-
On this page
The Australian public expect that when they share their personal information with Government, it will be handled responsibly and with care, and this is reflected in the additional safeguards in the Privacy (Australian Government Agencies – Governance) APP Code 2017 (the Australian Government Privacy Code). But as new projects, systems, technologies, and ways of working change how personal information is collected, held, used or disclosed, the impact these changes can have on people’s privacy are not always obvious.
A Privacy Impact Assessment (PIA) is one way entities can practically consider these issues. It asks questions such as: what personal information are we collecting? Why do we need it? What could go wrong? And what can we do to reduce the impact on people’s privacy?
Considering privacy early can help identify potential risks while there is still an opportunity to influence the design of a project and consider measures to negate, minimise or mitigate those risks.
Is a PIA required?
For Australian Government agencies subject to the Privacy Act 1988 (Cth) (Privacy Act), the Australian Government Privacy Code, requires a written PIA for all high privacy risk projects. A project may be a high privacy risk project where it involves new or changed ways of handling personal information that is likely to have a significant impact on individuals’ privacy.
While the Australian Government Privacy Code applies to Australian Government agencies, the OAIC encourages all APP entities to consider undertaking a PIA where a project may have privacy implications. Australian Privacy Principle (APP) 1.2 requires entities to take reasonable steps to implement practices, procedures and systems that ensure compliance with the APPs. A PIA can assist entities to consider appropriate practices, procedures and systems as part of project planning and privacy risk management.
Therefore, when entities are planning a new project or making a significant change to an existing one, they should ask: has there been consideration of whether a PIA is required?
Where to start?
Complete a Privacy Threshold Assessment (PTA) to help determine whether a PIA is needed.
A PTA is an initial screening exercise which assists in identifying whether a project involves new or changed ways of handling personal information and whether there are factors that suggest it could be a high privacy risk project. This could include new technology, systems, services, or significant changes to existing processes.
The following flowchart depicts the key issues considered under a PTA.
A PTA is not intended to determine the actual level of privacy risk. Rather, it acts as a probe to help identify projects that may require further assessment. The OAIC has developed a Privacy Threshold Assessment Template to guide entities through this process.
Where a PTA identifies a project has a potential to be a high privacy risk, the entity should undertake a PIA to assess the privacy risks in more detail. Further guidance on undertaking a PIA.
Conduct the PIA early
Completing a PIA early in the process allows for entities to forecast potential privacy risks, and incorporate mitigation strategies before key project decisions have been made.
Not every PIA needs to be lengthy or complex. Instead, a PIA should be tailored to the size, complexity and privacy risk of the project, and be proportionate to the nature of the project and the entity conducting it. It should consider how personal information will flow through the project, the potential impacts on individuals, and options for avoiding, minimising or mitigating those impacts. It can also provide an opportunity to consult relevant stakeholders and consider how the use of personal information in the project aligns with broader community expectations about privacy.
Advantages of conducting a PIA
A PIA assists entities in assessing whether their proposed project complies with their privacy obligations. It also allows entities to consider whether their project has included privacy by design processes by embedding privacy practices into the project planning.
A PIA may help an entity consider:
- Whether all proposed personal information is necessary for the project;
- Who will have access to personal information and for what purposes;
- Whether information will be shared with other entities or service providers;
- How individuals will be informed about the handling of their information; and
- What safeguards can reduce the likelihood or severity of privacy harms.
Considering these questions early can help build a project with privacy in mind and limit the need for privacy concerns to be dealt with retrospectively.
To assist entities in their completion of a PIA, the following PIA tool has been developed.
Lessons from our recent regulatory work
The OAIC recently made inquiries with a number of Australian Government agencies, including a regulatory agency with respect to a research study, and a portfolio department relating to AI deployment in the workplace. The aim of these inquiries was to better understand their practices for determining whether the project presented a high privacy risk and required a PIA.
Our inquiries identified that, in determining whether a PIA was required, agencies had taken steps to consider:
- Their obligations under the Australian Government Privacy Code, including whether the project constituted a high privacy risk project;
- Their obligations to comply with the APPs; and
- The privacy risks associated with the relevant project and appropriate measures to mitigate those risks.
The OAIC also found that the privacy assessment documentation maintained by these agencies aligned with the available OAIC guidance and tools. These artefacts not only assisted the agencies to comply with their responsibilities, but ensured that they could respond to the OAIC’s inquiries and maintain transparent records of their privacy decision making.
Available OAIC guidance for entities
The OAIC has developed a range of resources to assist entities in understanding and meeting their obligations under the Australian Government Privacy Code. These resources provide practical guidance on identifying and assessing privacy risks, determining whether the project is likely to constitute a high privacy risk project, and considering whether a PIA should be undertaken.
Entities can access the guidance here:
