pdf (310.28 KB)

Beth Abraham
Assistant Manager

Welfare Payments Reform Branch

Department of Families, Housing, Community Services and Indigenous Affairs
PO Box 7576, Canberra Business Centre
ACT 2610

Dear Ms Abraham

Exposure Draft - Policy Outlines for the New Model of Income Management

Please find below the Office of the Privacy Commissioner's comments on the exposure draft of the policy outlines for the new model of income management (the outlines).

These comments are made with reference to a previous submission made by the Office of the Privacy Commissioner (the Office) to the Senate Standing Committee on Community Affairs in February 2010. That submission related to the Social Security and Other Legislation Amendment  (Welfare Reform and Reinstatement of Racial Discrimination Act) Bill 2009 (Senate Submission).[1]

Background

The Office notes that outlines 2 and 3 detail the processes by which certain categories of parents (with school-age or younger than school-age children) subject to income management may seek an exemption from the income management program. Specifically, outlines 2 and 3 set out a process by which parents may provide evidence that they exhibit no indications of financial vulnerability, and are undertaking responsible parenting, and should therefore be exempted from the income management program.

Necessity for the Collection of Personal Information

The Office notes that, under the policies proposed by outline 2, individuals must provide a substantial amount of personal information in order to seek an exemption from an income management program (see pp. 6-8 of the outlines).

A key principle of good privacy practice is that personal information should only be collected where that information is necessary. Under the Privacy Act 1988, Information Privacy Principle 1 (IPP 1) relevantly provides that personal information must not be collected by a Government agency unless that information is collected for a lawful purpose directly related to a function or activity of the collector, and the collection is necessary for or directly related to that purpose.

At present, the outlines and associated explanatory materials do not include a rationale for the collection of the specific items of personal information that is proposed to be collected, used and stored (see, for example, the table set out in pp. 6-8 of the outlines).

Accordingly, the Office suggests that the specific purposes for the collection of each item of information be clearly articulated to the public.

The Office also suggests that FaHCSIA consider:

• whether, in the circumstances, individuals would have the ability to provide the required personal information,
• if so, the ease with which they would be able to do so, and
• what assistance (if any) individuals might be given in order to provide the necessary information.

Furthermore, to ensure good privacy practice and provide the most straightforward process possible, the Office suggests collecting the minimum amount of personal information necessary to establish that an individual should not be subject to further income management.

Privacy Impact Assessment

The Office also suggests that the agencies involved in the implementation of the policies set out in the outlines consider undertaking a Privacy Impact Assessment (PIA) in relation to those policies.

The Office's Senate Submission noted the utility of a PIA in connection with proposed measures involving additional or modified personal information handling, prior to the implementation of those measures.

In this instance, a PIA would assist in identifying the personal information flows involved in implementing the outlines, and could identify any privacy risks in the collection, use, storage and disclosure of personal information under those policies.

A PIA could also assist in developing and implementing appropriate privacy protections, including streamlining the amount of personal information that needs to be collected from individuals (if that is found to be appropriate).

Given the proposed national rollout of income management programs, the Office believes the comprehensive identification of privacy risks and the implementation of appropriate protections at this early stage would be especially valuable, and could also assist in future decision-making processes.

While the Office has no formal role in the conduct or approval of PIAs, we can provide general advice on the conduct and methodology of undertaking PIAs including whether to have the PIA conducted by an eternal consultant.

The Office would also welcome the opportunity to provide further submissions on the privacy implications of a national rollout of an income management program.

If you wish to discuss the above comments further please do not hesitate to contact me at andrew.solomon@privacy.gov.au or on (02) 9284 9800.

Yours sincerely,

Andrew Solomon

Director, Policy
Office of the Privacy Commissioner

21 June 2010

[1]   available for download on the office's website at http://www.privacy.gov.au/materials/types/download/9479/7045