Guide to the Privacy (Persons Reported as Missing) Rule 2024

<!doctype html> <html lang="en"> <head> <title>Guide to the Privacy (Persons Reported as Missing) Rule 2024 | OAIC</title>  <meta charset="utf-8"> <meta name="mobile-web-app-capable" content="yes"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">  <meta name="dcterms.title" content="Guide to the Privacy (Persons Reported as Missing) Rule 2024"> <meta name="dcterms.creator" content="OAIC"> <meta name="dcterms.created" content="2022-08-16T11:55:08+10:00"> <meta name="dcterms.modified" content="2024-04-03T16:42:24+11:00"> <meta name="dcterms.issued" content="2024-04-03T15:09:51+11:00"> <meta name="dcterms.format" content="HTML"> <meta name="dcterms.identifier" content="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024">    <meta name="publishedDate" content="3 April 2024"> <meta name="publishedDate_ISO" content="2024-04-03T00:00:00+11:00"> <meta name="description" content="A guide for any entity the Australian Privacy Principles covers, and for other entities to understand, and use the Privacy (Persons reported as Missing) Rule 2024" /> <meta name="pdISO" content="2024-04-03T00:00:00+11:00" /> <meta name="robots" content="" />  <meta name="chapter-nav" content="no" /> <meta name="chapter-nav-prev" content="" /> <meta name="chapter-nav-next" content="" /> <meta name="chapter-nav-prev-btn-text" content="Previous chapter" /> <meta name="chapter-nav-next-btn-text" content="Next chapter" /> <meta name="background_color" content="chapter-navigation__wrapper--white" />  <meta name="show-related-articles" content="no" /> <meta name="topic" content="Privacy" /> <meta name="contentType" content="" /> <meta name="featuredNews" content="no" /> <meta name="author-name" content="" /> <meta name="author-title" content="" /> <meta name="author-image" content="" />  <meta name="type" content="web" />  <meta name="showFeedbackWidget" content="yes" /> <meta name="showShareWidget" content="yes" />  <meta itemprop="name" content="Guide to the Privacy (Persons Reported as Missing) Rule 2024" /> <meta itemprop="description" content="A guide for any entity the Australian Privacy Principles covers, and for other entities to understand, and use the Privacy (Persons reported as Missing) Rule 2024" /> <meta itemprop="image" content="" />  <meta name="twitter:card" content="summary" /> <meta name="twitter:site" content="@OAICgov" /> <meta name="twitter:title" content="Guide to the Privacy (Persons Reported as Missing) Rule 2024" /> <meta name="twitter:description" content="A guide for any entity the Australian Privacy Principles covers, and for other entities to understand, and use the Privacy (Persons reported as Missing) Rule 2024" /> <meta name="twitter:image" content="" />  <meta property="og:title" content="Guide to the Privacy (Persons Reported as Missing) Rule 2024" /> <meta property="og:type" content="website" /> <meta property="og:url" content="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024" /> <meta property="og:image" content="" /> <meta property="og:description" content="A guide for any entity the Australian Privacy Principles covers, and for other entities to understand, and use the Privacy (Persons reported as Missing) Rule 2024" /> <meta property="og:site_name" content="OAIC" /> <meta property="article:published_time" content="2024-04-03T15:09:51+11:00" /> <meta property="article:modified_time" content="2024-04-03T16:42:24+11:00" /> <meta property="article:tag" content="" /> <meta name="theme-color" content="#fafafa">  <script src="//cdn-oc.readspeaker.com/script/9755/webReader/webReader.js?pids=wr" type="text/javascript" id="rs_req_Init"></script>  <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-PTH9SP3B');</script>   <meta name="google-site-verification" content="sQVHBUKhjuCjBjithPialZYhGQ5SPKwjb1_rY8OqsjA" /> <link rel="stylesheet" href="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/main.css?h=06ed308"> <link rel="stylesheet" href="https://www.oaic.gov.au/__data/assets/css_file/0024/240585/custom.css?v=0.1.202">  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.min.css"> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Source+Code+Pro:ital,wght@0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap" rel="stylesheet">  <link rel="shortcut icon" href="https://www.oaic.gov.au/__data/assets/image/0016/14182/favicon-32x32.png"> <link rel="apple-touch-icon" href="https://www.oaic.gov.au/__data/assets/image/0015/14181/apple-touch-icon.png">  </head> <body class="inside">  <section class="cookie-banner" aria-labelledby="cookie-heading"> <h2 class="visuallyhidden" id="cookie-heading">We use cookies on this site</h2> <div class="cookie-banner__content"> <div> <p>We use cookies to analyse traffic and to improve your browsing experience on our website. To find out more, read our <a href="https://www.oaic.gov.au/about-the-OAIC/our-corporate-information/plans-policies-and-procedures/privacy-policy">privacy policy</a>.</p> </div> <button class="cookie-banner__close primary-button" id="close-cookie-banner" aria-label="Close and accept cookie policy">Close</button> </div> </section>   <div class="skip-to-content"> <a href="#main-content-area" class="skip-to-content__link visuallyhidden focusable">Skip to main content</a> </div>  <div class="page-wrapper">     <header class="site-header"> <div class="utility-nav"> <div class="utility-nav__wrapper"> <a href="/news" class="utility-nav__link ">News</a> <a href="/about-the-OAIC/join-our-team" class="utility-nav__link ">Join our team</a> <a href="/contact-us" class="utility-nav__link ">Contact us</a> </div> </div> <div class="header-content"> <a href="https://www.oaic.gov.au" class="header-logo"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/13664/oaic-header-logo.svg" alt="OAIC - Australian Government - Office of the Australian Information Commissioner"> </a> <button class="mobile-menu" aria-controls="header-nav" aria-expanded="false"> <img class="menu-icon menu-icon--burger" src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/hamburger-menu.svg" alt="open menu"> <img class="menu-icon menu-icon--close" src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/cancel-icon-white.svg" alt="close menu"> </button> <div class="search-container search-container--header"> <form class="input-form" action="https://www.oaic.gov.au/search" data-action="https://www.oaic.gov.au/search?SQ_ASSET_CONTENTS_RAW"> <input name="query" autocomplete="off" id="autoComplete" placeholder="Search…" class="search-box" aria-label="Search input" data-autocomplete-endpoint="https://dxp-au-search.funnelback.squiz.cloud/s/suggest.json?collection=113e9365-ffcc-4320-a995-5c1b98bea3bb~sp-oaic-web-new&profile=auto-completion-global&fmt=json%2B%2B&alpha=0.5&show=10"> <input type="hidden" name="form" value="result"> <button type="button" id="clear-text-btn" class="cancel-logo" aria-label="Clear text"> <img src="https://www.oaic.gov.au/__data/assets/file/0022/13666/cancel-icon.svg" alt="clear text cancel icon"> </button> <button type="submit" aria-label="Submit search"> <img class="search-icon" src="https://www.oaic.gov.au/__data/assets/file/0023/13667/search-outline.svg" alt="search icon thst submits form"> </button> </form> </div> <div id="header-nav" class="header-nav"> <nav class="header-nav__nav"> <div class="header-nav__item"> <a href="https://www.oaic.gov.au" class="header-nav__link " > Home </a> </div> <div class="header-nav__item"> <button class="header-nav__button current" aria-expanded="false" > Privacy <div class="header-nav__mobile-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-plus" alt="expand menu"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-minus" alt="collapse menu"> </div> <div class="header-nav__desktop-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/chevron-down-white.svg" alt="expand menu"> </div> </button> <div class="header-nav__sub"> <div class="header-nav__sub-wrapper"> <div class="header-nav__sub-first"> <a href="https://www.oaic.gov.au/privacy" class="header-nav__sub-link"> Privacy </a> </div> <div class="header-nav__sub-grid"> <a href="https://www.oaic.gov.au/privacy/your-privacy-rights" class="header-nav__sub-link"> Your privacy rights </a> <a href="https://www.oaic.gov.au/privacy/privacy-complaints" class="header-nav__sub-link"> Privacy complaints </a> <a href="https://www.oaic.gov.au/privacy/australian-privacy-principles" class="header-nav__sub-link"> Australian Privacy Principles </a> <a href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies" class="header-nav__sub-link"> Privacy guidance for organisations and government agencies </a> <a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches" class="header-nav__sub-link"> Notifiable data breaches </a> <a href="https://www.oaic.gov.au/privacy/privacy-legislation" class="header-nav__sub-link"> Privacy legislation </a> <a href="https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions" class="header-nav__sub-link"> Privacy assessments and decisions </a> <a href="https://www.oaic.gov.au/privacy/privacy-registers" class="header-nav__sub-link"> Privacy registers </a> </div> </div> </div> </div> <div class="header-nav__item"> <button class="header-nav__button " aria-expanded="false" > Freedom of information <div class="header-nav__mobile-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-plus" alt="expand menu"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-minus" alt="collapse menu"> </div> <div class="header-nav__desktop-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/chevron-down-white.svg" alt="expand menu"> </div> </button> <div class="header-nav__sub"> <div class="header-nav__sub-wrapper"> <div class="header-nav__sub-first"> <a href="https://www.oaic.gov.au/freedom-of-information" class="header-nav__sub-link"> Freedom of information </a> </div> <div class="header-nav__sub-grid"> <a href="https://www.oaic.gov.au/freedom-of-information/your-freedom-of-information-rights" class="header-nav__sub-link"> Your freedom of information rights </a> <a href="https://www.oaic.gov.au/freedom-of-information/how-to-access-government-information" class="header-nav__sub-link"> How to access government information </a> <a href="https://www.oaic.gov.au/freedom-of-information/freedom-of-information-guidance-for-government-agencies" class="header-nav__sub-link"> Freedom of information guidance for government agencies </a> <a href="https://www.oaic.gov.au/freedom-of-information/freedom-of-information-legislation-and-determinations" class="header-nav__sub-link"> Freedom of information legislation and determinations </a> <a href="https://www.oaic.gov.au/freedom-of-information/information-commissioner-decisions-and-reports" class="header-nav__sub-link"> Information Commissioner decisions and reports </a> <a href="https://www.oaic.gov.au/freedom-of-information/freedom-of-information-statistics-for-the-oaic" class="header-nav__sub-link"> Freedom of information statistics for the OAIC </a> </div> </div> </div> </div> <div class="header-nav__item"> <button class="header-nav__button " aria-expanded="false" > Consumer Data Right <div class="header-nav__mobile-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-plus" alt="expand menu"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-minus" alt="collapse menu"> </div> <div class="header-nav__desktop-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/chevron-down-white.svg" alt="expand menu"> </div> </button> <div class="header-nav__sub"> <div class="header-nav__sub-wrapper"> <div class="header-nav__sub-first"> <a href="https://www.oaic.gov.au/consumer-data-right" class="header-nav__sub-link"> Consumer Data Right </a> </div> <div class="header-nav__sub-grid"> <a href="https://www.oaic.gov.au/consumer-data-right/information-for-consumers" class="header-nav__sub-link"> Information for consumers </a> <a href="https://www.oaic.gov.au/consumer-data-right/consumer-data-right-complaints" class="header-nav__sub-link"> Consumer Data Right complaints </a> <a href="https://www.oaic.gov.au/consumer-data-right/consumer-data-right-guidance-for-business" class="header-nav__sub-link"> Consumer Data Right guidance for business </a> <a href="https://www.oaic.gov.au/consumer-data-right/consumer-data-right-legislation,-regulation-and-definitions" class="header-nav__sub-link"> Consumer Data Right legislation, regulation and definitions </a> <a href="https://www.oaic.gov.au/consumer-data-right/consumer-data-right-assessments" class="header-nav__sub-link"> Consumer Data Right assessments </a> </div> </div> </div> </div> <div class="header-nav__item"> <a href="https://www.oaic.gov.au/digital-id" class="header-nav__link " > Digital ID </a> </div> <div class="header-nav__item"> <button class="header-nav__button " aria-expanded="false" > Engage with us <div class="header-nav__mobile-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-plus" alt="expand menu"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-minus" alt="collapse menu"> </div> <div class="header-nav__desktop-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/chevron-down-white.svg" alt="expand menu"> </div> </button> <div class="header-nav__sub"> <div class="header-nav__sub-wrapper"> <div class="header-nav__sub-first"> <a href="https://www.oaic.gov.au/engage-with-us" class="header-nav__sub-link"> Engage with us </a> </div> <div class="header-nav__sub-grid"> <a href="https://www.oaic.gov.au/engage-with-us/consultations" class="header-nav__sub-link"> Consultations </a> <a href="https://www.oaic.gov.au/engage-with-us/submissions" class="header-nav__sub-link"> Submissions </a> <a href="https://www.oaic.gov.au/engage-with-us/translations" class="header-nav__sub-link"> Translations </a> <a href="https://www.oaic.gov.au/engage-with-us/events" class="header-nav__sub-link"> Events </a> <a href="https://www.oaic.gov.au/engage-with-us/networks" class="header-nav__sub-link"> Networks </a> <a href="https://www.oaic.gov.au/engage-with-us/research-and-training-resources" class="header-nav__sub-link"> Research and training resources </a> </div> </div> </div> </div> <div class="header-nav__item"> <button class="header-nav__button " aria-expanded="false" > About the OAIC <div class="header-nav__mobile-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-plus" alt="expand menu"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/icon-plus-white.svg" class="icon-minus" alt="collapse menu"> </div> <div class="header-nav__desktop-toggle"> <img src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/mysource_files/chevron-down-white.svg" alt="expand menu"> </div> </button> <div class="header-nav__sub"> <div class="header-nav__sub-wrapper"> <div class="header-nav__sub-first"> <a href="https://www.oaic.gov.au/about-the-OAIC" class="header-nav__sub-link"> About the OAIC </a> </div> <div class="header-nav__sub-grid"> <a href="https://www.oaic.gov.au/about-the-OAIC/what-we-do" class="header-nav__sub-link"> What we do </a> <a href="https://www.oaic.gov.au/about-the-OAIC/who-we-are" class="header-nav__sub-link"> Who we are </a> <a href="https://www.oaic.gov.au/about-the-OAIC/join-our-team" class="header-nav__sub-link"> Join our team </a> <a href="https://www.oaic.gov.au/about-the-OAIC/access-our-information" class="header-nav__sub-link"> Access our information </a> <a href="https://www.oaic.gov.au/about-the-OAIC/our-regulatory-approach" class="header-nav__sub-link"> Our regulatory approach </a> <a href="https://www.oaic.gov.au/about-the-OAIC/our-corporate-information" class="header-nav__sub-link"> Our corporate information </a> <a href="https://www.oaic.gov.au/about-the-OAIC/information-policy" class="header-nav__sub-link"> Information policy </a> <a href="https://www.oaic.gov.au/about-the-OAIC/serving-legal-documents-on-the-australian-information-commissioner" class="header-nav__sub-link"> Serving legal documents on the Australian Information Commissioner </a> </div> </div> </div> </div> <div class="header-nav__item header-nav__item--mobile-only"> <a href="/news" class="header-nav__link">News</a> </div> <div class="header-nav__item header-nav__item--mobile-only"> <a href="/about-the-OAIC/join-our-team" class="header-nav__link">Join our team</a> </div> <div class="header-nav__item header-nav__item--mobile-only"> <a href="/contact-us" class="header-nav__link">Contact us</a> </div> </nav> </div> </div> </header> <div class="nav-close-overlay"></div>   <main class="main"> <div class="breadcrumb__wrapper"> <div class="section "> <div class="section-item flex-box "> <div class="breadcrumb breadcrumb--separator-chevron"> <nav class="breadcrumb__nav" aria-label="Breadcrumb"> <ul class="breadcrumb__list"> <span class="breadcrumb__list-item"><a href="https://www.oaic.gov.au" class="breadcrumb__list-item-link" aria-label="Go to home page"><svg xmlns="http://www.w3.org/2000/svg" version="1.0" viewBox="0 0 50 50" height="24" width="24"><path d="M25 9.0937 7.281 25.3747h5.563v15.531h24.312v-15.531h5.563L25 9.0937z" fill="currentColor"></path></svg></a></span> <li class="breadcrumb__list-item"> <a class="breadcrumb__list-item-link" href="https://www.oaic.gov.au/privacy">Privacy</a> </li> <li class="breadcrumb__list-item"> <a class="breadcrumb__list-item-link" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies">Privacy guidance for organisations and government agencies</a> </li> <li class="breadcrumb__list-item"> <a class="breadcrumb__list-item-link" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information">Handling personal information</a> </li> <li class="breadcrumb__list-item"> <a class="breadcrumb__list-item-link" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024">Guide to the Privacy (Persons Reported as Missing) Rule 2024</a> </li> </ul> </nav> </div> </div> </div> </div>  <div id="main-content-area" class="page-content"> <div class="toc"> <ul class="toc__list"> <li class="toc__heading"> <h2 class="toc-exclude">On this page</h2> </li> </ul> </div> <section class="banner-grey-newsroom__wrapper"> <div class="banner-grey-newsroom__content"> <h1 class="banner-grey-newsroom__title">Guide to the Privacy (Persons Reported as Missing) Rule 2024</h1> </div> </section>  <script> if(document.querySelector('.banner-grey-newsroom__wrapper .banner-grey-newsroom__content')) { document.querySelector('.breadcrumb__wrapper').insertAdjacentElement('afterend',document.querySelector('.banner-grey-newsroom__wrapper .banner-grey-newsroom__content').closest(' .banner-grey-newsroom__wrapper')) } </script> <div class="gov-numbered-paragraphs" id="component_20162"> <p>Published: 2 April 2024</p><h2>Background</h2><p>The Australian Privacy Principles (APPs)<a href="#_ftn1" name="_ftnref1" title="">[1]</a> are legally binding principles that set out standards, rights and obligations in relation to handling, holding, accessing and correcting personal information. They apply to most Australian Government agencies<a href="#_ftn2" name="_ftnref2" title="">[2]</a> and some private sector organisations — collectively referred to as APP entities. Further guidance about the APPs is contained in the OAIC’s <em>Australian Privacy Principle guidelines</em>.<a href="#_ftn3" name="_ftnref3" title="">[3]</a></p><p>The information handling requirements imposed by some APPs do not apply if a ‘permitted general situation’ (PGS) exists. The PGSs are set out in subsection 16A(1) of the Privacy Act.<a href="#_ftn4" name="_ftnref4" title="">[4]</a></p><p>The existence of a permitted general situation (PGS) provides an exception to the general prohibition against an APP entity collecting sensitive information about an individual (APP 3.4(b)), and the use and disclosure of personal information for a secondary purpose (APP 6.2(c)).</p><p>Item 3 of the table in subsection 16A(1) details a PGS which relates to the collection, use or disclosure of personal information to locate a person who has been reported as missing (PGS 3). It states:</p><blockquote><p>An APP entity is permitted to collect, use or disclose personal information if:</p><p>(a) the entity reasonably believes that the collection, use or disclosure is reasonably necessary to assist any APP entity, body or person to locate a person who has been reported as missing; and</p><p>(b) the collection, use or disclosure complies with the rules made under subsection (2).</p></blockquote><p>Subsection 16A(2) states:</p><blockquote><p>The Commissioner may, by legislative instrument, make rules relating to the collection, use or disclosure of personal information that apply for the purposes of item 3 of the table in subsection (1).</p></blockquote><p>The <em>Privacy (Persons Reported as Missing) Rule 2024</em> is a legislative instrument made under subsection 16A(2) of the Privacy Act and applies for the purposes of PGS 3.</p><h3>Outline of this guide</h3><p>This guide is to assist APP entities and others to understand and use the <em>Privacy (Persons Reported as Missing) Rule 2024</em> (the Rule). In particular, the guide outlines:</p><ul><li>the mandatory requirements in PGS 3 and the Rule — generally indicated by ‘must’ or ‘is required to’.</li><li>the Information Commissioner’s interpretation of PGS 3 and the Rule, including the matters that the Commissioner may take into account when exercising functions and powers relating to the APPs — generally indicated by ‘should’ or ‘is expected to’.</li><li>examples that explain how PGS 3 and the Rule may apply — generally indicated by ‘for example’ or ‘examples include’. Any examples given are not intended to be definitive or exhaustive of how an entity may comply with the mandatory requirements, and an entity’s compliance will depend on the particular circumstances.</li><li>good privacy practice to supplement minimum compliance with the mandatory requirements in PGS 3 and the Rule — generally indicated by ‘could’.</li></ul><p>This guide is not legally binding and does not constitute legal advice about how an APP entity must or should comply with PGS 3 and the Rule in particular circumstances. An entity may wish to seek independent legal advice where appropriate.</p><h3>Who should use this guide?</h3><p>The Rule and this guide may be relevant to three types of bodies:</p><ul><li>an APP entity<a href="#_ftn5" name="_ftnref5" title="">[5]</a> that seeks to use or disclose personal information (including sensitive information)  about a person reported as missing, in response to a request from a locating entity (see Key concepts for more information about ‘locating entities’)</li><li>a locating entity that is an APP entity and seeks to collect sensitive information about a person reported as missing</li><li>a locating entity that is not an APP entity and seeks to collect sensitive information about a person reported as missing. Locating entities that are not APP entities are not covered by the Rule or the APPs. However, being aware of the requirements of the Rule will ensure that locating entities frame their requests for information in a way that assists APP entities to comply with the Rule in responding to the request.</li></ul><h2>Requirements and scope of PGS 3 and the Rule</h2><h3>Requirements of PGS 3 and the Rule</h3><p>PGS 3 applies in relation to the collection of sensitive information (APP 3) and the use or disclosure of personal information for a secondary purpose (APP 6). The Rule sets out when, under PGS 3:</p><ul><li>an APP entity may collect sensitive information about a person reported as missing</li><li>an APP entity may use or disclose personal information about a person reported as missing.</li></ul><p>Importantly:</p><ul><li>only an APP entity that is a locating entity may collect sensitive information about a person reported as missing</li><li>an APP entity may only use or disclose personal information about a person reported as missing in response to a request from a locating entity</li><li>personal information (including sensitive information) may only be collected, used or disclosed if the APP entity reasonable believes that the collection, use or disclosure:<ul><li>is reasonably necessary to assist the locating entity to locate the person reported as missing, and</li><li>would not pose a serious threat to the life, health or safety of any individual</li></ul></li><li>the personal information that is collected, used or disclosed must be limited to that which is reasonably necessary to make contact with, or offer proof of life of, the person reported as missing</li><li>personal information may only be used or disclosed where:<ul><li>it is unreasonable or impracticable to obtain the consent of the person reported as missing</li><li>the use or disclosure is not contrary to any wish expressed by the person reported as missing of which the APP entity is aware.</li></ul></li></ul><h3>Scope of PGS 3 and the Rule</h3><p>Although PGS 3 and the Rule permit the collection of sensitive information, and the use or disclosure of personal information in certain circumstances (see above), it is important to be aware of the limited scope of PGS 3 and the Rule. Under PGS 3 and the Rule, an APP entity:</p><ul><li>may only collect sensitive information, or use or disclose personal information, to locate the person reported as missing. PGS 3 and the Rule do not permit sensitive information to be collected, or personal information to be used or disclosed, afterthe person reported as missing has been found. An APP entity would need to rely on another exception to APP 3.3 to collect sensitive information, or APP 6.1 to use or disclose personal information about an individual who has been located<a href="#_ftn6" name="_ftnref6" title="">[6]</a></li><li>is permitted, but not required, to collect the sensitive information, and use or disclose the personal information, of a person reported as missing. The Rule does not affect the operation of other laws that deal with the collection, use and disclosure of the personal information of a person reported as missing, for example, secrecy or confidentiality provisions which may prohibit the disclosure of certain types of personal information</li><li>is not permitted to use or disclose a government related identifier</li><li>is only permitted to collect sensitive information or use or disclose personal information about the person reported as missing. Where an APP entity wishes to collect, use or disclose another individual’s personal information (including sensitive information) to locate a person reported as missing, it should seek the consent of that individual, or consider whether another exception to APPs 3 or 6 applies to the proposed collection, use or disclosure</li><li>must comply with the APPs in handling any personal information collected, used or disclosed. For example, APP 10 (quality of personal information) and APP 11 (security of personal information).</li></ul><p>The Rule only applies to the collection of sensitive information, and the use or disclosure of personal information (including sensitive information) under the exception in PGS 3. The APP guidelines contain guidance on when an APP entity (including an APP entity that is a locating entity) may collect, use or disclose personal information (including sensitive information) in other circumstances.</p><p>The Rule only applies to APP entities. Where an entity (other than an APP entity) collects sensitive information, or uses or discloses personal information in circumstances covered by PGS 3 and the Rule, the Commissioner encourages compliance with the Rule and the APPs more generally as a best practice approach to privacy, subject to any specific privacy requirements the entity may already be subject to.</p><h2>Guidance for a locating entity</h2><h3>Making requests to an APP entity for personal information about a person reported as missing</h3><p>An APP entity may only use or disclose personal information under the Rule if the use or disclosure is in response to a request from a locating entity.</p><p>Processing requests from locating entities may be resource intensive for an APP entity. A locating entity could endeavour to make requests in a way that meets the needs of the APP entity.</p><p>For example, a locating entity could consider making requests for personal information using a template form, which could include information to assist an APP entity to decide whether it can use or disclose the personal information as requested by the locating entity under the Rule. For example, the locating entity could provide information about:</p><ul><li>the type of proof of life or contact information that the locating entity reasonably believes would assist it to locate the person reported as missing, where practicable</li><li>why the locating entity reasonably believes that the personal information is reasonably necessary to assist it to locate the person reported as missing</li><li>any factors relevant to the APP entity deciding whether it is unreasonable or impracticable for the APP entity to obtain consent, such as where the request is urgent.</li></ul><p>Where a locating entity makes regular requests for personal information to an APP entity, it may be useful for both parties to discuss the particular needs of that APP entity in relation to the form in which requests are made.</p><p>Although a locating entity may need to provide some personal information as part of its request (for example, to allow the APP entity to locate relevant information in its records about the individual), the locating entity should ensure that it minimises the amount of personal information that it discloses as part of its request.</p><h3>Collecting sensitive information under the Rule</h3><p>The Rule permits a locating entity that is an APP entity to collect sensitive information to assist it to locate a person reported as missing in certain circumstances.<a href="#_ftn7" name="_ftnref7" title="">[7]</a> A locating entity that is not an APP entity is not required to comply with the APPs and the Rule (see above). However, where a non-APP entity locating entity collects personal information (including sensitive information), the Commissioner encourages compliance with the Rule and the APPs more generally, as a best practice approach to privacy , subject to any specific privacy requirements the entity may already be subject to.</p><p>An APP entity must satisfy a four-step test to determine whether it is permitted to collect sensitive information under the Rule.</p><ul><li>Is it a locating entity? (s 5(1)(a) of the Rule. See Key concepts for a discussion of ‘locating entity’)</li><li>If so, does it reasonably believe that the collection of the particular sensitive information is reasonably necessary to assist it to locate the person reported as missing? (s 5(1)(b) of the Rule. See Key concepts for a discussion of ‘reasonably believe’ and ‘reasonably necessary’)</li><li>Is the sensitive information reasonably necessary to make contact with, or offer proof of life of, the person reported as missing? (s 5(1)(c) of the Rule. See Key concepts for a discussion of ‘contact or proof of life information’)</li><li>Would the collection of the sensitive information pose a serious threat to the life, health or safety of any individual? (s 5(1)(d) of the Rule. See Key concepts for a discussion of ‘serious threat to the life, health or safety of any individual’)</li></ul><h3>Handling sensitive information after collection</h3><p>A locating entity that is an APP entity must handle the personal information (including sensitive information) that it holds in accordance with the APPs. Two important obligations are discussed below.</p><h4>Disclosing the sensitive information of the person reported as missing</h4><p>APP 6 requires an APP entity to only use or disclose personal information (including sensitive information) it holds for the purpose for which it was collected, unless the individual whose personal information has been collected has consented to the use or disclosure, or where an exception under APP 6.2 or 6.3 applies. Where a locating entity that is an APP entity collects sensitive information under the Rule, it must only use or disclose it for the purpose of locating the person reported as missing, or a directly related purpose, unless another exception applies.</p><p>Generally, this would not include disclosure to the individual who reported the person as missing to the locating entity, unless the person reported as missing has been located and consents to such disclosure (APP 6.1(a)). The locating entity should allow the person reported as missing to indicate to the locating entity how much personal information (if any) they wish to be disclosed to the individual that reported them as missing.</p><p>Where the person reported as missing has not been located, the locating entity should not disclose any personal information collected from an APP entity to the individual that reported the person as missing, unless an exception in APP 6.2 or 6.3 applies.</p><p>The existence of an exception does not compel the locating entity to use or disclose the personal information. Before using or disclosing the personal information of a person reported as missing, the locating entity could consider the known wishes of the individual.</p><h4>Retaining the sensitive information of the person reported as missing</h4><p>APP 11.2 requires that where an APP entity holds personal information (including sensitive information) that it no longer needs for any purpose permitted by the APPs, it should take reasonable steps to destroy or de-identify the information, unless the information is contained in a Commonwealth record or the entity is required by or under an Australian law, or a court/tribunal order, to retain the information. See APP 11 and Chapter 11 (APP 11) of the OAIC’s APP guidelines for further information.<a href="#_ftn8" name="_ftnref8" title="">[8]</a></p><h2>Guidance for an APP entity</h2><h3>Receiving a request from a locating entity for personal information of a person reported as missing</h3><p>Processing requests for personal information under the Rule may be resource intensive for an APP entity. An APP entity that anticipates receiving a large number of requests could consider setting up processes to handle the processing of requests. Where an APP entity receives regular requests for personal information from a locating entity, it may be useful for both parties to discuss the particular needs of the entity in relation to the form in which requests are made.</p><p>When processing requests for personal information under the Rule, an APP entity could also take account of the timelines that the locating entity is working to, and whether the locating entity has requested acknowledgement of receipt of the request.</p><h4>Collecting personal information from a locating entity under the APPs</h4><p>Where an APP entity receives a request from a locating entity about a person reported as missing, it is likely that the APP entity will have to collect personal information about that person, in order to identify the person in its records and respond to the locating entity’s request.<a href="#_ftn9" name="_ftnref9" title="">[9]</a></p><p>An APP entity may collect personal information (other than sensitive information) where it is reasonably necessary for (or for agencies, directly related to) one or more of the entity’s functions or activities. One of the lawful functions or activities of an APP entity is assisting a locating entity to locate a person reported as missing under PGS 3. Personal information that is reasonably necessary for (or directly related to) that function or activity is likely to be limited to information that enables the APP entity to identify the individual in its records.</p><p>APP entities will still need to comply with other APPs in relation to the personal information it collects from a locating entity of the person reported as missing. For example, APP 11.2 requires that where an APP entity holds personal information (including sensitive information) that it no longer needs for any purpose permitted by the APPs, it should take reasonable steps to destroy or de-identify the information, unless the information is contained in a Commonwealth record or the entity is required by or under an Australian law, or a court/tribunal order, to retain the information. See APP 11 and Chapter 11 (APP 11) of the OAIC’s APP guidelines for further information.<a href="#_ftn10" name="_ftnref10" title="">[10]</a></p><h3>Using or disclosing personal information in response to a request from a locating entity</h3><p>When an APP entity has received a request for personal information from a locating entity, it must satisfy a five-step test to determine whether a particular use or disclosure of personal information is permitted under the Rule. This includes personal information collected from the locating entity as part of the request, and additional personal information it holds about the person reported as missing.</p><ul><li>Does the APP entity reasonably believe that the use or disclosure of the particular personal information is reasonably necessary to assist the locating entity to locate the person reported as missing? (s 6(1)(b) of the Rule. See Key concepts for a discussion of ‘reasonably believe’ and ‘reasonably necessary’)</li><li>Is it unreasonable or impracticable to obtain of the consent of the person reported as missing to the use or disclosure of the information? (s 6(1)(d) of the Rule. See discussion of ‘consent’, below)</li><li>Is the personal information reasonably necessary to make contact with, or offer proof of life of, the person reported as missing? (s 6(1)(e) of the Rule. See Key concepts for a discussion of contact or proof of life information)</li><li>Is the use or disclosure contrary to any wish expressed by the person reported as missing of which the APP entity is aware? (s 6(1)(f) of the Rule. See discussion of the known wishes of the individual, below)</li><li>Would the use or disclosure of the personal information pose a serious threat to the life, health or safety of any individual? (s 6(1)(g) of the Rule. See Key concepts for a discussion of ‘serious threat to the life, health or safety of any individual’).</li></ul><p>The Rule only permits the APP entity to disclose personal information to the requesting locating entity (s 6(1)(c)). If the APP entity wishes to disclose the personal information to another individual or entity, it may only do so in accordance with APP 6.1.</p><h4>Consent</h4><p>The Rule requires an APP entity to only use or disclose the personal information of a person reported as missing where:</p><ul><li>it is not reasonable or practicable to seek the consent of the person reported as missing to the use or disclosure of their personal information, and</li><li>the use or disclosure is not contrary to any known wishes of that individual.</li></ul><p>The requirement to consider whether obtaining consent is reasonable or practicable recognises that:</p><ul><li>the whereabouts of an individual only needs to be unknown to the locating entity in order for that individual to be considered a ‘person reported as missing’ under the Rule.<a href="#_ftn11" name="_ftnref11" title="">[11]</a> If the APP entity knows the whereabouts of the person reported as missing, it may be reasonable and practicable to obtain their consent</li><li>the person reported as missing may have exercised their free choice to disassociate themselves from friends and family for legitimate reasons, including removing themselves from harmful environments.</li></ul><p>This approach is consistent with the emphasis of the Privacy Act of the importance of an individual’s control over how their personal information is handled.</p><p>Consent is defined in the Privacy Act as ‘express consent or implied consent’ (s 6(1)). An APP entity may use or disclose personal information if the individual consents to that use or disclosure (APP 6.1(a)). Further guidance about the elements of consent, including assessing an individual’s capacity to consent, can be found in the OAIC’s APP guidelines (Chapter B (Key concepts) and Chapter 6 (APP 6)).</p><h5>Unreasonable or impracticable to obtain consent</h5><p>An APP entity should be able to point to one or more clear reasons that make it unreasonable or impracticable to obtain an individual’s consent. Relevant considerations may include:</p><ul><li>the ability to contact the individual to obtain consent. For example, it may be impracticable to obtain consent if the individual’s location is unknown after reasonable enquiries have been made, or if they cannot be contacted for another reason</li><li>the potential consequences for the individual associated with any delay to the disclosure of the information to the locating entity. For example, where there is concern for the safety and welfare of the person reported as missing, the urgency of the situation and level of potential threat may require use or disclosure before it is possible to seek consent</li><li>the possible adverse consequences for an individual if their consent is not obtained before the use or disclosure — it may be more difficult for an entity to establish that it was unreasonable or impracticable to obtain the individual’s consent as the risk of adversity increases</li><li>the capacity of the person reported as missing to give consent. For example, it may be unreasonable or impracticable to obtain consent where the person reported as missing is incapable of communicating consent because of their physical state, their psychological state, or their age. Capacity is discussed as part of ‘consent’ in Chapter B (Key concepts) of the OAIC’s APP guidelines.</li><li>the inconvenience, time and cost involved – however, an entity is not excused from obtaining consent by reason only that it would be inconvenient, time-consuming or impose some cost to do so. Whether these factors make it impracticable to obtain consent will depend on whether the burden is excessive in all the circumstances.</li></ul><h4>Known wishes of the individual</h4><p>An APP entity must not use or disclose the personal information of a person reported as missing if the use or disclosure is contrary to any wish expressed by the person reported as missing of which the APP entity is aware. The wishes of the person reported as missing need not have been communicated in writing.</p><p>Examples of when an APP entity may be aware of an individual’s wishes will depend on the circumstances, but will include where the individual has specifically requested that the APP entity does not use or disclose their personal information.</p><h3>Written note of disclosure</h3><p>If an APP entity discloses personal information in accordance with the Rule, the entity must make a written note of the disclosure (subsection 6(2)). On each occasion that an APP entity discloses the personal information of a person reported as missing, a note (either electronic or hard copy) of the disclosure must be included on that individual’s record.</p><p>The APP entity could include the following details in that note:</p><ul><li>the date of the disclosure</li><li>details of the personal information that was disclosed</li><li>which locating entity the information was disclosed to</li><li>the basis for the entity’s ‘reasonable belief’ that the information was reasonably necessary to assist to locate the person reported as missing. This will help the entity assure itself that the disclosure is in accordance with the Rule, and it may be a useful reference if the entity later needs to justify its reasonable belief.</li></ul><p>This requirement does not apply where a law prohibits the APP entity from making such a record.</p><p>After a person reported as missing has been located, any subsequent use and disclosure of that person’s personal information must comply with APP 6 and other obligations under the APPs more broadly.</p><h2>Key concepts</h2><p>This section outlines some key words and phrases that are defined or used in PGS 3 and the Rule.</p><h3>Contact or proof of life information</h3><p>The Rule specifies that the sensitive information that is collected, or the personal information that is used or disclosed must be limited to the extent reasonably necessary to make contact with, or to offer proof of life of, the person reported as missing.</p><p>This limitation recognises that the purpose of the collection, use or disclosure under the exception in PGS 3 and the Rule is to assist a locating entity to locate a person reported as missing. The personal information that is handled under PGS 3 and the Rule should be limited to that which is necessary to achieve this purpose. An APP entity should be mindful of this purpose when assessing whether the personal information is reasonably necessary to make contact with, or to offer proof of life of, the individual. In particular, an APP entity and/or locating entity should consider whether the personal information is likely to practically assist a locating entity to locate the person reported as missing. The information may not, on its own, lead to the location of the individual, however it may provide the locating entity with valuable knowledge, for example, the State or Territory that the individual is believed to be currently or recently resident in, or whether there is a record of the individual’s entry to or exit from Australia.</p><p>Examples of personal information that is likely to be reasonably necessary to make contact with, or to offer proof of life, of the person reported as missing will depend on the circumstances, but may include:</p><ul><li>the last known address or contact details of the individual, including a telephone number or email address</li><li>photographic identification (however, an APP entity is not permitted to use or disclose a government related identifier under the Rule. Any copy of the photographic identification of a person reported as missing must not contain a government related identifier of that individual, such as a driver licence number or passport number, unless permitted under APP 9)</li><li>bank or utility bills</li><li>record of entry to or exit from Australia</li><li>evidence of recent contact with an APP entity</li><li>the presence of the individual on a list of survivors from a particular disaster or incident.</li></ul><h3>Locating entity</h3><p>Only an APP entity that is a locating entity may collect sensitive information under the Rule. An APP entity may only use or disclose personal information under the Rule if it is in response to a request from a locating entity.</p><p>The term ‘locating entity’ is defined in the Rule. A ‘locating entity’ means:</p><ul><li>the Australian Federal Police</li><li>a police force or service of a State or Territory</li><li>the Australian Red Cross Society</li><li>International Social Service Australia</li><li>a Link-Up Service of a State or Territory</li><li>Department of Foreign Affairs and Trade.</li></ul><p>The locating entities are the key entities involved in locating persons reported as missing in Australia, or Australians reported as missing overseas. By listing these entities in the Rule, the OAIC does not endorse the information handling practices or searching processes undertaken by these entities, but seeks to provide clarity to APP entities that wish to collect sensitive information or use or disclose personal information in accordance with this Rule.</p><p>In general terms, these locating entities have the following characteristics in common:</p><ul><li>They have acceptance as an authority for investigating or searching for persons reported as missing by the community of search entities and support groups for family and friends of missing persons.</li><li>Their investigations into or searches for a person reported as missing are triggered by a concern for the person’s safety and wellbeing, or for the purpose of reuniting the person with their family.</li><li>They have information handling policies that require that the locating entity does not disclose information about the whereabouts of a person reported as missing to another individual or entity, without the consent of the person reported as missing.</li></ul><p>It is open to the OAIC to reconsider an entity’s status as a locating entity under the Rules.</p><h3>Person reported as missing</h3><p>The Rule regulates how an APP entity may collect sensitive information, or use or disclose personal information, where the entity reasonably believes that the collection, use or disclosure is reasonably necessary to assist a locating entity to locate a ‘person reported as missing’.</p><p>A person reported as missing is defined in the Rule to mean an individual:</p><blockquote><p>(a) who has been reported as missing to a locating entity, and</p><p>(b) whose whereabouts are unknown to the locating entity</p><p>(c) who is being sought by the locating entity because there are serious concerns for their safety and/or welfare or for the purpose of re-uniting them with their the family</p><p>but does not include an individual who is being sought:</p><p>(d) in relation to legal matters, including but not limited to, debt, maintenance, support proceedings, wills, child custody, divorce or investigations into suspected criminal activity of the individual, or</p><p>(e) for the purpose of genealogical research.</p></blockquote><p>There are a number of elements to this definition that must be satisfied for an individual to be considered as a ‘person reported as missing’ for the purposes of the Rule:</p><ul><li>the individual must have been reported as missing to a locating entity. The report may be made to any locating entity. An official missing person report to a police force of a State or Territory is not required for the purposes of the Rule (although, as a locating entity, the existence of a report to a police force of a State or Territory may satisfy the definition of ‘person reported as missing’)</li><li>the individual’s whereabouts must be unknown to the locating entity who receives the report. Another individual or entity may know the whereabouts of the individual, however this does not mean that the individual is not a ‘person reported as missing’</li><li>the individual must be sought because there are serious concerns for their safety and welfare or for the purpose of re-uniting them with their family. The terms ‘family’ and ‘child’ (used in the definition of ‘family’) are defined in the Rule</li><li>the individual must not be sought in relation to a legal matter or for the purpose of genealogical research.  These matters are excluded because the Commissioner considers them to be outside of the scope of PGS 3. An APP entity may be able to rely on other exceptions to APP 3 and APP 6 to collect, use or disclose personal information for these purposes.</li></ul><h3>Reasonable, Reasonably<a href="#_ftn12" name="_ftnref12" title=""><strong>[12]</strong></a></h3><p>A ‘reasonableness’ test is included in several sections of the Rule. An APP entity must form a ‘reasonable belief’ that the collection, use or disclosure is ‘reasonably necessary’. ‘Reasonable belief’ and ‘reasonably necessary’ are discussed further below.</p><p>‘Reasonable’ and ‘reasonably’ are not defined in the Privacy Act. The terms bear their ordinary meaning, as being based upon or according to reason and capable of sound explanation. What is reasonable is a question of fact in each individual case. It is an objective test that has regard to how a reasonable person, who is properly informed, would be expected to act in the circumstances. What is reasonable can be influenced by current standards and practices.<a href="#_ftn13" name="_ftnref13" title="">[13]</a> It is the responsibility of an APP entity to be able to justify that its conduct was reasonable. In a related context, the High Court has observed that whether there are ‘reasonable grounds’ to support a course of action ‘requires the existence of facts which are sufficient to [persuade] a reasonable person’;<a href="#_ftn14" name="_ftnref14" title="">[14]</a> it ‘involves an evaluation of the known facts, circumstances and considerations which may bear rationally upon the issue in question’.<a href="#_ftn15" name="_ftnref15" title="">[15]</a> As that indicates, there may be a conflicting range of objective circumstances to be considered, and the factors in support of a conclusion should outweigh those against.</p><h3>Reasonably believes<a href="#_ftn16" name="_ftnref16" title=""><strong>[16]</strong></a></h3><p>The Rule requires an APP entity to have a ‘reasonable belief’ that the collection, use or disclosure is reasonably necessary to assist a locating entity to locate a person reported as missing.</p><p>The phrase ‘reasonable belief’ is to be applied in the same manner as ‘reasonable’ and ‘reasonably’. That is, the APP entity must have a reasonable basis for the belief, and not merely a genuine or subjective belief. The requirement for a reasonable belief precludes arbitrary action, but may still leave something to surmise or conjecture.<a href="#_ftn17" name="_ftnref17" title="">[17]</a> It is the responsibility of an entity to be able to justify its reasonable belief.</p><h3>Reasonably necessary<a href="#_ftn18" name="_ftnref18" title=""><strong>[18]</strong></a></h3><p>An APP entity may only use or disclose personal information about a person reported as missing if it is ‘reasonably necessary’ to assist a locating entity to locate the individual. The type of personal information that may be collected, used or disclosed under the Rule is limited to information that is ‘reasonably necessary’ to make contact with, or offer proof of life of, the person reported as missing.</p><p>The term ‘reasonable’ is discussed above. ‘Necessary’ is not defined in the Privacy Act. The High Court of Australia has noted that ‘there is, in Australia, a long history of judicial and legislative use of the term ’necessary’, not as meaning essential or indispensable, but as meaning reasonably appropriate and adapted’.<a href="#_ftn19" name="_ftnref19" title="">[19]</a> However, in the context of the Rule, it would not be sufficient if the collection, use or disclosure is merely helpful, desirable or convenient.</p><p>The ‘reasonably necessary’ test is an objective test: whether a reasonable person who is properly informed would agree that the collection, use or disclosure is necessary. It is the responsibility of an APP entity to be able to justify that the particular collection, use or disclosure is reasonably necessary.</p><p>The test must be applied in a practical sense. For example, if an APP entity cannot in practice effectively assist a locating entity to locate the person reported as missing without using or disclosing the individual’s personal information, the use or disclosure would usually be considered reasonably necessary. However, a collection, use or disclosure of personal information will not usually be considered reasonably necessary if there are reasonable alternatives available.</p><h3>Serious threat to the life, health or safety of any individual<a href="#_ftn20" name="_ftnref20" title=""><strong>[20]</strong></a></h3><p>An APP entity must not collect, use or disclose personal information about an individual if the APP entity reasonably believes that the collection, use or disclosure would pose a serious threat to the life, health or safety of any individual.</p><p>The threat may be to the person reported as missing or to another person. It may also be a threat of serious harm to an unspecified individual, such as a threat to inflict harm randomly.</p><p>A ‘serious’ threat is one that poses a significant danger to an individual or individuals. The likelihood of a threat occurring as well as the consequences if the threat materialises are both relevant. A threat that may have dire consequences but is highly unlikely to occur would not normally constitute a serious threat. On the other hand, a potentially harmful threat that is likely to occur, but at an uncertain time, may be a serious threat.</p><p>A serious threat to life, health or safety can include a threat to an individual’s physical or mental health and safety. It could include a potentially life threatening situation or one that might reasonably result in other serious injury or illness. The permitted general situation would not ordinarily extend to a threat to an individual’s finances or reputation.</p> </div> <div class="footnotes"><h2 id="footnotes">Footnotes</h2><p><a name="_ftn1" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref1">[1]</a> See the <em>Privacy Act 1988</em>, Schedule 1, Federal Register of Legislation website <https://www.legislation.gov.au>.</p><p><a name="_ftn2" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref2">[2]</a> The APPs also apply to Norfolk Island agencies.</p><p><a name="_ftn3" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref3">[3]</a> See OAIC website <www.oaic.gov.au>.</p><p><a name="_ftn4" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref4">[4]</a> Guidance about the Permitted General Situations is in Chapter C, APP guidelines.</p><p><a name="_ftn5" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref5">[5]</a> ‘APP entity’ is defined in s 6(1) of the Privacy Act as an ‘agency or organisation’. ‘Agency’ is defined in s 6(1) and ‘organisation’ is defined in s 6C.</p><p><a name="_ftn6" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref6">[6]</a> See Note to clause 6 and OAIC, <em>APP guidelines</em>, OAIC website <www.oaic.gov.au>.</p><p><a name="_ftn7" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref7">[7]</a> APP 3 sets out when an APP entity may collect personal information (including sensitive information) in other circumstances.</p><p><a name="_ftn8" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref8">[8]</a> OAIC, APP guidelines: Chapter 11 (APP 11),OAIC website <www.oaic.gov.au>.</p><p><a name="_ftn9" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref9">[9]</a> The Rule only relates to the collection of sensitive information by a locating entity.</p><p><a name="_ftn10" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref10">[10]</a> OAIC, APP guidelines: Chapter 11 (APP 11),OAIC website <www.oaic.gov.au>.</p><div><p><a name="_ftn11" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref11">[11]</a> ‘Person reported as missing’ is defined in s 4(2) of the Rule as an individual:</p><ol type="a"><li>who has been reported as missing to a locating body</li><li>whose whereabouts are unknown to the locating body, and</li><li>who is being sought by the locating body because there are serious concerns for their safety and/or welfare or for the purpose of re-uniting them with their family</li></ol><p>but does not include an individual who is being sought:</p><ol type="a" start="4"><li>in relation to legal matters, including but not limited to, debt, maintenance, support proceedings, wills, child custody, divorce or investigations into suspected criminal activity of the individual, or</li><li>for the purpose of genealogical research.</li></ol></div><p><a name="_ftn12" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref12">[12]</a> Discussion of the terms ‘reasonable’ and ‘reasonably’ in this guide comes from the OAIC’s APP guidelines: Chapter B (Key concepts), OAIC website <www.oaic.gov.au>.</p><p><a name="_ftn13" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref13">[13]</a> For example, Jones v Bartlett [2000] HCA 56 [57] – [58] (Gleeson CJ); Bankstown Foundry Pty Ltd v Braistina [1986] HCA 20 [12] (Mason, Wilson and Dawson JJ).</p><p><a name="_ftn14" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref14">[14]</a> George v Rockett (1990) 170 CLR 104 at 112 (Mason CJ, Brennan, Deane, Dawson, Toohey, Gaudron & McHugh JJ).</p><p><a name="_ftn15" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref15">[15]</a> McKinnon v Secretary, Department of Treasury (2006) 228 CLR 423 at 430 (Gleeson CJ & Kirby J).</p><p><a name="_ftn16" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref16">[16]</a> Discussion of the term ‘reasonable belief’ in this Guide comes from the OAIC’s APP guidelines: Chapter B (Key concepts), OAIC website <www.oaic.gov.au>.</p><p><a name="_ftn17" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref17">[17]</a> George v Rockett (1990) 170 CLR 104 at 112, 116.</p><p><a name="_ftn18" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref18">[18]</a> Discussion of the term ‘reasonably necessary’ in this guide comes from the OAIC’s APP guidelines: Chapter B (Key concepts), OAIC website <www.oaic.gov.au>.</p><p><a name="_ftn19" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref19">[19]</a> Mulholland v Australian Electoral Commissioner [2004] HCA 41 [39] (Gleeson CJ).</p><p><a name="_ftn20" href="https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-the-privacy-persons-reported-as-missing-rule-2024#_ftnref20">[20]</a> Discussion of ‘serious threat to the life, health or safety of any individual’ in this guide comes from the OAIC’s APP guidelines: Chapter C (Permitted general situations), OAIC website <www.oaic.gov.au>.</p></div> </div>   </main>   <div class="footer"> <div class="footer__upper"> <div class="footer__upper--wrapper"> <div class="back-to-top__wrapper"> <button class="back-to-top" aria-label="Back to top"> <svg class="back-to-top__icon" aria-hidden="true" focusable="false" width="28" height="47" viewBox="0 0 28 47" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6 8.82715L14 1.00106" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><path d="M22 8.82715L14 1.00106" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><path d="M14 21L14 1" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><path d="M2.94 41V33.41H0.36V31.25H8.1V33.41H5.52V41H2.94ZM13.2027 41.18C12.5227 41.18 11.9027 41.065 11.3427 40.835C10.7927 40.605 10.3177 40.275 9.9177 39.845C9.5277 39.405 9.2227 38.87 9.0027 38.24C8.7827 37.6 8.6727 36.88 8.6727 36.08C8.6727 35.28 8.7827 34.57 9.0027 33.95C9.2227 33.32 9.5277 32.795 9.9177 32.375C10.3177 31.945 10.7927 31.62 11.3427 31.4C11.9027 31.18 12.5227 31.07 13.2027 31.07C13.8727 31.07 14.4877 31.18 15.0477 31.4C15.6077 31.62 16.0827 31.945 16.4727 32.375C16.8727 32.805 17.1827 33.33 17.4027 33.95C17.6227 34.57 17.7327 35.28 17.7327 36.08C17.7327 36.88 17.6227 37.6 17.4027 38.24C17.1827 38.87 16.8727 39.405 16.4727 39.845C16.0827 40.275 15.6077 40.605 15.0477 40.835C14.4877 41.065 13.8727 41.18 13.2027 41.18ZM13.2027 38.96C13.7927 38.96 14.2527 38.705 14.5827 38.195C14.9227 37.675 15.0927 36.97 15.0927 36.08C15.0927 35.19 14.9227 34.505 14.5827 34.025C14.2527 33.535 13.7927 33.29 13.2027 33.29C12.6127 33.29 12.1477 33.535 11.8077 34.025C11.4777 34.505 11.3127 35.19 11.3127 36.08C11.3127 36.97 11.4777 37.675 11.8077 38.195C12.1477 38.705 12.6127 38.96 13.2027 38.96ZM19.4784 41V31.25H23.0484C23.5784 31.25 24.0834 31.305 24.5634 31.415C25.0434 31.515 25.4634 31.695 25.8234 31.955C26.1834 32.205 26.4684 32.54 26.6784 32.96C26.8984 33.37 27.0084 33.88 27.0084 34.49C27.0084 35.09 26.8984 35.605 26.6784 36.035C26.4684 36.465 26.1834 36.82 25.8234 37.1C25.4634 37.37 25.0484 37.575 24.5784 37.715C24.1084 37.845 23.6184 37.91 23.1084 37.91H22.0584V41H19.4784ZM22.0584 35.87H22.9884C23.4984 35.87 23.8734 35.75 24.1134 35.51C24.3634 35.27 24.4884 34.93 24.4884 34.49C24.4884 34.05 24.3534 33.74 24.0834 33.56C23.8134 33.38 23.4284 33.29 22.9284 33.29H22.0584V35.87Z" fill="white"/></svg> </button> </div> <div class="footer__logo-group"> <img src="https://www.oaic.gov.au/__data/assets/file/0020/12962/logo.svg" class="logo--main" alt="OAIC logo"> <a href="https://www.oaic.gov.au/about-the-OAIC/access-our-information/freedom-of-information-requests-to-the-oaic" class="footer-logo" aria-label="OAIC sub-logo"> <img src="https://www.oaic.gov.au/__data/assets/file/0021/12963/logo2.svg" class="logo--sub" alt="OAIC sub logo"> </a> <a href="https://www.oaic.gov.au/about-the-OAIC/access-our-information/our-information-publication-scheme" class="footer-logo" aria-label="OAIC Information Publication Scheme"> <img src="https://www.oaic.gov.au/__data/assets/image/0026/91385/ips_white_text.png" class="logo--sub" width="120px" alt="Information Publication Scheme"> </a> </div><div class="footer__link-group"> <ul class="link-list"> <li><a href="https://www.oaic.gov.au/sitemap" class="footer-link" aria-label="Site map">Site map</a></li><li><a href="https://www.oaic.gov.au/about-the-OAIC/copyright" class="footer-link" aria-label="Copyright">Copyright</a></li><li><a href="https://www.oaic.gov.au/about-the-OAIC/terms-and-conditions" class="footer-link" aria-label="Terms and conditions">Terms and conditions</a></li><li><a href="https://www.oaic.gov.au/about-the-OAIC/our-corporate-information/plans-policies-and-procedures/privacy-policy" class="footer-link" aria-label="Privacy policy">Privacy policy</a></li><li><a href="https://www.oaic.gov.au/about-the-OAIC/accessibility" class="footer-link" aria-label="Accessibility">Accessibility</a></li> </ul> </div> </div> </div> <div class="footer__lower"> <div class="footer__util-group"> <div class="footer__contact"> <a href="https://www.oaic.gov.au/contact-us" class="contact--link" aria-label="Contact us">Contact us</a> <a href="tel:1300 363 992" class="contact--phone" aria-label="Call 1300 363 992">1300 363 992</a> <p class="contact--hours">Monday to Thursday 10 am to 4 pm (AEST/AEDT)</p> </div> <div id="footer_language_listing_13517"> <div class="footer__language-list"> <label for="languages">Translations</label> <select name="languages" id="languages" onChange="if (this.value.startsWith('https://www.oaic.gov.au')) window.location = this.value;"> <option value="">Please select…</option> <option lang="ar" value="https://www.oaic.gov.au/engage-with-us/translations/arabic">العربية</option><option lang="zh" value="https://www.oaic.gov.au/engage-with-us/translations/chinese">中文</option><option lang="el" value="https://www.oaic.gov.au/engage-with-us/translations/greek">ελληνικός</option><option lang="it" value="https://www.oaic.gov.au/engage-with-us/translations/italian">Italiano</option><option lang="es" value="https://www.oaic.gov.au/engage-with-us/translations/spanish">Español</option><option lang="th" value="https://www.oaic.gov.au/engage-with-us/translations/thai">ไทย</option><option lang="vi" value="https://www.oaic.gov.au/engage-with-us/translations/vietnamese">Tiếng Việt</option><option lang="EN" value="https://www.oaic.gov.au/engage-with-us/translations/easy-english">Easy English</option> </select> </div> </div> <div class="footer__social"> <p class="social--header">Follow us</p> <ul class="social-list"> <li> <a href="https://www.facebook.com/OAICgov" class="social-link social-link--facebook" aria-label="OAIC on Facebook"> <img class="social-icon" src="https://www.oaic.gov.au/__data/assets/file/0025/12958/facebook.svg" alt="OAIC on Facebook"> </a> </li> <li> <a href="https://twitter.com/OAICgov" class="social-link social-link--twitter" aria-label="OAIC on Twitter" > <img class="social-icon" src="https://www.oaic.gov.au/__data/assets/file/0026/12959/x-logo.svg" alt="OAIC on Twitter"> </a> </li> <li> <a href="https://www.youtube.com/user/oaicgov" class="social-link social-link--youtube" aria-label="OAIC on Youtube" > <img class="social-icon" src="https://www.oaic.gov.au/__data/assets/file/0018/12960/youtube.svg" alt="OAIC on Youtube"> </a> </li> <li> <a href="https://au.linkedin.com/company/office-of-the-australian-information-commissioner" class="social-link social-link--linkedin" aria-label="OAIC on Linkedin"> <img class="social-icon" src="https://www.oaic.gov.au/__data/assets/file/0019/12961/linkedin.svg" alt="OAIC on Linkedin"> </a> </li> <li> <a href="https://www.instagram.com/oaicgov/" class="social-link social-link--Instagram" aria-label="OAIC on Instagram" > <img class="social-icon" src="https://www.oaic.gov.au/__data/assets/file/0023/91364/Instagram_Glyph_White.svg" alt="OAIC on Instagram"> </a> </li> </ul> </div> </div> <div class="footer__content-group"> <p class="footer__content-header">Acknowledgement of Country</p> <p class="footer__content-text">The OAIC acknowledges Traditional Custodians of Country across Australia and their continuing connection to land, waters and communities. We pay our respect to First Nations people, cultures and Elders past and present.</p> <p class="footer__content-copyright">© Commonwealth of Australia</p> </div> </div> </div>   </div>   <div id="footer_js" style="display: none !important;"> <script src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/js/runtime.js?h=06ed308"></script> <script src="https://www.oaic.gov.au/__data/assets/git_bridge/0012/12063/js/main.js?h=06ed308"></script> <script src="https://www.oaic.gov.au/__data/assets/js_file/0025/242791/custom.js"></script> <script> var lhsWrapper = document.querySelector('.lhs-wrapper'); if(lhsWrapper) { lhsWrapper.innerHTML.trim() === '' ? lhsWrapper.style.display='none' : ''; } //Readpeaker function readSpeaker() { var readButtonContent = ` <div id="readspeaker_button1" class="rs_skip rsbtn rs_preserve"> <a rel="nofollow" class="rsbtn_play" accesskey="L" title="Listen to this page using ReadSpeaker webReader" href="//app-oc.readspeaker.com/cgi-bin/rsent?customerid=9755&lang=en_au&readclass=page-content&url=https%3A%2F%2Fwww.oaic.gov.au%2Fprivacy%2Fprivacy-guidance-for-organisations-and-government-agencies%2Fhandling-personal-information%2Fguide-to-the-privacy-persons-reported-as-missing-rule-2024"> <span class="rsbtn_left rsimg rspart"><span class="rsbtn_text"><span>Listen</span></span></span> <span class="rsbtn_right rsimg rsplay rspart"></span> </a> </div>`; var readButtonSearch = ` <div id="readspeaker_button2" class="rs_skip rsbtn rs_preserve"> <a rel="nofollow" class="rsbtn_play" accesskey="L" title="Listen to this page using ReadSpeaker webReader" href="//app-oc.readspeaker.com/cgi-bin/rsent?customerid=9755&lang=en_au&readclass=search-content&url=https%3A%2F%2Fwww.oaic.gov.au%2Fprivacy%2Fprivacy-guidance-for-organisations-and-government-agencies%2Fhandling-personal-information%2Fguide-to-the-privacy-persons-reported-as-missing-rule-2024"> <span class="rsbtn_left rsimg rspart"><span class="rsbtn_text"><span>Listen</span></span></span> <span class="rsbtn_right rsimg rsplay rspart"></span> </a> </div>`; //for content pages var pageContent = document.querySelector('.page-content'); //for search pages var pageSearch = document.querySelector('.search-content'); if(pageContent) pageContent.insertAdjacentHTML('afterbegin', readButtonContent); if(pageSearch) pageSearch.insertAdjacentHTML('afterbegin', readButtonSearch); } readSpeaker(); </script> <script> function feedbackGrepCallback(response) { if (response.length > 0) { document.querySelector(".feedback__submit input").disabled = false } } function feedbackGrepExpiredCallback(response) { if (!response) { document.querySelector(".feedback__submit input").disabled = true } } </script> </div> <style> .page-content section.banner-grey-newsroom__wrapper, .page-content section.landing-page { display: none; } </style>   </body> </html>

CINXE.COM

Guide to the Privacy (Persons Reported as Missing) Rule 2024 | OAIC