Policies and Legislation

NSW and QLD legislation:

NSW Anatomy Act 1977

QLD Transplantation and Anatomy Act 1979

NSW Human Tissue Act 1983

Privacy and Personal Information Protection Act 1998 No 133 - NSW Legislation

Commission for Children and Young People Act 1998

State Records Act 1998

Health Records and Information Privacy Act 2002

Records relating to Tertiary education and research Note that while State Records NSW gives approval for the destruction of certain records after minimum retention periods have been met in this retention and disposal authority, it does not compel destruction of records. Public offices are responsible for determining whether there are business or other needs for retaining records beyond the minimum retention periods set out in this authority. 

 

Australian and international legislation:

Privacy Act 1988

Guidelines under Section 95 of the Privacy Act

Guidelines Approved under Section 95A of the Privacy Act

EU General Data Protection Regulation (GDPR) research implications

 

Navigating Privacy Legislation:

Disclaimer: Nothing in this section may be relied upon as legal advice. These comments are intended to explain how the Privacy Act applies to research generally; researchers must ascertain the status of their own research proposals with respect to Privacy legislation.

NEW: Try our Privacy Legislation checker - currently in beta, we'd love your feedback.

Research at SCU that intends to access and utilise existing data that is:

  • personal (ie. information that could identify an individual), and
  • originally compiled for a different purpose (eg. provision of a health service or course administration), and
  • is to be used in research without obtaining individual consent from the individuals whose data is being used,

is subject to The Privacy Act 1988 (Cth).

The Australian Privacy Principles (APP) especially APP 6, pertaining to the use or disclosure of personal information, are the most accessible way to understand how the act applies to research.

Medical research (including epidemiological studies) or research that uses health information:

Section 16(B) of the Privacy Act allows the use or disclosure of personal information without consent where a permitted health situation exists – one of which is conducting research or the compilation or analysis of statistics, relevant to public health or public safety. Illustrative examples of the phrase ‘relevant to public health or public safety’ include research relating to communicable diseases, cancer, heart disease, mental health, injury control and prevention, diabetes and the prevention of childhood diseases (see Office of the Australian Information Commissioner – OAIC – Privacy Guidance on Research for information about Health Research).

Guidelines approved under S95 and S95(A) of the Privacy Act 1988 set out the requirements for assessing whether disclosure of such information to researchers can be approved.

  • Guidelines under Section 95 of the Privacy Act 1988, sets out procedures that HRECs and researchers must follow when personal information is disclosed from a Commonwealth agency for medical research purposes.
  • Guidelines under Section 95A of the Privacy Act 1988, provides a framework for HRECs to assess proposals to handle health information held by organisations for health research (without individuals' consent). They ensure that the public interest in the research activities substantially outweighs the public interest in the protection of privacy. Flowchart determining whether the s95A guidelines apply

If research requires the use or disclosure of other kinds of identifiable information without individual consent, the exceptions that allow its use or disclosure for a secondary purpose are more restrictive. In the context of research, information held about individuals can be shared where:

  • individuals have consented to a secondary use or disclosure (e., research), or
  • individuals would reasonably expect their information to be used or disclosed, and
    • only where the secondary use is related to the primary purpose, or
    • in the case of sensitive information, only where the secondary use is directly related to the primary purpose (see APP 6).

If individual consent is not sought for the use of data in research, researchers must request a waiver of the usual requirements for consent (see National Statement 2.3 – especially the criteria listed at 2.3.10). Note that NS 2.3.10 i) states that the waiver must not be prohibited by State, federal, or international law.