Assignment of 7905ICT
Privacy Impact Assessment for PenCS
PenCS was established in 1993. Its full name is PEN Computer Systems PTY. Limited. It aims
to improve the health of Australian’s through the delivery of leading eHealth informatics
and data solutions. Nowadays, it becomes the Austrlia’s leading provider of health analytics
software for national population health analysis and reporting, in primary care.
As claimed in its homepage, PenCS [5] puts the patients at the heart of its services, which
enables its clients to leverage data insights and health informatics software to:
• Share Data to Improve Care
• Drive Quality Improvement
• Inform Health Care Policy and Reform
• Access Eligible Patients for Clinical Trials
• Connect with Doctors and Their Patients
• Drive Evidence-based Research Programs
Therefore, it collects data, stores data, analyses data, shares data to provide different
service for various stakeholders. In order to make sure all usage of these data comply with
the APP (Australian Privacy Principles [3]), a Privacy Impact Assessment (PIA) must be done.
As stated in PenCS’s website [5], there are 7 products listed. All of them together can be
regarded as a whole project. They each can also be regarded as a small project. Some of
them were developed for General Practice, such as CAT4, CAT Plus. Some of the products
are supporting systems, such as Topbar as APPs to support clinical decision making, PAT BI
as the database to serve for PAT CAT, PIP QI as supplementary software with compliance.
There are also some projects developed for research study, such as “Consent Management
Portal” and some collaborated projects with universities.
Among all of them, please undertake the PIA on CAT4. If you are interested, you may
undertake the PIA for the whole range of products.
Please note in “QUICK LINKS”, there is the information about its Privacy Policy.
The following text (black colour) contains the introduction on What is the PIA, Why doing a
PIA, and how to do it. The contents are copied from “Guide-to-undertaking-privacy-impactassessments.pdf” (simplified by the name “Guide”). The full Guide is given in Griffith Course
Content. The texts in blue are about what you need to do for this assignment, which is not
from the Guide. In the step 6 of undertaking a PIA, “Privacy impact analysis and compliance
check”, you need to understand the full text of APPs. For each item listed in APPs, please
consider whether PenCS complies and identifies any risks to compliance. Instead of reading
the original document about APP [3] and [4], you may read page 19-27 of the Guide when
you read the red-colour text in this document.
Assignment of 7905ICT
When you read “Undertaking a PIA” part, there are 10 steps suggested to do for the PIA of
PenCS.
1. Threshold assessment
2. Plan the PIA
3. Describe the project
4. Identify and consult with stakeholders
5. Map information flows
6. Privacy impact analysis and compliance check
7. Privacy management — addressing risks
8. Recommendations
9. Report
10. Respond and review.
Among all these steps, you need to finish Steps 3, 5, 6, 7, 8, 9. The suggested report form
has also been given in the last step “Report”. Please note, the PIA report will be your
assignment report. You will be marked based on the report you generated. You may follow
the report advice in the step 7-9, or use any other templates available online. No matter
which format you use, your report should include the following parts. You may use the
following tables to write the parts of impact analysis and recommendations.
1. Include the project description.
2. Include the information flows in your report, where the diagrams should be used. If
you have difficulty in drawing in computer, you may include hand-drawn diagram,
but it needs to be clear.
3. Outcome of privacy impact analysis and compliance checks (please follow APP and
refer to the relevant privacy laws wherever applicable), including positive privacy
impacts and privacy risks that have been identified, and strategies already in place to
protect privacy. Not every APP principle need to be addressed if they are not
relevant to the personal information that is used in CAT4. APP2 and 11 are given as
an example on how this principle has been considered in current project and what
the possible risks are.
| Privacy Principles | Implemented Information handling practices |
Identified risks/Comments |
| APP 1 | ||
| APP 2 — Anonymity and pseudonymity • An APP entity is not required to provide those options where: the entity is required or authorised by law or a court or tribunal order to deal with identified individuals, or |
According to PenCS’s privacy policy, their software facilitates the sharing of de identified clinical information with the objective of improving population health outcomes. They process de-identified patient data for software development or testing. |
De-identification technique is not described, where re identification is possible. The pseudonym may not protect the privacy against data mining. Please take all possible risks into consideration based on your findings. |
Assignment of 7905ICT
| it is impracticable for the entity to deal with individuals who have not identified themselves • Anonymity means that an individual dealing with an APP entity cannot be identified and the entity does not collect personal information or identifiers. • A pseudonym is a name, term or descriptor that is different to an individual’s actual name. Where applicable, an APP entity must ensure that individuals are made aware of their opportunity to deal anonymously or by pseudonym with the entity. |
In appropriate circumstances, they pseudonymize and/or encrypt personal data There should be more included here. |
| … | |
| APP 11 — Security of personal information • An APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, as well as unauthorised access, modification or disclosure. • Where an APP entity no longer needs personal information for any purpose for which the information may be used or disclosed under the APPs, the entity must take reasonable steps to destroy the information or ensure that it is de identified. This requirement applies except where: o the personal information is part |
According to PenCS’s privacy policy, they store data in high security systems, and destroy any such data that remains in their possession once data are not needed. A Data Breach Response Plan is in place. There should be more included here. |
Assignment of 7905ICT
| of a Commonwealth record, or o the APP entity is required by law or a court/tribunal order to retain the personal information |
| …… |
| APP 13 |
4. List the identified risks, and the recommendations to avoid/mitigate the privacy
risks in details.
| Identified privacy risks |
Existing controls | Recommended actions |
Comments |
5. Conclusion on the overall findings including the risks and the privacy safeguards in
place, and your recommendations.
What is a privacy impact assessment?
A privacy impact assessment is a systematic assessment of a project that identifies the
impact that the project might have on the privacy of individuals, and sets out
recommendations for managing, minimising or eliminating that impact.
PIAs are an important component in the protection of privacy, and should be part of the
overall risk management and planning processes of APP [3] entities.
Undertaking a PIA can assist entities to:
• describe how personal information flows in a project
• analyse the possible impacts on individuals’ privacy
• identify and recommend options for avoiding, minimising or mitigating negative
privacy impacts
• build privacy considerations into the design of a project
• achieve the project’s goals while minimising the negative and enhancing the positive
privacy impacts.
While PIAs assess a project’s risk of non-compliance with privacy legislation and identify
controls to mitigate the risk, a PIA is much more than a simple compliance check. It should
‘tell the full story’ of a project from a privacy perspective, going beyond compliance to also
consider the broader privacy implications and risks, including whether the planned uses of
personal information in the project will be acceptable to the community.
Assignment of 7905ICT
Why do a PIA?
A large part of a project’s success will depend on whether it meets legislative privacy
requirements and community privacy expectations. Privacy issues that are not properly
addressed can impact on the community’s trust in an entity and undermine the project’s
success. It is in your entity’s interest to consider undertaking a PIA for any projects that
handle personal information.
Risks of not undertaking a PIA include:
1) non-compliance with the letter or the spirit of relevant privacy laws, potentially leading
to a privacy breach and/or negative publicity
2) loss of credibility by the entity through lack of transparency in response to public
concern about handling personal information
3) damage to an entity’s reputation if the project fails to meet expectations about how
personal information will be protected
4) identification of privacy risks at a late stage in the project development or
implementation, resulting in unnecessary costs or inadequate solutions.
Potential benefits of undertaking a PIA include:
1) ensuring that the project is compliant with privacy laws
2) reflecting community values around privacy and personal information in the project
design
3) reducing future costs in management time, legal expenses and potential negative
publicity, by considering privacy issues early in a project
4) identifying strategies to achieve the project’s goals without impacting on privacy
5) demonstrating to stakeholders that the project has been designed with privacy in mind
6) promoting awareness and understanding of privacy issues inside the organisation or
agency
7) contributing to broader organisational or agency risk management processes
8) building community awareness and acceptance of the project through public
consultation.
A PIA may also assist an entity to demonstrate its compliance with its privacy obligations
and its approach to managing privacy risk in the case of a future complaint, privacy
assessment or investigation relating to the privacy aspects of a project. APP 1.2 requires APP
entities to take reasonable steps to implement practices, procedures or systems that will
ensure that the entity complies with the APPs. A PIA can assist in identifying the practices,
procedures or systems that will be reasonable to ensure that new projects are compliant
with the APPs.
Undertaking a PIA
This section sets out 10 steps for undertaking a PIA, and guidance on completing each step:
1. Threshold assessment
Assignment of 7905ICT
2. Plan the PIA
3. Describe the project
4. Identify and consult with stakeholders
5. Map information flows
6. Privacy impact analysis and compliance check
7. Privacy management — addressing risks
8. Recommendations
9. Report
10. Respond and review.
Different entities might have their own processes for undertaking PIAs, or choose to use a
different methodology. The PIA process is a flexible one, and it can be integrated with an
entity’s existing approach to managing projects. The PIA Guide identifies 10 key elements of
PIAs which the OAIC suggests should be included in any process.
For this assignment, you do NOT need to do step 1 and 2 because you are not the
contracted party having the right to access more information than that shown on
the website. But we have known PIA is important to be done for this Health
system. So your role, as the PIA assessor, should start from the step 3 of PIA,
Describe the project.
3. Describe the project
A PIA needs a broad, ‘big picture’ description of the project, including:
• the project’s overall aims
• how these aims fit with the organisation or agency’s broader objectives
• the project’s scope and extent
• any links with existing programs or other projects
• who is responsible for the project
• timeframe for decision-making that will affect the project’s design
• some of the key privacy elements — for example, the extent and type of information
that will be collected, how security and information quality are to be addressed, and
how the information will be used and disclosed (these will be explored in more detail
in subsequent stages of the PIA).
The project description should be kept fairly brief, and should not include analysis of the
privacy implications, as this will be addressed in later stages of the PIA. This information is
important as it provides context for the rest of the PIA.
Since it’s hard to consult with the stakeholder, please skip Step 4, go to Step 5 Map
information flows. Please map the information flows of CAT4 with your best knowledge
from the website of PenCS [5].
5. Map information flows
Assignment of 7905ICT
After you have prepared a broad outline of the project’s nature and scope, you need to
describe and map the project’s personal information flows. The analysis should be
sufficiently detailed to provide a sense of what information will be collected, used and
disclosed, how it will be held and protected, and who will have access to it.
To map information flows effectively, you may explore all website information,
communicate with your friends, classmates or relevant stakeholders, such as your General
Practitioner. Please try not to overlook the valuable information about how the project
work and how the personal information is handled. On the main homepage, there is some
useful data cycle information in the introduction video.
Detailed information mapping should include:
• whether identity verification will be necessary
• what personal information will be collected and how it will be collected
• its use and disclosure
• the processes for ensuring information quality
• security safeguards that are (or will be) in place
• the ability individuals have to access and correct their personal information.
Mapping should also describe the current personal information environment and
how the project will affect it.
Areas for consideration when you are mapping the information flows are outlined below.
These points will help you describe how your project deals with each of these areas and
draw your attention to any privacy issues. Your responses should be documented and used
in the privacy impact analysis stage. They will also be useful for the preparation of the PIA
report.
If appropriate, consider using diagrams depicting the flow of information, or tables setting
out the key information for different types of personal information to be used in the
project.
Necessity of identity verification
Identify and describe:
• the extent to which the project can proceed using anonymous or de-identified
information
• whether it is necessary to verify identity, and the degree of confidence needed
• how identity will be verified
• whether a new identification number needs to be issued to individuals, and its
purpose, including whether the number could be used for other purposes or
adopted by other entities, and what protections could be put in place to prevent
other uses or adoptions
• other information that may need to be verified, such as an individual’s qualifications.
Collection
Identify and describe:
Assignment of 7905ICT
• the personal information to be collected, including any sensitive information
• how the collection relates to the agency or organisation’s functions or activities
• why the personal information, including the particular items and kinds of
information, is necessary for the project
• whether the information can be collected in a de-identified or anonymous way
• whether individuals can choose not to provide some or all of the personal
information
• if the method of collection may be unreasonably intrusive for some individuals (for
example, seeking personal information from individuals in a public area where
others may overhear).
Detail the collection process, including:
• how the information will be collected (for example, hard copy forms, electronic
forms, online transactions, CCTV etc)
• whether unsolicited personal information may be used in the project
• where the information will be collected from (for example, directly from the
individual, from other individuals or entities, or from publicly available sources)
• how an individual’s circumstances will be taken into account when the personal
information is being collected (for example, if they might require support to
understand why the information is being collected)
• any legislation or other authority on which you are relying to collect the information
• collection alternatives that have been considered and rejected (for example, using
de-identified information)
• how often the personal information is to be collected (once only or ongoing)
• any limits on the nature of the information to be collected (for example, information
over a certain age)
• any potentially sensitive or intrusive methods of collection (for example,
photographs, fingerprinting, drug testing, collection of genetic information)
• any covert methods of collection (such as surveillance) and why they are necessary
and appropriate. Note that covert collection is generally highly privacy invasive, and
should only take place in limited circumstances.
Identify and describe information (notice) about collection to be given to the individual and
how it will be given, including:
• Purpose and authority
o why the personal information is being collected
o whether the collection is authorised or required by law, and if so, which law.
• Use and disclosure
o uses or disclosures that you consider consistent with the purpose for collection
Assignment of 7905ICT
o the people or organisations to which you usually or sometimes disclose personal
information, and any further uses or disclosures that are made by those people or
organisations
o proposed uses or disclosures of the information for purposes other than the
purpose of collection.
• Choice
o whether there are choices for individuals about how their personal information is
handled, and if so, whether you will inform them.
Use
Identify and describe how you intend to use the information:
• all the planned uses of the personal information, including infrequent uses
• how all these uses relate to the purpose of collection
• measures in place to prevent uses for secondary purposes or to ensure that any
secondary uses are permitted under the APPs.
If information may be used for a secondary purpose, identify and describe:
• whether consent is required for the secondary use
• if the use is related or directly related to the purpose of collection
• whether an individual can refuse consent for secondary uses and still be involved in
the project
• any consequences for individuals who refuse consent
• how individuals will be involved in decisions if new, unplanned purposes for handling
personal information occur during the project.
Data linkage or matching, which involves aggregating or bringing together personal
information that has been collected for different purposes, has additional privacy risks. If
your project will involve data linkage or matching, identify and describe:
• any intention or potential for personal information to be data-matched, linked or
cross-referenced to other information held in different databases (by you or other
entities)8
• how data-matching, linking or cross-referencing might be done
• any decisions affecting the individual that might be made on the basis of datamatching, linking or cross-referencing
• safeguards that will be in place to limit inappropriate access, use and disclosure of
the information
• audit trails and other oversight mechanisms that will be in place
• protections in place to ensure data linkage accuracy and that individuals will not be
adversely affected by incorrect data matching.
Assignment of 7905ICT
Disclosure
Identify and describe:
• to whom, how and why the personal information will be disclosed
• whether the disclosed information will have the same privacy protections after it is
disclosed
• whether the information is to be published, or disclosed to a register, including a
public register
• whether an individual will be told about the disclosure and what choices they have
(such as publishing or suppressing their information)
• whether the disclosure is authorised or required by law, and if so, which law
• whether the personal information will be disclosed to overseas recipients.
Information quality
Identify and describe:
• the consequences for individuals if the personal information is not accurate or up-todate, including the kinds of decisions made using the information and the risks of
using inaccurate information
• the processes that ensure only relevant, up-to-date and complete information will
be used or disclosed, including by any contracted service providers
• how personal information updates will be given to others who have previously been
given personal information about an individual.
Security
Assess the project against your agency or organisation’s IT, telecommunications and
physical security measures.9
Identify and describe:
• security measures that will protect the personal information from loss, unauthorised
access, use, modification, disclosure or other misuse (including for contracted
service providers)
• how information will be transferred between sites
• how personal information will be protected if it will be managed by someone else
• who will have access
• who will authorise access
• the systems that will prevent and detect misuse or inappropriate access
• what action will be taken if there is a data breach.10
Retention and destruction
Identify and describe:
Assignment of 7905ICT
• when personal information will be de-identified or destroyed
• how this will be done securely
• whether an information retention policy and destruction schedule is in place
• how compliance with this policy and any relevant legislation about record
destruction will be assessed.
Access and correction
Identify and describe:
• how individuals can access their personal information, including any costs to the
individual
• how the individual can have their personal information corrected, or annotations
made, if necessary
• how decisions will be made about requests from individuals for access to or
correction of their information.
6. Privacy impact analysis and compliance check
Once you have mapped the information flows, you need to identify and critically analyse
how the project impacts upon privacy, both positively and negatively.
Privacy impact analysis investigates:
• the risk of privacy impacts on individuals (both serious and more minor) as a result of
how personal information is handled
• whether privacy impacts are necessary or avoidable
• whether there are any existing factors that have the capacity to mitigate any negative
privacy impacts
• how the privacy impacts may affect the project’s broad goals
• the project’s effect on an individual’s choices about who has access to their personal
information
• compliance with privacy law
• how the use of personal information in the project aligns with community expectations.
Ultimately, the privacy impact analysis should attempt to determine whether the project
has acceptable privacy outcomes, or unacceptable privacy impacts. This analysis should
include any stakeholder or public consultation results that may assist you to work out how
to improve the project’s privacy outcomes.
The analysis should include consideration of the content of the information and the context
in which the information is collected. A negative privacy impact may not appear to be
significant, but it is important to note that even minimal personal information, handled
inappropriately, may impact on someone’s privacy in ways an entity did not intend.
It is also important to note that some types of personal information are more sensitive than
others, such as genetic, health or criminal conviction information.
Assignment of 7905ICT
Some key questions to consider are:
• Do individuals have to give up control of their personal information?
• Will the project change the way individuals interact with the entity, such as through
more frequent identity checks, costs, or impacts on individuals or groups who do not
have identity documents?
• Will decisions that have consequences for individuals be made as a result of the way
personal information is handled in the project (such as decisions about services or
benefits)?
• Is there a complaint-handling mechanism? If yes, is it visible, comprehensive and
effective?
• How will you handle any privacy breaches?
• Are there audit and oversight mechanisms in place (including emergency
procedures) in case the system fails?
• Does the project recognise the risk of function creep? (For example, is there an
interest in using the personal information collected for the project for other
purposes that might occur in the future?)
• How valuable would the information be to unauthorised users? (For example, is it
information that others would pay money for or try to access via hacking?)
• Is any intrusion or surveillance fully justified and in proportion to the project’s
anticipated benefits? Is it the only way of achieving the aims of the project, and done
in the least intrusive manner? Is it subject to legislative or judicial authority? What
auditing and oversight measures are in place?
• How consistent is the project with community values about privacy? (You are likely
to need to undertake some form of consultation in order to assess this, but could
also look at community responses to similar projects, or research into community
attitudes about privacy).[2]
Ensuring compliance
• While a PIA is more than a compliance check, it is essential to consider compliance
with privacy legislation and any other privacy law relevant to your agency or
organisation. This guide provides guidance on ensuring compliance with the Privacy
Act, but there may also be other privacy-related legislation and rules that apply to
your entity, such as secrecy provisions or information handling obligations in other
legislation. It is also important to note that, even if the project appears to be
compliant with privacy legislation, there may still be other privacy risks that need to
be addressed, such as community expectations.
• You will need to consider whether your project complies with each of the APPs [3]. A
summary of each APP is below, but you should read the full text of the APPs before
completing this section. For each APP, consider whether your project complies and
identify any risks to compliance. You should document and provide specific details
about either how your project complies with the APP or why you are not required to
comply with an APP, and any considerations you took into account. The Guidelines
to the APPs provide a comprehensive guide to interpreting and applying the APPs.
[4]
Assignment of 7905ICT
• Some guidance questions are provided below. These questions cover some of the
same issues that you considered when you mapped the information flows, but focus
more closely on compliance with the Privacy Act. Responding to the questions set
out for each APP may assist you in assessing whether the way personal information
will be handled in your project is compliant.
• These questions are not exhaustive and are provided as a guide only. You may need
to consider other issues, taking into account the nature of your project. Consider
making recommendations as you go through your compliance check (Read ‘App1-
13’ in page 19-26 of Guide-to-undertaking-PIA.pdf).
7. Privacy management—addressing risks
Through the privacy impact analysis and compliance check, you may have identified risks to
privacy in the project’s current design. Risks to privacy can arise in many circumstances, for
example, from collecting more information than is needed, using intrusive means of
collection, or disclosing sensitive details more widely than is justified or necessary. These
risks may be to individual privacy, to an entity’s compliance and reputation, or both.
At this stage, you need to consider what options may allow you to remove, minimise or
mitigate any negative privacy impacts identified through the privacy impact analysis.
This does not necessarily mean compromising the goals of the project. You may find options
that will make a significant difference to the privacy impact and still allow you to achieve the
project’s goals.
A number of factors should be taken into account when considering strategies for dealing
with negative privacy impacts identified in the privacy impact analysis stage, including:
• necessity — minimising the collection of personal information to what is strictly
necessary
• proportionality — any negative privacy impact should be in proportion to, or
balanced with, any benefits to be achieved from the project
• transparency and accountability — privacy measures should be transparent to
individuals, through adequate collection notices and privacy policies
• implementation of privacy protections — consider how organisational/agency
policies and procedures can support privacy, as well as practical elements such as
staff training
• flexibility — take into account the diversity of individuals affected by the project, and
whether they may respond or be affected differently to the sharing of their personal
information
• privacy by design — privacy protections should be included in law or other binding
obligations, and built into new technologies
• privacy enhancing technologies — consider whether any privacy enhancing
technologies can be used in the project, and the impact of privacy invasive
technologies.
Assignment of 7905ICT
Strategies to reduce or mitigate privacy risks may include technical controls (for example,
access control mechanisms, encryption, design changes), more operational controls (for
example, organisational/agency policies or procedures, staff training, oversight and
accountability measures) or communication strategies (for example, privacy notices). Some
examples of possible mitigation strategies for common privacy risks are below. This is not a
comprehensive list of possible risks to privacy; rather, it is intended to provide an indication
of the types of strategies that you might consider. The Office of the Victorian Privacy
Commissioner’s Accompanying Guide: A guide to completing Parts 3 to 5 of your
Privacy Impact Assessment Report contains a more comprehensive list of common privacy
risks and potential mitigation strategies.15
Privacy risks and mitigation strategies
| Possible risks | Suggested mitigation strategies |
| Anonymity and pseudonymity: Individual’s personal information will be collected when it is not required (for example, to provide information) |
Consider whether you can use information that does not identify a person. If it is necessary to distinguish between different people, consider whether you can use pseudonyms instead. |
| Collection: Personal information will be collected without a clear purpose, which could increase the risk of unauthorised uses and disclosures. |
Ensure that you have clearly identified and documented the purposes for which you will be collecting and using personal information, and that others in your organisation or agency are aware of these purposes. |
| Collection: Unjustifiably intrusive methods will be used to collect personal information |
Consider other, less intrusive options for collecting the information. If these options are not suitable, the reasons should be documented in the PIA report. |
| Notification of collection: Collection notice will not be provided to all individuals, for example those using non-standard communication channels |
Ensure that the collection notice is consistent and accessible across all methods of collection, including hard-copy forms, online forms and via telephone. Provide a post-collection notice where notice prior to or at the time of collection is not practicable. |
| Notification of collection: Collection notice may not be accessible to all consumers, for example those from culturally and linguistically diverse backgrounds |
Ensure that the collection notice is available in a range of formats and an appropriate range of languages for the target group. |
| Collection, use or disclosure: Consent for collection, use or |
Review the process by which you plan to seek consent. Ensure that the consent will be truly voluntary, |
Assignment of 7905ICT
| disclosure of information may not be valid |
informed, current and specific, and given by a person with the capacity to provide consent. |
| Use or disclosure: Individuals may be surprised or upset by a |
Undertake further stakeholder consultation to test community expectations about your proposed |
| secondary use or disclosure, resulting in privacy complaints and/or negative publicity |
uses and disclosures. Consider whether it is possible to seek consent for secondary uses and disclosures. |
| Disclosure: De-identification of personal information before disclosure may not prevent re identification |
Review de-identification procedures to ensure that sufficient details are removed so that the recipient of the information will not be able to re- identify it, or combine it with other information to establish an individual’s identity. |
| Information quality: Poor quality information may lead to inappropriate decisions that have a negative impact on the individuals concerned. |
Check the reliability of tools used to collect or process personal information. Consider establishing regular checks of tools and procedures for human data processing. Identify and document procedures for how often personal information will be reviewed and updated. |
| Information security: The organisation or agency does not have basic information security standards in place. |
Review the OAIC’s Guide to information security and identify what additional steps your organisation or agency needs to take to ensure protection of personal information. |
| Information security: Information is saved onto personal storage devices, increasing the risk of accidental loss of personal information. |
Control the use of portable storage devices through organisational/agency policies and technical controls. |
| Access and correction: Individuals are not able to easily access and correct their personal information. |
Identify how access and correction procedures can be made more straightforward. Consider providing individuals with routine access to their personal information. |
8. Recommendations
A number of recommendations for the future of the project may emerge from the stages
above. These recommendations should identify avoidable impacts or risks and how they can
be removed or reduced to a more acceptable level. For example, recommendations could
address:
Assignment of 7905ICT
• changes that would achieve a more appropriate balance between the project’s goals,
the interests of affected individuals and the entity’s interests
• privacy management strategies, discussed above in ‘Privacy management —
addressing risks’, that will reduce or mitigate privacy risks
• the need for further consultation
• whether the privacy impacts are so significant that the project should not proceed.
Recommendations might also go beyond project-specific matters to overall privacy risk
management for the entity conducting the project.
Recommendations should be set out in the PIA report (discussed in more detail below). It
should be clear who the recommendations are addressed to, for example to different areas
of the organisation or agency, particular members of the project team, or those in positions
of authority within the organisation or agency. Recommendations should also include a
timeframe for implementation.
9. Report
A report that sets out all the PIA information is an important output of the PIA process. Key
elements for inclusion in a PIA report include:
• project description
• PIA methodology
• description of information flows
• outcome of privacy impact analysis and compliance checks, including positive privacy
impacts and privacy risks that have been identified, and strategies already in place to
protect privacy
• recommendations to avoid or mitigate privacy risks
• description of any privacy risks that cannot be mitigated, the likely community
response to these risks, and whether these risks are outweighed by the public
benefit that will be delivered by the project
• if necessary, more detailed information (for example about consultation processes
and outcomes) can be provided in appendices.
The OAIC has not developed a template for PIA reporting, as different report styles will be
appropriate for different types of projects and different entities. However, a suggested
format is in the table below (Pls refer to page 32 of the original Guide [1]). In addition, links
to sample PIA reports and templates developed by other organisations are at Appendix A
of original Guide document [1].
Suggested PIA Report Format
| Content |
Assignment of 7905ICT
| Section heading |
|
| Executive summary |
Depending on the length of the PIA report, it may be valuable to provide an Executive Summary. This should include: • the purpose of the PIA • brief project description and key information flows • summary of findings • recommendations or existing strategies to address identified privacy risks. |
| PIA methodology |
This section should outline the approach taken to undertaking the PIA, including any stakeholder consultation. (Refer to ‘Plan the PIA’, and ‘Identify and consult with stakeholders’.) |
| Project description |
In this section, describe the key features of the project, including any relevant background or the rationale for the project. Outline how personal information will be handled in the project, including through diagrams illustrating information flows if appropriate. Information flows can also be addressed in more detail in the next section if required. This section should be kept fairly short, and should not contain any analysis of privacy implications, as this will be addressed in later sections. (Refer to ‘Describe the project’, and ‘Map information flows’.) |
| Analysis | This section should identify: • the project’s impacts (positive and negative) on privacy • privacy risks that may arise from the project, including whether the project complies with privacy legislation • any strategies that are already in place to remove, minimise or mitigate privacy risks • recommendations about additional strategies required to remove, minimise or mitigate privacy risks. It may be appropriate to present an assessment of the project against each of the APPs or any other legal obligations relating to privacy. It is important to remember, however, that the PIA is more than a |
Assignment of 7905ICT
| compliance check, and that other questions may also need to be addressed. If the analysis is lengthy due to the complexity of the project or significant privacy impacts, it may be appropriate to split this information into separate sections; for example: • including information on privacy impacts and risks, existing strategies, and recommendations in separate sections • presenting separate analyses for discrete parts of the project or information flows. (Refer to ‘Privacy impact analysis and compliance check’, ‘Privacy management — addressing risks’ and ‘Recommendations’.) |
|
| Conclusion | This section should summarise the overall findings and outline the conclusions of the PIA, including whether the privacy safeguards currently in place or identified in the recommendations will be sufficient to protect personal information handled in the project. It should also outline the next steps in the PIA process (refer to ‘Respond and review’). Agencies who have been directed to undertake a PIA are required to provide their response to the recommendations contained in the PIA report to the OAIC, and this should be considered in the presentation of the report. |
| Appendices | Appendices can be used to communicate more detailed information, for example the nature of consultation, who participated in consultation and the outcomes of the project. |
It is important that the PIA report is a practical document that can easily be interpreted and
applied by the project team and the entity as a whole, as well as being clear to other project
stakeholders. While the report should outline the steps that have been followed in
undertaking the PIA, it might be appropriate to combine reporting on stages that consider
related issues. For example, as outlined in the suggested format above, reporting on the
privacy impact analysis could be combined with risk mitigation or avoidance strategies. This
would provide readers with a complete picture of how information will be handled in the
project, the privacy implications, and how identified risks will be addressed.
The step 10 is not needed.
Assignment of 7905ICT
Reference:
[1] Guide to undertaking privacy impact assessments, Office of the Australian Information
Commissioner
[2] the OAIC’s Community Attitudes to Privacy survey.
[3] APP https://www.oaic.gov.au/privacy/australian-privacy-principles/
[4] https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines/
[5] https://www.pencs.com.au/
The post Assignment of 7905ICT appeared first on My Assignment Online.
