Summary of the OAIC's assessment of five Registered Training Organisations and their management of personal information

Part 1: Introduction

1.1 The Office of the Australian Information Commissioner (OAIC) has a range of functions and powers directed towards protecting the privacy of individuals by ensuring the proper handling of personal information. These functions and powers are conferred by the Privacy Act 1988 and by other legislation containing privacy protection provisions.

1.2 The OAIC conducted a privacy self-assessment with five registered training organisations (RTOs) in August 2017. This report describes the assessment process and provides a summary of the key findings. All participating RTOs remain anonymous in this report.

Background

1.3 The Unique Student Identifiers (USI) scheme is a joint State and Commonwealth initiative administered by the Student Identifiers Registrar (SI Registrar). The Department of Education and Training (DET) provides resources, including staff, to support the Registrar. The SI Registrar’s operations are governed by the Student Identifiers Act 2014 (SI Act) and the Privacy Act.

1.4 The USI is a unique lifetime identifier consisting of ten digits and letters. All students in Australia undertaking nationally recognised vocational education and training require a USI to receive their qualifications or statements of attainment. The USI enables students to keep track of their training history and qualifications and gives permission to training providers to access their transcripts online for enrolment purposes, credit transfers and entitlement assessments. To obtain a USI, students may register either directly via the USI website, or through their nominated RTO. There are approximately 4,300 RTOs in Australia.

1.5 RTOs are required to collect a range of personal information to apply for USIs on behalf of their students, including:

• name
• gender
• date of birth
• place of birth
• contact details.

1.6 While the SI Registrar is responsible for the administration of the USI scheme, RTOs are responsible for the collection, use, storage and disposal of USIs and associated personal information required to apply for USIs on behalf of their students. RTOs are also required to issue students with a collection notice, an example of which is available from the SI Office.

1.7 The OAIC is the dedicated privacy regulator of student identifiers under the SI Act. The SI Registrar and the OAIC have a Memorandum of Understanding (MOU) regarding the provision of dedicated privacy-related activities under the Privacy Act and the SI Act.

1.8 Under the 2015-17 MOU arrangement, the OAIC conducted a self-administered SmartForm survey to assess the privacy practices and procedures of five RTOs.

Objective and scope of the assessment

1.9 This assessment was conducted under s33C(1)(a) of the Privacy Act, which allows the OAIC to assess whether personal information held by an entity is being maintained and handled in accordance with the Australian Privacy Principles (APPs).

1.10 In general, the objective of this assessment was to examine the maturity of selected RTOs privacy practices. Specifically, the assessment considered whether the RTOs were handling USIs and associated personal information in accordance with the requirements of APP 1 (open and transparent management of personal information) and APP 5 (notification of the collection of personal information). The assessment examined whether the RTOs have:

• implemented practices, procedures and systems to manage personal information in an open and transparent manner (APP 1.2)
• a clearly expressed and up-to-date APP Privacy Policy about how they manage personal information (APP 1.3 and 1.4)
• made their APP Privacy Policy available free of charge and in an appropriate form (APP 1.5)
• notified individuals or ensure their awareness of the APP 5 matters (APP 5).

Methodology

1.11 The five RTOs were nominated by the SI Registrar based on a number of considerations, including:

• the size of the organisation
• annual turnover (for jurisdictional purposes)
• whether or not the organisation is a private entity
• whether the RTO was likely to have a high number of international students
• educational sectors covered by the RTO.

1.12 The assessment involved the following:

• a desktop review of the privacy policy of the selected RTOs
• data collection using a self-administered SmartForm questionnaire from the selected RTOs over a four-week period
• analysis of RTOs’ responses against the requirements of APPs 1 and 5.

1.13 The questionnaire[1] consisted of 73 main questions, starting with 10 questions on statistical information about RTOs’ students and staff to help understand their business. The remaining questions were organised in three parts to be consistent with the steps outlined in the OAIC’s Privacy Management Framework. Most of the questions were presented as a statement to which RTOs were asked to select a response from a rating scale of five options. There were also questions which required a ‘yes’ or ‘no’ answer.

1.14 The findings presented in this report are based on RTOs’ self-reported data. The RTOs did not provide the OAIC with any supporting documents for their responses. The OAIC did not review any policy or procedure documents aside from the RTOs’ privacy policies, or undertake any inspections of the RTOs’ privacy practices. The OAIC provided individualised feedback to the RTOs on their survey responses and privacy policies and also made recommendations to address any identified privacy risks where applicable.

Privacy risks

1.15 This assessment was risk-based and focused on identifying privacy risks to the effective handling of personal information in accordance with privacy legislation.

1.16 Where the OAIC identified high or medium privacy risks, the OAIC made recommendations to the RTOs about how to address those risks. For guidance on how the OAIC assesses privacy risks, refer to Attachment A. Further detail on the OAIC’s approach to privacy assessments is provided in Chapter 7 of the OAIC’s Guide to Privacy Regulatory Action.

Reading this report

1.17 Part 2 of this report summarises the key findings from the assessment. It outlines areas of good privacy practices as well as areas for improvement that were identified from the assessment. The findings are presented under four main headings:

• Privacy management
• Policies, procedures and practices
• Privacy training and resources
• Risk management.

1.18 In addition to this report, the OAIC also hosted a webinar to discuss the key findings in this privacy assessment. The webinar was co-presented by a representative of one of the RTOs that participated in the assessment, and is available to view on the OAIC’s website.

Part 2: Summary of findings

Areas of good privacy practice

2.1 The OAIC’s analysis of the RTOs’ responses to the privacy assessment survey identified the following good privacy practices.

Privacy management

2.2 All RTOs reported to regularly brief senior management and other staff with responsibility for privacy management on privacy risks or issues identified.

2.3 The majority of RTOs reported to have:

• a senior staff member entrusted with overall privacy accountability
• management groups/committees that deal with privacy issues as they arise
• reporting mechanisms to ensure senior management are routinely informed about privacy issues (one RTO reported to be developing these mechanisms)
• a privacy officer or equivalent role.

2.4 Most RTOs reported to have:

• adopted a ‘privacy by design’ approach to managing business projects and making decisions that involve personal information
• one or more designated privacy champions.

Policies, procedures and practices

Collecting personal information

2.5 To apply for a USI on behalf of a student, all RTOs reported to have:

• an internal policy or process that governs the collection of personal information
• a procedure to verify the identity of students.

2.6 All RTOs reported to have an up-to-date privacy policy, which is available to students on the RTOs’ websites and in hard copy upon request.

2.7 The majority of RTOs reported to:

• have an up-to-date collection notice setting out how they handle personal information that they collect
• provide the collection notice to students at or shortly after the collection of their personal information.

2.8 The SI Office has a sample collection notice which entities can use to comply with the notification requirements in APP 5. One RTO reported to provide students with this collection notice at or shortly after the collection of their personal information.

Handling personal information

2.9 The majority of RTOs reported to have policies and procedures to manage the disclosure of USIs and associated personal information to third parties, i.e. persons other than the student such as the National Centre for Vocational Education Research.

2.10 The majority of RTOs also reported to keep:

• a record of the type and location (physical and virtual) of USIs and associated personal information they hold. Most RTOs reported to regularly update these records
• a list or register of policies or procedures that apply to personal information, including how USIs and associated personal information are handled (one RTO reported to be developing this register).

2.11 Most RTOs reported that they did not keep copies of documents used to prove a student’s identity.

2.12 None of the RTOs reported to:

• use USIs (in any form) for any purpose (including administrative purposes) other than the uses permitted in the SI Act
• disclose USIs or related personal information to a parent company or affiliate overseas, or to an overseas entity (such as a service provider).

Securing personal information

2.13 All RTOs reported to:

• have a policy that requires staff to change their passwords regularly, with the majority also reported that this policy requires staff to have strong passwords
• have all staff, including casual staff and contractors, sign confidentiality agreements or have confidentiality clauses included in their service contracts
• review staff access rights to ensure they remain appropriate
• log user access to/activity in the IT systems. Most RTOs also reported that they monitor these logs
• actively manage and restrict the number of staff with administrator rights to the IT systems.

2.14 The majority of RTOs reported to have:

• an internal policy that sets out how they manage information security (one RTO reported to be developing this policy)
• an access control policy that limits staff access to information and systems on a need to know basis (one RTO reported to be developing this policy)
• effective security measures such as access card or locked cabinets in place to protect USIs and associated person information held in hard copy (one RTO reported to be developing these measures)
• processes that provide for secure destruction and de-identification of personal information (one RTO reported to be developing these processes).

2.15 The majority of RTOs also reported to log administrator access to/activity in the IT systems. Some RTOs reported to monitor these administrator access logs.

2.16 To protect their IT systems, all RTOs reported to use firewalls, regularly patch applications and operating systems and undertake backups. The majority also reported to use encryption and penetration testing, followed by application whitelisting.

Accessing and correcting personal information

2.17 All RTOs reported to have a process in place to manage requests from students to access and/or correct their personal information. The majority also reported to have policies and procedures to ensure personal information they hold is accurate and up-to-date.

Privacy training and resources

2.18 All RTOs reported to have privacy resources available to staff. The majority also reported to train their staff on information security risks.

Risk management

2.19 Most RTOs have a risk register that includes:

• privacy risks and issues
• mitigation strategies and actions, with clear accountability for implementation
• processes and mechanisms for regular monitoring and review.

Complaints and enquiries

2.20 All RTOs reported to:

• have a process for receiving and responding to privacy complaints and privacy enquiries
• maintain a complaints register.

2.21 None of the RTOs received any privacy complaints in the financial year of 2015–16.

Evaluating and enhancing privacy management

2.22 All RTOs reported to have:

• channels for staff and students to provide feedback on their privacy processes
• processes for:
  • reviewing policies and procedures, with the most recent review conducted within the last 18 months
  • conducting threat risk/security assessments and reviewing their outcomes, with the majority of the most recent assessments conducted within the last 18 months
• a process for incorporating changes to their policies and procedures from issues identified in the ordinary course of business, for example, from complaints or data breaches.

2.23 All RTOs also reported to keep copies of their reviews and assessments.

Areas for improvement

2.24 The OAIC also noted the following areas for improvement in the RTOs’ responses and made recommendations to the respective RTOs accordingly to improve their privacy management and practices.

Privacy management

2.25 None of the RTOs reported to have a privacy management plan that sets out how they manage personal information and privacy risks, however, the majority of them reported to be developing such a plan.

2.26 None of the RTOs reported to have a process in place for determining whether to undertake a privacy impact assessment (PIA) on any new project or changed business process that involve the collection, storage, use or disclosure of personal information. However, two RTOs reported to be developing such a process at the time of the survey.

2.27 Only one RTO reported to have a documented privacy management structure, including appointments to key roles/responsibilities and clear reporting lines for privacy management. Two RTOs reported to be developing this document.

The OAIC’s Privacy Management Framework offers guidance on developing and maintaining a PMP.

Policies, procedures and practices

2.28 The OAIC reviewed the RTOs’ privacy policies and identified the following privacy risks:

• the language of the policies was too complex, which may be difficult for younger people or people with lower literacy to comprehend
• as required by APP 1.4, information was not included about:
  • how the RTO will handle complaints
  • how an individual can access or correct their personal information held by the RTO
  • whether the RTO discloses personal information overseas
• the policies were not published to the WCAG 2.0 standard, which is intended to make web content more accessible to people with disabilities.

2.29 None of the RTOs have their privacy policies or collection notices available in:

• languages other than English for their overseas students
• alternative accessible formats, for example, braille, video or large print, for students with disabilities.

Privacy training and resources

2.30 Only one RTO reported to provide mandatory privacy training for all new staff and regular refresher privacy training for all staff. Two RTOs reported to be developing mandatory privacy training for all new staff at the time of the survey.

Risk management

2.31 Only two RTOs reported to have a risk management plan that includes consideration of privacy risks, and one RTO reported to be developing this plan.

Privacy incidents and data breaches

2.32 Only one RTO reported to have policies and procedures that set out clear processes to deal with privacy related incidents, for example, a data breach response plan or an incident management plan that deals with privacy. Two RTOs reported to be developing these policies and procedures.