Director, Regulation and Strategy Getting privacy right Jacob Suidgeest Director, Regulation and Strategy www.oaic.gov.au 1

Outline Office functions and jurisdiction The co Office functions and jurisdiction Costs to business of getting privacy wrong Securing personal information Disclosure of personal information www.oaic.gov.au 2

Office of the Australian Information Commissioner (OAIC) The co Extensive range of functions in Freedom of Information, Information Policy and Privacy Privacy functions drawn from the Privacy Act 1988 OAIC may be replaced by an Office of the Privacy Commissioner www.oaic.gov.au 3

What does the Privacy Act cover The co Privacy Act 1988 provides for the protection of an individual’s personal information Privacy Act contains provisions that deal with: ‘personal information’ ‘sensitive information’ (which includes health information) The OAIC also regulates: credit reporting information, TFNs, Healthcare Identifiers, Personally Controlled Electronic Health Records www.oaic.gov.au 4

Who does the Privacy Act cover The co Australian Government agencies Businesses with turnover of more than $3 million All private health service providers Exemptions: employee records, some small business, media Others relating to credit reporting, healthcare identifiers, PCEHR, TFNs www.oaic.gov.au 5

Australian Privacy Principles The co 13 APPs replace IPPs and NPPs Single set of principles APPs apply to both private and public sectors – called ‘APP entities’ Structured to reflect the information life cycle from organisational preparedness, collection, through to use and disclosure, security and access and correction www.oaic.gov.au 6

Recent data breaches The co ‘80 Million Anthem customers hacked in data breach’ News8 ‘DNA test names exposed online’ The Australian ‘Medical records discovered in garden shed after robbery’ IT News www.oaic.gov.au 7

Community expectations The co 90% of Australians continue to be concerned about their personal information being sent overseas 95% of people say that they should be informed how their information is handled and protected, and if it is lost 74% of Australians are more concerned about the privacy of their personal information in the online environment than they were 5 years ago 63% of Australians have chosen to not deal with a public or private sector organisation due to concerns about the way their personal information is used or protected www.oaic.gov.au 8

Securing personal information The co Entities must account for the Human element Mobile devices and bring your own devices Trusted insider risk Embedding privacy into projects www.oaic.gov.au 9

Use and disclosure Is it personal information? means information or an opinion about an identified individual, or an individual who is reasonably identifiable…… www.oaic.gov.au 10

Use and disclosure APP 6 says you can use or disclose information for the primary purpose for which it was collected. To use it for a secondary purpose an exception must apply. www.oaic.gov.au 11

Use and disclosure APP 6.1(a) consent APP 6.2(a) -The individual would reasonably expect that secondary use or disclosure and - the use or disclosure is related (directly related for sensitive information) to the primary purpose of collection www.oaic.gov.au 12

Use and disclosure APP 6.2(b) use or disclosure is required or authorised by law APP 6.2(e) the APP entity reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body. www.oaic.gov.au 13

Use and disclosure s16A permitted situation 2: the entity has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the entity's functions or activities has been, is being or may be engaged in; and (b) the entity reasonably believes that the collection, use or disclosure is necessary in order for the entity to take appropriate action in relation to the matter. www.oaic.gov.au 14

Stay up-to-date www.oaic.gov.au Privacy Awareness Week: 3–9 May 2015 The co Privacy Awareness Week: 3–9 May 2015 APP guidelines Data breach notification guide Privacy impact assessment guide Guide to Securing Personal Information www.oaic.gov.au 15

www.oaic.gov.au www.oaic.gov.au 16