Publication | July 2018
The Privacy (Australian Government Agencies — Governance) APP Code 2017 (the Code), which commenced on 1 July 2018, represents a step towards best practice privacy governance in the Commonwealth.
The Code imposes a host of new requirements on Commonwealth agencies, adding to existing obligations under the Privacy Act 1988 (Privacy Act), and symbolises the commitment of the Commonwealth government to the protection of privacy and greater transparency in information handling practices.
The impetus for the Code’s development lies in the increasing emphasis in current policy-making on improving the availability of public data, and the ongoing shift towards the digital and online provision of many government services. In this context, the Code may help build public trust and confidence in government information handling practices and any future uses of public data by agencies.
Broadly, the Code imposes obligations on Commonwealth agencies in respect of:1
Whilst some of these obligations required an immediate response from agencies prior to 1 July 2018, many of the requirements set out in the Code are ongoing, and agencies will need to vigilantly monitor their compliance with the Code.
This article provides an overview of the requirements of the Code to assist agencies in managing their compliance. We have also included a checklist which agencies may wish to have regard to as part of their ongoing compliance activities.
By now, your agency should have made arrangements to:
Each of these initial requirements leads to further related ongoing obligations. Each agency to which the code applies will need to:
These requirements may necessitate changes to policy and procedure within an agency. For example, internal policies will need to reflect the requirement to annually measure and document performance against its privacy management plan.
Helpfully, the OAIC has launched a Privacy Officer toolkit and suggests that agencies should sign up to its Privacy Professionals’ Network to receive notifications on developments in Code resources and events.
In addition to these requirements, section 16 of the Code sets out an obligation for agencies to ensure that:
The training must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy. However, the level and amount of training that will be appropriate may differ depending on the degree to which the staff members deal with personal information in the course of their employment.11
Separately, section 17(1) of the Code imposes an obligation on agencies to regularly review and update their privacy practices, procedures and systems to ensure their currency and adequacy for the purposes of compliance with the APPs. As a minimum, the scope of such a review must encompass a review of the agency’s privacy policy (prepared for the purposes of APP 1) and any privacy notices (prepared for the purposes of APP 5). Given the pace at which privacy law and policy is evolving in Australia, agencies will need to actively monitor privacy developments in order to comply with this requirement.
Additionally, an agency must regularly monitor its compliance with these privacy practices, procedures and systems. The OAIC expects agencies to consider (and where appropriate, respond to) the outcomes of such compliance reviews in accordance with the APPs and their privacy management plans.12
Significantly, the Code mandates that an agency must conduct a Privacy Impact Assessment for all ‘high privacy risk projects’.
A privacy impact assessment (PIA) is a written assessment that both identifies the impact that a project might have on the privacy of individuals and sets out recommendations for managing, minimising or eliminating that impact.13
A project may be a ‘high privacy risk’ project for these purposes if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.14 Where such a risk exists, the process of developing a PIA can be complex and time-consuming.
Pursuant to section 13, an agency may publish a PIA, or may choose to publish a summary version or an edited copy of the PIA, on the agency’s website; however neither is mandatory.15
Section 15 also imposes an obligation on agencies to maintain a register of the PIAs that they conduct. Agencies must publish this register, or a version of this register, on their websites. Agencies will need to include all PIA titles and any other relevant information on the published register, unless doing so would divulge information that it would not be appropriate to share publicly (e.g. for reasons of national security).16
Agencies must also provide a copy of the register and all PIAs that are listed on it to the OAIC on request.
The OAIC is developing guidance on the PIA requirements in the Code, including in relation to the assessment of privacy risk.
Pursuant to section 26A of the Privacy Act, an agency must not do an act, or engage in a practice, that breaches the Code. A breach of a registered APP code will be an interference with privacy by the entity under section 13 of the Privacy Act and subject to investigation by the Commissioner under Part 5 of the Act.
Designate a Privacy Officer (pursuant to section 10 of the Code).
Designate a Privacy Champion (as required by section 11 of the Code).
Set up a Privacy Impact Assessment Register.
Maintain the privacy management plan.
Conduct Privacy Impact Assessments for all high privacy risk projects.
Maintain the Privacy Impact Assessment Register.
Have in place a system to handle privacy enquiries, complaints, and requests.
Maintain a record of all personal information held throughout the agency.
At all times, have a Privacy Champion and at least one Privacy Officer.
When the details of the Privacy Officer(s) change, keep the OAIC notified in writing.
Ensure that there is leadership within the agency on broader strategic privacy issues.
Include privacy education or training in all staff induction programs.
Measure and document performance against the privacy management plan at least annually.
Ensure that regular privacy reports are provided to the agency’s executive.
Take reasonable steps to provide training annually to all staff with access to personal information.
Regularly review and update privacy practices and procedures (including privacy policy and notices).
Regularly monitor compliance with privacy practices, procedures and systems.
Thanks to lawyer David Martin from our Sydney office for contributing to this article.
The Code places obligations on the ‘agency’ – which is defined by section 5 of the Code to take the same meaning as in the Privacy Act, excluding Ministers. Most corporate Commonwealth entities and non-corporate Commonwealth entities under the Public Governance, Performance and Accountability Act 2013 (Cth) will be covered by this definition, whilst certain Commonwealth companies will be excluded.
Although the term ‘senior official’ is not defined in the Code, the Explanatory Statement to the Code states that “given the strategic and cultural nature of the functions, the Commissioner would generally expect the Privacy Champion to be an SES employee, or a staff member of equivalent seniority”.
Section 9(3) of the Code. The Explanatory Statement clarifies that section 9(3) creates an obligation to maintain the privacy management plan.
Section 9(3) of the Code.
Section 10(5)(a) of the Code. The Explanatory Statement to the Code provides that the functions set out in section 10(5) may be performed by the Privacy Officer, or by another person.
Section 10(5)(b) of the Code.
Section 10(3) of the Code. It may be easiest for the agency to designate an officer as a Privacy Officer by reference to a position.
Section 11(4)(a) of the Code. The Explanatory Statement to the Code specifies that functions set out in section 11(4) may be performed by the Privacy Champion, or by another person.
Section 11(4)(b) of the Code.
See the Explanatory Statement to the Code.
See the Explanatory Statement to the Code.
See section 33D of the Privacy Act 1988.
Section 12(2) of the Code.
In the initial draft version of the Code, this was included as a mandatory obligation.
See the Explanatory Statement to the Code.
Publication
On February 6, 2024 the Council of the EU and the European Parliament agreed a provisional version of the Net-Zero Industry Act (NZIA), which is now expected to be formally adopted by the end of April 2024.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023
