Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697640516252.pdf (Australia)
Human Rights Commissioner Edward Santow 14 September 2018 Attention: Committee Secretary Senate Community Affairs Legislation Committee PO Box 6100 Parliament House Canberra ACT 2600 Dear Committee Inquiry — My Health Records Amendment (Strengthening Privacy) Bill 2018 I refer to the Committee’s current inquiry into the My Health Records Amendment (Strengthening Privacy) Bill 2018 (the Bill).

The Commission welcomes the opportunity to make this brief submission in relation to this inquiry.
This letter is addressed only to the Committee’s inquiry into the Bill.

It does not address the matters under consideration by the Senate Community Affairs References Committee in its separate inquiry into the My Health Records system.

The Commission welcomes the Bill and the improved privacy protections it would implement.

Subject to several comments below, the Commission recommends that the Bill be passed.
The My Health Record system The My Health Record system is ‘a system for making health information about a healthcare recipient available for the purposes of providing healthcare to the recipient’.1 It is established by the My Health Records Act 2012 (Cth) (the Act).
The stated object of the Act is: …to enable the establishment and operation of a voluntary national system for the provision of access to health information relating to recipients of healthcare, to: (a) (b) (c) help overcome the fragmentation of health information; and improve the availability and quality of health information; and reduce the occurrence of adverse medical events and the duplication of treatment; and Australian Human Rights Commission ABN 47 996 232 602 Level 3 175 Pitt Street Sydney NSW 2000 GPO Box 5218 Sydney NSW 2001 www.humanrights.gov.au General enquiries Complaints infoline TTY 1300 369 711 1300 656 419 1800 620 241 My Health Records Amendment (Strengthening Privacy) Bill 2018Submission 11 Australian Human Rights Commission Human Rights Commissioner Edward Santow (d) improve the coordination and quality of healthcare provided to healthcare recipients by different healthcare providers.2 The My Health Record system allows for the collection, use and disclosure of health information of people who are registered in it, for the purposes of the scheme.
The right to privacy The Right to privacy is a fundamental human right, protected by art 17 of the International Covenant on Civil and Political Rights (ICCPR).3 The United Nations High Commissioner for Human Rights has recently offered the following definition of privacy: Privacy can be considered as the presumption that individuals should have an area of autonomous development, interaction and liberty, a “private sphere” with or without interaction with others, free from State intervention and from excessive unsolicited intervention by other uninvited individuals….
In the digital environment, informational privacy, covering information that exists or can be derived about a person and her or his life and the decisions based on that information, is of particular importance.4 The right to privacy is an intrinsic good—it is valuable for its own sake.

However, it is also an instrumental good, serving as a necessary foundation for the protection of other rights: The right to privacy is central to the enjoyment and exercise of human rights online and offline.
It serves as one of the foundations of a democratic society and plays a key role for the realization of a broad spectrum of human rights, rights, ranging from freedom of expression and freedom of association and assembly to the prohibition of discrimination and more.5 Like the majority of human rights, the right to privacy may be subject to some permissible limitations, provided that those limits are not arbitrary.
In international law that means, among other things, that any legislation that limits the right to privacy must be necessary and proportionate to achieve a legitimate purpose.6 In general, personal information should only be collected, stored, processed and released with the ‘free, specific, informed and unambiguous consent of the individuals concerned’.7 At a minimum, the persons affected have a right to know that personal data has been retained and processed, to have access to the data stored, to rectify data that is inaccurate or outdated and to delete or rectify data unlawfully or unnecessarily stored.8 2 My Health Records Amendment (Strengthening Privacy) Bill 2018Submission 11 Australian Human Rights Commission Human Rights Commissioner Edward Santow Information about people’s health is a particularly private matter.
This is recognised in Australia; for instance, information about people’s health is classified as ‘sensitive information’ in the Privacy Act 1988 (Cth) (Privacy Act).9 Particular care is therefore required to ensure that intrusions into privacy in relation to people’s health are limited to necessary and appropriate circumstances.
Improving health care is a legitimate purpose which can justify the collection, use and disclosure of personal information, provided that those activities are carefully regulated and sufficient protections are in place.

Such uses can promote the right of affected people to the highest attainable standard of health.10 Collection, use and disclosure of health information under the Act The Act limits the ways in which health information held in the My Health Record system can be used.
Principally, that information can be used for the purposes of administering the My Health Record system.

The Act also currently allows health information held in the system to be released for a number of other purposes.
Relevantly for present purposes, health information held in the My Health Record system may be released:  where required or authorised by Commonwealth, State or Territory Law— s 65  where an order is made by a coroner—s 69(2)  where an order is made a court or tribunal (not being a coroner) in the course of proceedings relating to the Act, including proceedings relating to unauthorised use of information held in the My Health Record system— s 69(1)  where the disclosure is believed to be reasonably necessary for a range of activities of ‘law enforcement bodies’, including: (a) (b) (c) (d) (e) the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law; the enforcement of laws relating to the confiscation of the proceeds of crime; the protection of the public revenue; the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct; the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of the orders of a court or tribunal.
(s 70(1)) 3 My Health Records Amendment (Strengthening Privacy) Bill 2018Submission 11 Australian Human Rights Commission Human Rights Commissioner Edward Santow The Commission considers that the provisions summarised above are overly broad, in that they may allow for the disclosure of sensitive health information where that has not been shown to be strictly necessary in all the circumstance of each particular case.

The Bill The Bill would effect two key changes to the Act.
First, the Bill would amend s 17 to provide that, where a person requests that their My Health Record be cancelled, the System Operator of the My Health Record system will be required to destroy any record of health information held in the system (with the exception of some limited information to identify the former holder of the record).
The Commission considers that this proposed amendment better reflects the principle that people should be able to control how information about them is collected, used and disclosed.

The Commission notes that the Bill would not change the fact that the My Health Record system currently operates as an ‘opt-out’, rather than an ‘opt-in’, system.
As noted above, without appropriate justification, personal information should not be collected about people without their free, specific, informed and unambiguous consent.

The Explanatory Memorandum states that several reviews and trials were conducted before the decision was made to make the My Health Record system ‘opt-out’.11 The Commission is not aware whether the inputs to, or the findings of, those evaluation processes have been made publicly available.
The Commission urges the Government to consider whether compelling circumstances exist to justify continuing the operation of the My Health Record system on an ‘opt-out’, rather than an opt-in, basis.

In the meantime, the Commission considers that the proposed amendment to s 17 would significantly improve the protection of the right to privacy of Australians.

The Commission recommends that the proposed amendments to s 17 be passed.
Secondly, the Bill would alter the circumstances in which health information could be released under other statutes, or in relation to law enforcement activities, as follows:  Currently, the Act allows health information to be released where authorised under a Commonwealth, State or Territory Law.
The Bill would amend s 65 so that it only applies to disclosures made under the Act itself, 4 My Health Records Amendment (Strengthening Privacy) Bill 2018Submission 11 Australian Human Rights Commission Human Rights Commissioner Edward Santow under the Auditor-General Act 1997 (Cth), under the Ombudsman Act 1976 (Cth), or to the Information Commissioner for the purposes of performing functions in relation to the My Health Record system.
 The Bill would insert in the Act new provisions providing that, in general, Commonwealth agencies and State and Territory authorities can only obtain health information if they obtain an order under proposed s 69A.

Such an order would be made by an appropriately authorised judicial officer, acting in their personal capacity.
An order could only be made if: o the requesting agency has powers ‘to require persons to give information’ to it, or its officers are ordinarily authorised to execute warrants authorising entry and seizure—proposed s 69A(7) o the requesting agency has exercised or purported to exercise these powers o in all the circumstances, the particular information is reasonably necessary for the purposes of the requesting agency o the requesting agency has no other effective means of obtaining the relevant information o the issuing authority is satisfied that the disclosure of the information would not, on balance, unreasonably interfere with the privacy of the person whose information is to be released.
 The Bill would delete s 70(1)–(2) of the Act (the effect of which provisions is discussed above).

The Commission considers that restricting the scope of s 65 of the Act, the insertion of ss 69A and 69B (which are analogous to a warrant regime), and the deletion of s 70(1)–(2), would better protect the privacy of people whose health information is held in the My Health Record system.
In particular, these changes would better reflect the principle that personal information should only be released when that is shown to be necessary and proportionate to achieve a legitimate objective in all the circumstances of each particular case.
The Commission makes two further observations about these proposed amendments:  The Commission welcomes the proposed requirement that an issuing authority consider impacts on the human right to privacy before making an order under s 69A granting access to health information.

However, as noted above, the right to privacy is related to a number of other human rights.
The Commission urges the Government to consider amending proposed s 69A(6)(b) to require an issuing authority to consider the effect 5 My Health Records Amendment (Strengthening Privacy) Bill 2018Submission 11 Australian Human Rights Commission Human Rights Commissioner Edward Santow of any release of health information on other human rights, in addition to the right to privacy.
 Under proposed ss 69A(6)(a)(ii) and 69A(7)(a), an entity would be qualified to seek an order for disclosure of health information if it has power ‘to require persons to give information’ to it.

The Bill does not, however, expressly require that a requesting entity would (without the operation of s 69A(2)), have power to obtain information held in the My Health Record system.
Many agencies have the power to compel the production of limited categories of information that would not extend to information held in the My Health Record system.

The Commission recommends that proposed s 69A(7)(a) be amended to make it explicit that an order may only be made allowing disclosure of health information to an entity if that entity would, absent the operation of s 69A(2), have power to obtain information held in the My Health Record system.
The Commission welcomes the introduction of the Bill.

The provisions will better ensure that disclosures of sensitive information about people’s health are made only when that is shown to be necessary and proportionate.

In particular, the Bill will increase the extent to which the right to privacy must be considered before disclosures are made to government bodies.

Subject to the recommendations above, the Commission recommends that the Bill be passed.
Yours sincerely Edward Santow Human Rights Commissioner 1 My Health Records Act 2012 (Cth), s 4.

2 My Health Records Act 2012 (Cth), s 3.

3 International Covenant on Civil and Political Rights, opened for signature 16 December 1966, 999 UNTS 171 (entered into force 23 March 1976).

At http://www.ohchr.org/EN/ProfessionalInterest/Pages/CCPR.aspx (viewed 9 September 2018).
4 United Nations High Commissioner for Human Rights, The right to privacy in the digital age (Advance Edited Version) (3 August 2018), UN Doc A/HRC/39/29, at 6 My Health Records Amendment (Strengthening Privacy) Bill 2018Submission 11 Australian Human Rights Commission Human Rights Commissioner Edward Santow https://www.ohchr.org/EN/Issues/DigitalAge/Pages/ReportDigitalAge.aspx (viewed 9 September 2018), [5].
5 United Nations High Commissioner for Human Rights, The right to privacy in the digital age (Advance Edited Version) (3 August 2018), UN Doc A/HRC/39/29, at https://www.ohchr.org/EN/Issues/DigitalAge/Pages/ReportDigitalAge.aspx (viewed 9 September 2018), [11].
6 United Nations Economic and Social Council, Siracusa Principles on the Limitation and Derogation Provisions in the International Covenant on Civil and Political Rights, UN Doc E/CN.4/1985/4, Annex (1985) 7 United Nations High Commissioner for Human Rights, The right to privacy in the digital age (Advance Edited Version) (3 August 2018), UN Doc A/HRC/39/29, at https://www.ohchr.org/EN/Issues/DigitalAge/Pages/ReportDigitalAge.aspx (viewed 9 September 2018), [29].
8 United Nations High Commissioner for Human Rights, The right to privacy in the digital age (Advance Edited Version) (3 August 2018), UN Doc A/HRC/39/29, at https://www.ohchr.org/EN/Issues/DigitalAge/Pages/ReportDigitalAge.aspx (viewed 9 September 2018), [30].

9 Privacy Act 1988 (Cth), s 6.

10 Protected by art 12 of the International Covenant on Economic, Social and Cultural Rights, opened for signature 16 December 1966, 993 UNTS 3 (entered into force 3 January 1976).
11 Explanatory Memorandum to the My Health Record Amendment (Strengthening Privacy) Bill 2018, 1-2.

7 My Health Records Amendment (Strengthening Privacy) Bill 2018Submission 11