Introduction to the Information Privacy Act

1. Introduction to the Information Privacy Act

2. Session outline • What is information privacy? • Victorian privacy laws • Information Privacy Principles • Collection • Use and disclosure • Management of personal information • Access and correction • Responding to privacy complaints

3. Why do you need to know about privacy? • It’s the law – All Victorian public sector organisations and many community agencies must comply. People have a right to challenge how their personal information is handled. • Breaches can be costly – in $$ and reputation • Privacy is a basic human right enshrined in the Universal Declaration of Human Rights and the Victorian Charter of Human Rights and Responsibilities. • Good quality information is the basis for good decision-making. Privacy matters to people.

4. Context for privacy laws • Huge increase in the volumeof information collected and stored. • Electronic information is more vulnerable and more fluid.Large amounts of information can be easily – • copied, searched, aggregated and interlinked • stored on small, portable devices • transmitted widely • Collection and use of information can be less transparent. Technological advances are rapidly changing the way that information is collected and handled

5. Activity 1 What is information privacy?

6. Impact of privacy laws • Privacy laws provide people with more control over how organisations handle their personal information. • Privacy laws encourage openness and transparency. • The right to privacy has to be balanced against the necessary flow of information for provision of services.

7. The privacy protection landscape • **See - Outsourcing and Privacy Guide, 2011

8. Victorian Charter of Human Rights & Responsibilities • The public sector has been bound by the Charter since the beginning of 2008. • Includes the right to protection of privacy and reputation. • All public authorities must act compatibly with human rights. • All statutory provisions are to be interpreted compatibly with human rights. • Any new laws will require a statement of compatibility to advise Parliament on how they meet the charter’s standards.

9. The Victorian Information Privacy Act

10. Relationship to other laws If there is an inconsistency between a provision of the Information Privacy Act and another Act, the other Act’s provision prevails to the extent of the inconsistency.

11. What is personal information? Recorded information or opinion whether true or not about an individual whose identity is apparent or can be reasonably ascertained • This is a broad definition. For example, in some contexts, information about a property or business can be personal information. • The application of the Health Records Act is not limited to recorded information.

12. Exemptions The Act provides for some limited exemptions: • Publicly available information • generally available publications, e.g. newspapers; • information kept in a library, art gallery or museum for reference, study or exhibition; and • public record under the control of Keeper of Public Recordsthat is available for public inspection • Courts and tribunals (partial exemption) • Law enforcement (partial exemption)

13. Law enforcement exemption(partial exemption) • Law enforcement functions or activities • Enforcing laws relating to confiscation of proceeds of crime • Conduct of proceedings in court or tribunal • Police’s community policing functions It is not necessary for a law enforcement agency to comply with certain IPPs if it believes on reasonable grounds that non-compliance is necessary for: This is a partial exemption so, for example, there is no exemption for the IPPs relating to data quality and data security.

14. Public registers • The Information Privacy Act recognises that public registers may need different rules, but requires that they comply with the Information Privacy Principles (IPPs) as far as is reasonably practicable. • Consider: • the purpose of the register • what information has to be put on the register • how the register should be made available to the public • See Public Registers and Privacy – guidance for the Victorian Public Sector

15. Activity 2 What information is covered under the Act?

16. Information Privacy Principles • Collection • Use & Disclosure • Data Quality • Data Security • Openness 10 Information Privacy Principles (IPPs) form the core of the Information Privacy Act. Access & Correction Unique Identifiers Anonymity Transborder Data Flows Sensitive Information

17. Information Privacy Principles The IPPs are connected and set minimum standards for how personal information should be handled: • Collection (IPPs 8,1, and 10) • Use and disclosure (IPPs 2 and 9) • Management of personal information (IPPs 3,4,5 & 7) • Access and correction (IPP 6 and Freedom of Information Act)

18. Lifecycle of the Information Privacy Principles Privacy obligations apply for the entire life cycle of the information. They commence even before you collect or obtain personal information and remain as long as you have possession or control over that information.

19. Collection

20. Collection IPP 1 Collection and IPP 8 Anonymity • Don’t over collect— Collect only personal information that is necessary for the performance of functions • Anonymity – People should have the option of not identifying themselves when entering transactions, if that is lawful and feasible • Collect for a pre-determined purpose • Collect lawfully, fairly& not unreasonably intrusively

21. When collecting personal information, take reasonable steps to tell the person: who is collecting the information; what it will be used for; whether the collection is required by law; how the person can get access to the information; who else usually has access to the information; & what the main consequences, if any, are for the person if they do not provide the information. Collection notices TIP – Unsolicited personal information is also subject to the IPPs.

22. Examples of ways to give notice • A written notice which is: • on the organisation’s website; • sent with initial correspondence when a person is commencing their contact with the organisation; • on forms used to collect information; • on public notice boards or in advertisements; and/or • displayed in a reception area. • When people provide information over the phone - Included in an automated recorded message or set out in a standard script which is read out. • Included in brochures, posters and counter signage displayed in customer service locations.

23. Indirect collection • Information about a person should be collected only from that person if it is reasonable and practicable to do so • If information is collected from a third party, the organisation will need to assess what reasonable steps should be taken to give notice to the person that this information has been collected. • This will include considering issues such as: • The nature of the information collected; • What will be done with the information; and • The ability of the organisation to contact the individual concerned to provide them with the appropriate notice

24. Sensitive information (IPP 10) Collection of sensitive information is tightly restricted and usually will require consent. This includes information or opinion about an individual’s: • political views; • religious beliefs; • sexual preferences; • membership of groups (e.g. unions, political groups); • racial or ethnic origin; or • criminal record.

25. Activity 3 Applying the collection principles

26. What might this mean for your work? • Check forms for unnecessary questions • Know why you are asking for the information and how it will be used. • Ensure that all forms include ‘collection notices’ • When collecting information in person or over the phone, explain to people what the information is for and how it will be used • Know what information must be provided and what is optional • Provide notice when taking photos • Know what information your employer collects about you e.g. what monitoring occurs of email and internet usage

27. Use and disclosure Purpose governs use

28. Use and disclosure (IPP 2) • Step 1 - What purpose was the information collected for? • Step 2 – Consider IPP2: • Use and disclose personal information for the primary purpose for which it was collected; • Or fora related purpose a person would reasonably expect; • Or for one of the other reasons in IPP 2; • Otherwise, use and disclosure can only occur with consent. TIP – Disclosure includes confirming information and providing information that is also available from other sources.

29. Consent • Essential elements of consent – • Individual has the capacity to consent • Voluntary • Informed • Specific • Current • The Act does not require that consent be in writing.However, as a general rule, seek express consent in writing. • Prior consent should be obtained when using information for marketing or fund-raising -- opt-in rather than opt-out • Consent Vs notice – don’t ask for consent if there is no choice!

30. Use and disclosure • Required or authorised by another law; • Research or statistical analysis; • Serious and imminent threat to individual’s life, health, safety or welfare; • Serious [but not imminent] threat to public health, safety or welfare • To investigate or report concerns re unlawful activity; or • To assist a law enforcement agency. Info may also be used or disclosed for a secondary purpose, without consent, for the following reasons: TIP – Organisations are not required to disclose information under this principle, but may choose to. However obligations under other laws remain.

31. Use and disclosure for research • The research must be in the public interest; • Publication of the research must be non-identifying; • It must be impracticable for the organisation to seek the person’s consent; and • In the case of disclosure, the organisation must reasonably believe that the recipient will not disclose.

32. Transborder data flows (IPP 9) • Personal information can only be transferred interstate or overseas if certain conditions are met. Consent is one condition. • For example, cloud computing technology is being used increasingly by Victorian government agencies. See Information Sheet 03.11 Cloud Computing

33. Use and Disclosure scenarios Activity 4 4

34. What might this mean for your work? • Authorised, routine disclosures – • know your agency’s procedures • give only as much information as is necessary • security – verify identity and fax/send securely • tell them if the information is old or may not be accurate • make a record of the disclosure • Unusual requests – if in doubt, do not disclose anything until you check with supervisor/privacy officer • Share information with colleagues on a ‘need to know’ basis • Stop and think before placing information on the Internet

35. Management of personal information

36. Data Quality (IPP 3) • Make sure personal information is: • accurate • complete • up-to-date • Opinions, as well as factual information, can be inaccurate, incomplete or out of date E.G. if they are based on inaccurate facts TIP – Check the spelling of common names, such as John/Jon. Many privacy breaches occur by mixing client records.

37. Recording personal information • Be specific – vagueness and ambiguity make it difficult for others to use the information • Distinguish fact from opinion • Check the information, particularly if it is old or not provided by the person themselves • Inaccurate spelling of names and addresses lead to privacy breaches

38. What might this mean for your work? • Be careful with the initial data entry – check spellings of names, date of birth and addresses • If you can’t check the accuracy of the information, warn other users that the quality of the information is questionable • How will you distinguish clients with the same name? • Be careful with mail merges – check before they are sent • When advised of a change to contact details, ensure that all databases/records are updated. • Data cleansing by matching data sets may improve data quality but also carries privacy risks.

39. Data Security (IPP 4) • Take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or disclosure. • Personal information should be destroyed or de-identified when it is no longer needed. • Destruction should be in accordance with disposal schedules of the Public Records Act 1973.

40. What might this mean for your work? Secure your office, reception counter, work station - • Can customers read other people’s information from your computer, papers on your desk, whiteboards etc? • Can people overhear conversations with other customers? Avoid collecting information in waiting rooms. • Clear unclaimed documents from printers and faxes • Clear desks and lock cabinets

41. What might this mean for your work? • Establish systems so that you know what information leaves the workplace. • Do not leave documents unsecured in cars and your home • Password protect USB keys and laptops and think about what info is stored on them • Establish procedures to prevent documents being left in work cars, client’s homes etc Keep information secure when taken out of the office – See Portable Storage Devices Survey Report

42. What might this mean for your work? • Dispose of personal information securely • Use shredder or locked bin • Check paper before printing on the other side • Transmit information securely • What information can be emailed? • How can faxing be more secure? • Levels of access, audit trails, password rules help protect information on databases • BYO devices – how will security be maintained if staff use their own tablets, smartphones etc to connect to the organisation network? • Verify identity when providing information over the phone.

43. Protecting emails • Emails, esp. if sent via the internet, travel by circuitous routes. They can be read by unauthorised people along the way – like a postcard. • Encryption scrambles text during transit – like putting the postcard in a sealed envelope. • If encryption is not an option, consider sending sensitive documents by courier or an encrypted USB key. • Inter-office transmission (same network) is usually more secure. • Use BCC not CC, unless clear need to use CC.

44. Verifying identity • Steps should be taken to confirm a person’s identity before discussing any of their information with them. This helps to safeguard their information from unauthorised access. • However, requiring people to provide excessive amounts of personal information to identify themselves or requiring them to identify themselves for every interaction with you may be a problem. • Don’t use sensitive information to establish identity. • Be prepared that people may want to verify that you represent your organisation and that your request is legitimate.

45. What if there were a security audit today? Activity 5 5

46. A good password ... that you can remember! • at least 8 characters • a mix of 4 different types of characters – • upper case letters • lower case letters • numbers • special characters such as !@#$%^&*,;” • not a name, a slang word, or any word in the dictionary • don’t include any part of your name or your e-mail address (NASA) And one trick to remember it ... turn a sentence into a password - • E.G. “Now I lay me down to sleep” might become nilmDOWN2s (Bruce Schneier)

47. Unique identifiers (IPP 7) • Organisations must not require that a person provide a unique identifier in order to obtain a service unless: • it is required or authorised by law • it is in connection with the purpose for which the identifier was assigned • The assignment, adoption and sharing of unique identifiers is restricted, with the intention of minimising cross-matching of data across government agencies.

48. Openness (IPP 5) • Document clearly expressed policies on management of personal information and provide the policies to anyone who asks • Know where to find the policy • Know who your privacy contact person is • Make sure the policy is reviewed to reflect current practice

49. Access and correction

50. Access and correction (IPP 6) • Individuals have a right to seek access to their personal information and request corrections. • Access and correction are mostly handled under the Freedom of Information (FOI) Act. • Access and correction of information held by contracted service providers (CSPs) MAY be handled under the Information Privacy Act • See – • Information Sheet 01.10 Accessing and Correcting your Personal Information. • Outsourcing and Privacy Guide