slide1 n.
Skip this Video
Loading SlideShow in 5 Seconds..
Privacy law r eform for APP entities (agencies ) PowerPoint Presentation
Download Presentation
Privacy law r eform for APP entities (agencies )

Loading in 2 Seconds...

play fullscreen
1 / 22

Privacy law r eform for APP entities (agencies ) - PowerPoint PPT Presentation

  • Uploaded on

Privacy law r eform for APP entities (agencies ). Privacy Awareness Week. Asia Pacific Privacy Authorities . What does the Privacy Act cover?. Privacy Act 1988 provides for the protection of an individual’s personal information

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Privacy law r eform for APP entities (agencies )' - edmund

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Privacy law reform for

APP entities (agencies)

privacy awareness week
Privacy Awareness Week

what does the privacy act cover
What does the Privacy Act cover?

Privacy Act 1988 provides for the protection of an individual’s personal information

Privacy Act contains provisions that deal with:

  • ‘personal information’
  • ‘sensitive information’ (such as health information)
  • tax file numbers
  • credit information
privacy law reform ou tline
Privacy law reform — outline
  • Privacy Amendment (Enhancing Privacy Protection) Act 2012
  • New Australian Privacy Principles (or APPs)
  • Enhanced powers of the Commissioner
  • How to prepare for the changes
australian privacy principles
Australian Privacy Principles
  • 13 new APPs to replace IPPs and NPPs
    • Single set of principles which apply to both public and private sectors
    • Government agencies and private sector organisations are referred to as ‘APP entities’
    • Structured to reflect the information life cycle — collection, use and disclosure, quality and security, access and correction
    • Permitted general situation
app 1 open and transparent management of personal information
APP 1 — Open and transparent management of personal information
  • Agencies must have a clearly expressed and up to date privacy policy
  • Agencies must take reasonable steps to implement processes that will ensure that the agency complies with the APPs
app 2 anonymity and pseudonymity
APP 2 — Anonymity and pseudonymity

Allows individuals to interact with agencies by not identifying themselves

Permits the individual to use a pseudonym

Exceptions apply, such as where it is impracticable for the agency to deal with an unidentified individual

app 3 collection of personal and sensitive information
APP 3 – Collection of personal and sensitive information

Outlines obligations relating to the collection of personal and sensitive information

Collection must be ‘reasonably necessary’ for, or ‘directly related’ to, one or more of an agency’s functions or activities

Higher standards for collection of sensitive information. Some exceptions apply

app 4 dealing with unsolicited personal information
APP 4 — Dealing with unsolicited personal information

New principle for handling unsolicited personal information

Establish if the information could have been collected under APP 3

Destroy or de-identify the information if it could not have been collected under APP 3

app 5 notification of collection
APP 5 — Notification of collection
  • Outlines the matters an agency must inform an individual about when the agency collects their personal information. These matters include:
    • Information about an agency’s APP policy
    • Who the agency is and how to contact it
    • The purpose(s) of the collection
    • Any collections from third parties
    • Consequences of non-collection
    • Complaint handling process
    • Potential overseas disclosure
app 6 use or disclosure
APP 6 — Use or disclosure
  • Deals with use and disclosure of personal information
  • Different obligations apply to the use or disclosure of sensitive information. This is new for agencies
  • New limited exceptions, to permit use or disclosure for secondary purpose:
    • Locate missing person
    • Establish, exercise or defend a legal equitable claim
    • Confidential alternative dispute resolution
app 7 direct marketing
APP 7 – Direct marketing

Prohibits organisations from using or disclosing personal information for direct marketing purposes, except in specified circumstances

Contracted service providers for Commonwealth contracts are permitted to use or disclose personal information for the purpose of direct marketing if certain conditions are met

app 8 cross border disclosure
APP 8 – Cross border disclosure

Introduces an accountability approach for cross-border disclosure

Agencies must take reasonable steps to ensure overseas recipients do not breach APPs

Agencies may be accountable for a breach of APPs by overseas recipients

Exceptions apply

app 9 adoption use or disclosure of government related identifiers
APP 9 — Adoption, use or disclosure of government related identifiers

Prohibits an organisation from adopting, or using a government related identifier

Generally replicates the exceptions under National Privacy Principle 7, with some additions

An agency may be required to comply with APP 9 under s7A

app 10 quality
APP 10 — Quality
  • Requires agencies to take reasonable steps to ensure personal information it collects, uses or discloses is:
    • Accurate
    • Up-to-date
    • Complete
  • Agencies should ensure that personal information that it uses or discloses is also relevant for the purpose of the use or disclosure
app 11 security
APP 11 — Security
  • Inclusion of ‘interference’
    • an agency must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure
  • New destruction requirements
    • the agency must take such steps as are reasonable in the circumstances to destroythe information or to ensure the information is de-identified
    • Some exceptions eg information contained in a Commonwealth record
app 12 access
APP 12 — Access

Agencies required to respond to requests for access of personal information within 30 days

Exceptions apply – Freedom of Information Act 1982 or other legislation

Access should be provided in the requested manner (where reasonable and practicable)

Individual not to be charged

Written reasons for the refusal and complaint mechanism

app 13 correction
APP 13 — Correction
  • Agencies required to take ‘reasonable steps’ to correct personal information to ensure it is accurate, up-to-date, complete, relevant and not misleading, if:
    • agency satisfied it needs to be corrected, or
    • individual requests correction
  • Agency to respond to request within 30 days
  • Individual not to be charged
  • Statement required if agency refuses to correct and individual requests statement
  • Written reasons for refusal and complaint mechanism
commissioner s new powers
Commissioner’s new powers

Performance assessments

Code making powers

Ability to make a determination to resolve OMIs

Enforceable undertakings

Civil penalty orders

Ability to direct Privacy Impact Assessment to be conducted

stay in touch
Stay in touch
  • Information Contact Officer Network
    • Join ICON:
  • Privacy law reform breaking news available
    • Web & RSS:
  • Follow us on social media
    • Twitter: and during PAW #2013PAW
    • Facebook:
    • YouTube: