THE OFFICE OF THE PRIVACY COMMISSIONER

Office of the Privacy Commissioner

Publications

SPECIFIC PRIVACY INFORMATION FOR:


Contents Users Guide Chapter 1 Chapter 2 Chapter 3 Chapter 4 Appendices Glossary

Annual Report 2005-06

Appendices

Appendix 1 The Privacy Act and the Office of the Privacy Commissioner

Privacy Commissioner's Functions

The Privacy Commissioner has specific statutory functions under ss. 27, 28 and 28A of the Privacy Act 1988. These functions include, amongst other things, investigating possible breaches of the Privacy Act, undertaking audits of agencies or organisations to ensure compliance with the Privacy Act, providing advice to agencies and organisations on matters related to privacy, and promoting and encouraging the adoption of privacy standards in the community.

One of the key responsibilities of the Office is to handle complaints. Individuals who believe that their privacy may have been interfered with by an agency or organisation are able to lodge a complaint with the Office under s. 36 of the Privacy Act. The Privacy Commissioner may then undertake preliminary enquiries of the respondent to determine whether there are grounds, and whether the Commissioner has jurisdiction, to formally open an investigation into the complaint under s. 40 of the Privacy Act.

Staff of the Compliance section facilitate a conciliation between the parties to attempt to adequately resolve the dispute. If the parties are not able to come to a mutually satisfactory agreement, the Privacy Commissioner is able to make a determination under s. 52 of the Privacy Act to dismiss the complaint. Alternatively, the Privacy Commissioner is able to find in favour of the complainant and decide upon suitable orders to remedy the breach. The orders are enforceable in the Federal Court or Federal Magistrates Court under s. 55A of the Privacy Act.

Generally, a complaint must be in writing. The Office is obliged to provide appropriate assistance to people who require it in order to help formulate and appropriately set out the particulars of the complaint.

Individuals cannot complain to the Privacy Commissioner about organisations which are bound by a privacy code approved by the Commissioner, when that code has its own code adjudicator. Individuals may, however, ask the Privacy Commissioner to review a determination made by a code adjudicator under s. 18BI of the Privacy Act.

The Privacy Commissioner has the power to launch investigations under s. 40(2) of the Privacy Act, and these are referred to as Own Motion Investigations (OMIs). The Privacy Commissioner undertakes OMIs where it appears that a breach of the Privacy Act may have occurred and it is thought to be desirable that an OMI be undertaken. For example, where the alleged breach is not limited to one complainant, or in circumstances where the alleged breach raises systemic and/or ongoing issues.

The Office's Policy section assists the Privacy Commissioner in providing advice on privacy issues, including interpreting the operation of the Privacy Act, to Ministers, Australian and ACT Government agencies, and organisations. The section develops guidance material (such as guidelines, information sheets and FAQs) to help explain the operation of the Privacy Act and the Privacy Commissioner's functions.

The Policy section examines enactments and proposals from agencies, advising on their potential privacy implications and their overall compliance with the Privacy Act. It also assists the Privacy Commissioner in carrying out other functions under the Privacy Act, as well as prescribed functions under the National Health Act, the Telecommunications Act and the Crimes Act.

The Office's Corporate and Public Affairs section manages the public profile of the Office and the Privacy Commissioner, provides secretariat support and manages the Office's corporate responsibilities. The unit is responsible for developing and maintaining the Office's website, handling media enquiries, assisting with the provision of Privacy Act training and providing a secretariat role to several committees including the Privacy Contact Officer (PCO) Steering Committee, Privacy Advisory Committee and Asia Pacific Privacy Authorities Forum. The section also liaises with key stakeholders, including domestic bodies and international authorities, and handles the Office's corporate governance responsibilities.

Chart A1.1 Organisational Structure

Organisation chart

Privacy Act

The Privacy Act gives effect to Article 17 of the International Covenant on Civil and Political Rights and to the OECD's Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. The Privacy Act establishes the method by which personal information about individuals can be collected and stored, specifies the permissible uses of that information, and limits the circumstances in which that information can be disclosed. It also sets out a mechanism by which individuals can gain access to, and amend where appropriate, the personal information about them held by agencies and organisations.

The Privacy Act protects personal information under four sets of requirements:

Subordinate Legislation

Privacy in Australia is further regulated by subordinate legislation including:

These are supported by non-binding advisory guidelines issued by the Office, such as:

In addition, the National Health and Medical Research Council (NHMRC) has issued the following binding guidelines after consulting with the Privacy Commissioner:

Other Legislation

The role of the Privacy Commissioner is further defined by legislated responsibilities that are set out in the following Acts of Parliament:

Outcomes and Outputs Structure

The Office's outcome statement, as set out in the Portfolio Budget Statement, is:

An Australian culture in which privacy is respected, promoted and protected.

There is one output for the Office's outcome:

Complaint handling, compliance and monitoring, and education and promotion.

There are two performance measures:

Quality

Quantity

Table A1.1 Resources for Outcomes


Budget 2005-06 $'000 Actual Expenses 2005-06 $'000 Budget 2006-07 $'000
Total Administrative Expenses - - -
Price of Department Outputs
Output Group 1.1 Complaint handling, compliance and monitoring, and education and promotion
4975 4944 7046
Subtotal Output Group 1.1 4975 4944 7046
Revenue from Government (Appropriation) for Departmental Outputs 4156 4156 6282
Revenue from other Sources 819 788 764
Total price of Outputs 4975 4944 7046
Total for Outcome 1
(total price of Outputs and Administered Expenses)
4975 4944 7046
Actual 2005-06 Estimated Actual 2005-06
Average Staffing Level 41 54

Appendix 2 Freedom of Information Act Compliance

The Freedom of Information Act 1982 (FOI Act) gives the general public legal access to government documents. For information on the Office's procedures see Freedom of Information procedures on page 73.

Section 8 of the FOI Act requires each Australian Government agency, including this Office, to publish information about the way the Office is organised, together with its functions, powers and arrangements for public participation in the work of the agency. The Office is also required to publish the categories of documents that the Office holds and how members of the public can gain access to them.

Organisational structure

The Office's organisational structure is provided in Chart A1.1 in Appendix 1.

Authority and legislation

The Office is established, and the Privacy Commissioner's functions and powers are conferred, by the Privacy Act 1988. Information regarding the Office's functions and powers are set out in Appendix 1.

Number of formal requests for information

During 2005-06, the Office received five requests for access to documents under the FOI Act. The requests all related to access to documents relating to individual privacy complaints.

Avenues for public participation

The Office uses the following processes and consultative bodies to assist the participation by persons or bodies outside the Commonwealth administration in the policy-making functions of the Office or in its administration of various schemes and enactments.

Categories of documents

Documents held by the Office relate to:

Freedom of Information procedures

Initial enquiries regarding access to the Office's documents should be directed to the Freedom of Information Officer by either telephoning (02) 9284 9800 or writing to:

Freedom of Information Officer
Office of the Privacy Commissioner
GPO Box 5218
Sydney NSW 2001

Procedures for dealing with FOI requests are detailed in s.15 of the FOI Act. A valid request must:

Some documents are exempt from public perusal under the FOI Act. Where documents are not accessible by the applicant, valid reasons will be provided. The Office's decisions about accessibility of documents may be reviewed by the Administrative Appeals Tribunal.

Facilities for obtaining physical access

The Office provides copies of the requested documents by mail to the enquiring party, subject to exceptions established under the FOI Act.

The Office will also consider requests from parties to view hard copies of the requested documents in person at the Office.

Appendix 3 Speeches and Presentations

Karen Curtis, Privacy Commissioner

2005

12 July
Safeguarding Australia Conference, Canberra 20 July Australian Credit Forum Luncheon, Sydney 28 July Standing Committee of Attorneys-General (SCAG), Canberra

16 August
Department of Human Services, Canberra

19 August
Administrative Review Council Meeting, Canberra

2 September
Privacy Contact Officer Meeting, Canberra

13 September
Privacy Laws and Business Roundtable, Montreux, Switzerland

15 September
27th International Data Protection Commissioners' Conference, Montreux, Switzerland

16 November
12th Meeting of the Privacy Victoria Network and Shared Issues in Privacy Forum, Melbourne

25 November
Australian Court Administrators' Group - Courts and Tribunals Annual Conference, Sydney

2 December
Privacy Contact Officer Network Meeting, Canberra

2006

3 March
Privacy Contact Officer Network Meeting, Canberra

30 March
Keynote Speech to Privacy Issues Forum, New Zealand 28 April Administrative Appeals Tribunal (AAT): Presentation to Professional Development Session,Sydney

17 May
Australian Graduate School of Management Symposium, Sydney

17 May
New South Wales Privacy and FOI Network Meeting,Sydney

31 May
Presentation at Staff Induction Training, Sydney

2 June
Privacy Contact Officer Network Meeting, Canberra

15 June
Institute of Public Administration Australia, Breakfast Seminar, Canberra

5 September
University of New South Wales, Masters of Laws Students

7 September
UNICEF Australia, Sydney

9 September
Customer Contact Management Association (CCMA) Luncheon, Melbourne

14 October
Alternative Dispute Resolution (ADR) Seminar on Privacy and Complaint Handling for Joint Initiatives Group (JIG)

25 October
Computer Audit, Control and Security Conference, Perth

26 October
Department of Defence Biannual Fraud Forum for Commonwealth Fraud Investigation Agencies, Canberra

16 November
Australian Communications and Media Authority (ACMA) International Conference, Sydney

2 December
Privacy Contact Officer Network Meeting, Canberra (two presentations)

15 December
Better Health IT Conference, Melbourne

3 March
Privacy Contact Officer Network Meeting, Canberra (three presentations)

4 April
Consumers' Health Forum of Australia Electronic Health Records Consumer Representatives Meeting, Sydney

29 May
Consumers' Health Forum of Australia E-Health National Information Workshop, Canberra

2 June
Privacy Contact Officer Network Meeting, Canberra (two presentations)

22 June
Australia and New Zealand Education Law Association (ANZELA) Seminar, Sydney

Appendix 4 Commonwealth Disability Strategy Performance Reporting June 2006

Table A4.1 Commonwealth Disability Strategy Performance Reporting June 2006

Policy Adviser Role

Performance Indicator Performance Measure Current level of performance (2005-06)

1. New or revised policy/program proposals assess impact on the lives of people with disabilities prior to decision.

Percentage of new or revised policy/program proposals that document that the impact of the proposal was considered prior to the decision making stage.

Submissions are made available on the Office's website where possible.

The Office provides advice on the policy/program/legislative activities of other agencies from a privacy perspective. In a significant number of advices provided, particularly where new technologies are being considered, the privacy of people with disabilities is factored into the discussion. The Office seeks to have representative bodies actively involved in consultation, including in privacy impact assessments of proposals.

A consideration for the Office is how the privacy rights of individuals with disabilities are being met. To aid this assessment, the Office surveys and collects demographic information relating to complainants.

During the period 1 July 2005 to 30 June 2006 the Office received 118 responses to the survey. Of these 37 (31.4 %) of respondents indicated they had a disability.

2. People with disabilities are included in consultation about new or revised policy/program proposals.

Percentage of consultations about new or revised policy/program proposals that are developed in consultation with people with disabilities.

Where the Office undertakes consultations, groups representing the interests of people with disabilities are invited to participate.

During consultation processes the Office considers the needs of individuals with disabilities.

Public consultation events all occur in accessible venues.

During 2005-06 the Deputy Disability Commissioner was a member of the Office's Privacy Advisory Committee, which advises the Privacy Commissioner on privacy issues. In January 2006 following his appointment as the Human Rights Commissioner Mr Graeme Innes AO resigned from the committee.

3. Public announcements of new, revised or proposed policy/ program initiatives are available in accessible formats for people with disabilities in a timely manner.

Percentage of new, revised or proposed policy/ program announcements available in a range of accessible formats.

Time taken in providing announcements in accessible formats.

Simultaneously to public release 100% of information about new Office initiatives is available on a W3C compliant website. Other formats are available on request.

All material is available in other formats on request.

The Privacy Connections Network had 688 members as of 30 June 2006.

Disability peak groups are members, membership is also open to members of the public who may have disabilities. Members are offered the opportunity to sign up to an email subscription. Messages to the network are sent in plain text accessible formats.

Regulator Role

Performance Indicator Performance Measure Current level of performance (2005-06)

1. Publicly available information on regulations and quasi-regulations is available in accessible formats for people with disabilities.

Percentage of publicly available information on regulations and quasi-regulations requested and provided in:

  • accessible electronic formats; and
  • accessible formats other than electronic.

Average time taken to provide accessible material in:

  • electronic format; and
  • formats other than electronic.

100% of Office information is available on its W3C compliant website.

All material is available in other formats on request.

Office services are accessible via website, phone and TTY.

Electronic access is immediate, via website. Average turnaround for requests for electronic information is within the day; hard copy information a couple of days.

Some requests may require that we use external service providers. In these cases the turnaround to provide information in accessible formats may be impacted.

2. Publicly available regulatory compliance reporting is available in accessible formats for people with disabilities.

Percentage of publicly available information on regulations and quasi-regulations requested and provided in:

  • accessible electronic formats; and
  • accessible formats other than electronic.

Average time taken to provide accessible material in:

  • electronic format; and
  • formats other than electronic.

100% of Office information is available on its W3C compliant website.

All material is available in other formats on request.

Office services are accessible via website, phone and TTY.

Electronic access is immediate, via website. Average turnaround for requests for electronic information is within the day; hard copy information a couple of days.

Some requests may require that we use external service providers. In these cases the turnaround to provide information in accessible formats may be impacted.

Provider Role

Performance Indicator Performance Measure Current level of performance (2005-06)

1. Providers have established mechanisms for quality improvement and assurance.

Evidence of quality improvement and assurance systems in operation.

The Office has a complaints/feedback hotline and a website link which gives individuals the opportunity to lodge complaints/grievances with the Office.

The Office generally conducts customer satisfaction surveys to determine the level of customer satisfaction with the Office's services. During 2005-06 the Office was unable to conduct this survey but plans to undertake this survey again in 2006-07.

2. Providers have an established service charter that specifies the roles of the provider and consumer and service standards which address accessibility for people with disabilities.

Established service charter that adequately reflects the needs of people with disabilities in operation.

The Office does not have an agency wide service charter but has complaint handling service standards in place as this is a major client focus.

All Office complaints information and brochures are available on the website in accessible electronic format. Information about the complaints process and legislation is available in plain English format on the Office website. The website is updated regularly.

Office information available in alternative formats on request.

3. Complaints / grievance mechanism, including access to external mechanisms, in place to address issues and concerns raised about performance.

Established complaints/grievance mechanisms, including access to external mechanisms, in operation.

The Office uses a current complaints information referral list to ensure callers with disabilities can be referred to appropriate advocacy groups.

The Office has a complaints/feedback hotline and a website link which gives individuals the opportunity to lodge complaints/grievances with the Office.

Email, TTY and a National 1300 number at the cost of a local call available.

Premises are accessible.

Section 36(4) of the Privacy Act requires the Commissioner to provide appropriate assistance to complainants where they have difficulty in lodging a complaint.

When dealing with requests for access to personal information, organisations are advised to consider issues of accessibility.

No complaints have been received regarding access to the Office complaint handling service or premises.

Employer Role

Performance Indicator Performance Measure Current level of performance (2004-06)

1. Employment policies and procedures comply with the requirements of the Disability Discrimination Act 1992.

Number of employment policies, procedures and practices that meet the requirements of the Disability Discrimination Act 1992.

The Office promotes and supports APS values.

The Office's Certified Agreement (CA) contains reference to Workplace Diversity principles. Most of the Office's policies on employment are contained within the CA.

The Workplace Diversity Plan (jointly participated in by the Office and HREOC) outlines strategies to maximise employment opportunities for people with disabilities. On induction all new staff are provided with a copy of the plan.

The email/internet policy is reviewed annually. It specifically refers to the inappropriate use of email that may demean people with disabilities.

There were no formal complaints/grievances made by staff with disabilities with regard to current work practices.

2. Recruitment information for potential job applicants is available in accessible formats on request.

Percentage of recruitment information requested and provided in:

  • accessible electronic formats; and
  • accessible formats other than electronic.

Average time taken to provide accessible information in:

  • electronic formats; and
  • formats other than electronic.

100% compliance providing accessible formats for recruitment material.

Recruitment information is able to be provided in any format.

All recruitment material is on the Office's website.

Advertisements in press advise that information is available at contact phone number, by TTY phone and on the Office's website.

The Office website meets the criteria for accessibility as outlined in the Government Online Strategy and the Deputy Disability Commissioner has advised in the process.

There were no requests for Braille during 2005-06.

3. Agency recruiters and managers apply the principle of 'reasonable adjustment'.

Percentage of recruiters and managers provided with information on 'reasonable adjustment'.

Selection guidelines include information on 'reasonable adjustment' and guidelines for interviewing staff with disabilities.

Recruitment action is managed internally and not outsourced and all committees are provided with selection information on 'reasonable adjustment'.

4. Training and development programs consider the needs of staff with disabilities.

Percentage of training and development programs that consider the needs of staff with disabilities.

Due to the small number of staff in the Office, training is coordinated by each of the unit managers under the Office's Performance Management Scheme. The majority of training is provided off-site with external providers and any in-house training programs recognise the needs of people with disabilities.

Training nomination forms include specific requirements that may be needed such as:

  • wheelchair access
  • accessible toilets/parking
  • a hearing device
  • sign language interpreter
  • an attendant
  • a support person
  • information in Braille, audio cassette, large print, ASCII format.

5. Training and development programs include information on disability issues as they relate to the content of the program.

Percentage of training and development programs that include information on disability issues as they relate to the program.

As noted above training is coordinated by each individual section.

Induction includes information on Workplace Diversity and relevant legislation, including the DDA.

The Complaint Handling section of HREOC conducts training and information on disability issues for staff of HREOC and the Office.

6. Complaint/ grievance mechanism, including access to external mechanisms, in place to address issues and concerns by staff.

Established complaints/ grievance mechanisms, including access to external mechanisms in operation.

There is an established process in the Office's Certified Agreement for complaints/grievances, which includes access to external review through the Australian Public Service Commission.

All staff are advised of access to the Office's Employee Assistance Program and encouraged to use this service when needed. This free service provides counselling and support for staff and their families.

100% compliance with provision of access to complaints/grievance mechanisms.

Note: Accessible electronic formats include ASCII (or .txt) files and html for the website. Non electronic accessible formats include Braille, audio cassette, large print and easy English. Other ways of making information available include video captioning and Auslan interpreters.

Appendix 5 Demographic Information about Complainants

In 2005-06 the Office continued collecting detailed demographic information of complainants. The Office invites all complainants to respond to the survey. While the response rate is low, the Office will continue to use the information to improve its accessibility and other services to complainants. Below are a series of tables which provide a summary of the responses received in 2005-06 compared to the results received in 2004-05.

Table A5.1 Gender of complainants

2004-05 2005-06
Female 40 43.0% 53 44.9%
Male 53 57.0% 65 55.1%
Total 93 100% 118 100%

Table A5.2 Complainants' access to the Internet

2004-05 2005-06
Nil return 3 3.2% 0 0.0%
No 22 23.7% 23 19.5%
Yes 68 23.1% 95 80.5%
Total 93 100% 118 100%

Table A5.3 Main language spoken at home

2004-05 2005-06
English 83 89.2% 115 97.5%
Other 10 10.8% 3 2.5%
Total 93 100% 118 100%

Table A5.4 Country of birth of complainants

2004-05 2005-06
Australia 60 64.5% 83 70.3%
Great Britian 16 17.2% 14 11.9%
New Zealand 0 0.0% 7 5.9%
Other 17 18.3% 14 11.9%
Total 93 100% 118 100%

Table A5.5 Location of complainants

2004-05 2005-06
Capital City 58 62.4% 81 68.6%
Country Town 14 15.1% 18 15.3%
Major regional centre 18 19.4% 18 15.3%
Rural 3 3.1% 1 0.8%
Total 93 100% 118 100%

Table A5.6 Aboriginal or Torres Strait Islander background of complainants

2004-05 2005-06
Did not comment 3 3.2% 0 0.0%
Aboriginal/ Torres Strait Islander 1 1.1% 2 1.7%
Non Aboriginal/ Torres Strait Islander 89 95.7% 116 98.3%
Total 93 100% 118 100%

Table A5.7 Level of education completed by complainants

2004-05 2005-06
Nil Return 3 3.2% 1 0.8%
Postgraduate Degree 12 12.9% 11 9.3%
Bachelor Degree 15 16.1% 36 30.5%
Diploma/Advanced Diploma 13 14.0% 21 17.8%
Study not leading to a qualification 2 2.2% 4 3.4%
Year 10 or below 32 34.4% 29 24.6%
Year 12 16 17.2% 16 13.6%
Total 93 100% 118 100%

Table A5.8 Age range of complainants

2004-05 2005-06
19-29 years 7 7.5% 12 10.2%
30-39 years 23 24.7% 20 16.9%
40-49 years 29 31.2% 39 33.1%
50-59 years 17 18.3% 27 22.9%
60-69 years 12 12.9% 15 12.7%
70-79 years 3 3.2% 3 2.5%
80-89 years 2 2.2% 2 1.7%
Total 93 100% 118 100%

Table A5.9 Complainants with a disability

2004-05 2005-06
No comment 0 0.0% 1 0.8%
No Disability 58 62.4% 80 67.8%
Medical 13 14.0% 10 8.5%
Sensory 7 7.5% 4 3.4%
Psychiatric 2 2.2% 6 5.1%
Movement 11 11.8% 12 10.2%
Other 2 2.1% 5 4.2%
Total 93 100% 118 100%

Table A5.10 Source of knowledge about the Office of the Privacy Commissioner

2004-05 2005-06
A legal Centre/Laywer 7 7.5% 11 9.3%
Another Community Organisatoin 7 7.5% 8 6.8%
Family member/freind/support person/associate 11 11.8% 8 6.8%
Government agency (not the government agency I complained about) 7 7.5% 16 13.6%
Internet 4 4.3% 8 6.8%
Media 3 3.2% 13 11.0%
Other 23 24.9% 28 23.8%
Our website www.privacy.gov.au 11 11.8% 9 7.6%
Pamplet/leaflet 5 5.4% 1 0.8%
State or Territory Privacy Commissioner 4 4.3% 1 0.8%
Telephone book 4 4.3% 5 4.2%
The organisation/government agency Icomplained about told me 7 7.5% 10 8.5%
Total 93 100% 118 100%

Table A5.11 Annual income range of caomplainants

2004-05 2005-06
Nil Return 5 5.4% 2 1.7%
$0 - $25,000 26 28.0% 42 35.6%
$25,001 - $50,000 36 38.7% 31 26.3%
$50,001 - $75,000 15 16.1% 16 13.6%
$75,001 or more 11 11.8% 27 22.9%
Total 93 100% 118 100%

Appendix 6 National Privacy Principles

The National Privacy Principles as set out in Schedule 3 of the Privacy Act 1988

Appendix 7 Information Privacy Principles

The Information Privacy Principles as set out in s. 14 of the Privacy Act 1988