Document ID: chunk:federal_register_of_legislation:F2016L00360:reg:14:p7
Version: federal_register_of_legislation:F2016L00360
Segment Type: reg
Provision Reference: reg 14 (pt 7/16)
Character Range: 17516–20600

Act.
6.8  Upon completing an investigation under section 73 of the My Health Records Act, the Information Commissioner may take enforcement action under that Act. The Commissioner will consider the suitability of attempting by conciliation to effect a settlement of a matter under paragraph 73(3)(a) of the My Health Records Act before deciding to take enforcement action.
7 Enforcement action – general principles

  Factors taken into account
7.1  Factors the Information Commissioner may take into account in deciding whether to take enforcement action against a person in relation to the My Health Record system and what action to take, include the following:
           a)      the object of the My Health Records Act;
           b)     the objects of the Privacy Act;
           c)      whether the investigation was completed under the My Health Records Act or the Privacy Act;
           d)     the seriousness of the incident or conduct to be investigated, including:
                1. the number of persons potentially affected;
                2. whether the matter involves sensitive information (as defined in s 6 of the Privacy Act) or other information of a sensitive nature;
                3. the adverse consequences caused or likely to be caused to one or more persons arising from an incident or conduct;
                4. whether disadvantaged or vulnerable groups may have been or may be particularly adversely affected or targeted;
                5. whether conduct was deliberate or reckless;
                6. the seniority and level of experience of the person or persons responsible for the conduct;
           e)      the level of public interest or concern relating to the conduct (with enforcement action more likely to be taken where significant public interest or concern exists);
           f)       whether the burden on the individual or entity likely to arise from the enforcement action is justified by the risk posed to the protection of personal information;
           g)     the specific and general educational, deterrent or precedential value of the particular enforcement action, including whether pursuing court action (where applicable) would test or clarify the law;
           h)     whether the individual or entity responsible for the incident or conduct has been the subject of prior compliance or enforcement action in relation to the My Health Record system or by the Information Commissioner, and the outcome of that action;
           i)       the likelihood of the individual or entity contravening the My Health Records Act or Privacy Act in the future;
           j)       whether the conduct is an isolated instance, or whether it indicates a potential systemic issue (either with the individual or entity concerned or within an industry) or an increasing issue which may pose ongoing compliance or enforcement issues;
           k)     action taken by the individual or entity to remedy and address the consequences of the conduct, including whether the individual or entity attempted to conceal a contravention or data