Lemm Ex heads the Privacy Unit in the Queensland Office of the Information Commissioner and has been actively involved with Queensland’s privacy law since its inception in July 2009.
At the 2016 QCOSS State Conference, Lemm presented a session on good practice in privacy management in community-based organisations, covering topics such as the different types of privacy principles, who is covered by privacy law, and how to make a privacy complaint.
Privacy's all about information where individual people's identity is apparent. So if you know who the person is - then any information about that. Privacy is actually a human right, it's one of those rights that people have - it's one of them. It's like social rights, it's a bit like discrimination, workers comp. Privacy is a law for people about people and only people. Corporations don't have privacy.
Privacy in the modern world started out with this. It was an article called 'The Right to Privacy' - now this article was written in 1890 - yeah not a lot's changed since then has it! Privacy started because the press had cottoned on to the idea that: ask the servants of the rich and famous, the servants would provide them with gossip which they would then fill in the newspapers. So this right to privacy was actually the indignation of the rich and the famous that their personal lives were being spread in the press. And we did this in 1948 - so yeah, it took about 60 years before someone said, oh yeah we should do something about that, and this is what all privacy law in the world is based on including in Australia. So we ratified this in 1966, ah man we were on it like a shot as well - we actually in Queensland got the privacy act in 2009.
Now privacy is a bit confusing in Australia, because here in Queensland we have these 11 information privacy principles (don't bother reading those, they're there), we also have national privacy principals that's for health, only for health and health agencies, anything to do with health. So we've got two sets here, and then we have the Australian privacy principles which is the Commonwealth principles, and they have thirteen. So we have 11, 9, 13 and they are all privacy principles, but essentially they all deal with the same things.
Privacy is all about this. It's about collecting information - google actually finding out where you are. It's about sticking it somewhere, it's about using it - does anybody know that quote? ah you're all too young, it's McCarthy, Senator McCarthy and the communist witch trial. And giving information out. So those four things - collecting information, storing it, using it and disclosing, that's what privacy's all about no matter where you are.
But they all apply to different things and this is your point and they actually can get quite complicated. So the Commonwealth only applies to Departments, Commonwealth Departments, that's mainly tax, defence, Centrelink, they're all coming under the Commonwealth. Private hospitals, private doctors, Gps, private schools, government owned corporations so that's mainly your gas and electricity, your Telcos, anyone who - medium-to-large - anyone who actually has more than a 3 million dollar turnover a year, and their contractors and subcontractors. Here in Queensland we have Queensland Government Departments, public hospitals, public schools, all councils, public authorities - that's you know crowds like myself, the office of the information commissioner, the Ombudsman those sort of crowds, universities and just the contractors, not subcontractors.
Who's not covered by privacy law at all anywhere? People. Generally people, so it is not illegal anywhere in Australia for you to train a CCTV camera on your neighbour's yard, to film somebody in the street, to basically just breach everyone's privacy here. No privacy laws apply to individuals. Small business is exempt, the corner stores the community sector generally across Australia, so that's most of your clients there. MPs - they made sure that they were exempt - small professional bodies, and even if you work for a big crowd your employees are exempt. While the community sector isn't normally covered under the act, if they contract to government they are - so contractors - so if a community service has a contract with government, government will bind you by the contract to compliance with a law which doesn't normally apply to you.
So if you think privacy's been breached you can make a complaint about your agency, so that's it you're a contracted community service or it happened to you in your own you know - how come this community service has got my criminal history - you can make a complaint and you lodge it with the agency. Give them 45 days, then with us, we get involved and then QCAT. And this is what I'm saying, there is a right to sue in Queensland - we have a right to sue for breach of privacy - but only the crowds that are covered by the privacy laws, so that's government agencies and your contractors.
And the other thing too is that privacy is a human right. Yay! We need all of those! It's the weakest one you have, absolutely, privacy is in the bottom of the food chain when that comes to that - you know, yay it's a human right, yay it's all about people, yay we've got protection - any law, any law trumps it. You cannot breach somebody's privacy by obeying a law, that's the way it goes. So as soon as there is a law forget about citing privacy, forget it
And you know, as I said, there are lots of things people think privacy is and it isn't, it's all about common sense. So here's one - you never need anyone's permission to collect their information - there they are “you collected that and you didn't get my permission to collect that” - it's not in the law. No law. You can collect information about anyone you like without their consent, you don't need their consent, so that's a myth we can say that.
You can use it for - you got it for one purpose, you want to use it for another purpose - there's wiggle room for that. If there is a law, compliance absolutely that's a myth, compliance actually, you know gets in the way. Privacy puts health and safety at risk, yeah we talked about that, no it doesn't, absolutely it doesn't, anybody who says otherwise is talking crap and put them on to me and I'll tell them that they're talking crap. There's even an exemption for marketing yeah, you can market people, as long as you give them that unsubscribe button at the bottom of it, that's in the spam act, but yeah you can market to people. You can actually give people out to researchers, I mean a lot of your people in your services would be doing that, social services. Absolutely there's a huge exemption for research projects. And not obeying the law.
As you can see this is what I do for a job, I actually help agencies and individuals - this is your taxpayer dollar at work - negotiate, try and maintain, to the greatest degree practical that you can, privacy protections while allowing you to do your job.