1. Presentation to the Local Authorities Revenue Management Association – October 2012 The role of the Office of the Information Commissioner

2. Today’s presentation 1.The role of the OIC 2.Overview of the RTI Act and IP Act 3.Important privacy concepts 4.Resources 5.Where to go for help

3. What is the OIC? Independent statutory body Established under the Right to Information Act 2009 (Qld) (RTI Act) and the Information Privacy Act 2009 (Qld) (IP Act) Promotes access to government-held information and protects people’s personal information held by the public sector.

4. OIC structure Queensland community Queensland Parliament Legal Affairs and Community Safety Committee Information Commissioner RTI Commissioner Privacy Commissioner First Assistant Information Commissioner Manager, Corporate & Executive Services External Review Privacy functions (IP Act) Info and Assistance Performance Monitoring Training and stakeholder relations Corporate and business support

5. Decision-making functions OIC conducts independent merits reviews of RTI and IP decisions Reconsideration of all aspects of the original decision Encourages early and informal resolution Can require agencies to hand over documents Can examine witnesses under oath or affirmation

6. Privacy functions Privacy complaints Referral to QCAT if cannot be mediated Waive or modify privacy principles obligations Issue compliance notices if agency has contravened privacy obligations

7. Support functions Promotes awareness of the RTI and IP Acts Provides information and assistance to agencies and public Produces guidelines to assist with interpretation of the RTI and IP Acts Monitors and reports on agency compliance Conducts training and education programs

8. RTI Act: A new approach

9. Push model: Government information will be released administratively as a matter of course, unless there is a good reason not to, with applications under this Act being necessary only as a last resort - Preamble to the Right to Information Act 2009 (Qld)

10. Important privacy concepts Object of the IP Act: to provide for the fair collection and handling of personal information in the public sector environment AND a right of amendment. Agencies are obliged to comply with the privacy principles when handling personal information: Information Privacy Principles (IPPs) Transfer out of Australia rules Contracted service provider rules

11. IPPs Set of rules about how agencies must: Collect Store Use Disclose Handle Dispose of the personal information they hold

12. Transfer out of Australia Risk that personal information may not be appropriately protected S.33 IPA only allows transfer in certain situations eg where individual agrees Consider s.33 before placing personal information online or transferring/collecting it over the internet  eg cloud computing, social networking, online survey tools

13. Contracted service providers Agency should ensure contractor is required to comply with the IP Act. Once bound, the contracted service provider assumes the privacy obligations as if it were the agency.

14. Consequences of a privacy breach Privacy complaints – QCAT can make compensation orders of up to $100,000 Information Commissioner can issue compliance notices, conduct reviews into PI practices and report to Parliament These powers extend to bound contracted service providers

15. Training Online information privacy training now available – contact our Training and Stakeholder Relations team for more details and to register: training@oic.qld.gov.au

16. Support OIC Enquiries Service 3234 7373 enquiries@oic.qld.gov.au Guidelines and other resources available on OIC website: www.oic.qld.gov.au

17. Questions?