Annual Report 2006-07:

Appendices

• Appendix 1 The Privacy Act and the Office of the Privacy Commissioner
  • Privacy Commissioner's Functions
  • Privacy Act
  • Subordinate Legislation
  • Other Legislation
  • Outcomes and Outputs Structure
• Appendix 2 Freedom of Information Act Compliance
  • Organisation
  • Authority and legislation
  • Number of formal requests for information
  • Avenues for public participation
  • Categories of documents
  • Freedom of Information procedures
  • Facilities for obtaining physical access
• Appendix 3 Speeches and Presentations
• Appendix 4 Commonwealth Disability Strategy Performance Reporting June 2006
• Appendix 5 Demographic Information about Complainants
• Appendix 6 National Privacy Principles
• Appendix 7 Information Privacy Principles
• Appendix 8 Strategic Plan 2007–09

Appendix 1 The Privacy Act and the Office of the Privacy Commissioner

Privacy Commissioner’s Functions

The Privacy Commissioner has specific statutory functions under ss. 27, 28 and 28A of the Privacy Act 1988. These functions include, amongst other things, investigating possible breaches of the Privacy Act, undertaking audits of agencies or organisations to ensure compliance with the Privacy Act, providing advice to agencies and organisations on matters related to privacy, and promoting and encouraging the adoption of privacy standards in the community.

One of the key responsibilities of the Office is to handle complaints. Individuals who believe that their privacy may have been interfered with by an agency or organisation are able to lodge a complaint with the Office under s. 36 of the Privacy Act. The Privacy Commissioner may then undertake preliminary enquiries of the respondent to determine whether there are grounds, and whether the Commissioner has jurisdiction, to formally open an investigation into the complaint under s. 40 of the Privacy Act.

Staff members of the Compliance section conciliate between the parties to attempt to adequately resolve the dispute. If the parties are not able to come to a mutually satisfactory agreement, the Privacy Commissioner is able to make a determination under s. 52 of the Privacy Act to dismiss the complaint. Alternatively, the Privacy Commissioner is able to find in favour of the complainant and decide upon suitable orders to remedy the breach. The orders are enforceable in the Federal Court or Federal Magistrates Court under s. 55A of the Privacy Act.

Generally, a complaint must be in writing. The Office is obliged to provide appropriate assistance to people who require it in order to help formulate and appropriately set out the particulars of the complaint.

Individuals cannot complain to the Privacy Commissioner about organisations which are bound by a privacy code approved by the Commissioner, when that code has its own code adjudicator. Individuals may, however, ask the Privacy Commissioner to review a determination made by a code adjudicator under s. 18BI of the Privacy Act.

The Privacy Commissioner has the power to launch investigations under s. 40(2) of the Privacy Act, and these are referred to as Own Motion Investigations (OMIs). The Privacy Commissioner undertakes OMIs where it appears that a breach of the Privacy Act may have occurred and it is thought to be desirable that an OMI be u ndertaken. For example, where the alleged breach is not limited to one complainant, or in circumstances where the alleged breach raises systemic and/or ongoing issues.

The Office’s Policy section assists the Privacy Commissioner in providing advice on privacy issues, including interpreting the operation of the Privacy Act, to Ministers, Australian and ACT Government agencies, and organisations. The section develops guidance material (such as guidelines, information sheets and FAQs) to help explain the operation of the Privacy Act and the Privacy Commissioner’s functions.

The Policy section examines enactments and proposals from agencies, advising on their potential privacy implications and their overall compliance with the Privacy Act. It also assists the Privacy Commissioner in carrying out other functions under the Privacy Act, as well as prescribed functions under the National Health Act 1953, the Telecommunications Act 1977 and the Crimes Act 1914.

The Office’s Corporate and Public Affairs section manages the public profile of the Office and the Privacy Commissioner, provides secretariat support and manages the Office’s corporate responsibilities. The unit is responsible for developing and maintaining the Office’s website, handling media enquiries, assisting with the provision of Privacy Act training and providing a secretariat role to several committees including the Privacy Contact Officer Steering Committee, Privacy Advisory Committee and Asia Pacific Privacy Authorities forum. The section also liaises with key stakeholders, including domestic bodies and international authorities, and handles the Office’s corporate governance responsibilities.

Privacy Act

The Privacy Act gives effect to article 17 of the International Covenant on Civil and Political Rights and to the OECD’s Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. The Privacy Act establishes the method by which personal information about individuals can be collected and stored, specifies the permissible uses of that information, and limits the circumstances in which that information can be disclosed. It also sets out a mechanism by which individuals can gain access to, and amend where appropriate, the personal information about them held by agencies and organisations.

The Privacy Act protects personal information under four main sets of requirements.

• The National Privacy Principles (NPPs) (see Appendix 6) regulate the way private sector organisations handle personal information. These principles cover the collection, storage, use, disclosure and access obligations of organisations covered by the Privacy Act. In general the NPPs apply to all businesses and non-government organisations with a turnover of $3 million or more, all health service providers and a limited range of small businesses.
• The Information Privacy Principles (IPPs) (see Appendix 7) regulate the way most Australian and ACT Government agencies handle personal information. These principles cover the collection, storage, use, disclosure and access obligations of those agencies covered by the Privacy Act.
• Individuals’ Tax File Number (TFN) provisions: the Privacy Act prevents TFNs from being used as a de facto national identification system and gives individuals the right to withhold this information. Where a TFN is provided, its use is limited to tax-related, assistance agency and superannuation purposes. Under the Privacy Act, the Privacy Commissioner issues and enforces legally binding guidelines.
• Part IIIA of the Privacy Act places strict safeguards on the handling of individuals’ consumer credit information by the credit industry. These provisions recognise the sensitivity of credit-worthiness information and the implications for individuals should credit information be mishandled. Strict penalties apply if these provisions are breached.

Subordinate Legislation

Privacy in Australia is further regulated by subordinate legislation including those listed below.

• Privacy (Private Sector) Regulations 2001, which set out the standards under s. 18BB(3)(a)(i) of the Privacy Act that need to be met before a privacy code can be approved by the Privacy Commissioner, and prescribe specific agencies, state authorities and organisations for particular purposes under the Privacy Act.
• Privacy Regulations 2006, which exempt the secrecy provisions of the Census and Statistics Act 1905 from the provisions in the Privacy Act (Part VIA) which relate to allowable disclosures during emergencies.
• Privacy codes developed by organisations and approved by the Privacy Commissioner under Part IIIAA of the Privacy Act can replace the National Privacy Principles for particular organisations or activities if they enhance or are equivalent to those principles.
• Mandatory guidelines under the Privacy Act, for example the Tax File Number Guidelines issued under s. 17 of the Privacy Act.
• Public Interest Determinations and Temporary Public Interest
  Determinations under Part VI of the Privacy Act.
• Credit Reporting Determinations under Part IIIA of the Privacy Act.
• The Credit Reporting Code of Conduct issued under s. 18A of the Privacy Act.

The Privacy Act and the subordinate legislation are supported by advisory guidelines issued by the Office, including:

• Guidelines to the National Privacy Principles
• Guidelines to the Information Privacy Principles
• Guidelines for the Use of Data-matching in Commonwealth
  Administration
• Guidelines on Privacy in the Private Health Sector
• Guidelines on Privacy Code Development (part of these guidelines are mandatory)
• Guidelines on Public Interest Determination Procedure
• Guidelines for Federal and ACT Government Websites
• Guidelines on Workplace Email, Web Browsing and Privacy
• Guidelines for Agencies using Privacy and Public Key Infrastructure to communicate or transact with individuals.

In addition, the National Health and Medical Research Council (NHMRC) has issued the following binding guidelines after consulting with the Privacy Commissioner:

• Guidelines under Sections 95 and 95A of the Privacy Act 1988.

Other Legislation

The role of the Privacy Commissioner is further defined by legislated responsibilities that are set out in the following legislation.

• Part VIIC of the Crimes Act 1914, the Commonwealth Spent Convictions Scheme, which provides protection for individuals with old minor convictions in certain circumstances (the Privacy Commissioner has the power to investigate breaches of the legislation, and is also required to provide advice to the Attorney-General in relation to exemptions under the scheme).
• The Data-matching Program (Assistance and Tax) Act 1990, which regulates data-matching between the Australian Taxation Office and the assistance agencies to detect overpayment and ineligibility for assistance (under this Act, the Privacy Commissioner is responsible for issuing mandatory guidelines for protecting privacy, investigating complaints and monitoring agency compliance).
• The National Health Act 1953, under which the Privacy Commissioner is required to issue guidelines covering the storage, use, disclosure and retention of individuals’ claim information under the Pharmaceutical Benefits Scheme and the Medicare program.
• The Telecommunications Act 1997, under which the Privacy Commissioner has certain monitoring and compliance functions.

Outcomes and Outputs Structure

The Office’s outcome statement, as set out in the Portfolio Budget Statement, is:

An Australian culture in which privacy is respected, promoted and protected.

There is one output for the Office’s outcome:

Complaint handling, compliance and monitoring, and education and promotion.

There are two performance measures:

Quality

• Majority of complainants and respondents surveyed satisfied that complaint handling service was timely and impartial.
• Majority of enquirers surveyed satisfied with advice provided by
  Hotline and in written response.
• 80% of complaints finalised within 12 months of receipt, 90% of written enquiries answered within ten days.
• Agencies and organisations satisfied that audits improve their privacy practices and procedures.
• Audits finalised within 6 months of commencement.
• Targeted information available that informs the community, including business and government, of their rights and responsibilities in respect of the Office’s jurisdictional responsibilities.

Quantity

• Close 1300 complaints, respond to 2000 written enquiries, and answer 20 000 calls.
• 3 audits commenced.
• >800 000 visits to the website.
• >3.5 million pages viewed on the website.

Table A1.1 Resources for Outcomes

Appendix 2 Freedom of Information Act Compliance

The Freedom of Information Act 1983 (FOI Act) gives the general public legal access to government documents. For information on the Office’s procedures see Freedom of Information procedures on page 87.

Section 8 of the FOI Act requires each Australian Government agency, including this Office, to publish information about the way the Office is organised, together with its functions, powers and arrangements for public participation in the work of the agency. The Office is also required to publish the categories of documents that the Office holds and how members of the public can gain access to them.

Organisation

The Office’s organisational structure is provided in Chart A1.1 in Appendix 1.

Authority and legislation

The Office is established, and the Privacy Commissioner’s functions and powers are conferred, by the Privacy Act 1988. Information regarding the Office’s functions and powers are set out in Appendix 1.

Number of formal requests for information

During 2006–07, the Office received 14 requests for access to documents under the FOI Act. Twelve requests related to access to documents concerning individual privacy. Two requests related to documents concerning the functions and activities of this Office.

Avenues for public participation

The Office uses the following processes and consultative bodies to assist the participation by persons or bodies outside the Commonwealth administration in the policy-making functions of the Office or in its administration of various schemes and enactments.

• The Office has a Strategic Plan (see Appendix 8) which commits it to developing robust relationships with external stakeholders, and to ensuring that effective relationships, partnerships and networks are at the core of the Office’s internal and external operations.
• Part VII of the Privacy Act provides for the establishment of the Privacy Advisory Committee to advise the Commissioner on relevant matters, recommend material to the Commissioner for inclusion in guidelines and, subject to direction by the Commissioner, engage in community education and consultation.
• The Privacy Commissioner’s Health Privacy Forum is an informal group of senior stakeholders from the health sector to assist the Commissioner on matters of health privacy.
• The Office coordinates the Privacy Contact Officer (PCO) Network to facilitate the resolution of privacy issues within Australian and ACT Government agencies and provide training and expertise to those agencies. The PCO network meets four times per year.
• The Privacy Connections network plays a similar role in the private sector and regular forums are held for network members across Australia.
• The Office meets on an informal basis with representatives of privacy and consumer non-government organisations to discuss privacy matters affecting the Australian community.
• The Compliance section conducts customer surveys to determine levels of service and customer satisfaction. A survey was conducted in 2004–05. Although initially scheduled for 2006–07, this survey will now be carried out again in 2007–08.
• The Commissioner also has legislative requirements to consult. For example the provisions relating to making a public interest determination require the production of a draft determination and the invitation of interested parties to attend a conference (ss. 75 and 76). Similarly, the Commissioner needs to be satisfied that there has been an adequate opportunity for the public to comment before approving a proposed privacy code (s. 18BB(2)(f)).
• The Office invites public consultation from individuals and organisations through its website.

Categories of documents

Documents held by the Office relate to:

• administration matters, including personnel, recruitment, accounts, purchasing, registers, registry, library records and invoices
• complaint matters, including audits and the investigation, clarification, conciliation and resolution of complaints
• legal matters, including legal documents, opinions, advice and representations
• research matters, including research papers in relation to complaints, existing or proposed legislative practices, public education, national inquiries and other relevant issues
• policy matters, including minutes of meetings, administrative and operational guidelines
• operational matters, including files on formal inquiries and
• reference materials, including press clippings, survey and research materials, documents relating to conferences, seminars and those contained in the library.

Freedom of Information procedures

Initial enquiries regarding access to documents from the Office of the Privacy Commissioner should be directed to the Freedom of Information Officer by either telephoning (02) 9284 9800 or writing to:

Freedom of Information Officer
Office of the Privacy Commissioner
GPO Box 5218
Sydney NSW 2001.

Procedures for dealing with FOI requests are detailed in s. 15 of the FOI Act. A valid request must:

• be in writing
• be accompanied by the payment of a $30 application fee
• include the name and address of the person requesting the information and
• be processed within 30 days of receipt.

Some documents are exempt from public perusal under the FOI Act. Where documents are not accessible by the applicant, valid reasons will be provided. The Office’s decisions about accessibility of documents may be reviewed by the Administrative Appeals Tribunal.

Facilities for obtaining physical access

The Office provides copies of the requested documents by mail to the enquiring party, subject to exceptions established under the FOI Act.

The Office will also consider requests from parties to view hard copies of the requested documents in person at the Office.

Appendix 3 Speeches and Presentations

Karen Curtis, Privacy Commissioner

2006

25 July         Personal Property Securities – Policy Development Workshop, Sydney

29 August       Privacy Awareness Week Launch, Sydney

1 September     Privacy Contact Officer Network Meeting, Canberra

18 September    Launch of DIMA/OPC Memorandum of Understanding, Canberra

24 October      Australian Regulatory Reform Evolution Conference, Canberra

23 November     Privacy Connections Corporate Breakfast, Sydney

23 November     ACMA Information Communications Entertainment Conference, Canberra

1 December      Privacy Contact Officer Network Meeting, Canberra

2007

23 March        Administrative Review Council, Canberra

27 March        Privacy Professionals Network, Sydney

10 May          Privacy Connections Corporate Breakfast, Adelaide

11 May          Privacy Connections Corporate Breakfast, Perth

1 June          Privacy Contact Officer Network Meeting, Canberra

25 June         Second Technical Assistance Seminar on International Implementation of the APEC Privacy Framework, Cairns

Staff of the Office of the Privacy Commissioner

2006

27 July         Advertising, Marketing and Media Summit, Melbourne

28 July         Little Sisters of the Poor, Melbourne

10 August       DIMA Compliance Officer Pilot Training Program, Canberra

1 September     Privacy Contact Officer Network Meeting, Canberra

12 September    ACMA International Training Program, Melbourne

1 December      Privacy Contact Officer Network Meeting, Canberra

2007

2 March         Privacy Contact Officer Network Meeting, Canberra (2 presentations)

31 May          OSHC Worldcare ‘The Application of the Privacy Act to the International Student Industry’, Melbourne

1 June          Privacy Contact Officer Network Meeting, Canberra (3 presentations)

Appendix 4 Commonwealth Disability Strategy Performance Reporting June 2007

Table A4.1 Commonwealth Disability Strategy Performance Reporting June 2007

Policy adviser role

Regulator role

Provider role

Employer role

Appendix 5 Demographic Information about Complainants

In 2006–07 the Office continued collecting detailed demographic information about complainants. The Office invites all complainants to voluntarily respond to a survey. While the response rate is low, the Office will continue to use the information to improve its accessibility and other services to complainants. Below are a series of tables which provide a summary of the responses received in 2006–07 compared to the results received in 2005–06.

Due to the voluntary nature of the survey, the information gathered may not necessarily give an accurate representation of the relative proportions of demographic categories of complainants.

Table A5.1 Gender of complainants

Table A5.2 Complainants’ access to the internet

Table A5.3 Country of birth of complainants

Table A5.4 Main language spoken at home

Table A5.5 Location of complainants

Table A5.6 Aboriginal or Torres Strait Islander background of complainants

Table A5.7 Level of education completed by complainants

Table A5.8 Age range of complainants

Table A5.9 Complainants with a disability

Table A5.10 Source of knowledge about the Office of the Privacy Commissioner

Table A5.11 Annual income range of complainants

Appendix 6 National Privacy Principles

The National Privacy Principles as set out in Schedule 3 of the Privacy Act 1988. See NPPs

Appendix 7 Information Privacy Principles

The Information Privacy Principles as set out in s. 14 of the Privacy Act 1988. See IPPs

Appendix 8 Strategic Plan 2007–09

Our Vision:

An Australian community in which privacy is valued and respected.

Our Purpose:

To promote and protect privacy in Australia.

Our Values:

As an Australian Government agency the Office of the Privacy Commissioner is committed to upholding the APS Values and Code of Conduct. In particular we will:

• demonstrate leadership in promoting and protecting privacy
• act with independence, impartiality and integrity
• value our staff
• be responsive to our clients
• work collaboratively with stakeholders.

Context:

The Office of the Privacy Commissioner is established under the Privacy Act 1988 to:

• provide advice and assistance to individuals
• provide advice and assistance to organisations and agencies with responsibilities under the Privacy Act
• promote privacy through policy advice and educational activities
• administer the Privacy Act including by investigating individual privacy complaints and systemic issues, and conducting audits.