Guidance: Transborder Disclosure Principle - section 19(2)

This Fact Sheet is prepared under s 36(b) of the Privacy and Personal Information Protection Act 1998 (PPIP Act) which provides the Privacy Commissioner with a general function "to prepare and publish guidelines relating to the protection of personal information and other privacy matters, and to promote the adoption of such guidelines".

The PPIP Act s 19(2) sets out requirements when agencies are disclosing non-health ‘personal information’ to a recipient who is a Commonwealth agency, or who is outside the NSW jurisdiction.[1]

Transborder rules

Any disclosure must first meet the applicable standard disclosure rule (or an exemption to that rule); and then, if the disclosure is going to a recipient who is outside the NSW jurisdiction (or to a Commonwealth agency within NSW), it must also meet the additional criteria set under the applicable transborder rule (or an exemption to that rule).

The standard disclosure and transborder rules differ, depending on the type of 'personal information' at issue. The inter-relationship between the different disclosure rules is outlined in the table below:

What does the transborder principle require?

Section 19(2) provides a number of grounds under which a transborder disclosure can be made. The full text of
s 19(2) is in Attachment A.

The Privacy Commissioner does not determine which other jurisdictions might be considered to offer "a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the information protection principles."

The rationale for this decision is that if there is a similar privacy law in another jurisdiction, the recipient may not be bound to comply with that law due to specific exemptions. Recipients might decide to later opt out of a self­ regulatory binding scheme. Further, judgments as to the adequacy of privacy rules applying to another organisation can be subject to disagreement from the courts.[5]

Agencies must make their own enquiries on a case-by-case basis, and where necessary seek legal advice.

The Privacy Commissioner urges caution when seeking to rely on this provision.

Consent cannot be a condition of receiving a good or service from an agency. If a person has no practical alternative but to provide certain information in order to receive a service, an agency should not suggest they are seeking the person's consent.[6] In these circumstances the agency must still be open about how it will handle a person's information by notifying the person about relevant matters when it collects their information (s 10 of the PPIP Act).

Express consent means consent that is clearly and unmistakably communicated.[7] It must be "precise as to the kind and, possibly, the exact contents of the information to which the consent relates".[8]

This provision requires the subject of the information to expressly consent to the disclosure being made to a recipient in a jurisdiction outside NSW. This is distinct from any consent obtained to make the disclosure in the first place (e.g. in order to comply with s 18). This would likely require the individual to first be warned that the recipient is outside the NSW jurisdiction, and might not be bound by privacy principles that could be enforced by the individual.

Even if the subject individual has entered into a contract with the agency which necessitates disclosure to a recipient who is outside the NSW jurisdiction, notice to the individual should have been provided under s 10 of the PPIP Act, prior to entering the contract, that such a disclosure is likely to take place.

NCAT has found that ‘impracticable’ means “impossible in practice”.[9]

The fact that seeking consent is inconvenient or would involve some effort or expense is not of itself sufficient to warrant it 'impracticable'.

Some examples of where it might be impracticable to seek consent include if:

• the subject is deceased, or
• the age and / or volume of the information is such that it would be very difficult or even impossible to track down all the individuals involved, or
• there are no current contact details for the individuals in question and there is insufficient information to get up-to-date contact details.[10]

This provision is to be narrowly construed, and only permitted in very limited circumstances.[11]

Any threat must be both 'serious' and 'imminent'. A 'serious' threat could include a potentially life-threatening situation, or one that might result in an illness or injury without timely decision or action.[12] 'Imminent' means "likely to occur at any moment; impending".[13]

The proposed disclosure must also be 'necessary' to prevent the threat from being realised. The decision should be based on whether the proposed disclosure will lead to the intended outcome, that is, whether disclosure will lessen or prevent a serious threat.[14]

Exactly what will constitute 'reasonable steps' will differ according to the nature of the personal information, the risk of harm to the individual if there is a breach, and the safeguards already offered by the recipient.

However, it is expected that at a minimum, this provision would require a public sector agency to enter into an enforceable contract with the recipient, with at least the following features:

• a requirement on the recipient to handle the personal information in accordance with the IPPs in relation to its collection, storage, use, disclosure and data retention
• a mechanism by which the public sector agency can enforce these terms against the recipient if necessary
• a mechanism for handling or referring privacy complaints
• a mechanism for handling data breaches, including notification to the agency, and
• a requirement on the recipient to bind any sub-contractors to the same terms.[15]

Additional steps that might be appropriate could include requiring the recipient to provide evidence to the agency of the way in which the recipient's personnel (and any sub-contractors) have been made aware of their privacy obligations, or the conduct of site visits or audits of the recipient's information handling practices.

This provision is similar in terms to the exemption found at s 25 of the PPIP Act If another NSW or Commonwealth statute, or the order of a court or tribunal such as a subpoena,[16] specifically requires or authorises  a disclosure  to take place, that other law  will override the  general prohibition  against disclosure in s 19(2).

As with most of the IPPs, there are numerous exemptions to s 19(2). These may be found elsewhere in the PPIP Act, in the PPIP Regulation, in Privacy Codes of Practice, or in temporary public interest directions made by the Privacy Commissioner.

Examples include the 'other law’ exemption at s 25 of the PPIP Act, and the research exemption at s 27B of the PPIP Act.

Note that there are some exemptions which relate only to s 18, or only to s 19(1), which will not assist in relation to s 19(2). Examples include the exemption relating to investigative agencies at s 24 of the PPIP Act, and the exemption relating to credit information at s 27C of the PPIP Act.

The transborder rule only applies to disclosure, not use. The provision of personal information to a contracted cloud data storage provider may be considered a 'use', rather than a 'disclosure', so long as certain conditions are met.

In a discussion about privacy responsibilities when considering the use of cloud computing, the NSW Government Cloud Policy states:

"The collection, storage, access, use and disclosure of personal information is governed by PP/PA and HR/PA. Where the use of cloud computing requires the transmission or storage of personal information, including health information, agencies must ensure that their arrangements comply with relevant privacy and disclosure requirements. ...

If an agency shares with or transfers personal information to a contracted cloud service provider and the cloud service provider simply holds the data and acts according to the instructions of the agency, then disclosure will not be considered to have occurred. If the cloud service provider uses the data provided for its own purposes, this may be unauthorised access, use, modification or disclosure".[17] (emphasis added)

A similar view has been expressed by the Australian Privacy Commissioner, in the context of the equivalent federal 'transborder disclosure' privacy principle.[18]

When in doubt about its ability to comply with any of the other criteria set out in s 19(2), a public sector agency seeking to disclose non-health personal information to a Commonwealth agency, or to a recipient who is outside the NSW jurisdiction, should follow s 19(2)(g), and take reasonable steps to ensure that the information that it plans to disclose will not be held, used or disclosed by the recipient of the information inconsistently with the information protection principles.

As noted above, the ‘reasonable steps’ would at least include contractual arrangements.

Disclaimer

This document is intended as a guide for public sector agencies regulated by the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIP Act), as to the Privacy Commissioner's views on the interpretation of sections 18 and 19.

This guide is not legally binding, and does not constitute legal advice. Agencies should also be guided by interpretations of the PPIP Act by the NSW Civil & Administrative Tribunal (NCAT) and higher courts, and by their own legal advice.

Am I intending to disclose information outside the NSW jurisdiction?

No

↓

Section 18 Limits on disclosure of personal information applies.

Yes

↓

Does an exemption under s 19(2) apply to allow disclosure of the personal information?

↓

[1] It is the location of the recipient, rather than where the disclosure occurs, that is the pertinent fact in determining whether this section applies; see Bevege v Commissioner of Police, NSW Police Force [2014] NSWCATAD 22.