Presentation is loading. Please wait.

Presentation is loading. Please wait.

Protecting information rights –­ advancing information policy Privacy law reform for APP entities (organisations)

Similar presentations

Presentation on theme: "Protecting information rights –­ advancing information policy Privacy law reform for APP entities (organisations)"— Presentation transcript:

1 Protecting information rights –­ advancing information policy Privacy law reform for APP entities (organisations)

2 Privacy Awareness Week

3 Asia Pacific Privacy Authorities

4 What does the Privacy Act cover? Privacy Act 1988 provides for the protection of an individual’s personal information Privacy Act contains provisions that deal with: – ‘personal information’ – ‘sensitive information’ (such as health information) – tax file numbers – credit information

5 Privacy Amendment (Enhancing Privacy Protection) Act 2012 New Australian Privacy Principles (or APPs) Enhanced powers of the Commissioner How to prepare for the changes Privacy law reform — outline

6 Australian Privacy Principles 13 new APPs to replace IPPs and NPPs – Single set of principles which apply to both public and private sectors – Government agencies and organisations are referred to as ‘APP entities’ – Structured to reflect the information life cycle — collection, use and disclosure, quality and security, access and correction – Permitted general situation

7 APP 1 — Open and transparent management of personal information Organisations must have a clearly expressed and up to date privacy policy Organisations must take reasonable steps to implement processes that will ensure that the organisation complies with the APPs

8 APP 2 — Anonymity and pseudonymity Allows individuals to interact with organisations by not identifying themselves Permits the individual to use a pseudonym Exceptions apply, such as where it is impracticable for the organisation to deal with an unidentified individual

9 APP 3 – Collection of personal and sensitive information Outlines obligations relating to the collection of personal and sensitive information Collection must be ‘reasonably necessary’ for one or more of an organisation’s functions or activities Higher standards for collection of sensitive information. Some exceptions apply

10 APP 4 — Dealing with unsolicited personal information New principle for handling unsolicited personal information Establish if the information could have been collected under APP 3 Destroy or de-identify the information if it could not have been collected under APP 3

11 APP 5 — Notification of collection Outlines the matters an organisation is required to inform an individual of when the organisation collects their personal information. These matters include: – Who the organisation is and how to contact it – The purpose(s) of the collection – Any collections from third parties – Consequences of non-collection – Complaint handling process – Potential overseas disclosure

12 APP 6 — Use or disclosure Deals with use and disclosure of personal information New additional limited exceptions, to permit use or disclosure for secondary purpose: – Locate missing person – Establish, exercise or defend a legal equitable claim – Confidential alternative dispute resolution

13 APP 7 – Direct marketing New principle dedicated to direct marketing Prohibits the use or disclosure of personal information for direct marketing purposes, except in specified circumstances Subject to the operation of other direct marketing legislation, eg the Spam Act 2003

14 APP 8 – Cross border disclosure Introduces an accountability approach for cross- border disclosure Organisations must take reasonable steps to ensure overseas recipients do not breach APPs Organisations may be accountable for a breach of APPs by overseas recipients Exceptions apply

15 APP 9 — Adoption, use or disclosure of government related identifiers ‘Identifiers’ and ‘government related identifier’ defined under s 6 of the Privacy Act Prohibits an organisation from adopting, or using a government related identifier, unless an exception applies Generally replicates the exceptions under National Privacy Principle 7, with some additions

16 APP 10 — Quality Requires an organisation to take reasonable steps to ensure personal information it collects, uses or discloses is: – Accurate – Up-to-date – Complete An organisation should ensure that personal information that it uses or discloses is also relevant for the purpose of the use or disclosure

17 APP 11 — Security Similar to NPP 4 Inclusion of ‘interference’ – an organisation must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure New exceptions to the requirement to destroy or de- identify personal information that is no longer needed

18 APP 12 — Access Organisations are required to respond to requests for access of personal information within a reasonable timeframe Access should be provided in the requested manner (where reasonable and practicable) Written reasons for the refusal and complaint mechanism Any charges for access to personal information must not be excessive, and must not apply to the making of the request

19 APP 13 — Correction Organisations required to take ‘reasonable steps’ to correct personal information to ensure that it is accurate, up-to-date, complete, relevant and not misleading, if either: – organisation satisfied it needs to be corrected, or – individual requests correction Statement required if organisation refuses to correct and individual requests statement Organisation must respond within reasonable period Written reasons for refusal and complaint mechanism

20 Commissioner’s new powers Performance assessments Code making powers Ability to make a determination to resolve OMIs Enforceable undertakings Civil penalty orders Ability to direct Privacy Impact Assessment to be conducted

21 OAIC guidance and resources

22 Stay in touch Privacy Connections – Join: Privacy law reform breaking news available – Web & RSS: Follow us on social media – Twitter: and during PAW – Facebook: – YouTube:

Download ppt "Protecting information rights –­ advancing information policy Privacy law reform for APP entities (organisations)"

Similar presentations

Ads by Google