Definition of research

65.44 Given the proposed expansion of the arrangements relating to research under the Privacy Act, the ALRC has considered whether it is necessary to define the term ‘research’ for the purposes the Act. Section 6 of the Privacy Act currently states that ‘medical research includes epidemiological research’, but the term is not otherwise defined.

65.45 The IPPs do not refer to health or medical research, but s 95 of the Privacy Act—which establishes the research exception to the IPPs and provides for the development of the Section 95 Guidelines—refers to ‘medical research’.^[52] The NPPs refer to research, or the compilation or analysis of statistics, relevant to public health or public safety. The NHMRC has expressed the view that there is no obvious rationale for the differences between the approach to research taken by s 95 of the Privacy Act and the NPPs.^[53]

65.46 The National Statement makes the point that:

There is no generally agreed definition of research; however, it is widely understood to include at least investigation undertaken to gain knowledge and understanding or to train researchers.^[54]

65.47 Rather than attempting to define ‘research’, the National Statement adopts a contextual approach. It attempts to define those activities that should fall under the National Statement, by asking the following two questions:

• What is human research?

• When and by what means does human research, or other activities such as quality assurance or improvement, or clinical audit, need ethical review?

65.48 As noted above, human research is defined broadly in the National Statement as research ‘conducted with or about people, or their data or tissue’. The National Statement then sets out the circumstances in which such research requires ethical review:

Research with more than a low level of risk … must be reviewed by an HREC. Research involving no more than low risk may be reviewed under other processes … Institutions may also determine that some human research is exempt from ethical review.^[55]

65.49 Risk is defined as potential for harm, discomfort or inconvenience and involves:

• the likelihood that a harm (or discomfort or inconvenience) will occur; and

• the severity of the harm, including its consequences.^[56]

65.50 In DP 72, the ALRC suggested that the term ‘research’ in the Privacy Act should be defined only by reference to the National Statement. The existing regime in relation to health and medical research under the Privacy Act and the Section 95 and 95A Guidelines relies on structures established in the National Statement and, in particular, on review of research proposals by HRECs. The new research regime proposed in DP 72, and recommended in this Report, continues to rely on these safeguards. For this reason the ALRC proposed that ‘research’, for the purposes of the Privacy Act, should be limited to those activities subject to review by an HREC under the National Statement.^[57]

65.51 The ALRC also proposed that the definition of research expressly include ‘the compilation and analysis of statistics’.^[58] While it is possible to argue that the term ‘research’ is broad enough to include the compilation or analysis of statistics, this is not universally accepted. The proposal was intended to put the matter beyond doubt for the purposes of the Privacy Act.

Submissions and consultations

65.52 DOHA noted in relation to the draft National Health Privacy Code^[59] that:

In relation to the definition of the term ‘research’ … the approach taken in NHPP 1 of the draft Code was to leave the term undefined, but to refer to the activities of ‘research or the compilation or analysis of statistics’. There is room within the guidelines designed to support the application of this principle, to provide guidance on the meaning of the term ‘research’. Such an approach would appear to be appropriate and effective.^[60]

65.53 A number of other stakeholders, however, were of the view that it was important to include a definition of the term ‘research’ in the Privacy Act.^[61] Others expressed support for the approach adopted in the National Statement.^[62] The Office of the Health Services Commissioner in Victoria expressed the view that any definition should be consistent with the National Statement, as the recent review and redrafting of that document had been a very thorough process.^[63]

65.54 The AIC expressed strong support for the ALRC’s proposal to define research as those activities subject to review by an HREC under the National Statement, noting that this approach would ensure consistency between the Privacy Act and the National Statement. The AIC was of the view that this alignment would assist researchers and HRECs in their decision making.^[64] Other stakeholders supported this proposal;^[65] for example, the University of Newcastle submitted that ‘the compilation and analysis of statistics’ should be clearly included;^[66] and the Western Australian Department of Health stated that the principle purpose of defining the term ‘research’ in the Privacy Act would be to distinguish those activities that must be given independent review by an HREC.^[67]

65.55 On the other hand, the OPC argued that the Privacy Act should not attempt to define the term ‘research’ by reference to the National Statement. The OPC was concerned that the National Statement was not legally binding and might change over time. The OPC also suggested that the link between the research exceptions in the Privacy Act and review by HRECs could be achieved more directly by making such review a requirement in the research exceptions.^[68]

65.56 Professor Colin Thomson, of the University of Wollongong, also expressed the view that any attempt to link the definition of research in the Privacy Act to the National Statement would cause confusion. He noted that the National Statement included three definitions: ‘research’; ‘human research’; and ‘human research subject to ethical review’. To define the term ‘research’ in the Privacy Act as any activity subject to review by an HREC under the National Statement would involve conflating these terms in a potentially confusing way.^[69]

ALRC’s view

65.57 The ALRC notes that there is no generally agreed definition of research, and acknowledges the concerns raised by stakeholders in relation to linking a definition of research in the Privacy Act with the National Statement. Following further consideration, the ALRC concludes that it is unnecessary to make this link by defining the term ‘research’ in the Privacy Act by reference to the National Statement. The ALRC agrees with the OPC that the crucial link can be made simply by requiring that research proposing to collect, use or disclose personal information in breach of the model UPPs must be reviewed by an HREC that is constituted in accordance, and acting in compliance, with the National Statement as in force from time to time. This requirement is included expressly in the research exceptions to the ‘Collection’ principle and the ‘Use and Disclosure’ principle recommended below.^[70]

65.58 While it is possible to argue that the term ‘research’ is broad enough to include the compilation or analysis of statistics, this is not universally accepted. The NPPs refer to research, or the compilation or analysis of statistics. This wording tends to infer that research does not include the compilation or analysis of statistics. The National Statement does not refer to the compilation or analysis of statistics, but HRECs are asked to review research proposals consisting of the compilation or analysis of statistics or including statistical elements. In order to put the matter beyond doubt, the ALRC recommends that the Privacy Act should state expressly that the term ‘research’ includes ‘the compilation and analysis of statistics’.