2021 Review of the Privacy Act: Submission in Response to the Discussion Paper

This submission responds to the discussion paper for the 2021 Review of the Privacy Act 1988, focusing on proposals that affect how the Act accommodates research, a matter the paper did not address directly. Research Australia supports Proposal 1.1 to amend the Act’s objects to recognise that privacy protection is balanced against activities undertaken in the public interest. It cautions that defining ‘reasonably identifiable’ as ‘capable’ of being identified appears to set a stricter test than intended, and is wary that replacing de-identification with a higher anonymisation standard could restrict research access to datasets, noting emerging evidence that true anonymisation is rarely achievable. It maintains that release decisions should assess the full risk profile, both the likelihood and the consequences of reidentification and the safeguards in place, rather than likelihood alone. Research Australia recommends that the research implications of anonymisation be considered alongside drafting of the amendments, that an expert group redevelop the NHMRC privacy guidelines for research made under sections 95 and 95A in parallel, and that research use be explicitly considered in any regulatory impact statement. It recommends that the Government consult the research sector before reintroducing the Privacy Amendment (Re-identification Offence) Bill, including on inadvertent reidentification and encouraging its reporting. It supports a Commonwealth, state and territory working group to harmonise privacy laws, and asks that health information be included.