Guide 4 of 5 · Personal information
New systems and personal information: privacy by design
Rests on: the OAIC’s Guide to undertaking privacy impact assessments.
The OAIC describes privacy by design as “building privacy into the design specifications and architecture of new systems and processes”, and says a privacy impact assessment (PIA) is the best way to understand the privacy impacts that involves. A PIA should be done at a stage “early enough for it to influence how the project proceeds (for example, at the planning and design or business case stage)”, and should be revisited and updated when the project changes.
General information about the OAIC’s guidance, not legal or privacy advice. The OAIC is the official place to check. Not every small business has to comply with the Privacy Act, and the OAIC suggests its Privacy Checklist for Small Business, or advice from an industry association or lawyer, to find out.
01 Why the start of the project
“It’s more effective and efficient to manage privacy risks proactively, rather than to retrospectively alter a product or service to address privacy issues that come to light,” the OAIC says. Its PIA guide ties this to the law: APP 1 requires APP entities to take reasonable steps to put in place practices, procedures and systems that ensure they comply with the Australian Privacy Principles, and in that way, the guide says, the principles require privacy by design.
Size is no guide: “even a small-scale project may have significant privacy implications.” For a business bound by the Privacy Act, handing the work to someone else does not hand over the responsibility: in the guide’s words, “Your entity is responsible and accountable for the personal information it collects, even when the information is held by external service providers or contractors operating in Australia or overseas.”
02 The threshold question
The first step of a PIA is working out whether one is needed, and the OAIC says not every project will need one. The first question it asks is: “Will any personal information be collected, stored, used or disclosed in the project?” Personal information is wider than a name. Under the Privacy Act it can include other information that can identify a person or allow their identity to be worked out.
When a PIA may not be necessary
The guide says a PIA may not be necessary if the project proposes no changes to existing information handling practices, those practices have been assessed for privacy before, and their controls are current and working well.
Keep a record either way
Whether or not a PIA follows, the guide suggests recording the threshold assessment: a short description of the project, the personal information involved, any changes to how it will be handled, the decision on whether to go on to a PIA, and who made the assessment.
03 What widens a project’s privacy scope
The guide lists circumstances in which a project’s privacy scope can increase. Several describe the ordinary shape of a transformation project:
- outsourcing the handling of personal information, now or in the past;
- needing new technology, or new legislation, to handle or store it;
- pulling personal information together into databases;
- using it for data-matching;
- planning entirely new collections, or a new way of using or disclosing it;
- making it compulsory for people to provide it.
The greater the privacy scope, the guide says, the more likely the PIA will need to be detailed.
04 The ten steps, in the OAIC’s order
The guide sets out ten steps, and says they can be combined with a business’s own project and risk management methods.
- Threshold assessment. Decide whether a PIA is needed, as above.
- Plan the PIA. Settle how detailed it will be, who will do it, the timeframe and budget, how and when stakeholders will be consulted, and what happens after it.
- Describe the project. A brief, big-picture description that leaves the privacy analysis for later steps.
- Identify and consult with stakeholders. Those inside and outside the business who are interested in or affected by the project; the guide says some form of consultation should happen.
- Map information flows. How information is collected and, once collected, who can access it, how it is stored and what it is used for.
- Privacy impact analysis and compliance check. Analyse the project’s effect on privacy, and consider whether it complies with each of the Australian Privacy Principles.
- Privacy management. Find options to remove, minimise or mitigate negative privacy impacts.
- Recommendations. Identify avoidable impacts and how to remove or reduce them, saying who each recommendation is addressed to and a timeframe for putting it in place.
- Report. Set out the PIA in a report proportionate to the project.
- Respond and review. Act on the recommendations, record which will not be implemented and why, and keep the PIA up to date as the project changes.
05 Principles a new system has to meet from day one
The compliance check in step 6 runs through each Australian Privacy Principle. A few are worth designing for at the start, in the words of the guide’s own summaries:
| Principle | What it says |
|---|---|
| APP 2, anonymity | “Individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with an APP entity in relation to a particular matter, unless an exception applies.” |
| APP 3, collection | Personal information other than sensitive information must be reasonably necessary for one or more of the entity’s functions or activities, and collected only by lawful and fair means. |
| APP 7, marketing to people | “An organisation must not use or disclose personal information for the purpose of direct marketing unless an exception applies, such as where the individual has consented.” |
| APP 11, security | Reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure; and, once it is no longer needed for any purpose for which the principles allow it to be used or disclosed, reasonable steps to destroy or de-identify it, unless an exception applies. |
06 Who looks at a business’s PIA
For a private sector organisation, the OAIC has no role in developing, reviewing, endorsing or approving its PIA process, and the OAIC’s power to direct a PIA applies to government agencies, not to private sector organisations. The OAIC encourages organisations to undertake PIAs for projects that involve handling personal information, and to share their findings publicly.