G.P.O. Box 1196
Sydney NSW 2001

enquiries@privacy.org.au

http://www.privacy.org.au/	

15 February 2005

Mr P. Chadwick
Privacy Commissioner
Privacy Victoria
Level 11, 10-16 Queen Street
Melbourne   VIC   3000

Dear Paul

RE:   'Privacy Impact Assessments – a guide', issued in August 2004

The Foundation doesn't appear to have made a submission to your Office in relation to the above document, which came to our attention late last year.

We have just completed a response to the OFPC in relation to the public consultation process regarding their 'Privacy Impact Assessment Guidelines'.  I enclose a copy.

We've now reviewed the Victorian document.  Although we welcome the provision of guidance to agencies, we are concerned about a number of aspects of it.

There is now a substantial literature on PIAs.  In addition to the government documents referenced in your own and the OFPC's Guidelines, there are important contributions by non-government writers.  A list is on p. 10 of our submission to the OFPC.  These establish a body of knowledge that we submit needs to be reflected in guidelines issued by government regulators.

In comparison with that body of knowledge, the Foundation has four key areas of concern about the Guide of August 2004:
•	the categories of organisation the document is addressed to;
•	PIA cf. compliance audit;
•	the scope of 'privacy';  and
•	the role of public consultation.

1.	The Scope of Applicability

The Commissioner's functions are in many cases limited to the Victorian public sector.  On the other hand, the vital functions of research, reporting, public statements, education and consultation expressed in the Information Privacy Act 2000 ss.58(m)-(s) are not restricted to the public sector.

It is therefore arguable that the document in question could have been written so as to provide guidance to Victorian people, and to corporations and incorporated associations operating in Victoria, as well as to Victorian government agencies.  The document is, however, of no use outside the Victorian public sector.  It declares that "it is designed chiefly for organisations working with the Information Privacy Principles (IPPs) in the Information Privacy Act 2000 (Vic)" (p. 2, our emphasis);  but it is written in such a way as to be of no use to anyone else.

The Foundation suggests that consideration be given to publishing a companion document that explains PIAs in contexts other than Victorian government agencies.
 
Further concerns are that the title of the current document is unqualified, the cover and Introduction contain no other indication of scope limitation, and in the segment of the web-site from which the document can be discovered and downloaded, nothing explains that it is not for general guidance and that advice in relation to the conduct of PIAs in other contexts should be sought elsewhere.  It is vital that the scope limitation be made sufficiently clear on the cover, in the Introduction, and on the web-site, so as to avoid confusions about the document's applicability.

2.	PIA cf. Compliance Audit

A PIA is concerned with privacy impacts.  It commences by understanding the intentions of the project, the context in which it is to be performed, and the stakeholders who are likely to have an interest in its first-order impacts and its second-order implications.  In a PIA, legal requirements are a relevant consideration, but a fairly minor one.  Technology changes quickly, and it is of the nature of the law that it is well behind public opinion and public needs, not ahead of them.  A PIA leads to insights into deficiencies in privacy laws, and cannot be constrained to a mere check of a proposal against existing laws.

"A PIA is quite different from a privacy compliance audit.  Such an audit presumes the existence of specific laws and/or standards with which a proposal or project needs to comply.  An audit is an appropriate means whereby performance of an operational system can be evaluated.  A PIA adopts a much broader perspective than an audit.  It considers the impacts of a proposed action, and is not constrained by questions of whether the action is already authorised by law.  Moreover, to the extent that relevant codes or standards exist, it does not merely accept them, but considers whether they address the public's needs" (Clarke 1998).  As Flaherty (2000) put it, "a privacy impact assessment is a risk assessment tool for decision-makers that can address not only the legal, but the moral and ethical, issues posed by whatever is being proposed".

As it is currently written, the document may be a guide for Privacy Law Compliance Audit, but not for Privacy Impact Assessment.

In addition, the document makes repeated mentions of the IPPs and the Information Privacy Act, and does not refer to the many additional laws that establish privacy protections.  Victoria has, for example, a Health Records Act, a well-developed Surveillance Devices Act, and occupational health and safety laws.  Every agency that deals in personal data is subject to privacy-protective provisions within its own governing legislation.  And the common law also provides protections (albeit of a very patchy and uncertain nature).

The document would therefore be best described as a guide to 'Privacy Act Compliance Audit'.  The Foundation believes that it is important that the document be given a title that avoids misleading readers as to its scope, and avoids using well-established terms in ways that are not consistent with mainstream usage.

3.	The Scope of 'Privacy' 

In its submission to the OFPC, the Foundation argued that "it is vital that PIAs be understood by all organisations to be about much more than merely information privacy.  The Australian Privacy Charter (which is on the Foundation's site, at
http://www.privacy.org.au/About/PrivacyCharter.html) draws attention to the multiple dimensions of "privacy of [one's] own body, private space, privacy of communications, information privacy ..., and freedom from surveillance".  A similar analysis is provided by one of the Foundation's Board Members at:
http://www.anu.edu.au/people/Roger.Clarke/DV/Intro.html#Priv".

The Guide states that "a PIA may help in identifying issues affecting dimensions of privacy other than information privacy", and mentions privacy of the body, of the home and belongings, for spoken communications, and for personal activities (p. 2).  But the remainder of the document makes no further mention of anything other than compliance with Information Privacy Act 2000.  This is far less than the public is looking for from its watchdog agency.  On the other hand, this may be appropriate, if that is the document's limited purpose, and if that purpose is reflected in the title, the Introduction, and the manner in which the document is projected on the web-site.

4.	The Role of Public Consultation

The Foundation considers public consultation to be intrinsic to the very notion of a PIA.  In its submission to the OFPC, the Foundation drew attention the discussion of participation in PIA processes at http://www.xamax.com.au/DV/PIA.html#Part.

The public interest in participation is a strong enough argument in itself.  But the benefits of open information and open processes accrue to agencies as well.  Asking the people who will be subjected to a scheme is likely to result in better-informed designs, higher levels of public acceptance, the avoidance of re-work to mitigate negative effects, and much-reduced risk of media backlash directed at the agency and the responsible Minister.

Unfortunately, most of the Guide is written as though the exercise was purely internal.  On p. 8 (of 13 pages of text), there is an acknowledgement that "releasing PIAs gives the public an opportunity to express concerns".  But, even at this point, the process and product are internal, issued to the public ex cathedra.

Later, the text acknowledges the possibility that some limited openness might be of value:  "you may wish to consider incorporating external opinion on the result before finalising the PIA" (p. 9).  Then, on the very last page of the text, mention is made of "public consultation" as distinct from "publishing".  Only in the very last paragraph is attention drawn to the fact that "The Information Privacy Act [s. 5] emphasises the 'transparent' handling of personal information.  In the PIA context, that indicates public consultation" (p. 13).  Because of the weak treatment of the need for consultation, the document fails to guide agencies towards compliance with s.5.

The Foundation urges that the Guide be revised to very substantially upgrade the emphasis on public consultation, as an intrinsic part of a PIA, commencing at an early stage of the process.

Conclusions

Government employees have an inbuilt (and understandable) desire to have a simple life, free from intrusions by members of the public.  There is a serious risk that agencies will take advantage of the Guide's compliance orientation, its scope limitations, and its inadequate emphasis on consultation, resulting in nominal processes that exacerbate problems rather than solving them.  The Foundation accordingly urges that the Guide be quickly revised in order to overcome the document's weaknesses.

The Foundation would, as always, be pleased to work with your Office on this matter.

Yours sincerely

Roger Clarke, Board Member

_________________________________________________________

The contact-person for this matter is Roger Clarke, Board Member
(02)  6288 1472  –  Roger.Clarke@xamax.com.au

Contact Details for the Australian Privacy Foundation and its Board Members are at:
http://www.privacy.org.au/About/Contacts.html