Australian Privacy Management Framework Launched

On 3 May, marking the start of Privacy Awareness Week, the Australian Office of the Information Commissioner (OAIC) published its previously announced Privacy Management Framework. The framework is intended to assist private- and public-sector organisations in meeting their privacy compliance obligations under the Australian Privacy Principles (APPs).

The Australian Context of the Framework

Under APP 1.2, organisations are required to take reasonable steps to implement practices, procedures and systems that will ensure compliance with the APPs. To help organisations understand their obligations under this broadly phrased principle, the APP Guidelines propose a list of specific practices, procedures and systems that organisations should consider implementing in order to satisfy APP 1.2. These include, for example, governance mechanisms, regular staff training, procedures for identifying and managing privacy risks and periodic assessments of the adequacy and currency of the organisation’s privacy practices and procedures. Nonetheless, the privacy commissioner, in his privacy governance speech of 11 February, identified APP 1.2 as an area that organisations need more help with and proclaimed the framework as the tool to assist organisations to meet the requirements of APP 1.2.

International Context of the Framework

The OAIC is not the first privacy regulator to issue a privacy governance framework. The respective privacy regulators of Canada, Hong Kong and France have previously issued privacy governance frameworks for private-sector organisations. And the New Zealand and New South Wales privacy regulators have issued privacy governance frameworks for the public sector.

This trend amongst privacy regulators to issue guides on privacy governance is no coincidence. Rather, it can be attributed to the global privacy principle of accountability, which is currently undergoing a significant evolution. Various international data protection documents have recently been, or are in the process of being, updated in relation to the accountability principle, which is increasingly understood as requiring organisations to take a comprehensive, systematic and proactive approach to privacy compliance, as opposed to merely allocating responsibility for privacy compliance. For a detailed discussion of the evolution of the accountability principle in international data protection instruments and the trend amongst national privacy regulators to promote the implementation of privacy management programs as the tool to get privacy compliance right, see the author’s two-part article on accountability, published respectively in the April & May 2015 editions of Data Protection Law & Policy.

The Content of the Framework

The framework, a succinct six-page document, sets out four steps that organisations should take to ensure they practise good privacy governance and meet their privacy compliance obligations. Within each step, the framework provides a list of “commitments,” in bullet-point format, that organisations are encouraged to make depending on the entity’s particular circumstances, including its size, resources and business model. Namely, organisations are encouraged to take the following four steps:

1. Embed a culture of privacy that enables compliance. This is arguably the most important step. It requires organisations to treat personal information as a valuable business asset that deserves protection; allocate responsibility for privacy management to designated staff; adopt a Privacy-by-Design approach; develop and implement a privacy management plan; implement reporting mechanisms, and understand its privacy obligations and the role of the OAIC.      
2. Establish robust and effective privacy practices, procedures and systems. This is the most detailed part of the framework and proposes nine actions that organisations should take. These include keeping an up-to-date personal data inventory; implementing processes that ensure compliant personal information-handling practices; promoting privacy awareness within the organisation; developing and implementing good internal privacy policies; implementing risk-management processes; undertaking privacy impact assessments; establishing processes for handling privacy enquiries, complaints, access and correction requests, and developing data breach response plans.
3. Evaluate privacy processes to ensure continued effectiveness. This third step emphasises the importance of regular monitoring, reviewing and assessing of existing privacy practices, procedures and systems. Organisations should commit to regularly monitoring and reviewing their privacy processes, documenting compliance with their privacy obligations, measuring their performance against their privacy management plan and seeking feedback from staff and customers on privacy practices.
4. Enhance response to privacy issues. This fourth step underlines the fact that privacy compliance is an ongoing obligation that requires a proactive and anticipatory approach. The OAIC proposes eight action points in this regard, including changing privacy practices in response to the evaluation results, considering external assessments of privacy practices and monitoring and addressing new security risks and threats.

Practical Implications of the Framework

The framework comes 14 months after the large-scale reforms of Australian privacy laws took effect and is one of several recent OAIC initiatives signifying that privacy compliance is an important task not to be underestimated. Those organisations that are subject to the APPs would do well to start sooner rather than later to overthink their privacy practices in a systematic way. Making available a compliant privacy policy on paper will no longer be considered sufficient to demonstrate privacy compliance. Rather, organisations will be expected to build a culture of privacy from the top down, dedicate sufficient staff and other resources to privacy matters, implement sound privacy measures—such as data inventories, privacy impact assessments and data breach response plans—and continuously monitor, evaluate and adapt their privacy processes. This is not something that can be achieved overnight but requires time and planning.