Site Changes

On 1 November 2010 the Office of the Privacy Commissioner was integrated into the Office of the Australian Information Commissioner and a new website established at www.oaic.gov.au.

Note 1: Major changes to the Privacy Act 1988 will come into effect in March 2014. Agencies, businesses and not for profits need to start preparing for these changes. For more information go to our privacy law reform page at www.oaic.gov.au
Note 2: From 12 March 2013 content is no longer being added to, or amended, on this site, consequently some information may be out of date. For new privacy content visit the www.oaic.gov.au website.

Types

Topic(s): Other

Privacy Code Development (September 2001)

document icon pdf (190.16 KB)

FOREWORD

The Privacy Amendment (Private Sector) Act 2000 extends the operation of the Privacy Act 1988 to cover much of the private sector. An integral feature of the Amendment Act is the option for organisations to develop their own privacy codes, which when approved, replace compliance with the National Privacy Principles.

The co-regulatory approach offered by the legislation allows for some flexibility in how organisations approach their privacy obligations but, at the same time, ensures that minimum enforceable standards apply to the protection of personal information.

Trust will be the new weapon in winning and maintaining customer loyalty. Good privacy practices will give business a competitive edge. The development and adoption of a code by an organisation could be used to send a powerful message to consumers that the organisation is conscious of the privacy concerns of individuals and is active in protecting their privacy rights.

The recent research on community, business and government attitudes towards privacy conducted by the Office shows Australians place a high value on their privacy. It makes good business sense for many organisations to take control of their privacy obligations by the development of a code. Privacy Codes will contribute to the Office's goal of promoting an Australian culture that respects privacy.

This document will assist organisations in deciding whether it is appropriate for them to develop a privacy code. It also informs and carefully outlines the matters that will need to be addressed in the development and approval of a code.

Malcolm Crompton Federal Privacy Commissioner August 2001

Code Development Guidelines

Foreword

Summary of Code Development Guidelines

Appendices Appendix A Prescribed standards Appendix B Checklist

SUMMARY OF CODE DEVELOPMENT GUIDELINES

Section 18BB(2) sets out the matters the Commissioner must be satisfied are met before a privacy code may be approved. In deciding whether to approve a code section 18BB(4) also allows the Commissioner to consider matters specified in any guidelines issued by the Commissioner.

Where it is proposed to have complaint handling procedures under a code, section 18BB(3) sets out additional matters that the Commissioner must be satisfied are met. These matters include that the complaint handling procedures meet the prescribed standards issued by the Minister and any guidelines issued by the Commissioner.

A summary of both the Commissioner's guidelines relating to code approval and the Commissioner's guidelines relating to complaint handling procedures are provided below. Code proponents should consider these guidelines in the context of the broader document.

Guidelines relating to code approval

Consultation

1. In most cases the code proponent will be expected to allow a minimum of six weeks for public consultation where the first day of the consultation period does not start or end on a public holiday or a weekend.

2. To assist the Commissioner in deciding if members of the public have been given an adequate opportunity to comment on a draft of the code, the Commissioner requires code proponents to submit a statement of consultation with the application for code approval. This statement will need to contain the following details:

i) The beginning and ending date that the code was available for public consultation.

ii) The people or groups likely to be affected by the privacy code.

iii) The methods that were employed by the code proponent to consult with these groups.

iv) A list of the individuals or groups who made submissions to the draft code.

v) Where a draft code was changed, the details of these changes.

vi) A summary of any issues raised by individuals or groups that remain unresolved (if any).

vii) The reasons why any feedback was not incorporated into the final document.

viii) A list of organisations likely to adopt the proposed code.

Equivalence

1. The Act requires codes to incorporate all the NPPs or set out obligations that, overall, are at least the equivalent of all the obligations under the NPPs. In deciding if this condition has been met, the Commissioner requires code proponents to include a statement of claims detailing:

i) how the obligations under the code differ from the obligations under the NPPs;

ii) the rationale for the change to any obligation provided in the NPPs; and

iii) how, in the opinion of the code proponent, the obligations set out in the code are at least equivalent of all the obligations set out in the NPPs.

Explanatory material

1. The Commissioner considers it appropriate for code proponents submitting an application for code approval to include any explanatory material that has been prepared in relation to a code.

Coverage

1. In most cases the Commissioner will expect codes to make provision for the establishment and appropriate funding of a code administrator.

2. To ensure the legislative requirements are met in relation to the coverage of the code, the Commissioner requires the code to provide for the maintenance of an accurate, up to date and easily accessible record of code members. The Commissioner also requires the application to include a statement as to how this record will be maintained. Where the proposed approach does not include an online record of members with links to the Commissioner's website, the Commissioner will ordinarily expect the application to state how individuals will not be unreasonably disadvantaged by the proposed alternative system.

Voluntary membership

1. In order to be satisfied that the code is voluntary, the Commissioner will require organisations submitting an application for code approval to include a statement as to how they will ensure that agreeing to be bound by a code requires a voluntary act of an organisation. Ordinarily, it is expected that any such statement will also highlight the procedures in which an organisation can opt in and out of the code.

Code review

1. Ordinarily, the Commissioner expects codes to:

i) include a process for independent review - to occur at least once every three years;

ii) include a stated commitment to allocate sufficient resources to the review of the code; and

iii) require the code administrator to produce a response to the independent review report and to submit this response to the Commissioner, along with the review report, within 30 days of the review report being finalised.

Limited life codes

1. Where codes are to have a limited life, the Commissioner expects the code to clearly articulate when or under what circumstances it is to terminate.

2. Ordinarily, the Commissioner expects limited life codes to include arrangements for how the cessation will be communicated to consumers and to pre-establish procedures for termination.

Limited coverage

1. The Commissioner expects codes with limited coverage to clearly articulate what type of personal information, activity and/or profession the code is to cover.

Code drafting

1. The Commissioner expects codes to be written to a professional standard using language that is clear and easy for individuals to understand.

Openness and code promotion

1. The Commissioner expects codes to require code members to make available a copy of the code and any relevant explanatory material on request.

Guidelines relating to complaints handling procedures

Representative complaints

1. A code must provide a procedure for accepting, investigating and making a decision on a representative complaint.

Attempt to resolve complaint directly with respondent

1. A code must provide that, before a code adjudicator determines a complaint, the adjudicator must be satisfied that the complainant has first complained to the respondent before making the complaint to the adjudicator but that either:

i) the complaint has not been resolved to the satisfaction of the complainant; or

ii) the respondent has not responded to the complainant within 60 days from the date that the complaint was lodged with the respondent.

Referral to the Commissioner

1. A code must provide that an adjudicator is to refer a complaint to the Commissioner in accordance with section 40(1B) where:

i) the complaint includes a matter that relates to Consumer Credit information - Part IIIA; Tax File Number information - Part III, Division 4 and the Tax File Number Guidelines; or Spent Conviction information - Part VIIC of the Crimes Act 1914;

ii) the respondent to the complaint is not a subscriber to the code under which the code adjudicator makes decisions on complaints and the code adjudicator is unable to identify another approved code under which the complaint could be more appropriately handled; or

iii) there would be a conflict of interest if the code adjudicator made a decision on the complaint.

NOTE:

Where a complaint relates to an organisation that is carrying out functions or services that involve the handling of personal information under a contract with a Commonwealth agency, section 40A of the Act requires the adjudicator to refer the matter to the Commissioner for determination. The Commissioner must accept the complaint and investigate the matter as if the complaint had been made to the Commissioner under section 36.

Referral to another adjudicator

1. A code is only to allow an adjudicator to refer a complaint to another code adjudicator if the first-mentioned code adjudicator considers that another code is more appropriate in its application or provides remedies more appropriate to the circumstances of the complaint. However, before referring a complaint to another code adjudicator, the first-mentioned code adjudicator must:

i) consult with the other code adjudicator about whether the complaint would be more appropriately determined by that code adjudicator; and

ii) advise the complainant of the reasons for the proposed referral and obtain the agreement of the complainant to such a referral.

Reporting to the Privacy Commissioner

1. In accordance with section 18BB(3)(h), the code must provide that the report on the operation of the code is to be provided to the Commissioner in an electronic format as specified, from time to time, by the Commissioner and using a template issued annually by the Commissioner.

2. In accordance with section 18BB(3)(i), the code must provide that the report to the Commissioner on the operation of the code for a given financial year is to be provided to the Commissioner within two months of the end of the financial year.

3. In addition to the matters set out in section 18BB(3)(k), the code must provide that the report to the Commissioner on the number and nature of complaints made to an adjudicator under the code during the relevant financial year is to include:

i) the number of complaints received during each calendar month;

ii) the geographical source of complaints by State or Territory of Australia;

iii) the nature of the complaint by reference to the relevant provisions of the code;

iv) the number of complaints that were resolved to the satisfaction of both parties without proceeding to a determination;

v) the number of complaints received during the financial year that were referred to another code adjudicator or to the Commissioner for determination and the reasons for the referral;

vi) the number of enquiries that the code adjudicator received during the financial year, set out in categories agreed to in consultation with the Commissioner during the process of approving the code;

vii) the number of unresolved complaints as at the end of the financial year and the status of those complaints categorised as follows:

(a) no action taken yet;

(b) seeking clarification of facts/issues;

(d) awaiting response from respondent;

(e) awaiting comment from complainant on response; and

(f) settlement under negotiation;

ii) the number of complaints received during the financial year that have been referred by the adjudicator to the code member to attempt to resolve the matter directly with the complainant;

iii) the number of complaints that were resubmitted to the code adjudicator following an unsuccessful attempt by the code member to resolve the matter with the complainant;

iv) any systemic problems arising from complaints;

v) examples of representative case studies;

vi) information about how the scheme ensures equitable access;

vii) a list of code members, together with any changes to the list during the year;

viii) the names of any code members that do not meet their obligations as members of the code; and

ix) information about new developments or key areas in which policy or education initiatives are required.

4. In addition to the matters referred to in section 18BB(3)(ka), the code must provide that the report is to include the time taken to finally deal with each complaint during the relevant financial year.

Chapter one / Chapter two / Chapter three / Chapter four / Chapter five / Chapter 6 / Chapter 7 /Appendix A Prescribed standards / Appendix B Checklist

CHAPTER ONE - EXPLANATION OF THESE GUIDELINES

1.1 Purpose of these guidelines

The Privacy Act (1988)(Cth) (the Act) as amended by the Privacy Amendment (Private Sector) Act 2000 gives important privacy rights to individuals but also recognises the rights of business to achieve its objectives in an efficient way. The Federal Privacy Commissioner (the Commissioner) is required to uphold this ideal and to work with all stakeholders, in a balanced manner, to ensure that the privacy rights of individuals are protected while enabling business to continue to operate efficiently.

One way the Act works to achieve this goal is by allowing organisations to have and to enforce their own privacy codes that continue to uphold the privacy rights of individuals while allowing some flexibility of application for organisations.

However, before the Commissioner may approve a privacy code, the Act provides that the Commissioner must be satisfied with a number of important matters. For instance:

Â· Section 18BB(2) sets out matters that the Commissioner must be satisfied are met before a privacy code may be approved. These are:

- the code must set out obligations that, overall, are at least the equivalent of all the obligations in the NPPs; - the code must specify which organisations are bound by the code (or specify how to determine which organisations are bound by the code); - the code must only bind organisations that have consented to be bound by the code, and set out a procedure by which an organisation can cease to be bound by the code; and - the Commissioner must also be satisfied that members of the public are given an adequate opportunity to comment on the draft of the code.

Â· Where the code proposes separate complaint handling procedures, section 18BB(3) sets out additional matters in paragraphs (a) to (l) that the Commissioner must be satisfied are met before a privacy code may be approved.

Â· Included among these additional matters, section 18BB(3)(a)(i) requires the Commissioner to be satisfied that any proposed complaint handling procedures meet the prescribed standards issued by the Minister. The Minister's standards may be found in Appendix A.

Â· Similarly, section 18BB(3)(a)(ii) requires the Commissioner to be satisfied that the complaint handling procedures meet any guidelines issued by the Commissioner under section 18BF(1)(b). These are set out in bold print in Chapter 5 of this document and repeated in the summary of guidelines provided at the beginning of the document.

Â· In deciding whether to approve a privacy code, section 18BB(4) provides that the Commissioner may also consider the matters specified in guidelines issued by the Commissioner under section 18BF(1)(a) and (c). Individual summaries of these guidelines are set out in bold print in Chapter 4 with a consolidated summary of the guidelines provided at the beginning of the document.

The purpose of this document is to detail all of the guidelines the Commissioner has made under section 18BF(1) in relation to the development and approval of a privacy code.

1.2 Organisations that may develop a code

Any sole organisation, group of organisations or industry association representing the interests of its members may make an application to the Commissioner to have a privacy code approved. This includes profit seeking third parties (that is, non-representative bodies) that intend to attract organisations to their dispute resolution scheme.

Each code will be judged on its merits and in relation to the Act and these requirements regardless of the nature of the code proponent. However the Commissioner will also be considering how codes interact and relate with each other, especially where approval could lead to more than one code applying to a particular set of circumstances. The Commissioner will be particularly mindful of the views of other stakeholders and consumers on the impact of potential overlap.

1.3 Key terms

Code adjudicator - is a decision maker identified in section 18BB(3)(b) of the Act, that is responsible for the determination of complaints where there is a separate complaint handling process under a code. The code adjudicator is required to have a well-defined independence from the members of the scheme. The code adjudicator may be the Commissioner or another individual, panel of individuals or entity (refer to the prescribed standards).

Code administrator - is a body established to oversee the running and operation of the code and, where applicable, the separate complaint handling process.

Code member - is any organisation or business that has agreed to be bound by a privacy code and is registered with the code administrator (refer to section 18BB(2)(b) of the Act).

Code proponent - is an organisation, or association of organisations that has responsibility for developing, seeking approval for and/or implementing a code (refer to section 18BA of the Act).

Complainant - is an individual who lodges a complaint with a code adjudicator or the Commissioner.

National Privacy Principles (NPPs) - are a set of 10 high level principles that are intended to form the basis for the protection of personal information. Private sector organisations are bound by the NPPs unless they have their own privacy code that is approved by the Privacy Commissioner. The NPPs cover matters such as the collection, use and disclosure of personal information, data quality, access and data security. The NPPs are located in Schedule 3 to the Act and are not to be confused with the Information Privacy Principles, which apply to Commonwealth agencies.

The Office - means the Office of the Federal Privacy Commissioner

Organisation - is defined by the Act to be an individual, a body corporate, a partnership, any other unincorporated association or a trust that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory authority. The Act goes on to define which entities are covered by the Act and which are not. For example, some small businesses are exempt from the coverage of the Act. The full definition is more formally set out in section 6C and 6E of the Act.

Respondent - is the code member that is subject to a privacy complaint by an individual.

The Act - means the Privacy Act 1988 (Cth).

The Health Privacy Guidelines - are a set of guidelines made by the Commissioner under section 27(1)(e) of the Act that are designed to give organisations that are health service providers practical help on how to apply the NPPs to their operations. To obtain a copy of the Health Privacy Guidelines go to: www.privacy.gov.au (the Commissioner's website).

The Minister - means the Commonwealth Attorney-General.

The NPP Guidelines - are a set of guidelines made by the Commissioner under section 27(1)(e) of the Act that are designed to give organisations practical help on how to apply the NPPs to their operations. To obtain a copy of the NPP Guidelines go to: www.privacy.gov.au (the Commissioner's website).

The prescribed standards - are a set of principles that complaint handling procedures must meet before the Commissioner can approve a code (refer to section 18BB(3) of the Act). The prescribed standards cover matters to do with the accessibility, independence, fairness, accountability, efficiency and effectiveness of complaints handling procedures. The prescribed standards, as set down in regulation, may be found at Appendix A.

Chapter one / Chapter two / Chapter three / Chapter four / Chapter five / Chapter 6 / Chapter 7 /Appendix A Prescribed standards / Appendix B Checklist

CHAPTER TWO - LEGISLATIVE OVERVIEW

This chapter gives organisations an explanation of how privacy codes fit within the privacy legislative framework. It explains what is meant by the term "co-regulation" in the context of the Act and discusses the responsibilities of organisations and the Office of the Federal Privacy Commissioner (the Office) under this regime. The chapter also places the Code Development Guidelines into a broader context by discussing how they relate to the NPPs and the National Privacy Principles Guidelines and the Health Privacy Guidelines issued by the Commissioner.

2.1 Background to the legislation

The Act establishes a framework for a national and consistent set of privacy standards for the private sector. The Act does this by implementing a set of National Privacy Principles (the NPPs) that outline minimum requirements in relation to how private sector organisations should collect, use, keep secure and disclose personal information. The principles also give individuals a right to know what information an organisation holds about them and a right to correct it if it is wrong. The Act also provides arrangements for enforcing these rights.

In addition to the minimum requirements of the NPPs (which operate as a set of default privacy principles), the Act establishes a framework in which organisations are able to develop specialised binding codes for the handling of personal information. These privacy codes, when approved, replace the NPPs. This "co-regulatory" component in the legislation is designed to allow for flexibility in an organisation's approach to privacy but, at the same time, guarantees consumers that their personal information is subject to minimum standards that are enforceable in law.

The Act does exempt some organisations and practices from its coverage. Information Sheets and other details about these exemptions are available at www.privacy.gov.au (the Commissioner's website).

A flow chart detailing the co-regulatory privacy scheme is provided at the end of this chapter.

2.2 A co-regulatory approach

The co-regulatory approach adopted in the Act was developed on the basis that the privacy concerns of consumers can best be addressed if organisations are allowed room to negotiate an appropriate privacy standard with their customers. This approach ensures that an effective and comprehensive data protection framework is provided for the private sector in Australia while still allowing some flexibility in its application.

The term "co-regulation" is difficult to define in a general sense as it has the potential to apply to an array of regulatory systems. However, as the term relates to the Act, it can be thought of as a legislative framework in which organisations can gain official recognition for codes of practice that they themselves develop and implement. A "co-regulatory" approach, however, is quite distinct from "self-regulation", because organisations covered by the Act that choose not to have a code, must handle personal information in accordance with the NPPs in the Act. Both the NPPs and approved codes are enforceable by law.

The co-regulatory approach allows organisations:

Â· to tailor the NPPs to fit industry specific sensitivities or market needs; and

Â· to adopt an industry-based complaints handling mechanism with either the Commissioner or some other person or body as the independent code adjudicator.

While there is some flexibility in this co-regulatory approach, it is important to recognise that the Act does not give an organisation complete freedom when collecting and handling personal information. The privacy rights of an individual cannot be lessened by the use of a code. For instance, the Commissioner must approve each privacy code in accordance with the Act, the prescribed standards and guidelines issued by the Commissioner, before a code can replace the minimum privacy standards embodied in the NPPs. When deciding whether or not to approve a code, the Commissioner must also consider whether the code incorporates all the NPPs or sets out obligations that, overall, are at least the equivalent of all the obligations set out in the NPPs.

Where an organisation consents to be bound by an approved code, the code operates in place of the NPPs until the organisation ceases to be bound by the code. Where an organisation chooses not to adopt an approved code it will be bound by the NPPs.

2.3 Related publications

These guidelines should not be read in isolation. They are designed to help organisations understand and develop privacy codes and to set out requirements on the development of codes. Organisations planning to develop a code are encouraged to first gain a detailed understanding of the legislation and, in particular, the NPPs.

To help organisations understand the legal obligations contained in the NPPs, the Commissioner will release guidelines that explain the NPPs. Separate guidelines on the application of the NPPs in the health services sector will also be issued by the Commissioner to assist organisations that handle personal health information as well as provide health services. The NPP Guidelines and the Health Guidelines spell out how the Commissioner expects the NPPs to be applied in practice. Code proponents should bear the NPP and Health Guidelines in mind when preparing their own codes given that the Act intends that codes be overall equivalent to the NPPs.

Organisations intending to submit a code should consult the NPP guidelines, and where appropriate the Health Privacy Guidelines, before submitting a privacy code for approval.

More information on these additional guidelines is available from: www.privacy.gov.au (the Commissioner's website).

Chapter one / Chapter two / Chapter three / Chapter four / Chapter five / Chapter 6 / Chapter 7 /Appendix A Prescribed standards / Appendix B Checklist

CHAPTER THREE - SOME HELPFUL ADVICE BEFORE DEVELOPING A PRIVACY CODE

Organisations that are unclear about what is involved in developing and implementing a privacy code may find this chapter useful. It is designed to help an organisation build a basic understanding of the substance and role of codes. This chapter may also assist an organisation in deciding whether to develop a code and, if so, the resources that will need to be allocated to its development and maintenance.

3.1 Reasons for developing a code

Some of the reasons why an organisation may wish to adopt a code rather than simply comply with the baseline NPPs are listed below:

Â· The adoption of a code can give an organisation a sense of ownership of its privacy obligations and put the organisation in an active position rather than just being the passive recipient of legislative obligations.

Â· A code can make good business sense by sending a positive statement to the community that a particular organisation/industry is conscious of the privacy concerns of individuals and is active in protecting their privacy rights. This can be done by:

-	adopting a code that incorporates higher standards for privacy protection than the NPPs require, thus allowing organisations/industries to differentiate themselves in the marketplace; and
-	a code administrator committing the scheme to a stronger assurance process (through independent audit or monitoring programs) as a way of further differentiating an organisation/industry in the marketplace.

Â· A code can be a good way of changing the culture of an organisation or industry by raising awareness of privacy and by introducing a compliance regime.

Â· A code may serve as a guide to regulation by providing organisations with a single document that incorporates all its related legislative requirements (both Commonwealth and State) and industry standards written in industry specific language. Â· A successful code can promote industry integrity that, among other things, may serve to lessen consumer demand for further regulatory intervention.

Â· It is often quicker and easier to amend codes than it is to amend the law, allowing organisations/industries to be more responsive to the concerns of individuals.

Â· A code can allow organisations/industries to develop higher standards or introduce different principles in order to comply with the privacy directives of other countries or trading partners. This will be particularly relevant to organisations with global operations.

Â· A code that incorporates complaint handling procedures can give industry a sense of ownership in dispute resolution. Also, there may be an existing dispute resolution system operating in an organisation/industry that can operate as a "one-stop-shop" for consumers seeking redress.

3.2 Assessing the need for a code

In deciding whether to develop a privacy code or comply with the default NPPs, an organisation may wish to consider the following matters:

Â· What are the benefits and risks involved for the organisation?

Â· What kinds of personal information are held by the organisation?

Â· Does the organisation want to incorporate higher standards for privacy protection than the NPPs require so as to distinguish itself from its competitors?

Â· Does the organisation need to promote cultural change through the introduction of a privacy scheme?

Â· Does the organisation want to have all of its policies concerning privacy and other consumer codes in the one document?

Â· Does the organisation have sufficient resources to develop and administer a privacy code?

Â· Could the organisation prepare its own explanatory material on the application of the NPPs in an organisation/industry context without the need to develop a code?

Â· Is there an existing privacy code that may have been developed by industry that may be suitable for adoption without the need to develop a separate code?

3.3 Options for complaint resolution

The Act provides for a number of options when dealing with complaints under a code. For instance, a code proponent may decide to use the complaint handling procedures established under the Act. This would mean that a complaint about a breach of a code would be dealt with in the same way as a complaint about a breach of the NPPs. Alternatively, the code proponent may decide to have a code with complaint handling procedures. When a code provides for separate complaint handling procedures, an independent adjudicator must be nominated to decide these complaints. Either the Commissioner or some other person or body may be nominated as the independent adjudicator.

A summary of options for complaint resolution is set out in the table below.

Method of Compliance	Method of Complaint Resolution
Organisation which intends to comply with the NPPs	Commissioner
Code without complaints handling procedure	Commissioner
Code with a separate complaint handling procedure	Can ask Commissioner to be the independent adjudicator or can nominate other person or body to be the independent adjudicator

More information about the requirements of complaint handling procedures under a code is provided in Chapter 5.

3.4 Resource requirements

Organisations need to be aware that to develop and implement a privacy code requires a commitment of resources. Obviously the costs will vary greatly from scheme to scheme. Likely variants are whether or not the scheme establishes its own complaint handling body, the size and nature of the organisation/industry that will be covered by the code and the nature of the code itself.

In developing and implementing a code, resources may need to be allocated to the following matters:

The development of a code

Â· investigating the need for a code;

Â· writing and publishing the code;

Â· seeking legal or professional advice; and

Â· involving all stakeholders (including consumers) in an effective consultation program.

The implementation of a code

Â· maintaining a register of members;

Â· implementing systems and educating and training staff;

Â· establishing a code administrator to oversee the operation of a code; and

Â· costing a review of the code.

There are unlikely to be any further costs where an organisation does not wish to develop complaint handling procedures of its own but wishes to rely on the Commissioner investigating code complaints under Part V of the Act, in a similar manner to complaints relating to the NPPs. However, where an organisation wishes to develop its own complaint handling procedures, additional resources will need to be allocated to the following matters:

The development of complaint handling procedures

Â· investigating the need for complaint handling procedures;

Â· developing the complaint handling procedures;

Â· seeking legal or professional advice; and

Â· consultation with regards to appointment of an adjudicator.

The implementation of complaint handling procedures

Â· costing compliance with the prescribed standards, such as the promotion of the scheme in the media or by other means; publishing determinations and reviewing systemic problems and notifying members;

Â· understanding the increased costs associated with a code administrator administering complaint handling procedures, including the cost of providing reports to the Commissioner on the operation of the procedures;

Â· establishing and adequately funding an independent code adjudicator;

Â· providing sufficient funding, support staff and administrative services to be able to carry out independent investigations;

Â· being aware of costs associated with annual reporting requirements to the Commissioner;

Â· costing the review of complaint handling procedures; and

Â· understanding the additional cost of training staff in the operation of the complaint handling procedures.

3.5 Getting help

The Office is able to provide some assistance to organisations that are considering or are in the process of developing a code, although these guidelines will be the first source of assistance.

The Office is also able to provide some support to steering committees or related groups through privacy introduction workshops or presentations early in the code development process.

The Office may be able to provide a contact officer from its policy section to provide general (non-legal) advice to code development steering committees and to assist them to resolve any difficult privacy issues. Depending on the complexity of the issue, the advice would be given by telephone, email or in some cases in writing. Any advice provided by the contact officer will be given with the understanding that the advice provided is a "good practice" view of the issue and not approval of the practice. Approval of a practice is the responsibility of the Commissioner through the code approval process. However, the contact officer is able to offer comment and recommendations on the draft of the code (that is, the draft before it is released for public comment) on a "without prejudice" basis.

To ensure that there is no potential conflict of interest between providing advice and the formal approval of a code by the Commissioner, the Office is not available to participate as a full-time or part-time member or observer in any private sector code development committee.

3.6 The Australian Competition and Consumer Commission (ACCC)

In drafting a privacy code organisations should be careful to ensure that it does not breach the Trade Practices Act 1974 (the TPA). The TPA prohibits various forms of anti-competitive conduct including:

Â· contracts, arrangements or understandings that have the purpose or effect of substantially lessening competition in a market in which a business operates;

Â· contracts, arrangements or understandings that contain an exclusionary provision. Sometimes referred to as a 'primary boycott', these are agreements between persons in competition with each other which exclude or limit dealings with a particular supplier or customer, or a particular class of suppliers or customers.

The vast majority of privacy codes will not raise issues under the TPA, especially where they impose conditions that are no more onerous than the requirements set down in the NPPs, or where the relevant standards apply to only one organisation. Furthermore, membership of a code on its own would not amount to anti-competitive conduct.

However, concerns may arise if the development and implementation of a privacy code involves an agreement or understanding between competitors to comply with standards that go beyond the legislative requirements of the NPPs and where the purpose or effect is to restrict competition. For example, it may be argued that an industry-wide privacy code, implemented by the relevant industry association, which requires members to invest in expensive computer software which is not necessary to comply with the NPPs, could restrict entry to the relevant industry and lessen competition in breach of the TPA. Another example of where a requirement of this type could potentially be anti-competitive is where the code required competitors not to deal with other competitors who do not have that software.

In cases like this, parties should seek legal advice as to whether the relevant provisions are likely to breach the TPA. If so, consideration should be given to excluding or amending the relevant clauses. Alternatively, parties may consider applying to the Australian Competition and Consumer Commission (ACCC), the body responsible for administering the TPA, for authorisation of the clauses.

Authorisation provides protection from action by the ACCC or any other party for certain potential breaches of the TPA. It will only be granted where the applicant can demonstrate that benefits to the public result from conduct and that the detriment resulting from the conduct, including any lessening of competition, are outweighed by those benefits.

Authorisation can only be initiated by parties to the conduct, and will be granted only after a public process of assessment.

Further information regarding the TPA and the authorisation process can be obtained from: http://www.accc.gov.au (the ACCC website).

Overview of co-regulatory privacy scheme

This is a flow chart that takes organisations through their regulatory options under the Privacy Act, including their option to develop a privacy code

[D]

Chapter one / Chapter two / Chapter three / Chapter four / Chapter five / Chapter 6 / Chapter 7 /Appendix A Prescribed standards / Appendix B Checklist

CHAPTER FOUR - DEVELOPING PRIVACY CODES

Once an organisation has decided to develop a privacy code there are a number of things that will need to be considered further.

Section 18BB of the Act sets out the conditions under which the Commissioner may approve a code. These conditions cover things such as consultation, privacy standards and coverage. In deciding whether to approve a code, section 18BB(4) provides that the Commissioner may consider the matters specified in guidelines issued by the Commissioner under sections 18BF(1)(a) and (c). This chapter sets out the Commissioner's guidelines under these sections and sets out summaries of these guidelines in bold print. There is also a consolidated summary of the guidelines provided at the beginning of the document.

Chapter 5 outlines the requirements that must be met, in accordance with section 18BB(3) of the Act, before the Commissioner will approve a code with complaint handling procedures.

4.1 Consultation on draft codes - section 18BB(2)(f)

One of the key features of the co-regulatory approach to the Act is that industry has the opportunity to benefit from developing privacy codes and handling any complaints associated with the operation of those codes. However, along with this opportunity comes the responsibility of ensuring that codes, which are essentially replacing the legislation, are adequately discussed with the relevant stakeholders.

When government initiates and develops regulation, and industry develops voluntary codes of conduct on other issues, extensive consultation is generally a key element. Privacy codes should not offer less opportunity for the public to comment, and to examine industry led regulation, particularly when the code seeks to replace consumer protection under default legislation. Effective consultation will ensure that codes adequately meet the needs and expectations of both industry and individuals. The credibility and integrity of the co-regulatory approach depends on privacy codes gaining widespread support and acceptance from stakeholders (including consumers).

4.1.1 The consultation process

When formulating a consultation strategy, the Commissioner encourages organisations to have regard to the following matters:

Â· Identify the main parties or stakeholders that are likely to be affected by, or have an interest in, the proposed code, including consumers.

Â· Identify the most appropriate technique for seeking the views of affected stakeholders (for example, notices in the media, in-store advertising, establishing focus groups, presentations at industry conferences, and face-to-face discussions with appropriate government agencies and consumer representatives).

Â· Define a consultation period that ensures stakeholders are given an adequate and real opportunity to comment on the draft code.

Â· Ensure that the techniques used to seek the views of affected stakeholders do not impose barriers or restrict opportunities for certain groups to respond. For example, stakeholders with disabilities or with limited English language skills may find it difficult using some communication channels or may need different timeframes in order to participate in the consultation process.

Â· Ensure that a full and proper consideration is given to the comments raised by the affected parties or stakeholders consulted.

Â· Ensure that comments are considered promptly and, where appropriate, relevant stakeholders are included in any redrafting exercise as part of an ongoing consultation process.

4.1.2 Defining adequate consultation

Section 18BB(2)(f) of the Act states that the Commissioner can only approve a code after being "satisfied that members of the public have been given an adequate opportunity to comment on a draft of the code". The term adequate is a subjective one and therefore will be judged according to varying conditions and circumstances. For example, where an industry is highly specialised and has a distinct clientele it may not be necessary to consult directly with a broad range of interest groups. Instead, adequate consultation in this circumstance may involve consulting only a small number of industry and community representatives who specialise in the field.

However, in each case the Commissioner will need to be satisfied that the code proponent has consulted as many interested parties as is reasonable in the circumstances. Consultation strategies will play an important part in the process of judging adequate consultation. It is important that consultation strategies not put up barriers or restrict opportunities for certain groups to respond. Some members of the community likely to have a legitimate interest in a proposed code may find it difficult to participate in a consultation process. Code proponents should consider the methods it chooses to use for consultation and examine them for any potential access problems.

Government agencies may be key stakeholders in relation to proposed codes. Code proponents must take account of the information requirements of industry regulators and other law enforcement agencies, especially where a law of the Commonwealth, or of a State or Territory mandates these requirements. Consulting with regulators and other agencies on proposed codes is a good way for organisations to assess any other legal requirements associated with their information handling practices.

When considering a code for approval, the Commissioner will have particular regard to stakeholder views as to how the proposed code relates to laws and other privacy codes operating in the marketplace.

Furthermore, the Commissioner is unlikely to approve a code unless the code proponent has sought to address any legitimate and reasonable concerns raised by stakeholders after having been given an adequate opportunity to comment. The Act provides for the Commissioner to contact "any person the Commissioner considers appropriate" before deciding to approve a code. This becomes an important step in the consideration process if a code proponent cannot clearly demonstrate that all relevant stakeholders have had an adequate opportunity to comment on a draft of a code. However, relying on the Commissioner to undertake consultation will generally mean that the approval process will be subject to considerable delay.

During consultation, the Commissioner will not act to broker a resolution between the code proponent and stakeholders who have raised legitimate objections. The code proponent is expected to make a reasonable effort to work with stakeholders to resolve issues before a code is submitted for approval. Failure to do so could adversely affect the approval decision.

4.1.3 Additional help

Code proponents who have little experience in consulting stakeholders may need to seek additional help. The two publications listed below may be of assistance in this regard. They are listed only as a source of general advice on consultation and should not be regarded as requirements for consultation in relation to privacy codes. These publications are:

Â· The Consumer Affairs Division of the Department of the Treasury has issued a paper entitled Getting it Right: Ideas for Consulting Communities. This document describes the three key elements of effective consultation - careful planning, appropriate implementation and responsible outcomes and provides helpful advice on how to conduct effective public consultation. The document is available from: www.treasury.gov.au/publications (the Consumer Affairs website).

Â· The Department of Family and Community Services has issued a paper called Inclusive Consultation: A Practical Guide to Involving People with Disabilities. This guide has been developed to provide practical advice on how best to consult people with disabilities. It also offers strategies that are relevant for all consultations in order to cater for the broad needs of the community. This document is available from: http://www.facs.gov.au/disability/ood/consgide.htm (the Department of Family and Community Services website).

Summary of guidelines - consultation