1. Director, Regulation and Strategy
Getting privacy right
Jacob Suidgeest
Director, Regulation and Strategy 1

2. Outline Office functions and jurisdiction
The co
Office functions and jurisdiction
Costs to business of getting privacy wrong
Securing personal information
Disclosure of personal information 2

3. Office of the Australian Information Commissioner (OAIC)
The co
Extensive range of functions in Freedom of Information, Information Policy and Privacy
Privacy functions drawn from the Privacy Act 1988
OAIC may be replaced by an Office of the Privacy Commissioner 3

4. What does the Privacy Act cover
The co
Privacy Act 1988 provides for the protection of an individual’s personal information
Privacy Act contains provisions that deal with:
‘personal information’
‘sensitive information’ (which includes health information)
The OAIC also regulates:
credit reporting information, TFNs, Healthcare Identifiers, Personally Controlled Electronic Health Records 4

5. Who does the Privacy Act cover
The co
Australian Government agencies
Businesses with turnover of more than $3 million
All private health service providers
Exemptions: employee records, some small business, media
Others relating to credit reporting, healthcare identifiers, PCEHR, TFNs 5

6. Australian Privacy Principles
The co
13 APPs replace IPPs and NPPs
Single set of principles
APPs apply to both private and public sectors – called ‘APP entities’
Structured to reflect the information life cycle from organisational preparedness, collection, through to use and disclosure, security and access and correction 6

7. Recent data breaches
The co
‘80 Million Anthem customers hacked in data breach’ News8
‘DNA test names exposed online’ The Australian
‘Medical records discovered in garden shed after robbery’ IT News 7

8. Community expectations
The co
90% of Australians continue to be concerned about their personal information being sent overseas
95% of people say that they should be informed how their information is handled and protected, and if it is lost
74% of Australians are more concerned about the privacy of their personal information in the online environment than they were 5 years ago
63% of Australians have chosen to not deal with a public or private sector organisation due to concerns about the way their personal information is used or protected 8

9. Securing personal information
The co
Entities must account for the Human element
Mobile devices and bring your own devices
Trusted insider risk
Embedding privacy into projects 9

10. Use and disclosure Is it personal information?
means information or an opinion about an identified individual, or an individual who is reasonably identifiable…… 10

11. Use and disclosure
APP 6 says you can use or disclose information for the primary purpose for which it was collected. To use it for a secondary purpose an exception must apply. 11

12. Use and disclosure APP 6.1(a) consent
APP 6.2(a) -The individual would reasonably expect that secondary use or disclosure and
- the use or disclosure is related (directly related for sensitive information) to the primary purpose of collection 12

13. Use and disclosure
APP 6.2(b) use or disclosure is required or authorised by law
APP 6.2(e) the APP entity reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body. 13

14. Use and disclosure s16A permitted situation 2:
the entity has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the entity's functions or activities has been, is being or may be engaged in; and
(b) the entity reasonably believes that the collection, use or disclosure is necessary in order for the entity to take appropriate action in relation to the matter. 14

15. Stay up-to-date www.oaic.gov.au Privacy Awareness Week: 3–9 May 2015
The co
Privacy Awareness Week: 3–9 May 2015
APP guidelines
Data breach notification guide
Privacy impact assessment guide
Guide to Securing Personal Information 15

16. 16