To: "Linda King" <linda.king@privacy.gov.au>,
	"Privacy Consultation" <Privacy.Consultation@privacy.gov.au>
Cc: "APF Board" <APFBoard@privacy.org.au>
Subject: Re: Invitation to comment on draft information sheets [SEC=UNCLASSIFIED]
Date: Fri, 3 Apr 2009 13:19:00 +1100

Thank you for the opportunity to comment on the drafts of the Information Sheets and FAQs
We have reviewed them and generally feel the documents are helpful.  We have some specific comments/suggestions:
 
FAQs on NPP 6.5
1.	The FAQ paper could usefully contain a separate section on "How/when can the OPC help me?", going beyond the 'If they don‚t adequately resolve your complaint, you can complain to our Office.' which appears somewhat hidden at the end of the last FAQ . We note that the TIO publishes 'what we accept and what we don't' sort of information.  While we acknowledge there is a lot of separate material along these lines on your website, we suggest that a brief 'how we can help' section under a separate heading should  be included in all FAQs and IS,
2. 	The first FAQ on NPP 6.5 could usefully emphasise that the onus is on the individual to establish, not on the organisation to justify their records.
3. 	The second FAQ last line could usefully add that access is a right and cross-refer to other advice on NPP6
4. 	There should perhaps be some cross reference (as in the IS) to the data quality principle NPP3, which may require an organisation to modify personal information to ensure it is accurate, complete and up to date independently of any request.
5. 	The reference in the last FAQ to disposal or permanent de-identification should make it clear that this a separate obligation under NPP 4.2.
	The last sentence of the last FAQ could usefully be added to "If they don‚t adequately resolve your complaint within a reasonable time period, you can complain to our Office.
 
IS 4 - NPP6
6. 	We haven't reviewed the unchanged bits of IS4, but notice a typo in the first para "  ...a suitably qualified personal..." should be '... suitably qualified personnel...' ?
7. 	On page 4, column 2, the bullet point "Allowing poor quality information to remain on a record may have adverse consequences for the individual and/or the organisation." could usefully mention that this could include a breach of NPP3 i.e.bringing forward the last bullet point. The second bullet point could similarly reference NPP 4.2 - advice on these points will carry more weight if readers are immediately aware that they could be in breach of a statutory obligation.
8. 	The hypothetical 'examples' given in the IS are helpful, but we would also have liked to have seen summaries of or links provided to relevant complaint Case Notes in your published series.  This would help to convey the message that there are real teeth to the Act.
 
IS 28 - NPP3
9. 	The definition of 'organisation' on page 2 column 1 could usefully include 'all reporting entities under the AML-CTF Act, as this now brings in a lot of previously exempt small businesses, rather than relying solely on the 'some small businesses' bullet and footnoted reference to IS12 (which is OK for the other miscellaneous inclusions).
10. 	There should arguably be some specific discussion of verification using third party data, such as comparison of name and address data.  While this will sometimes be justified, in other cases it could be unduly intrusive, and create unnecessary work in seeking to reconcile differences.  In many cases, there will be no justification for organisations verifying address and other contact details - the details given by an individual will either work or not, and if not, the preferable answer may be to delete the record rather than making enquiries and assumptions about alternative 'correct' details.  This discussion could go in section 7, but also illustrates the point in section 8 about why sometimes 'no steps' may be required. 
11. 	The hypothetical 'examples' given in the IS are helpful, but we would also have liked to have seen summaries of or links provided to relevant complaint Case Notes in your published series.  This would help to convey the message that there are real teeth to the Act.
 
Thanks
 
Nigel Waters, Board Member
Australian Privacy Foundation
Phone: 02 4981 0828 and 0407 230342
E-mail: Board5@privacy.org.au
APF website: <http://www.privacy.org.au>http://www.privacy.org.au