Jayne Van Souwe , Principal, Wallis Consulting Group Andrew Maher , Partner, HR Legal

3. Jayne Van Souwe, Principal, Wallis Consulting Group • Andrew Maher, Partner, HR Legal

4. Agenda • What do Australians think about Privacy? • The APPs • The market and social research industry’s response • Questions

5. What do Australians think about privacy? • Key findings from “Community Attitudes towards Privacy” – study completed by Wallis for the Office of the Australian Information Commissioner

6. Australian Privacy Principles • Definition and coverage • The principles and their implications

7. The Australian Privacy Principles • Cover all Australian government agencies and most private businesses. • Replace the Information Privacy Principles (previously applied to government) and the National Privacy Principles (applied to businesses) • The market and social research industry had its own set of Privacy Principles (Market and Social Research Privacy Principles) and will have its own Code again. • APPs are minimum standards that can only be exceeded in separate industry codes – previous codes allowed limited trade-offs. • They are data protection laws and only apply to information about private individuals.

8. The Australian Privacy Principles • State government agencies excluding SA and WA remain bound by the relevant state data and privacy protection legislation usually administered by state privacy commissioners: • ACT – Health records are administered by the Human Rights Commission, no territory specific privacy law • NSW – Privacy and Personal Information Protection Act 1998 • NT – Information Act 2002 • QLD – Right to Information Act 2009, Information Privacy Act 2009 • TAS – Personal Information and Protection Act 2004 • VIC – Information Privacy Act 2000 (health information is covered by the Health Services Act administered by the Health Services Commissioner)

9. The Australian Privacy Principles • State governments with their own privacy legislation are taking a “wait and see” approach to the APPs. They are likely to bring their own legislation into line eventually. • At present state legislation exceeds base requirements of federal law and/or clarifies state-specific situations, eg states have different systems for managing health records • State and federal laws (and codes that have force of law) always take precedence over industry guidelines. • Researchers should be aware of related guidelines, but recognise their place! ACT = CODE = LAW Guideline = good practice

10. The Australian Privacy Principles • For market researchers the situation is clear – if you abide by the Code of Professional Behaviour of AMSRS you will continue to exceed ANY privacy legislation currently in force. (Note the Code of Professional Behaviour is being re-written so that it complements the new Industry Privacy Code, which in turn references the Code of Professional Behaviour).

11. The Australian Privacy Principles • For other areas of business the situation is less clear • Federal and state privacy commissioners work together to ensure that legislation complements rather than conflicts – it is more a matter for ensuring that any companies working for state government agencies are clear about which piece of legislation applies. • If in doubt, comply with the most stringent piece of legislation.

12. The Australian Privacy Principles • What do we mean by Privacy? • Personal information • Information or an opinion that identifies or could reasonably identify a person, whether true or not • Examples include, name, age, DOB, phone number, email address, photograph, credit card details, salary, information collected from customer surveys etc • Sensitive information • information about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices criminal record or health information. • Under the APPs, the definition of sensitive information has been expanded to include biometric information used for biometric verification or identification (such as fingerprints, iris recognition, DNA etc).

13. The Australian Privacy Principles • 13 new APPs replace IPPs and NPPs • Single set of principles which apply to both public and private sectors (APP entities) • Structured to reflect the information life cycle — collection, use and disclosure, quality and security, access and correction • Mandatory minimums which must be equalled or exceeded in every case Provides a single set of rules (at least for the majority of agencies and businesses bound only by them). No longer allows trade-offs in specific industry codes – all agencies and businesses must meet minimum standards

14. App 1 – Open and Transparent Management of personal information • Agencies must have a clearly expressed and up to date privacy policy and complaints procedure • Agencies must take reasonable steps to implement processes that will ensure that the agency complies with the APPs While most organisations have privacy policies they will need to update them and their complaints procedures regularly and ensure that they have processes in place to meet APP requirements

15. APP 2 – Anonymity and pseudonymity • Allows individuals to interact with agencies anonymously • Permits the individual to use a pseudonym – unless it is impracticable to deal with an unidentified individual Organisations need to allow people to use pseudonyms or deal with them anonymously where possible

16. APP 3 – Collection of personal and sensitive information • Collection must be ‘reasonably necessary’ for, or ‘directly related’ to, one or more of an agency’s functions or activities • Higher standards for collection of sensitive information (necessary and with consent). The definition of sensitive information hasn’t changed, but if it can be implied (eg some surnames are particular to specific races and ethnic groups) then information should be treated the same way.

17. APP 4 – Dealing with unsolicited personal information • Unsolicited personal information now has the same protections as solicited personal information • New principle for handling unsolicited personal information mandates that such data should be destroyed or de-identified if it could have been collected overtly and is not part of a commonwealth record. Ensure that only necessary information is transferred to external companies. Companies receiving unsolicited information should destroy it.

18. APP 5 – Notification of collection • This principle outlines the information that must be given to an individual when the agency collects their personal information. It includes: • Information about an agency’s APP policy • Who the agency is and how to contact it • The purpose(s) of the collection • Any collections from third parties • Consequences of non-collection • Complaint handling process • Potential overseas disclosure There is no substantial change in this APP compared with previous regulations on data collection

19. APP 6 – Use or disclosure • Deals with use and disclosure of personal information • Different (more stringent) obligations apply to the use or disclosure of sensitive information eg must gain permission • New limited exceptions, to permit use or disclosure for secondary purpose to: • Locate missing person • Establish, exercise or defend a legal equitable claim • Confidential alternative dispute resolution There is no substantial change in this APP compared with previous regulations on data collection

20. APP 7 – Direct marketing • Prohibits organisations from using or disclosing personal information for direct marketing purposes, except in specified circumstances • Provides a compulsory ‘opt out’ clause • Includes personalised advertisements on websites which use information gathered from “cookies” and similar to target individuals This is a completely new Principle and differentiates Direct Marketing practices aimed at selling or marketing products. It includes electronic personalised DM

21. APP 8 – Cross border disclosure • Introduces an accountability approach for cross-border disclosure • Agencies must take reasonable steps to ensure overseas recipients do not breach APPs • Agencies may be accountable for a breach of APPs by overseas recipients While this is now a separate Principle the concepts contained within it were in the NPPs previously.

22. APP 9 – Adoption, use or disclosure of government related identifiers • Prohibits an organisation from adopting, or using a government related identifier as its own identifier Open data sets and the ability to conduct meta-analysis have led to the introduction of this additional measure to ensure data protection. It is recommended that an organisation uses its own identification system for records. It can hold a concordance, but must do so carefully.

23. APP 10 – Quality • Requires agencies to take reasonable steps to ensure personal information it collects, uses or discloses is: • Accurate • Up-to-date • Complete • Agencies should ensure that personal information that it uses or discloses is also relevant for the purpose of the use or disclosure There is no substantial change in this APP compared with previous regulations

24. APP 11 – Security • Inclusion of ‘interference’ • an agency must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure (including hacking) There is no substantial change in this APP compared with previous regulations on data handling

25. APP 12 – Access • Agencies required to respond to requests for access of personal information within 30 days • Exceptions apply – Freedom of Information Act 1982 or other legislation • Access should be provided in the requested manner (where reasonable and practicable) • Individual not to be charged • Written reasons for the refusal and complaint mechanism There is no substantial change in this APP compared with previous regulations

26. APP 13 – Correction • Agencies required to take ‘reasonable steps’ to correct personal information to ensure it is accurate, up-to-date, complete, relevant and not misleading, if: • agency satisfied it needs to be corrected, or • individual requests correction • Agency to respond to request within 30 days • Individual not to be charged • Statement required if agency refuses to correct and individual requests statement • Written reasons for refusal and complaint mechanism There is no substantial change in this APP compared with previous regulations

27. Commissioner’s New Powers • Ability to investigate a potential privacy breach without receiving a complaint (own motion investigations - OMIs) as well as in response to complaint • Wider range of action to be taken if a breach of the Act is substantiated whether as a result of OMI or complaint (as before) • Written undertakings can now be enforced • Seek civil penalties for serious or repeated breaches (up to $1.7 million for corporations) Commissioner can take unilateral action, fines are larger.

28. Market Research Industry Response • New Privacy Code • Information/template pack for AMSRO companies

29. New Market and Social Research Industry Privacy Code • New codes must follow the format of the APPs and add to it • To our knowledge the market research industry is the only one that has tendered its own Code for ratification. This will mean that the Code administrator is the industry body (AMSRO) rather than the OAIC.

30. New Market and Social Research Industry Privacy Code • The main areas of change are: • Subscribers to Code (AMSRO members) will have access to an industry Dispute Resolution mechanism, but must ensure public access to Privacy Policies, Complaints Procedures and the industry Code, as well as reporting complaints systematically and regularly to AMSRO • Allow respondents to use a pseudonym if a name is needed and it is practicable • Definition of personally identified information – care in what happens with de-identified data sets in public arena. MR data falls into three areas irrespective of the collection method: • Contact details of research participants/sample • Research status • Research data • New Privacy Principle for Direct Marketing will allow the industry to differentiate practice further

31. New Market and Social Research Industry Privacy Code • Main changes are…..: • Government identifiers must not be used as research identifiers, unless : • Is reasonably necessary for verifying the person’s identity • Is reasonably necessary for the organisation to fulfil its obligations to an agency or a state/territory authority • It is authorised by or under an Australian law or a court order • It is necessary for enforcement activities • If a respondent requests that their personally identified data be amended or corrected and this would damage the original point in time data, keep a record of the amendment if practical

32. PRIVACY Do’s and Don’ts • Do ensure appropriate systems and processes are in place to comply with the APPs • Don’t collect more personal information than is necessary or relevant • Do tell individuals what you are going to do with the collected information • Don’t use information for an unrelated secondary purpose without consent • Don’t disclose personal information unnecessarily • Do give people access to their personal information if they ask unless there are proper grounds not to • Do keep information secure and free from interference • Don’t keep personal information you no longer need or are no longer required to retain • Do keep personal information accurate and up to date • Don’t disclose information to overseas recipients in countries without equivalent privacy laws and the ability to enforce those rights unless consent is provided • Do make someone in the organisation responsible for privacy complaint handling, processes and systems.

33. Information pack for AMSRO companies • AMSRO has produced information for members to help them comply with the requirements in particular: • Templates for privacy policies • Guidance on how to meet the requirements

34. The Trustmark • The Trustmark guarantees business and government decision makers that they are buying research that is quality-assured and meets not only ethical standards, but also the new Privacy Code. • AMSRO member organisations operate under the following stringent, mandatory criteria: • Privacy: Adherence to the Market & Social Research Privacy Code • Quality assurance: Companies must have the International Standard for Market, Opinion and Social Research qualifications (ISO 20252) • Ethics: Adherence to the AMSRS Code of Professional Behaviour

35. Questions?