Gavin provided us with an overview of the Privacy Act (2020) and outlined the things we can do to meet our obligations. The Information Privacy Principles are Collecting information, Holding it, Using and Disposing of it. Under the heading collecting information, it has to be necessary and you should only collect information from the person directly not via a third party. It must also be transparent in that the purpose the information is collect for is clear to the individual. Holding information requires security safeguards that are reasonable and that individuals can have access to their information. It should also be noted that individuals have the right to correct personal information.
Disposing of information is expected once an individual's personal information is no longer required for the purposes it may lawfully be used.
Purpose is also important as information must not be used for another purpose and it cannot be shared without the individuals knowledge. Information can be shared overseas only if the individual authorised it and if the foreign entity has the same security as NZ but there is no list in existance that shows which countries have similar security?
Gavin's advice is that all agncies should have a dedicated Privacy officer. Under the Privacy Act every agency is required to have a privacy officer who must abide by the Privacy principles and ensure the agnecy complies with the Act, deal with requests for access to information and/or the correction of any personal information. The privacy officer is also expected to work with the Privacy Commission during any investigation of complaints. Should there be a privacy breach the privacy office would need to determine: has there been unauthorised or accidental access to or disclosure, alteration, loss or destruction of personal information or an action that prevents an agency from accessing the information on either a temporary or permanent basis. If personal harm could occur you need to notify the Privacy Commissioner within 72 hours of the breach.
Purpose is also important as information must not be used for another purpose and it cannot be shared without the individuals knowledge. Information can be shared overseas only if the individual authorised it and if the foreign entity has the same security as NZ but there is no list in existance that shows which countries have similar security?
Gavin's advice is that all agncies should have a dedicated Privacy officer. Under the Privacy Act every agency is required to have a privacy officer who must abide by the Privacy principles and ensure the agnecy complies with the Act, deal with requests for access to information and/or the correction of any personal information. The privacy officer is also expected to work with the Privacy Commission during any investigation of complaints. Should there be a privacy breach the privacy office would need to determine: has there been unauthorised or accidental access to or disclosure, alteration, loss or destruction of personal information or an action that prevents an agency from accessing the information on either a temporary or permanent basis. If personal harm could occur you need to notify the Privacy Commissioner within 72 hours of the breach.
Complaints and consequences - have a good internal processes, understand and support an investigation by the Privacy Commissioner if necessary. The fine can be up to $10,000 but if a court case evolves the costs can be much higher not to mention reputational harm. To avoid all of this it is a good idea to appoint a privacy officer and create good Privacy Collateral - Privacy Statements, Privacy Policy, Privacy Incident Response Plan, Contractual clauses and busineness processes. An outline of process can be to contain any breach, determine if there is a breach and how serious it is and who to notify. But preferably workplaces train staff to prevent any breaches, and have clear policy settings and collateral. Is your agency privacy sorted if not Go Private are offering a 10% discount until 26 September using the coupon code PORTNICHOLSON10.