1. APP entities (organisations)
Privacy law reform for
APP entities (organisations)

2. Privacy Awareness Week

3. Asia Pacific Privacy Authorities

4. What does the Privacy Act cover?
Privacy Act 1988 provides for the protection of an individual’s personal information
Privacy Act contains provisions that deal with:
‘personal information’
‘sensitive information’ (such as health information)
tax file numbers
credit information

5. Privacy law reform — outline
Privacy Amendment (Enhancing Privacy Protection) Act 2012
New Australian Privacy Principles (or APPs)
Enhanced powers of the Commissioner
How to prepare for the changes

6. Australian Privacy Principles
13 new APPs to replace IPPs and NPPs
Single set of principles which apply to both public and private sectors
Government agencies and organisations are referred to as ‘APP entities’
Structured to reflect the information life cycle — collection, use and disclosure, quality and security, access and correction
Permitted general situation

7. APP 1 — Open and transparent management of personal information
Organisations must have a clearly expressed and up to date privacy policy
Organisations must take reasonable steps to implement processes that will ensure that the organisation complies with the APPs

8. APP 2 — Anonymity and pseudonymity
Allows individuals to interact with organisations by not identifying themselves
Permits the individual to use a pseudonym
Exceptions apply, such as where it is impracticable for the organisation to deal with an unidentified individual

9. APP 3 – Collection of personal and sensitive information
Outlines obligations relating to the collection of personal and sensitive information
Collection must be ‘reasonably necessary’ for one or more of an organisation’s functions or activities
Higher standards for collection of sensitive information. Some exceptions apply

10. APP 4 — Dealing with unsolicited personal information
New principle for handling unsolicited personal information
Establish if the information could have been collected under APP 3
Destroy or de-identify the information if it could not have been collected under APP 3

11. APP 5 — Notification of collection
Outlines the matters an organisation is required to inform an individual of when the organisation collects their personal information. These matters include:
Who the organisation is and how to contact it
The purpose(s) of the collection
Any collections from third parties
Consequences of non-collection
Complaint handling process
Potential overseas disclosure

12. APP 6 — Use or disclosure
Deals with use and disclosure of personal information
New additional limited exceptions, to permit use or disclosure for secondary purpose:
Locate missing person
Establish, exercise or defend a legal equitable claim
Confidential alternative dispute resolution

13. APP 7 – Direct marketing New principle dedicated to direct marketing
Prohibits the use or disclosure of personal information for direct marketing purposes, except in specified circumstances
Subject to the operation of other direct marketing legislation, eg the Spam Act 2003

14. APP 8 – Cross border disclosure
Introduces an accountability approach for cross- border disclosure
Organisations must take reasonable steps to ensure overseas recipients do not breach APPs
Organisations may be accountable for a breach of APPs by overseas recipients
Exceptions apply

15. APP 9 — Adoption, use or disclosure of government related identifiers
‘Identifiers’ and ‘government related identifier’ defined under s 6 of the Privacy Act
Prohibits an organisation from adopting, or using a government related identifier, unless an exception applies
Generally replicates the exceptions under National Privacy Principle 7, with some additions

16. APP 10 — Quality
Requires an organisation to take reasonable steps to ensure personal information it collects, uses or discloses is:
Accurate
Up-to-date
Complete
An organisation should ensure that personal information that it uses or discloses is also relevant for the purpose of the use or disclosure

17. APP 11 — Security Similar to NPP 4 Inclusion of ‘interference’
an organisation must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure
New exceptions to the requirement to destroy or de- identify personal information that is no longer needed

18. APP 12 — Access
Organisations are required to respond to requests for access of personal information within a reasonable timeframe
Access should be provided in the requested manner (where reasonable and practicable)
Written reasons for the refusal and complaint mechanism
Any charges for access to personal information must not be excessive, and must not apply to the making of the request

19. APP 13 — Correction
Organisations required to take ‘reasonable steps’ to correct personal information to ensure that it is accurate, up-to-date, complete, relevant and not misleading, if either:
organisation satisfied it needs to be corrected, or
individual requests correction
Statement required if organisation refuses to correct and individual requests statement
Organisation must respond within reasonable period
Written reasons for refusal and complaint mechanism

20. Commissioner’s new powers
Performance assessments
Code making powers
Ability to make a determination to resolve OMIs
Enforceable undertakings
Civil penalty orders
Ability to direct Privacy Impact Assessment to be conducted

21. OAIC guidance and resources

22. Stay in touch Privacy Connections
Join:
Privacy law reform breaking news available
Web & RSS: oaic.gov.au
Follow us on social media
Twitter: twitter.com/OAICgov and during PAW #2013PAW
Facebook: facebook.com/OAICgov
YouTube: youtube.com/user/OAICgov