Reference no: EM132619765

Task 1 - Privacy Compliance Program/Management System

This assessment task requires the development of a compliance program/management system centered on meeting privacy legislative obligations. As a basis, you may use a business you work in, have access to or a simulated business.

Assume that your organisation needs to comply and it can choose to:

• become bound by an approved industry code
• apply to have its own code under the Privacy Act approved by the Federal Privacy Commissioner
• be bound by the Australian Privacy Principles (APPs) The functions of a compliance program are to;
• develop an organisation's privacy practices
• assist in defending a complaint made to the Privacy Commissioner

The following information will assist your organisation in developing a privacy compliance program.

1. The privacy officer

Depending on the size of the organisation, consider nominating a staff member to act as a privacy officer. The privacy officer should be given clear authority to:

• undertake a privacy review of existing systems to ascertain the way in which the organisation uses personal information
• direct and implement a privacy strategy
• establish systems to ensure compliance with the new legislation
• maintain the privacy compliance system.

2. Know the APPs

Be familiar with the Australian Privacy Principles (APPs) to understand the ways in which they are likely to impact on the business practices of the organisation.

3. Conduct a Privacy review

The key reasons for carrying out a review of activities are to assess:

• the type of information your organisation collects and keeps
• how your organisation uses such information and with whom it shares such information (if at all)

The review (in the form of a comprehensive questionnaire) should, as a minimum, address the following questions;

• What personal information has been and will be collected and from whom? (this question needs to be answered in two parts relating to personal information and sensitive information)
• How is personal information collected? (any medium of information collection should be taken into account, for example; standard forms, surveys, mails, emails, call centres)
• The purpose for which personal information is collected?
• The functions or activities carried out by your business and do all the purposes for which information is collected relate to one of those functions or activities?
• Who accessed and uses the personal information (within the organisation and third parties).
• How is the personal information stored and disposed of?
• How can the personal information be accessed?
• Who has access to what information?
• What information is disclosed to third parties? (for example mailing houses, business partners)
• What consents are in place for use or disclosure of personal information collected?
• How accurate and up to date is the information? (this will involve an assessment of what procedures there are to update information or delete irrelevant information and to ensure accurate data recording)
• How are complaints handled?
• Do you send or transmit information overseas or to related companies?
• How individuals may access personal information about them that the business holds; and seek the correction of such information?
• How individuals may complain to the business about a breach of the Australian Privacy Principles and how the business deals with such a complaint?
• Whether the business discloses personal information to overseas recipients?
• If the business is likely to disclose personal information to overseas recipients - the countries in which such recipients are likely to be located (if it is practicable to specify those countries).

4. Implement a privacy compliance program

Prepare a privacy compliance manual to minimise your exposure to privacy compliance risks. Consider the following three step process.

1. Identify privacy compliance issues which have been highlighted in the review. The privacy officer and senior management in consultation with lawyers should take responsibility for planning.
2. Implement - Educate staff about their responsibilities for security and information management.
3. Maintain - Update the contents of the manual according to changes in business practices law, regulations and industry codes and practices. Retrain and refresh staff in relation to their responsibilities. Undertake audits at regular intervals.

Refer to AS3806-1998.

5. The privacy statement and policy

An organisation which is subject to the Act is required to formulate a privacy policy which sets out clearly its approach on the management of personal information.

The policy is required to be made publicly available, free of charge. The website is a good place to do that, although hard copies should also be freely available.

A business' privacy policy must disclose:

a. the kinds of personal information it collects and holds;
b. how it collects and holds personal information;
c. the purposes for which it collects, holds, uses and discloses personal information;
d. how an individual may access personal information about them that the business holds; and seek the correction of such information;
e. how an individual may complain to the business about a breach of the Australian Privacy Principles and how the business will deal with such a complaint;
f. whether the business is likely to disclose personal information to overseas recipients; and
g. if the business is likely to disclose personal information to overseas recipients-the countries in which such recipients are likely to be located (if it is practicable to specify those countries).

6. Privacy procedures

An organisation must take reasonable steps to protect the personal information it holds from misuse and loss from unauthorised access, modification or disclosure.

It must also destroy and de-identify information as soon as it is no longer required for any purpose for which the information could be used or disclosed.

• Develop a procedure for handling complaints regarding privacy breaches and information access to records - this should cover logging of complaints and logging information disclosed to applicants (refer to AS 4269-1995).
• Train staff about your privacy policy and guidelines.
• Monitor ongoing privacy procedures to ensure compliance.
• Consider the need for external legal advice.

Specific procedures which support the privacy policy include guidelines on:

• the management of mailing lists
• the collection, management and use of contact lists
• provisions to include in contracts with consultants and suppliers including outsourcing where personal information may be handled
• managing personal information access requests
• use of sensitive information
• conduct security review of current practices or procedures
• forms used to collect personal information are not to be left in correspondence trays overnight
• paper shredders to be utilised for daily waste
• computer screens at inquiry counters positioned away from the public
• password protected computers and screen savers
• short time frame for activation of screen savers
• regular password changes
• restricted access to data by key staff only
• anti-virus software used for computers
• computer backup tapes to be stored securely away from the location of the relevant computer system
• removal of access rights for employees who leave the organisation
• internet and email usage policy distributed to staff Procedures in place:
• to ensure data is removed, destroyed or cleared once it is no longer required
• for access request to records handling policy
• to handle complaints or incidents regarding breaches of privacy - a key means of achieving privacy compliance is the inclusion of appropriate provisions governing information handling issues like security and confidentiality of personal information in contracts for service providers (two key areas identified by the Privacy Commissioner include cleaning services and counselling services)

Attachment:- Management System.rar