCAT considered the primary purpose of collection was to undertake statutory functions, which included regulating the teaching profession, maintaining standards and investigating the conduct of teachers.

This list shows the primary purpose for collection will vary in breadth and generality according to the circumstances of collection, use or disclosure. OVIC suggests organisations define the primary purpose of collection of personal information narrowly.

Where an organisation compulsorily acquires personal information, the purposes for which it can use and disclose that information will be more limited than if the information was obtained voluntarily. This is for two reasons. First, the scope of the power used to compulsorily acquire the information will limit the scope of the primary purpose of collection. Second, the fact the information was compulsorily acquired may impose an obligation of confidence on the organisation, in accordance with the principle discussed in Johns v Australian Securities Commission (1993) 178 CLR 408. In this case, Justice Brennan of the High Court of Australia said:

When a power to require disclosure of information is conferred for a particular purpose, the extent of dissemination or use of the information disclosed must itself be limited by the purpose for which the power was conferred. In other words, the purpose for which a power to require disclosure of information is conferred limits the purpose for which the information disclosed can lawfully be disseminated or used…

A statute which confers a power to obtain information for a purpose defines, expressly or impliedly, the purpose for which the information when obtained can be used or disclosed. The statute imposes on the person who obtains information in exercise of the power a duty not to disclose the information obtained except for that purpose. If it were otherwise, the definition of the particular purpose would impose no limit on the use or disclosure of the information. The person obtaining information in exercise of such a statutory power must therefore treat the information obtained as confidential whether or not the information is otherwise of a confidential nature. Where and so far as a duty of non-disclosure or non-use is imposed by the statute, the duty is closely analogous to a duty imposed by equity on a person who receives information of a confidential nature in circumstances importing a duty of confidence…

It is therefore important to ascertain the purposes for which such information can be legitimately used or disclosed.⁷

This case concerned the disclosure of transcripts of evidence by the former Australian Securities Commission (ASC) to the Royal Commission into the collapse of the Tricontinental group of companies. The transcripts of Johns’ evidence (the managing director of the companies at the time) had been acquired through the compulsory examination powers of the ASC and were subject to confidentiality obligations and strict limitations around use and disclosure. The ASC permitted the Royal Commission to use the material in public hearings, which were then reported by the media.

Johns successfully argued that he had been denied natural justice by the ASC for not being provided an opportunity to be heard before they allowed the confidential material to be publicly disseminated, so as to prejudice his rights or interests. Public disclosure could prejudice Johns’ personal reputation and encroach on his right to maintain silence about the matters being investigated by the ASC. The High Court of Australia held that the ASC’s decision to disclose the transcripts to the Royal Commission for use in public hearings was therefore invalid.

Where an organisation has compelled the provision of information, it should be cautious about disclosing that information for any other purpose.

There are many situations where individuals are compelled to provide their information in order to obtain a benefit, exercise a right, or comply with a legal obligation. Examples include:

• obtaining a driver’s licence or registering a motor vehicle;
• registering a pet cat or dog;
• planning to renovate or build a house, or objecting to a planning proposal;
• applying for public housing;
• practising as a professional (for example, as a teacher, lawyer or doctor);
• seeking a licence to operate a childcare centre;
• working in certain child-related areas;
• voting at state and local government elections; or
• complying with notices to produce documents or give evidence.

Organisations should carefully examine any laws underpinning the compulsory collection of information to ensure any subsequent use or disclosure of that information is permitted.

Under IPP 2.1(a), an organisation can use and disclose personal information for a related secondary purpose, if the individual the information is about would reasonably expect the organisation to do so.

The secondary purposes for use and disclosure must be related to the primary purpose of collection and consistent with what an individual would reasonably expect. In the case of sensitive information, the secondary purpose must be directly related.

This is a two-part test:

• Is the secondary purpose related (or directly related) to the primary purpose?
• Would the individual whose information was collected reasonably expect the use or disclosure?

The secondary purpose for which the information is used or disclosed has to be connected to or associated with the primary purpose. It must relate to the primary purpose for which it was collected. If sensitive information is involved, the secondary purpose has to be directly related to the primary purpose. VCAT has said the link between the primary and secondary purposes must be ‘clear, undeniable and inextricable’.⁹

The Explanatory Memorandum to the PDP Act suggests that a reasonably expected secondary use would be where information collected in delivering a government service is subsequently used to manage, evaluate or improve that particular service. So, quality assurance, program evaluation and development are likely to be regarded as reasonably expected secondary purposes. The Explanatory Memorandum says:

[Organisations] are entitled to use or disclose personal information for a secondary purpose where it is related to the primary purpose of collection and the use or disclosure is within the reasonable expectations of the individual. This would be the case, for example, where the information was used to manage, evaluate or improve particular government services in relation to which the information was originally collected. Secondary uses or disclosures are otherwise permitted in cases where there is a strong public interest in doing so.¹¹

In Ng v Department of Education [2005] VCAT 1054, the Department installed a CCTV camera in the computer room of a school to minimise the risk of vandalism and to monitor student use of the computers. The CCTV footage was subsequently used during an investigation into the teacher’s work performance in the classroom. In that case, VCAT found the purpose of installing the CCTV camera was not the broad purpose of taking visual recordings of any ‘relevant incident’ that may need to be investigated, but the specific purpose of collecting information about student misbehaviour and inappropriate conduct. However, use of the CCTV footage to assess the teacher’s performance in managing inappropriate student behaviour was a secondary purpose because it ‘clearly related to monitoring the inappropriate behaviour itself’.¹³

Examples of related secondary purposes, found to be within the reasonable expectations of the person involved include:

• the use of personal information by local councils for fire and flood protection. Local councils may collect information from ratepayers in relation to owners’ properties. The primary purpose of collection may be to make decisions about amenities, value, uses and upkeep of those properties. However, disclosure of this information to a relevant authority for the secondary purpose of safety against bushfire, flood or extreme weather would be a related and reasonably expected secondary purpose.
• the secondary use by police of firearm licence holders’ fingerprints in the investigation of crime.¹⁵
• the disclosure of a tertiary student’s contact details to a debt collector after the student incurred a debt for a course. This was related to the primary purpose of collection, that is, the enrolment of fee-paying students.¹⁶

In some cases, use or disclosure will not be related, despite what may seem at first to be an apparent link between the primary purpose and the disclosure. For example, in Duggan v Moira Shire Council (Unreported, VCAT, Preuss SM, 11 October 2004) [35], VCAT found the primary purpose of collecting the identity of a person who found a dog, was not related to the secondary purpose of informing the grateful owner of the finder’s details so that the owner could thank the finder:

The second part of the test for IPP 2.1(a) is if the individual whose information was collected reasonably expect the use or disclosure.

For a use or disclosure to be ‘reasonably expected’, it is necessary to ask what an ordinary person in the position of the person who the information is about would consider reasonable. This is an objective test. It is the reasonable expectation of an ordinary person, who is not necessarily expert in the workings of government, that is to be considered in the particular circumstances.

The expectations of the actual individual involved are a consideration, but they are not determinative.

A secondary use or disclosure might be reasonably expected where that use or disclosure is ‘inextricably linked’ to the primary purpose of collection. In Ng v Department of Education, VCAT found:

(T)he inextricable link between inappropriate behaviour by students and the quality of teachers’ management of that behaviour is so close as to render it reasonably foreseeable by a reasonable teacher that footage taken for the one purpose should be used for the other.²¹

Whether an ordinary person would reasonably expect the use or disclosure will depend upon the circumstances of each case. A number of factors can influence this assessment, including:

• the manner in which the information was given to the organisation;
• the notice provided to the individual upon collection;
• the sensitivity of the personal information;
• the nature of the organisation;
• the actions of the individual in question; or
• the individual’s expressed expectations.

The context in which an organisation collects the personal information from an individual affects the reasonableness of expectations of use and disclosure.

Collection notices can outline the secondary purposes for which the information is to be used or disclosed (see IPP 1.3). Collection notices can help create an expectation that information is to be used for related secondary purposes. However, further communication with an individual may be required to establish that the secondary use is ‘reasonably’ expected. For example, a secondary use or disclosure that breaches an undertaking of confidentiality cannot be said to be ‘reasonably’ expected. Collection notices cannot be used to override other existing legal obligations.

Reasonableness also requires the related secondary use or disclosure is also proper and fair, and generally not incompatible with the primary purpose of collection. Organisations that give notice of their intention to use or disclose information in a way that is different to what a person might reasonably expect may find that individuals will not want to transact with the organisation. Similarly, individuals may not want to provide complete and accurate information to organisations.

Later disclosures of information may be influenced by the manner in which the information was received by the organisation or whether the information is sensitive or delicate information.

For example, in Complainant H v Local Council [2004] VPrivCmr 2 (see Case Study 2B above), in addition to finding the disclosure in council minutes of petitioners’ details was in accordance with the primary purpose of collection, the former Privacy Commissioner found the circumstances in which the information was gathered and presented to Council also created a reasonable expectation that it would be publicly disclosed. However, the Privacy Commissioner cautioned that there may be cases where disclosure would not be appropriate because that disclosure would reveal sensitive or delicate information.

The type of organisation using and disclosing the personal information will affect how reasonable it is to expect the particular use or disclosure. In Case Study 2B above, the organisation publishing the petition online was a local council, an organisation that facilitates public discussion of various matters important to the community. For example, the reasonableness of the disclosure in Case Study 2B can be contrasted with the publication of a petition by a private organisation that does not have such a role in the democratic process.

The extent to which personal information might reasonably be expected to be disclosed within an organisation will also be influenced by matters such as the size of the organisation and the functions of the individuals within the organisation (affecting their ‘need to know’). For example, in Complainant Q v Contracted Service Provider to a Department [2005] VPrivCmr 3, the former Privacy Commissioner accepted it was reasonably expected that a Human Resources Manager could pass on the outcomes of a criminal record check for a job applicant to two senior staff members with responsibility for supervision and management of the person’s work. A person would reasonably expect that the information would not flow outside the organisation, or to people within the organisation who did not have a ‘need to know.’

Individuals that disclose their own information in a public forum, for example, by talking to the media about a complaint they made about a public sector organisation, should reasonably expect that the public sector organisation will respond to media inquiries and may, in responding, disclose the person’s information in a proportionate manner. In Complainant Y v The Department [2005] VPrivCmr 7 the former Privacy Commissioner stated:

An individual’s desire to control the way in which an organisation uses or discloses their personal information must be balanced against other competing factors. For example, an organisation may be required to disclose an individual’s personal information under other legislation (see IPP 2.1(f)). Alternatively, it may not be practicable for an organisation to carry out a particular function such as investigating a complaint, without the disclosure of an individual’s personal information. When considering whether a particular use or disclosure is reasonably expected, the actual individual’s expressed expectations will be relevant (but not determinative). See the discussion on sensitive and delicate information in the Key Concepts chapter for more information.

The following case studies provide examples of how VCAT and former Privacy Commissioners have decided whether a use or disclosure of personal information for a secondary purpose is reasonably expected.

When disclosing personal information under IPP 2.1(a), organisations should only disclose the amount of information sufficient to satisfy the related secondary purpose (see the following two Case Studies 2J and 2K). Excessive disclosure is not reasonably expected.

Consent is one of the exceptions to the rule that personal information can be used and disclosed only for the purpose it was collected for. Organisations can seek consent from an individual to use or disclose information for unrelated or incompatible purposes with the primary purpose of collection, that is, purposes that fall outside the scope of IPP 2.1(a).

If an individual provides valid consent, the organisation may use or disclose the personal information in a way that is consistent with the consent. Please refer to the Key Concepts chapter for information regarding ‘Consent’. Case Study 2L demonstrates the importance of ensuring consent is valid.

In cases where an individual has not provided consent to use or disclose their personal information, this will not necessarily mean an organisation will be unable to use or disclose the information. Other exceptions under IPP 2, such as disclosure authorised or required by or under law (IPP 2.1(f)), may allow a disclosure to proceed irrespective of whether the individual has consented.

Organisations must distinguish consent from notice (provided by a collection notice, under IPP 1.3). Often individuals have no real choice in a use or disclosure when transacting with government. In such circumstances, when the individual signs a form it is usually regarded as an acknowledgement that he or she has received notice. It is not ‘consent’ in the proper sense of the word. The differences between notice and consent are discussed further under Consent in the Key Concepts chapter.

If an organisation is seeking to rely on consent as the authority to use or disclose information, it should be opt-in consent. The opt-in method demonstrates more reliably that the individual has actively consented compared to the opt-out method.  For more information, the opt-in and the opt-out consent models are discussed under ‘Opt In versus Opt Out’ in the Key Concepts chapter.

IPP 2.1(c) allows organisations to use and disclose personal information necessary for research or the compilation or analysis of statistics when three requirements are met:

• The research is in the public interest.
• The information is not for publication in a form that identifies any particular individual.
• It is impracticable for the organisation to seek the individual’s consent before the use or disclosure.

In the case of disclosure, the organisation must also reasonably believe the recipient of the information will not disclose the information.

For organisations to use and disclose personal information under IPP 2.1(c), the use and disclosure must be necessary for the research or statistical work. Use or disclosure will not be necessary when the same research objectives can be achieved with alternative sources of data or data that has been de-identified or is anonymous. When developing research projects, organisations should consider if the same objectives could be achieved without using personal information.

Before organisations rely on IPP 2.1(c) to use or disclose personal information (or for any project or initiative that poses a risk to the privacy of individuals), they should consider completing a privacy impact assessment (PIA). PIAs are a tool to assist organisations identify potential privacy risks and ways to mitigate them before personal information is handled.⁴⁵

‘Research’ is not defined in IPP 2.1(c). As such, the word should be given its ordinary meaning. Research is a systematic investigation and study which seeks to establish new facts and reach new conclusions. It is more than a reorganisation of data or restatement of facts. Research begins with a clearly defined goal and the information gathered aims to help reach that goal.

‘Statistics’ are numerical data, especially when large quantities are involved. Compilation is the collection of numerical data and analysis involves an undertaking of detailed examination of the data and inferring conclusions about the information or the set or a subset of data subjects.

Organisations can only rely on IPP 2.1(c) to use or disclose personal information for research or statistical work without individuals’ consent when the work is in the public interest.

To determine whether a proposal for research or statistical work is ‘in the public interest’, organisations should be explicit in their definition of the public interest and how the research promotes this public interest. Organisations should consider the following questions:

• Is the organisation considering the public interest as broader than its own needs?
• What is the public importance of the research?
• How will the wider community benefit from the research or statistical work? Will the community benefit, for example, by:
  • gaining in greater knowledge, insight or understanding within fields such as science and humanities;
  • the improvement of social welfare, public safety or individual well-being, or the minimisation of serious harm, or;
  • the enhancement of the delivery of government services or the targeting of government funded welfare or educational services?
• Are there any countervailing interests to consider to balance the public interest in privacy and the public interest in the conduct of the research?
  • Is there a cost to the community of not undertaking the research or statistical work?
  • Are participants at risk of any harm (for example, physical, emotional, social, economic or legal harm)? If so, what is the seriousness and likelihood of this harm?

The National Health Medical Research Committee has published Guidelines approved under s 95A of the Commonwealth Privacy Act 1988. Although not directly applicable to the PDP Act, these Guidelines provide additional questions and considerations which may help an organisation determine whether their research is in the public interest.

A research ethics committee may also help an organisation assess whether the research involving personal information is in the public interest. Some organisations, such as universities, may be required due to their funding or other arrangements to consider the National Statement on Ethical Conduct in Human Research.⁴⁷ Some Departments also have research committees, for example, the Department of Justice and Community Safety requires ethics approval from this research committee where a researcher wishes to use departmental data and the risk or discomfort to participants is greater than low or the research involves vulnerable or disadvantaged individuals.

To use and disclose personal information under IPP 2.1(c), organisations must ensure the research or statistical work is not for publication in a form that identifies any particular individual. This means organisations should de-identify personal information prior to publication to ensure published material does not contain personal information. Organisations should not consider de-identification as a final end state. Instead, organisations should always consider the possibility of re-identification, especially when data is drawn from small communities or data sets. For more information, see ‘De-identified information’ in Key Concepts.

Impracticability means more than mere inconvenience or some cost or effort for a public sector organisation. The impracticability of seeking consent should not be confused with the undesirability of seeking consent. IPP 2.1(c) does not permit consent to be waived where consent can be readily sought but organisations would prefer not to do so in order to achieve greater participation. Impracticability must be assessed in context.

The quantity, age or accessibility of records may make it impracticable to obtain.⁴⁹ According to the NHMRC’s National Statement on Ethical Conduct in Human Research, it is usually impractical to obtain consent from individuals for secondary use of information collected during the delivery of a service by a government department because the collection of information may involve large numbers of people or whole populations. For example, it may be impracticable to seek consent where the organisation is unable to locate the individual, despite making reasonable efforts.

In the case of disclosure only, there is an additional requirement: organisations must reasonably believe the recipient of the information will not disclose that information. To be able to demonstrate a reasonable belief under IPP 2.1(c)(ii), organisations should ensure they keep records of the following considerations (among others):

• Does the organisation reasonably believe that the recipient of the personal information will not further disclose the information?
• Have undertakings or agreements of confidentiality been sought?

Where the disclosure is outside of Victoria, have appropriate privacy protection measures been attended to in accordance with obligations under IPP 9 (Transborder Data Flows)? Case Study 2M illustrates the points organisations need to consider when seeking to rely on IPP 2.1(c).

The PDP Act facilitates the conduct of research in a number of ways which are not limited to the use and disclosure ground in IPP 2.1(c). Organisations should consider these alternatives before disclosing personal information to researchers or conducting research themselves. These include:

• using de-identified data;
• where the research is related to the organisation’s functions or activities and is reasonably expected, organisations can rely on IPP 2.1(a) to make first contact with prospective participants on the behalf of the researcher. For example, a school may initiate contact with students and their families about education-related research. Here, the public interest in privacy and the public interest in research are balanced, by the organisation maintaining control over the information it holds and only disclosing identifiable details after consent has been obtained by those individuals wishing to participate in the research;
• relying on the valid consent of an individual for the future use or disclosure for research or statistical work obtained when the personal information is collected (under IPP 2.1(b));
• the disclosure is necessary to lessen or prevent a serious threat to public health, safety or welfare under IPP 2.1(d); and
• where the disclosure is required and authorised by law and IPP 2.1(f) applies. For example, s 34 of the Electoral Act 2002 (Vic) expressly authorises disclosure of enrolment information in the public interest after consultation with the Information Commissioner.

Where it is impracticable to seek consent before the research subject’s personal information is used, organisations may still notify the person after the use or disclosure. Notification is distinct from consent, but it does provide individuals with an opportunity to withdraw from further participation in the research study. This is consistent with ethical research standards supporting revocation of consent.

IPP 2.1(d) allows use or disclosure to occur where the organisation reasonably believes it is necessary to lessen or prevent:

• a serious threat to an individual’s life, health, safety or welfare; or
• a serious threat to public health, public safety or public welfare.

This section requires two things of organisations which seek to rely on this exception for the use and disclosure of personal information. An organisation must form a reasonable belief there is a serious threat and it must believe the use or disclosure is necessary to lessen or prevent the threat. What an organisation believes on reasonable grounds ‘is very much a matter to be decided on the evidence of each case’.⁵¹To decide whether there are reasonable grounds for belief, organisations should consider the source and reliability of the information that indicates the threat and the seriousness of the indicated threat.⁵²

Legislative reforms in 2017 removed the word ‘imminent’ from IPP 2.1(d)(i). These reforms are discussed below under the heading ‘Removal of the word ‘imminent’’.

For IPP 2.1(d) to permit use or disclosure for a secondary purpose, the organisation must reasonably believe that the disclosure is necessary to lessen or prevent a serious and imminent threat to an individual’s life, health, safety or welfare. This means the belief is not a wholly subjective matter. There must be circumstances in which it is reasonable for the organisation to form the belief. Whether a belief is reasonable is to be determined at the time of disclosure. Later circumstances cannot be relied on to make a belief reasonable.⁵⁵

It is not enough for an organisation to form a reasonable belief there is a serious threat. IPP 2.1(d) also requires the organisation believe it is necessary to disclose information to lessen or prevent the threat. ‘Necessary’ in this context has been interpreted as ‘that which is … needed; essential; indispensable; that must be done’.⁵⁹

In determining whether a use or disclosure might be regarded as necessary, organisations should consider:

• Is the use or disclosure motivated by an intention to lessen or prevent the threatened harm?
• Is the information being used or disclosed relevant to managing that threat?
• Where information is disclosed, is the recipient in a position to act on the information to lessen or prevent the harm from eventuating?

IPP 2.1(d) does not specify who can use the information or to whom it may be disclosed. In most cases, the recipient would need to be an appropriate agency in a position to lessen or prevent the particular threat. For example, and depending on the circumstances, appropriate recipients would be the police, emergency services or health authorities.

Whether or not a threat can be considered ‘serious’ for the purposes of the PDP Act should take into account what a reasonable person would regard as ‘serious’. In making an assessment as to whether a threat is ‘serious’, organisations should consider the following factors:

• Severity – How significant are the consequences of the threat?
• Likelihood – What is the chance of the threat actually happening? What is the relative likelihood that harm will occur?

Serious has been used, in the context of IPP 2.1(d), in the sense of being ‘important’ or ‘grave’.⁶¹

There are a range of circumstances that may impact upon the seriousness of a threat. It may not be clear in all situations whether a threat is likely to ever happen or how severe the consequences might be for an affected individual. In these cases, organisations may wish to look at secondary factors applicable to the particular situation in making an assessment as to the severity and likelihood of the threat. These factors may include, but are not limited to:

• Timing – How soon is the threat likely to occur? Is the threat ongoing?
• Nature of the harm – What is the level of perceived harm to the individual? What type of harm is likely to result (for example, physical, mental, financial)?
• Vulnerability – Considering the circumstances, how vulnerable might the affected individual be to the threat (for example, is the victim a child?)

These secondary factors may not be relevant in every case, but in some situations, may assist in making an assessment as to whether a threat is ‘serious’. Seriousness should be determined on a case by case basis, as the circumstances surrounding a threat will differ.

Legislative reforms in 2017 removed the word ‘imminent’ from IPP 2.1(d)(i). Previously, organisations could only rely on this exception to disclose information in response to a threat that was imminent. While the legislative change in Victoria came about in the context of family violence prevention, the removal of ‘imminent’ has a broader application. The removal of ‘imminent’ means organisations need only establish a threat is serious, and that disclosure is necessary to lessen or prevent that threat is necessary, before relying on IPP 2.1(d)(i) to use and disclose personal information.⁶³ Case Study 2O illustrates the effect of this change.

Public sector employees may come across information in their private capacity that leads them to believe or suspect someone poses a serious risk to an individual’s or the public’s health, safety or welfare. Public sector employees may be tempted to use their privileged access to official information (such as criminal records or child protection files) to confirm their suspicions and decide to use or disclose the information in their private capacity. This situation may create difficulties for an organisation which has a function to protect the community from threats of harm but also has obligations to prevent sensitive information it holds from being used or disclose in an unauthorised manner. Organisations should balance all relevant interests including the protection of a well-meaning staff member from later accusations of wrongful use of databases.

Factors relevant to determining whether the official’s use or disclosure is necessary to lessen or prevent a serious harm might include:

• the reliability of the information obtained in the official’s private capacity;
• the seriousness of the potential harms;
• the degree of vulnerability of the potential victims (including whether they are in a position to recognise the threat themselves); and
• the involvement of an appropriate authorised person.

Where there is a serious threat to public health or safety, for example, an infectious disease or large-scale evacuation, significant amounts of personal information could be required. Additionally, threats to health, safety or welfare in this context will generally require a fast and appropriate response from the organisation. Steps to ensure limited disclosure consistent with the circumstances should be developed by organisations prior to an emergency situation.

Organisations are advised to have and communicate a policy that covers the use and disclosure of personal information in the event of an emergency, so organisations can quickly and confidently handle a request for personal information.

IPP 2.1(d) may also be relevant to information uses and disclosures after a disaster or accident has occurred to assist emergency services, for example, in locating victims and reuniting them with their family, ensuring victims receive medical attention and ensuring they have the opportunity to take advantage of various other forms of support (such as financial assistance and counselling). Such disclosures are likely to be permitted under IPP 2.1(d) as lessening or preventing serious harm to public welfare.

‘Public welfare’ in this context includes offering assistance to victims to assist the community more generally to overcome the effects of disasters and other trauma. It is legitimate for authorities to try to reach victims to offer support, however, authorities must also be aware not everyone responds to offers of support in the same way. Disaster victims can always decline offers of support made by or on behalf of government agencies and their wishes for no further contact should be respected.

Where an organisation has reason to suspect that unlawful activity has been, is being, or may be, engaged in, IPP 2.1(e) allows personal information to be used or disclosed:

• as a necessary part of the organisation’s investigation of the matter; or
• in reporting the organisation’s concerns to relevant persons or authorities.

This ground for use and disclosure should not be used lightly as it has serious privacy implications. It should not be used for speculative monitoring, surveillance or intelligence gathering. There must be a reasonable basis for suspecting unlawful activity. However, it is not necessary that unlawful activity has in fact occurred; even if the organisation’s suspicion eventually turns out to be unwarranted, disclosure will still have been authorised if the circumstances described in IPP 2.1(e) are met.⁶⁵

The activity being investigated must be unlawful, not simply unethical or objectionable. Suspected breaches of the criminal law would fall within the meaning of ‘unlawful activity’. However, ‘unlawful’ should not be interpreted as limited to criminal activity. It can also include activity contrary to civil law and rules.⁶⁷

Misconduct by public sector employees may also be considered unlawful if it contravenes a statutory prohibition, such as a secrecy obligation. For example, IPP 2.1(e) may be relied upon to enable a department to investigate and report misconduct concerns to human resources in relation to workplace discrimination or harassment, because there are statutory prohibitions against this behaviour.

Misconduct may also be considered unlawful if it involves conduct that may result in the imposition of a penalty or other sanction, such as the types of misconduct set out in the Public Administration Act 2004 (Vic).⁶⁹ See Case Study 2P for more information.

In Kudleck v Victoria University (Human Rights) [2013] VCAT 1971 (see Case Study 2D above), VCAT found ‘unlawful activity’ does not include activities that may constitute disciplinary offences created through regulations made under Part 5 of the Victoria University Act 2010 (Vic). This was because a regulation made under that Act is not a statutory rule under the Subordinate Legislation Act 1994 (Vic) nor a subordinate instrument for the purposes of s 32 of the Interpretation of Legislation Act 1984 (Vic). Therefore, VCAT found IPP 2.1(e) did not authorise the use or disclosure by Victoria University.

When an organisation proposes to use or disclose personal information to investigate suspected unlawful activity, the organisation should be aware that:

• any suspicion of wrongdoing should be based on reasonable grounds, not unsubstantiated gossip or rumour;
• the use or disclosure must be considered necessary after due consideration of alternatives; and
• the use or disclosure should be as confined as possible throughout the organisation’s investigation, both in terms of the number of individuals whose information is involved and the number of people who are given access to the information.

Personal information may be used or disclosed at any point during an investigation into unlawful activity or serious misconduct. See Case Study 2P above, concerning Complainant I v Department [2004] VPrivCmr 4.

Any organisation to which the PDP Act applies may investigate suspected unlawful activity or refer its concerns to a relevant person or authority (disclosing the information).⁷³ Investigations or reporting of concerns under IPP 2.1(e) are not limited to criminal investigations of law enforcement agencies. For example, in McLean v Racing Victoria Ltd [2019] VSC 690, Victoria Police was permitted to disclose personal information to Racing Victoria because Victoria Police had reason to suspect unlawful activity had been engaged in, and the disclosure to Racing Victoria was ‘reporting its concerns to the relevant persons or authorities’, as under IPP 2.1(e).

When an organisation decides to report suspected unlawful activity, such use or disclosure should be limited to the persons or authorities with a need to know the information because they have relevant duties to perform in the circumstances. Examples include law enforcement organisations, an organisation responsible for the protection of public revenue, such as the State Revenue Office, or regulatory authorities such as the Food Safety Council.

Any organisation wishing to use or disclose an individual’s personal information under IPP 2.1 should consider if it has taken reasonable steps to provide the individual with notice as required under IPP 1.3. Disclosures under IPP 2.1(e) are no exception. Relevant factors for consideration include:

• the source of the information – consider whether the information has been obtained from a suspect, a victim or witness; and
• the nature of the unlawful activity – whilst the activity must be ‘unlawful’ (rather than simply objectionable or unethical, as discussed above), this will capture a broad range misconduct, some more serious or ‘sensitive’ than others.

The reasonableness of providing notice of a disclosure under IPP 2.1(e) needs to be determined on a case by case basis. It would be unreasonable to provide notice of an IPP 2.1(e) to a suspect. It may be reasonable to provide notice of an IPP 2.1(e) to a victim of an unlawful activity that is particularly ‘sensitive’, for example, sexual assault.

IPP 2.1(f) allows personal information to be used or disclosed for a purpose other than the primary purpose if such use or disclosure is required or authorised by or under law.

‘Required by law’ means there is a legal obligation to use or disclose personal information in a particular way.⁷⁵ Words such as ‘must’ or ‘shall’ will indicate a requirement and may be accompanied by the presence of a sanction for non-compliance. ‘Requires’ includes demands or necessities and extends to warrants, court orders and statutory provisions.⁷⁶ One type of statutory provision that is often relevant to IPP 2.1(f) is the power to demand the production of documents or information.

In Dodd v Department of Education and Training,⁸¹ VCAT found the Department’s disclosure of two documents to the Victorian Institute of Teaching (VIT) fell within IPP 2.1(f). The documents consisted of Mr Dodd’s exchange of letters with a teacher about the veracity of her evidence before a disciplinary hearing held by the Department in relation to the conduct of another teacher. VCAT found the disclosure was in accordance with s 27(2) of the Institute of Teaching Act 2001 (Vic) which requires the Department to provide the VIT with any information the VIT might reasonably require to conduct its enquiry. The Department was acting under a mandatory duty to provide the information.

The phrase ‘authorised by law’ refers to a law which permits the use or disclosure but does not make it compulsory.⁸³ Words such as ‘may’ are indicative of this. An authorising power must be reasonably specific; a general power or function for ‘anything incidental’ would be insufficient.

Authorisation under law need not be confined to a specific statutory duty under an Act but may extend to other common law duties or authorities for disclosure.

Section 16(2) of the Freedom of Information Act 1982 (Vic) (FOI Act) authorises organisations to make information (including documents that might otherwise be exempt under the FOI Act) available to the public informally, without requiring individuals to lodge a formal written request for access under the FOI Act, where the organisation can properly do so or is required by law to do so. This procedure for publishing or disclosing documents outside of the FOI Act is sometimes referred to as ‘administrative release’.⁸⁷

Section 16(2) of the FOI Act only authorises disclosure where organisations can ‘properly do so’ or are required by law to do so. It would not be ‘proper’ to give access under s 16(2) of the FOI Act where this would involve an unreasonable impact on the personal privacy of an individual or breach of some other legal obligation. Organisations should also consider whether it would be proper to release information having regard to:

• any relevant duties of confidentiality or statutory secrecy requirements; and
• existing legal obligations under the PDP Act not to disclose personal information about any person for a purpose other than the primary purpose of collection unless the disclosure is in accordance with IPP 2.1(a)-(h).

In some cases, the legislative authority behind the information request or demand may be conditional or limited in some way. For example, the legislation may require an investigation to be formally established before a demand for information can be issued to obtain information to assist in that investigation.

When disclosing information, it is important to disclose only information that is required by the request. There might be circumstances where information is privileged and therefore may not be disclosed. If required seek additional information from the requestor about the information being sought and the authority or requirement under legislation to collect the information, to ensure that the disclosure includes only what information is required under the request.

IPP 2.1(g) allows an organisation to use or disclose personal information where the organisation reasonably believes the use or disclosure is reasonably necessary for any of five specified purposes undertaken by or on behalf of a law enforcement agency. Under IPP 2.1(g), organisations may share information; it is not mandatory. Some organisations prefer to share certain information only in response to subpoena, warrant, court order or equivalent request for information.

The five specified purposes are:

• the prevention, detection, investigation, prosecution or punishment of criminal offences or breaches of a law imposing a penalty or sanction;
• the enforcement of laws relating to the confiscation of the proceeds of crime;
• the protection of the public revenue;
• the prevention, detection, investigation or remedying of seriously improper conduct; or
• the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of the orders of a court or tribunal.

If an organisation uses or discloses personal information to assist law enforcement agencies for any of the above purposes, IPP 2.2 requires the organisation to make a written record of that use or disclosure. Refer to IPP 2.2 below for further information.

IPP 2.1(g) authorises disclosure to law enforcement agencies. ‘Law enforcement agency’ is defined in s 3 of the PDP Act. The definition specifically includes state and federal police, crime commissions and examiners, the Business Licensing Authority and the Special Investigations Monitor. The definition also includes agencies involved in the prevention and detection of crime, the release of persons from custody, the execution of warrants, the provision of correctional services, the management and seizure of property under confiscation laws and the protection of public revenue. Many Victorian government departments and agencies have some law enforcement functions.

IPP 2.1(g) also authorises disclosure to persons who carry out any of the five functions (listed above) on behalf of a law enforcement agency. For example, this includes lawyers preparing matters for trial. The Explanatory Memorandum of the PDP Act says IPP 2.1(g) and (h) are intended to give latitude to organisations disclosing personal information to law enforcement agencies.

Organisations are not prevented by the PDP Act from cooperating with law enforcement agencies. IPP 2.1(g) expressly authorises organisations to assist law enforcement agencies by providing information relevant to law enforcement functions. However, IPP 2.1(g) requires organisations to make a judgement about whether the use or disclosure is reasonably necessary in the circumstances. The tests of ‘reasonable belief’ and ‘reasonable necessity’ must be satisfied.

In Zeqaj v Victoria Police,⁸⁹ VCAT held Victoria Police did not have reasonable belief the disclosure was reasonably necessary because they had not considered whether departure from the IPPs was reasonably necessary. VCAT required evidence of this reasonable belief being formed for IPP 2.1(g) to authorise the use of the personal information.

Organisations must ‘reasonably believe’ it is ‘reasonably necessary’ to disclose the information for one of the specified purposes in IPP 2.1(g)(i)-(v). IPP 2.1(g) requires the organisations to make a judgement in the circumstances as to whether the use or disclosure is necessary.

The organisation should also take steps to satisfy itself the use and disclosure is reasonably necessary for the specific law enforcement function. However, these steps do not need to be extensive. In determining when it is reasonably necessary to disclose, the Explanatory Memorandum to the PDP Act suggests: ⁹¹

Minimal information about the purpose of collection by the law enforcement agency would usually be enough to establish that the disclosure was ‘reasonably necessary.’

Further information on assessing a request is provided under the heading ‘Assessing a request for information for a law enforcement function’.

In some cases, organisations may determine it is inappropriate to release the information under IPP 2.1(g). This may be because they have not been persuaded the information is necessary for one of the authorised purposes. Or the organisation may determine that, due to the sensitivity or volume of information requested, it would be more appropriate to withhold the information until and unless a warrant or other legal authority is produced.

Any use or disclosure of personal information under IPP 2.1(g) must be noted by the organisation in writing (see IPP 2.2).

Although the range of authorised recipients is broad, the authority to disclose under IPP 2.1(g) is limited. Use or disclosure must be tied to one of the five specified purposes, explained in more detail below.

IPP 2.1(g)(i) allows information to be used or disclosed for the purpose of prevention, detection, investigation, prosecution or punishment of criminal offences or breaches of a law imposing a penalty or sanction.

A criminal offence is an act or practice that is prohibited by criminal law at Commonwealth, State or Territory level. ‘Penalty’ generally refers to a punishment, including a fine or monetary payment. ‘Sanction’ generally refers to some other legal requirement, order or action used to punish non-compliance with a law. Common sanctions include revocation of a licence, withdrawal of a benefit or disciplinary actions such as suspension or dismissal.

In Complainant AB v Victoria Police,⁹³ fingerprints from applicants for firearms licences, such as the Complainant, were stored on the national fingerprints database and routinely compared to those found at crime scenes across Australia. The Privacy Commissioner decided that police can use the personal information of firearms licence holders for the investigation of criminal offences.

Laws relating to the confiscation of the proceeds of crime include the Confiscation Act 1997 (Vic) and comparable laws in other States, Territories and the Commonwealth. These laws allow for the seizure and confiscation of property and other proceeds derived from the commission of criminal offences.

In Victoria, the law which relates to the confiscation of the proceeds of crime is the Confiscation Act 1997. Asset Confiscation Operations is the business unit within the Department of Justice and Community Safety responsible for the confiscation and disposal of property connected to crime. The seizure and sale of personal goods or belongings derived from the commission of criminal offences is the responsibility of Victoria Police.

‘Public revenue’ refers to regular payments to Commonwealth, State, Territory and Local Governments, such as taxes (including excise and duties), levies, rates, application fees and charges. The term may not encompass fines enforcement, as fines are not regular payments made to a government agency. However, as discussed below, IPP 2.1(g)(v) may be a basis for use and disclosure in the fines enforcement context.

‘Seriously improper’ is not defined in legislation. Instead, it can be interpreted as a higher standard of misconduct proportionate and reasonable in the circumstances. ‘Seriously improper conduct’ may include serious breaches of standards of conduct associated with a person’s duties, powers, authority and responsibilities. It includes corruption, abuse of power, dereliction of duty, and breach of obligation which warrant enforcement action from an enforcement body.

Activities or behaviours which constitute misconduct are sometimes set out in statutes that apply to specific organisations or the public service as a whole. For example, s 22 of the Public Administration Act 2004 (Vic) lists the types of activities that are regarded as ‘misconduct’ by public sector employees. This includes contravention of a binding code of conduct or use of position for personal gain.

A number of statutory agencies exist to investigate allegations of serious misconduct, particularly where they concern individuals engaged in regulated professions such as teachers, lawyers and health professionals.

Use and disclosure under this heading would include proceedings in the courts and tribunals of Victoria, other States and Territories and the Commonwealth.

Uses and disclosures of personal information to a law enforcement agency that is empowered to implement the orders of a court or tribunal need a clear link to the order that is being enforced. Any disclosure should be limited in scope to what is necessary and relevant in each case. This ground should not be used as a basis for the bulk release of information about individuals who are not subject to the orders which are being enforced.

A record of a reasonable belief the disclosure is reasonably necessary should comply with the requirements of IPP 2.2.

IPP 2.1(h) allows an organisation to disclose information to officers of the Australian Security Intelligence Organisation (ASIO) and the Australian Secret Intelligence Service (ASIS) where the agency has requested the information in connection with its functions and:

• the disclosure is made to an ASIO or ASIS officer or employee who is authorised in writing by the Director-General of ASIO or ASIS to receive the information; and
• the Director-General of ASIO or ASIS has also certified in writing that the disclosure would be connected with the performance by ASIO or ASIS of its functions.

Organisations complying with requests from ASIO or ASIS may wish to consider keeping a record of the disclosure in case the disclosure is queried, but this is not a requirement of the PDP Act.

When dealing with a request for information or documents under IPPs 2.1(f)-(h), organisations make sure the request is legitimate, and the requester is authorised to act on behalf of the organisation that has the power to demand access to the information. This may entail verifying the identity and authority of the person making the request, for example, by requiring a verbal or preferably written confirmation from a more senior officer in the organisation. The requester should also be able to provide a specific reference to their legislative authority, for example, by stating the section in the relevant Act they are relying on to authorise or demand the information being sought.

Organisations are not authorised by IPP 2.1(g) to simply hand over information on request. IPP 2.1(g) requires the organisation to make a judgement about whether the use or disclosure is reasonably necessary in the circumstances. See Dodd v Department of Education and Training (General) [2005] VCAT 2207, where VCAT noted a Department may need to give more consideration to relevance when exercising a discretion to release information under IPP 2.1(g) than it might when responding to a compulsory demand for information under IPP 2.1(f):

When assessing whether to disclose information to a law enforcement agency, the organisation can take the following steps to assess whether the request is properly made.

• Consider if the information is to be released to an authorised member of a ‘law enforcement agency’ (as defined in s 3 of the PDP Act). Has the member’s identity and authority to make the request been verified?
• Consider if the information is relevant to one of the five purposes specified in IPP 2.1(g)? Has this use been confirmed by the law enforcement agency? What information has been provided to verify the information is to be used for the stated purpose?
• Contact the law enforcement agency to verify the request and to establish what information is being requested, so only the required information is provided to prevent making an excessive disclosure. Irrelevant third-party information should be redacted.
• Discussing the decision to disclose information with the appropriate staff within your organisation, for example, the legal department.
• Ensuring the information related to making the decision and related correspondence is stored appropriately. Refer to IPP 2.2.

IPP 2.2 states a written note must be made of any use or disclosure made under IPP 2.1(g) to a law enforcement agency. It does not specify what should be included in the note, but the note should include information that can assist in establishing the rationale and circumstances of the disclosure, so that if this information is requested in the future, it can be retrieved and provided.

The note should specify at least the following information:

• the personal information used or disclosed, with a copy of any material supplied;
• a copy of the request for the information;
• the law enforcement agency or agencies and their representatives’ names and the date that information was provided;
• the basis of the reasonable belief that the use or disclosure was reasonably necessary, taking care not to prejudice any investigation or proceeding including any supporting documentation used in making the decision to disclose the information; and
• the name and title of the decision-maker.

This information should be stored securely, especially if the information is sensitive, in accordance with IPP 4.1.

In the PDP Act there is only a requirement to record a note if a use or disclosure is made under IPP 2.1(g), which is stated in IPP 2.2. However, decisions or queries may be made in relation to any use or disclosure under IPPs 2.1(e)-(h). Therefore, it is recommended any decision to use or disclose information under IPPs 2.1(e)-(h) be recorded, including the reasons for the decision made. For more guidance, refer to IPP 2.2, above.