What’s a ‘serious threat’?
In the Privacy Act 2020, Principles 2, 10 and 11 each have an exception that applies if the collection, use or disclosure of personal information is necessary to prevent or lessen a serious threat to the life, health, or safety of any individual, or to public health or public safety.
Generally, the exception is used to prevent or lessen a serious threat to the life or health of an individual. The exception can also apply where there is a serious threat to public health (e.g. a pandemic or public health emergency). You can read more about the serious threat to public health exception on our blog here.
Whether a threat is serious depends on three criteria. Not all three factors have to be present in order for a threat to be serious. The test is what a reasonable person would consider to be serious in the circumstances.
The three factors to be considered are:
- the likelihood of the threat occuring (is there a good chance this thing will actually happen?); and
- the severity of the consequences if the threat occurs (if it happens, how bad will it be?); and
- the time at which the threat might occur (how soon could this happen?).
Under principle 11, you should only disclose information to the person, body or agency which is able to do something to prevent or lessen the threat. You should also disclose only the information you need to make it clear why you believe there is a serious threat.
For more information, see:
- Releasing personal information to Police and law enforcement agencies
- Blog – Safety comes first
- Inquiry into use and disclosure of Covid-19 patient information
Updated December 2020