New obligations for indirect information collection

• the fact that the information has been collected
• the purpose of the collection of that information
• the intended recipients of the information
• the name and address of the agency that is collecting the information and the name of the agency that holds it
• whether the collection is authorised or required by law and, if so, which law
• the individual’s rights to access and correct their information.

In practice, IPP3, IPP3A and Rule 3A work together so that where you obtain a customer’s personal or health information, you must ensure the customer is provided with the same disclosure regardless of whether you obtained the information directly from the customer or from somewhere else.

Exceptions to the duty to disclose

Although notification of the above information is the default position, there are some exceptions to the rule.

The main exception to the duty to disclose under IPP3A and Rule 3A is that the customer has already been notified. If the original collector of the information has told the customer that their information would be provided to your organisation – specifically naming your organisation and describing the information to be provided – the customer does not need to be notified again.

Other examples of key exceptions include:

• A serious threat to public health or safety. Where immediate action is needed (for example, to contain a contagious disease), notification can be delayed or omitted if telling the individual would cause a serious threat to public health or safety, or to another individual’s health or safety.
• Notification is not reasonably practicable. In some high‑volume, low‑risk indirect collections where contact details are not held and collecting them would be disproportionate, notification may not be reasonably practicable. However, the fact that notification is inconvenient, expensive, or administratively burdensome is not sufficient to make it an exception.
• Non-compliance will not prejudice the individual. If the individual will not be prejudiced or suffer any detriment, the organisation can avoid notification. However, the expectation is that if an agency considers it likely that an individual would be surprised by the indirect collection, this exception should not be relied upon.
• Research, statistics or other non‑identifying use. If the information will not be used in an identifiable form, or will be used only for research or statistical purposes and will not be published in a form that could reasonably be expected to identify the individual, notification may not be required.

Practical steps

Compliance with IPP3A is largely about integrating indirect‑collection transparency into your existing frameworks and documentation. Consider implementing the following:

• Conduct a data mapping exercise to identify indirect sources of personal or health information, including referrals, discharge summaries, multidisciplinary meetings, care‑coordination platforms, outsourced vendors, registries, insurers, ACC and public sources.
• Embed advance notices in your procedures. That means updating patient onboarding materials, admission packs, privacy statements and website pages to cover routine indirect collection and naming common source agencies and downstream recipients where practicable.
• Require referring agencies to notify individuals on your behalf by naming your organisation and covering the IPP3A items in your referral forms and service agreements. Alternatively, agree which party will notify at which point.
• Train your clinical and administrative teams to ensure that everyone can recognise indirect collection, apply exceptions correctly and trigger notifications or confirm prior notice.

If you rely on a third party to notify individuals of the matters required under IPP3A on your organisation’s behalf, the privacy commissioner expects you to be able to evidence that reliance or belief. This may include, for example, addressing notification obligations expressly in your contractual arrangements. However, responsibility for complying with IPP3A ultimately remains with the indirect collector, so it is important to retain copies of any agreements under which another party is responsible for providing that notification. You should also aim to avoid these common pitfalls:

• Don’t assume that indirect collection is covered by your existing IPP3 notices without naming the indirect collector – patients should be able to identify who has their information.
• Don’t automatically treat a third‑party processor as an independent indirect collector or vice versa – they may be considered to be acting on your behalf and so you will be the party required to provide disclosure.
• If you intend to rely on the exception that the customer was already made aware, ensure you have evidence to support that, particularly if you rely on upstream notices.

Conclusion

IPP3A and Rule 3A are significant developments for the healthcare sector. They effectively require organisations to ensure their customers are aware of all of the personal or health information held about them, no matter where it came from. In a sector built on trust, those expectations are now firmly embedded in law.

The introduction of IPP3A and Rule 3A may not be the last change for a while. Later this year, amendments to the Australian Privacy Act 1988 will require certain organisations to disclose in their privacy policy where the entity has arranged for an automated system to use personal information to make a decision that could reasonably be expected to significantly affect an individual. Although New Zealand has not yet explicitly dealt with the use of automated decision making in our privacy legislation, it is likely that we may need to adopt similar provisions in the near future.

If you have any questions about IPP3A or Rule 3A, or about your privacy obligations, please contact [email protected] or [email protected].