The Privacy (Australian Bushfires Disaster) Emergency Declaration (No 1) 2020 came into force on 20 January 2020 in response to bushfires in Australia resulting in death, injury and property damage occurring from August 2019 into 2020. The Emergency Declaration will expire on 20 January 2021.
The Emergency Declaration was made under Part VIA of Privacy Act 1988 (Cth) (Privacy Act), and authorises agencies and organisations to handle personal information about individuals who they reasonably believe may be involved in the bushfire emergency (Emergency Provisions). This must be more than a subjective belief, and the agency or organisation must be able to justify its reasonable belief. Personal information collected, used and disclosed as a result of the Emergency Provisions can only be used for a permitted purpose that directly relates to the Commonwealth’s response to the bushfire disaster. Permitted purposes are defined in section 80H of the Privacy Act and include:
- identifying individuals who are, or may be, injured, missing or dead as a result of, or otherwise involved in, the emergency or disaster;
- assisting individuals in the emergency or disaster to obtain services, including repatriation, medical or other treatment, health services and financial or other humanitarian assistance;
- assisting law enforcement in relation to the emergency or disaster;
- coordination or management of the emergency or disaster; and
- ensuring that responsible persons for individuals who are, or may be, involved in the emergency or disaster are kept appropriately informed about matters that are relevant to those individuals, or the response to the emergency or disaster relating to those individuals.
Disclosure of personal information under the Emergency Provisions is limited to certain entities and individuals. The table below illustrates that there are differences as to who an agency and an organisation can disclose personal information to. As a general rule, agencies and organisations should limit the personal information they disclose to that which is necessary to meet an individual’s needs.
| Disclosure by an Australian Government agency under the Emergency Provisions may only be to: | Disclosure by an organisation under the Emergency Provisions is only permitted to: |
|
|
Entities who are subject to the Privacy Act and intend to rely on the Emergency Provisions should take particular note of the permitted purposes, as well as the limitations on how that personal information can be used and disclosed (depending on the type of entity). It is also worth noting that an entity’s obligations under the Privacy Act will continue to apply, including notice and information security requirements. Part VIA of the Privacy Act does not permit disclosure to media organisations. Any such disclosure must be made in accordance with Australian Privacy Principle 6.
This article was written by Hayley Bowman in consultation with Mark Fitzgerald. If you have any questions about the Bushfire Emergency Declaration, please contact Hayley Bowman.