Privacy (Comcare Contestability Review) Temporary Public Interest Determination 2015
 
I, Timothy Pilgrim, Privacy Commissioner, make the following determination under subsection 80A(2) of the Privacy Act 1988 (Privacy Act).
Dated: 16 March 2015
Signed
 
 
 
Timothy Pilgrim
Privacy Commissioner
 
1  Name of determination
This determination is the Privacy (Comcare Contestability Review) Temporary Public Interest Determination 2015.
2  Commencement
This determination takes effect on the day of its registration on the Federal Register of Legislative Instruments maintained under section 20 of the Legislative Instruments Act 2003.
3  Expiry
This determination expires, as if it had been repealed by another instrument, on 22 May 2015 unless ceased earlier because of subsection 80D(2) of the Privacy Act.
4  Authority
This determination is made under subsection 80A(2) of the Privacy Act.
5  Definitions         
Terms defined in the Privacy Act have the same meanings in this determination.
6  Application for a public interest determination
(1)   Comcare (Applicant) has applied under section 73 of the Privacy Act for a public interest determination in relation to the acts and practices set out in section 7 below. 
(2)   The Applicant is an APP entity under subsection 6(1) of the Privacy Act because it is an agency as defined under subsection 6(1) of the Privacy Act.
7  Disclosure of personal information
(1)   The Applicant discloses the personal information contained in no more than 100 injured worker claims files (Claims Files) to professional services firm Ernst & Young for the purposes of the undertaking of a ‘Contestability Review’ of the Commonwealth’s insurable risk portfolio.
(2)   This disclosure breaches or may breach Australian Privacy Principle (APP) 6.1 in Schedule 1 of the Privacy Act
8  Public Interest
The public interest in the Applicant carrying out the acts and practices set out in section 7 above outweighs to a substantial degree the public interest in adhering to APP 6.1.
9  Temporary public interest determination
(1)   The Applicant’s application raises issues that require an urgent decision.
(2)   Accordingly, by operation of subsection 80B(1) of the Privacy Act the Applicant is taken not to breach section 15 of the Privacy Act if:
(a)   the Applicant engages in the acts and practices set out in subsection 7(1) above, and
(b)   the acts and practices are carried out in accordance with the conditions set out in subsection 3 below.
(3) This determination only applies where the acts and practices set out in section 7(1) are carried out in accordance with the following conditions:
(a)   before an Ernst & Young employee accesses the personal information contained in the Claims Files, that employee must have signed a written confidentiality undertaking in relation to the information
(b)   access to the Claims Files must only be given to a maximum of three Ernst & Young employees with a need to access the information for the purposes of the Contestability Review
(c)    Ernst & Young must not collect personal information about any individual referred to in a Claims File, other than that of the Applicant’s employees in the context of the performance of the employees’ duties, and
(d)   the Applicant must review and approve the content of the Ernst & Young report prior to its finalisation to ensure that no personal information, other than that of the Applicant’s employees is included in the report.