Submissions and consultations

68.69 There was general support from stakeholders for the inclusion of provisions in the Privacy Act clarifying the handling of personal information of children and young people.^[109] There were opposing opinions, however, on whether the ALRC’s proposals were appropriate.

68.70 A number of stakeholders highlighted particular areas where they considered it important for young people to be able to participate without the need to disclose information to parents. Access to health services was one such area mentioned.^[110] Accessing library services also was raised as a concern.^[111]

68.71 A number of stakeholders indicated that parents and guardians should continue to have full access to personal information relating to their children until the child reaches 18 years of age, and that this approach should be incorporated expressly into the Privacy Act.^[112] Stakeholders expressing this view were concerned about the decision-making capacity of individuals under the age of 18, and maintained that parents and guardians are the best people to make decisions in the best interests of the child or young person. The Festival of Light Australia acknowledged that, while the capacity of minors to make their own decisions develops with age, parents are best equipped to make a thorough assessment of the child’s capacity to make a particular decision.^[113]

68.72 The Caroline Chisholm Centre for Health Ethics expressed a contrary view.

In familial settings there are wide ranging situations where it could be argued that the parent abdicates certain rights that accompany parental responsibility because of neglect, emotional, psychological and physical abuse, or their own drug use, or other harmful behaviour which negatively impacts on the child … It is therefore not possible to argue that it is always in the child’s best interest for the parent to be able to access the health information of the child, where the child has independently sought medical, welfare or social services care, and because of fear or parental reaction, has decided to conceal this information from the parental figure(s).^[114]

68.73 One individual suggested that parents should not always be seen as ‘baddies’ from whom young people need to be protected.^[115] The New South Wales Commissioner for Children and Young People also emphasised that children and young people do not necessarily exclude parents from decision-making processes even as they increase their own involvement.

Many children and young people tell the Commission that they want their parents to be involved in their lives and to assist them when needed and so want to share their personal information with their parents. However, as young people grow older and seek assistance with more intimate issues they want to choose if and when their parents are involved. Therefore, laws on how information is collected and disclosed need to reflect this need for flexibility.^[116]

68.74 A number of stakeholders opposed any attempt to clarify issues of capacity and regulate decision making by individuals under the age of 18.^[117] These stakeholders highlighted the problems for agencies and organisations that regularly deal with children and young people in making assessments regarding capacity or otherwise obtaining consent from parents of individuals under a specified age. It was suggested the proposals would be ‘a detriment to young people’ by depriving them of opportunities to participate in activities such as birthday clubs and competitions where personal information is collected for marketing purposes.^[118]

68.75 The National Catholic Education Commission (NCEC) and the Independent Schools Council of Australia (ISCA) also opposed the proposals for individual assessment or an age-based presumption. Instead, they preferred to retain flexibility within the school environment without having decision making hampered by ‘artificial and irrelevant considerations’. They indicated that schools must balance a variety of complex factors and must make decisions that, in each situation, reflect the best interests of the child involved.

The schools are very concerned that the proposals fail to appreciate the practical situations that arise in schools on a daily basis and, if implemented, will distort the decision-making process which school staff need to employ in the course of their duties.^[119]

68.76 Three stakeholders supported the retention of the individual assessment approach in all circumstances and rejected the ALRC’s proposal for an age-based presumption in the absence of a practicable opportunity for assessment.^[120] SBS opposed the proposal on two grounds. First, it argued that the journalist’s assessment of the capacity of a child or young person participating in an interview or discussion should be paramount. Secondly, it was concerned about preventing individuals under the age of 15 from participating in online activities such as competitions, discussions and educational initiatives.^[121]

68.77 A number of stakeholders suggested that the age at which capacity is assumed should be reduced from 18 to a lower age, with no assessment required from the age of 16^[122] or, in relation to health information, 15.^[123]

68.78 The majority of stakeholders that addressed these issues, however, supported the ALRC’s approach to reform.^[124] One agency indicated that a set age would ensure consistency of application across the various jurisdictions involving interaction with children and young people.^[125] A number of stakeholders acknowledged the need for the age-based presumption, although wanted further emphasis on the requirement to undertake an assessment.^[126] There were concerns that the age-based presumption would be used by many agencies and organisations without consideration of the need to undertake an assessment. The ALRC’s proposal to undertake assessment used the words ‘where practicable’, but stronger language was urged by some stakeholders, including the terms ‘take all reasonable steps’,^[127] ‘take all steps possible’,^[128] or ‘where at all possible’.^[129]

68.79 The OPC suggested that the following factors may help to decide whether or not it is ‘reasonable and practicable’ to undertake an assessment:

• the type of personal information in question;

• the proposed handling of that information;

• the degree to which appropriately skilled staff are able to conduct the assessment; and

• how young the child is (eg, it is likely to be unreasonable to conduct an assessment of a 7 year old).^[130]

68.80 Other stakeholders gave strong support to the age-based presumption, highlighting the impracticality of individual assessment in many environments.^[131] There were, however, differences of opinion as to the most appropriate place to set the age-based presumption. Some argued for a lowering of the age to 13, making it consistent with regulation of the online environment in the United States.^[132] Others argued that the ALRC had misinterpreted the research and set the age presumption too low.^[133] In youth workshops conducted by the ALRC, there were varying suggestions about the age at which most young people should be able to control access to their personal information, although it was generally placed around the age of 14 to 16.^[134]

68.81 A number of stakeholders agreed with the ALRC’s proposal that the age-based presumption of capacity be set at 15 years of age, with the Privacy Foundation of Australia noting that this reflects an ‘appropriate balance between the autonomous capacity of 15+ year olds and at the same time providing protection for younger children’.^[135]

68.82 A number of stakeholders pointed out the problems with setting an age when other legislation sets alternative ages of capacity, including:

• the Motor Accidents Compensation Act 1999 (NSW) which sets the age of consent at 18 years for making decisions or executing documentation in relation to personal injury claims;^[136]

• the Minors (Property and Contracts) Act 1970 (NSW) which effectively requires parental consent to medical treatment for an individual under the age of 14;^[137]

• obligations on parents to provide the necessities of life, including medical attention, to children under the age of 16;^[138] and

• banking relationships based on contract law that allows a minor to open a bank account but not to authorise another person to operate the account.^[139]

68.83 Other stakeholders suggested additional provisions to qualify or add to the ALRC’s proposals, including:

• a requirement that consideration be given to the best interests of the child when handling personal information relating to all children under the age of 18;^[140]

• that the views of a child or young person should be heard and considered as part of the decision-making process, even where a child or young person is found to be incapable of making his or her own decision;^[141] and

• a stipulation in the Privacy Act that, where health information has no short-term impact on the circumstances of an individual under the age of 18, clinical decision making cannot be the sole responsibility of the patient.^[142]

68.84 The AMA was concerned that different age limits for the regulation of consent to disclosure of personal information would ‘muddy’ the regulation of consent to medical treatment.^[143] It was stressed by some stakeholders, however, that the assessment of an individual’s capacity to consent to medical treatment differs from a decision to disclose personal information. The individual may be unable to consent to the medical treatment (particularly where it is of an invasive nature or has serious consequences), but have the capacity to determine that the practitioner should not disclose the fact and details of the treatment.^[144]

68.85 The distinction between consent to medical treatment and the disclosure of personal information will become more important if Australia moves to a national electronic health record system. Such a system may involve decisions to opt in or opt out of the system, or stipulate who should have access to the record.

The requirement of health practitioners to assess the capacity of a young person to consent to an electronic health record has raised particular concerns. Assessing a young person’s capacity to make decisions about the handling of their personal and health information … is different to assessing a young person’s capacity to make decisions about their healthcare or medical treatment. Therefore is the use of ‘standard clinical practice’ appropriate? The distinction between capacity to make decisions about privacy, and capacity to make decisions about healthcare needs to be more clearly articulated in any electronic health record implementation.^[145]

Assessing capacity

68.86 In DP 72, the ALRC proposed that the Privacy Act be amended to incorporate a test of capacity to be applied when assessing an individual under the age of 18.^[146] The proposal indicated that individuals under the age of 18 who are found to be incapable of making a decision—either because of an individual assessment or application of the age presumption—must have an authorised representative make the decision on their behalf. The proposal also clarifies who has responsibility in such situations.^[147]

68.87 A number of stakeholders supported the inclusion of the test of capacity in the Privacy Act.^[148] A number of suggestions were made to simplify the wording of the test, in particular removing the list of specific factors that may give rise to incapacity (such as maturity, injury, disease, illness, cognitive impairment, physical impairment, mental disorder or any disability) and focusing instead on the general nature and effect of giving the consent, and the individual’s capacity to communicate consent.^[149] The OPC had concerns about adding the term ‘any other circumstance’ to the end of the list of specific factors, considering it too broad.^[150]

68.88 In contrast, two stakeholders considered that it was not necessary to set out a test of capacity in the Privacy Act.^[151] They argued that OPC guidance was more appropriate.

68.89 Stakeholders generally did not comment on the proposal to specify in the Privacy Act the authority of persons with parental responsibility to make decisions on behalf of a child or young person who is considered to be incapable of making such decisions. The Obesity Policy Coalition, however, gave strong support for the requirement that a parent or other person make decisions on behalf of a child under a set age.^[152]

Verifying age

68.90 In DP 72, it was noted that agencies and organisations that deal with children and young people may have to establish a system for either assessing capacity or verifying the age of individuals. If individuals are under the age of 15, agencies and organisations will have to establish alternative methods for communicating directly with an authorised representative. The ALRC did not suggest including specific requirements for age verification processes in legislation, but considered that guidance should be developed by the OPC to assist agencies and organisation to establish appropriate mechanisms and practices for implementing the age of presumption. Such mechanisms would include establishing appropriate age verification mechanisms and facilitating decision making by authorised representatives on behalf of children and young people lacking capacity.^[153] The ALRC proposed that the Privacy Act provide that an agency or organisation will not be considered to have acted without consent if it did not know, or could not reasonably be expected to have known from the information available, that an individual was aged 14 or under, and the agency or organisation acted upon the consent given by the individual.^[154]

68.91 There was strong support from stakeholders for a limitation on the liability of agencies and organisations when relying on the age-based presumption.^[155] There were, however, different opinions on the wording to be included in the provision and the extent of the onus on agencies and organisations to verify the age of the individual.

68.92 A number of stakeholders considered it to be appropriate to place the onus on the individual to provide correct and timely information to the agency or organisation, and not hold the agency or organisation responsible where the age has been falsified.^[156] Others considered that the wording was too open to abuse. A number of stakeholders suggested that agencies and organisations should be required to take ‘reasonable steps’ to verify the age of the individual.^[157] The OPC suggested that ‘due diligence’ should be exercised.^[158] The Law Society of New South Wales considered that agencies and organisations should be required to ‘explore’ the circumstances to ascertain whether the information is correct.^[159]

68.93 A number of submissions focused on the practical limitations of establishing age verification mechanisms. The Law Council of Australia noted the practical problems that have been encountered in determining an appropriate ‘Restricted Access System’ and age verification mechanism to prevent young people from accessing MA15+ content on the internet and via mobile phones.^[160] The Australian Direct Marketing Association indicated that it is ‘extremely difficult and onerous for businesses to accurately ascertain the age of both current and prospective customers’.^[161]

68.94 The Obesity Policy Coalition also noted the limitations of existing age verification mechanisms.

Introduction of the age of presumption would have little effect if an organisation could escape liability by taking cursory steps to ascertain a young person’s age or seek an authorised representative’s consent, such as asking the young people to provide their dates of birth, and, if they admit to being younger than 15, asking them to indicate (e.g by ticking a box) that an authorised representative consents to the proposed use of their personal information. Some organisations currently use these types of practices when collecting children’s personal information for direct marketing through competitions, website registrations and so on. For example, to register for the competitions and promotions section of the Cadbury website, people must agree to use of their personal information for direct marketing and enter their age range (<16, 16–17 or 18+). The registration page states that ‘Children under 16 are advised to get permission from their parent or guardian before they submit any personal information to Cadbury.’ In situations like this, many children would be likely to lie about their age or the fact that their parent has consented, or ignore advice to seek parental consent, if this would allow them to immediately enter a website or participate in a desired activity.^[162]

68.95 The OPC was concerned that a lack of robust age verification mechanisms would make the ALRC’s proposals problematic.^[163] Microsoft Asia Pacific also noted the significant limitations associated with existing age verification technologies, but submitted that it expects market-driven solutions to be forthcoming in the near future.^[164]

68.96 ASTRA submitted that it should be sufficient for organisations to establish reasonable age verification procedures, and they should not be subject to onerous rules. It stated that tighter restrictions would be appropriate for those organisations handling particularly sensitive information.^[165] Microsoft indicated its support for the ALRC’s proposal that guidance on these issues be provided by the OPC rather than through prescriptive legislative provisions.^[166] In contrast, the Obesity Policy Coalition was concerned that dealing with age verification procedures in guidance, rather than by establishing enforceable legal requirements, would result in non-compliance.^[167]

Implementing the provisions

68.97 To facilitate implementation of the new provisions dealing with decision making by individuals under the age of 18, the ALRC proposed:

• the development of guidance by the OPC, which should focus on applying the provisions in practice;^[168] and

• a requirement on agencies and organisations that handle the personal information of individuals under the age of 18 to address in their Privacy Policies how such information is managed and to ensure staff are adequately trained to assess the decision-making capacity of children and young people.^[169]

68.98 All but one stakeholder that addressed the issue gave support for the development of guidance by the OPC.^[170] Similarly, there was strong support for including in Privacy Policies relevant information on the handling of personal information of individuals under the age of 18.^[171]

68.99 There also was support for the ALRC’s proposal on staff training.^[172] The National Children’s and Youth Law Centre submitted that:

The development of the knowledge and skills to recognise and respect the rights of all children to privacy, to explain the processes and decisions in age-appropriate language, to make assessments of decision-making capacity and, regardless of the results of such assessments, to engage children in the decision-making processes to the fullest extent of their capacity are important goals.^[173]

68.100 There was, however, opposition to the training requirements. The Australian Bankers’ Association indicated:

An obligation for banks to train staff to undertake assessments of the capacity of minors is onerous, costly and potentially of disadvantage to minors in introducing a complex process over the top of long standing simple practices of opening and maintaining accounts for minors, eg school bank accounts.^[174]

68.101 A number of other stakeholders considered that the requirement to train staff to undertake assessment of the decision-making capacity of those under the age of 18 was unreasonable, impracticable and inappropriate, and had significant compliance costs.^[175] The Australian Taxation Office considered that the training requirement should be confined to those bodies whose functions specifically include service provision to client groups including individuals under the age of 18.^[176]