The right to privacy in the digital age — submission to the Office of the United Nations High Commissioner for Human Rights (OHCHR)

Our reference: D2018/004204

Secretariat
Office of the United Nations High Commissioner for Human Rights
Geneva, CH 1211

via email: privacyreport@ohchr.org

Dear Secretariat

OHCHR report on the right to privacy in the digital age

Thank you for the opportunity to provide comments to the Office of the United Nations High Commissioner for Human Rights (OHCHR) for its forthcoming report, ‘the right to privacy in the digital age’.

The Office of the Australian Information Commissioner (OAIC) recognises that global and technological developments are creating unprecedented opportunities and challenges for privacy regulation, in particular for how regulation can support individuals to exercise meaningful choice and control in how their personal information is handled by governments and businesses.

The Australian Privacy Act 1988 (Privacy Act) provides a principle-based and robust framework for protecting individuals’ information privacy in Australia. Our comments provide an overview of how the protections and oversight mechanisms in the Privacy Act operate, and interact with other privacy laws where the OAIC has oversight functions. When exercising these functions, the OAIC draws on our domestic and international networks to shape how entities harness emerging technologies and data practices to improve the lives of Australians.

About the Office of the Australian Information Commissioner

The OAIC is an independent statutory agency within the Commonwealth Attorney-General’s portfolio. The Australian Parliament established the OAIC in 2010 to bring together three functions:

• freedom of information functions, including access to information held by the Australian Government in accordance with the Freedom of Information Act 1982 (Cth)
• privacy functions (regulating the handling of personal information under the Privacy Act 1988 (Privacy Act) and other Acts)
• information management functions.

The integration of these three interrelated functions into one agency provides the OAIC with a unique insight into the challenges of the digital age, particularly with regard to striking an appropriate balance between individuals’ right to privacy and the flow of information in the digital environment.

Privacy regulation in Australia

In Australia, information privacy is protected by a number of regulatory schemes at the national and state levels. Australia’s national privacy law is the Privacy Act 1988 (Privacy Act), which applies to the handling of information by both Australian (Commonwealth) Government agencies and the private sector, while various State and Territory schemes generally apply to the handling of information by agencies of those governments.[1]

The Privacy Act is intended to give effect to Australia’s obligations under international agreements,[2] including:

• Article 17 of the International Covenant on Civil and Political Rights (ICCPR),[3] and
• the Organisation for Economic Co-operation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) (OECD Guidelines).[4]

The Privacy Act is consistent with these key international privacy agreements. It aims to ensure that Australia is able to meet the international community’s expectations of privacy protection so that Australian organisations are able to participate in international markets and Australians have comparable privacy protections.

The 13 Australian Privacy Principles (APPs) in the Privacy Act are the cornerstone of the privacy protection framework in the Privacy Act.[5] They are principles-based, providing regulated entities with the flexibility to tailor their personal information handling practices to their diverse needs and business models, and the varied needs of individuals. The APPs are also technology neutral, preserving their relevance and applicability to changing and emerging technologies. The APPs set out obligations in relation to governance and accountability,[6] and around the collection,[7] use and disclosure,[8] integrity,[9] and correction[10] of personal information, as well as individuals’ ability to access personal information held about them by regulated entities.[11]

The Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, which commenced on 22 February 2018, formalises long-held community expectations around data transparency. The scheme requires regulated entities with information security obligations under the Privacy Act to notify affected individuals, and the OAIC, in the event of a data breach that is likely to cause serious harm[12].

A breach of an APP, or a failure to report a notifiable data breach, is an ‘interference with the privacy of an individual’.[13] The OAIC’s regulatory powers include undertaking assessments of regulated entities,[14] investigating individuals’ complaints and commencing Commissioner initiated investigations, making a determination about breaches of privacy,[15] and applying to the Federal Court for a civil penalty order for serious or repeated interferences with privacy.[16] The OAIC’s approach to using its privacy regulatory powers is outlined in the OAIC’s Privacy regulatory action policy.[17]

Balancing privacy with other interests

The right to privacy is not absolute, and privacy rights will necessarily give way where there is a compelling public interest reason to do so. The Australian privacy framework recognises that entities may have legitimate reasons to undertake projects that may limit or interfere with privacy, provided that any impacts are reasonable, necessary and proportionate for the achievement of the particular policy objective. The OAIC plays a leading role, across both the private and public sectors, to support entities in striking the right balance between the right to privacy and legitimate functions or activities, including through:

• promoting an understanding and acceptance of the APPs and the objects of those principles[18]
• examining draft laws,[19] and proposals for data matching or linkage, [20] that may involve an interference with the privacy of individuals, or which may otherwise have any adverse effects on the privacy of individuals
• ensuring that any adverse effects of draft laws or proposal for data matching on the privacy of individuals are minimised[21]
• undertaking research into, and monitoring developments in, data processing and technology to ensure that any adverse effects on the privacy of individuals are minimised[22]
• providing reports and recommendations to government in relation to any matter concerning the need for, or desirability of, legislative or administrative action in the interests of the privacy of individuals[23]
• directing an agency to give the Commissioner a privacy impact assessment[24]
• an oversight role in aspects of mandatory data retention and other requirements under the Telecommunications Act 1997[25]and the Telecommunications (Interception and Access) Act 1979 (TIA Act),[26] and
• engaging with government on the development of its biometric face matching capability, focussing on the need for a robust governance framework and independent oversight.

In performing these functions, the OAIC’s key message is often the importance of adopting a privacy by design approach from the outset of a proposal, including conducting privacy impact assessment where appropriate.[27]

To support entities in leveraging the value of data while protecting privacy, the OAIC has developed a range of practical tools and guidance. Recently for instance, the OAIC and Data61[28] have jointly produced a De-identification Decision-Making Framework,[29]and the OAIC has released a guide to De-identification and the Privacy Act. [30]

Leveraging international partnerships

Increasingly, businesses are carried on globally, personal information moves across borders, and privacy threats and challenges extend internationally. A coordinated and consistent global approach is important for responding to global privacy concerns. The OAIC is actively engaged in a range of international privacy and data protection forums and enforcement arrangements.[31]

The OAIC looks forward to reviewing the OHCHR’s report and stakeholder comments, to inform our regulatory approach to the challenges of safeguarding privacy in the digital age.

If you would like to discuss these comments or have any questions, please contact me or Sophie Higgins, Director, Regulation & Strategy, on [contact details removed].

Yours sincerely

Angelene Falk
Acting Australian Information Commissioner
Acting Privacy Commissioner

30 April 2018