Speech by Professor Rosalind Croucher* at the Managing Patient Confidentiality & Information Governance Forum, 22 August 2011, Melbourne.

1. For Your Information: Australian Privacy Law and Practice – key recommendations for health information privacy reform Professor Rosalind Croucher President, ALRC 1

2. Time line 1982 – FOI Act (Cth) 1983 – Archives Act (Cth) 1988 – Privacy Act (Cth) 2000 – Privacy (Private Sector) 2

3. Time line 2004 – Privacy Commissioner review of private sector provisions 2005 – Senate Legal and Constitutional Affairs Committee inquiry into Privacy Act 2006 – Privacy Act amendments to include ‘genetic information’ 3

4. Time line 2006 – January referral to ALRC 2006 – COAG agrees to national approach 2008 – May, ALRC report 2009 – October, Government response 2009 – Dec, COAG agreement re e-health 4

5. Time line 2010 – Privacy Commissioner into Office of the Australian Information Commissioner 2010 – Health Identifiers Bill 2011 – June, Draft Australian Privacy Principles 5

6. 6

7. Terms of Reference the effectiveness of privacy laws in Australia given: rapid advances in information, communication, storage, surveillance and other technology possible changing community perceptions around privacy expansion of state & territory activity in this area

10. Spectrum 10

11. Secrecy obligations? 11

12. Federal interest in privacy 12

14. Part B – Developing Technology

15. Part C – Interaction, Inconsistency and Fragmentation

16. Part D – The Privacy Principles

17. Part E – Exemptions

18. Part F – Office of the Privacy Commissioner

19. Part G – Credit Reporting Provisions

20. Part H – Health Services and Research

21. Part I – Children, Young People and Adults Requiring Assistance

22. Part J – Telecommunications

23. Part K – Protecting a Right to Personal Privacy3 volumes, 74 chapters, 295 recommendations

24. Key Recommendations Rationalisation of the Privacy Principles Greater national harmonisation – same privacy principles to apply across Australia Fewer exemptions Greater enforcement powers for the OPC Mandatory data breach notification Cause of action for serious invasions of privacy

26. Ensuring that the Privacy Act is not an impediment to appropriate information sharing among health care professionals

27. What constitutes appropriate consent in particular contexts

30. State and territory privacy laws - not apply to private sector organisations

31. Major impact on health privacy legislation by excluding state and territory privacy laws applying to organisations - eg:

32. Health Records and Information Privacy Act 2002 (NSW)

33. Health Records Act 2001 (Vic)

35. Health Identifiers National shared system Underpinned by enabling legislation Build on Medicare infrastructure Consent of individual not required to assign UHI (unique healthcare identifier) 19

36. Health Identifiers Control use Subject to privacy principles Sanctions – criminal offences Purpose – sharing of healthcare info for management of patients 20

37. For information about ALRC work, copies of speeches and presentations ALRC website – all papers available online (free): www.alrc.gov.au Email: info@alrc.gov.au GPO Box 3708, Sydney 2001 21