Introduction
This report is made pursuant to the reporting requirements set out under section 7.3 of the Memorandum of Understanding (MOU) between the Australian Capital Territory (ACT) and the Office of the Australian Information Commissioner (OAIC) for the provision of privacy services related to the Information Privacy Act 2014 (ACT) (Information Privacy Act).
The Information Privacy Act contains the Territory Privacy Principles (TPPs) which ACT public sector agencies must comply with when collecting and handling personal information (other than personal health information).
This report is for the period 1 July 2022 to 30 June 2023.
The numbered headings below correspond to the reporting requirements set out in the MOU.
7.3 (1) Number of complaints, assessments, written and telephone enquiries
Number of | Total |
|---|---|
(a) Complaints open as at 1 July 2022 | 6 |
(b) Complaints received in 2022-23 | 12 |
(c) Complaints closed in 2022-23 | 8 |
(d) Complaints open as at 30 June 2023 | 10 |
(e) Complaints that resulted in a report to the Minister under section 43 of the Information Privacy Act | N/A |
(f) Complaints about which the Commissioner has given a notice under section 45 of the Information Privacy Act | N/A |
(g) Assessments finalised | 0 |
(h) Written and telephone enquiries about ACT public sector agencies | 2 |
7.3 (1)(h) Summary of issues raised in written and telephone enquiries
Telephone calls
The OAIC received 2 telephone enquiries during the reporting period:
- Both of the telephone enquiries related to the TPPs:
− 1 individual called with concerns about the accuracy and security of their personal information held by ACT Government agencies. The OAIC provided advice about TPPs 10 and 11, and the OAIC’s complaints process.
− 1 individual called regarding an alleged disclosure of inaccurate personal information about them by ACT Government agencies. The OAIC provided advice about TPPs 6, 10, and 13, and the OAIC’s complaints process.
Written enquiries
The OAIC received no written enquiries during this reporting period.
7.3 (2) For each complaint received in 2022-23, a summary of issues raised and outcomes
Respondent: Child and Youth Protection Services
Details: The complaint was received on 13 August 2022. The complainant alleges that the respondent failed to ensure the accuracy of the personal information it collected, used, and disclosed about them.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Canberra Health Services
Details: The complaint was received on 13 August 2022. The complainant alleges that the respondent failed to correct their personal information, and disclosed inaccurate personal information to third parties.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: The Office of the Director of Public Prosecutions
Details: The complaint was received on 10 September 2022 and closed on 4 April 2023. The complainant alleged that the respondent improperly disclosed their personal information.
This complaint was closed following conciliation.
Respondent: Access Canberra
Details: The complaint was received on 8 October 2022. The complainant alleges that the respondent failed to ensure the security of their personal information, which was disclosed in a data breach by a different entity.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Child and Youth Protection Services
Details: The complaint was received on 27 October 2022. The complainant alleges that the respondent improperly disclosed their personal information.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: ACT Health
Details: The complaint was received on 15 November 2022 and closed on 9 January 2023. The complainant alleged that the respondent’s new digital health records system did not protect their health records appropriately.
The OAIC found that the respondent’s handling of the complainant’s information did not meet the definition of ‘personal information’ under the Information Privacy Act. This complaint was closed under s 39(a) of the Information Privacy Act.
Respondent: Justice and Community Safety Directorate
Details: The complaint was received on 27 November 2022. The complainant alleges that the respondent improperly disclosed their personal information, which was also inaccurate.
This complaint is currently moving through the OAIC’s complaint handling process..
Respondent: ACT Education Directorate
Details: The complaint was received on 30 November 2022 and closed on 6 June 2023. The complainant alleged that the respondent failed to provide them with the option to receive content/correspondence anonymously, and failed to notify them that it was collecting personal information when it delivered content to them via an online method.
This complaint was closed following conciliation.
Respondent: Major Projects Canberra
Details: The complaint was received on 11 January 2023 and closed on 30 January 2023. The complainant alleged that the respondent improperly disclosed their personal information.
The OAIC found that the respondent had adequately dealt with this matter and the complaint was closed under s 39(g)(i) of the Information Privacy Act.
Respondent: Canberra Health Services
Details: The complaint was received on 10 February 2023 and closed on 29 March 2023. The complainant alleged that the respondent improperly disclosed their personal information.
This complaint was closed following conciliation.
Respondent: Canberra Health Services
Details: The complaint was received on 30 March 2023. The complainant alleges that the respondent improperly disclosed their personal information.
This complaint is currently moving through the OAIC’s complaint handling process.
7.3 (3) For each finalised assessment, a summary of the outcomes
Assessments finalised as at 30 June 2023
Data Breach Response Plan Assessment
The OAIC conducted an assessment of the data breach response plans for each ACT government directorate. The OAIC considers having a data breach response plan focused on reducing the impact of a breach is a reasonable step towards compliance with TPP 11. TPP 11 requires an ACT public sector agency that holds personal information to take reasonable steps to protect the information from misuse, interference or loss and from unauthorised access, modification or disclosure.
Under the Notifiable Data Breaches (NDB) scheme, any organisation or agency the Privacy Act 1988 (Cth) covers must notify affected individuals and the OAIC when a data breach is likely to result in serious harm to an individual whose personal information is involved. If an ACT public sector agency experiences an eligible data breach involving tax file number information, it must notify affected individuals and the OAIC.[1] However, the OAIC understands that it is ACT Government policy to voluntarily report any significant privacy data breaches to the OAIC, even where tax file number information is not involved in the breach.
The scope of this assessment was limited to examining whether the directorate:
- had a plan to respond to data breaches, that reflects the OAIC’s best practice guidance, as a reasonable step under TPP 11
- had taken steps to operationalise the data breach response plan including training, testing, escalation, notification and governance.
Across all assessments, the OAIC made 11 recommendations to address privacy risks, including in relation to:
- having an approved data breach response plan
- considering the use of external expertise following a data breach
- documenting data breach response team processes and details.
The OAIC provided draft assessment reports to the 7 directorates on 16 June 2023. We finalised the assessment reports for 4 of the directorates in the reporting period. The remaining 3 assessment reports were finalised by early August 2023.
At the time of writing, these recommendations have been accepted in full by the respective directorates. Following finalisation of all assessments, a summary report of the will be published on the OAIC website.
Future assessments as at 30 June 2023
Under the 2021-24 MOU, the OAIC will conduct 2 assessments over the 3-year term. Early in 2023-24 the OAIC will hold preliminary discussions with the ACT’s Justice and Community Services Directorate about the scope of the second of these assessments.
7.3 (4) Information about any complaints that have not yet been finalised
Respondent: Chief Minister, Treasury and Economic Development Directorate
Details: The complaint was received on 6 March 2022. The complainant alleged that their personal information had been compromised in a data breach by the respondent.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Transport Canberra and City Services Directorate
Details: The complaint was received on 3 June 2022. The complainant alleged that the respondent improperly disclosed their personal information to third parties.
This complaint is currently moving through the OAIC’s complaint handling process.
* This case is related to the complaint described below.
Respondent: Transport Canberra and City Services Directorate
Details: The complaint was received on 3 June 2022. The complainant alleged that the respondent improperly disclosed their personal information to third parties.
This complaint is currently moving through the OAIC’s complaint handling process.
* This case is related to the complaint described above.
Respondent: Child and Youth Protection Services
Details: The complaint was received on 13 August 2022. The complainant alleges that the respondent failed to ensure the accuracy of the personal information it collected, used, and disclosed about them.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Canberra Health Services
Details: The complaint was received on 13 August 2022. The complainant alleges that the respondent failed to correct their personal information, and disclosed inaccurate personal information to third parties.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Access Canberra
Details: The complaint was received on 8 October 2022. The complainant alleges that the respondent failed to ensure the security of their personal information, which was disclosed in a data breach by a different entity.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Child and Youth Protection Services
Details: The complaint was received on 27 October 2022. The complainant alleges that the respondent improperly disclosed their personal information.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Justice and Community Safety Directorate
Details: The complaint was received on 27 November 2022. The complainant alleges that the respondent improperly disclosed their personal information, which was also inaccurate.
This complaint is currently moving through the OAIC’s complaint handling process.
Respondent: Canberra Health Services
Details: The complaint was received on 30 March 2023. The complainant alleges that the respondent improperly disclosed their personal information.
This complaint is currently moving through the OAIC’s complaint handling process.
7.3 (5) Details of formal reports and recommendations made to ACT public sector agencies as a result of complaints or other investigations
Not applicable.
7.3 (6) Any other information about the management of complaints or significant issues, including an analysis of systemic issues and common themes that have come to the Commissioner’s attention during the year
Advice to ACT Integrity Commission
The OAIC received a request for policy advice from the ACT Integrity Commission in respect of the Commission’s privacy processes. The OAIC is currently assisting the Commission with this request.
Acronyms and abbreviations
ACT Australian Capital Territory
APPs Australian Privacy Principles
Cth Commonwealth
Housing ACT Housing and Community Services ACT
Information Privacy Act Information Privacy Act 2014 (ACT)
MOU Memorandum of Understanding
OAIC Office of the Australian Information Commissioner
Privacy Act Privacy Act 1988 (Cth)
TPPs Territory Privacy Principles[2]
[1] See Privacy Act 1988 (Cth), s 26WE(1)(d).
[2] Schedule 1 of the Information Privacy Act.
