G.P.O. Box 1196
Sydney NSW 2001

enquiries@privacy.org.au

http://www.privacy.org.au/	

Office of the Privacy Commissioner
Managing Privacy Risk:   Privacy Impact Assessment Guidelines

Submission by the Australian Privacy Foundation
February 2005

The Australian Privacy Foundation

The Australian Privacy Foundation is the main non-governmental organisation dedicated to protecting the privacy rights of Australians.  The Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians.  The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions.  The Foundation uses the Australian Privacy Charter as a benchmark  against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see http://www.privacy.org.au.

Submission

The Foundation appreciates the invitation by the Office of the Privacy Commissoner (OFPC) to provide comments on the Office's draft version of 'Managing Privacy Risk'.

The Foundation has urged the use of Privacy Impact Assessment (PIA) for many years.  In its Submissions in relation to the private sector provisions in 1999 and 2000, the Foundation recommended that privacy impact assessment be mandated for projects with significant privacy implications.  The importance of PIAs was also drawn to the attention of the political parties in our Election Challenge in late 2004.  The Foundation has repeated its call for mandatory PIAs in its recent submission to the Review of the private sector provisions.

The Foundation is, in broad terms, very supportive of both the OFPC's initiative in producing the Guide, and a great deal of the approach and content.  The Foundation believes, however, that a number of aspects of the current Draft need to be clarified and strengthened.

The following sections identify the Foundation's areas of concern, commencing with broad issues, then moving on to specifics. 

1.	Scope

The first cluster of concerns relates to the document's scope. 

1.1	Scope – Organisations

The Foundation supports the OFPC's intention to issue a document specifically addressed to government agencies, and strongly supports the explicit mention of that scope limitation in the title of the document.

However, the Foundation also supports the subsequent preparation of a further document that is specifically addressed to private enterprise.

1.2	Scope – All Dimensions of Privacy

It is vital that PIAs be understood by all organisations to be about much more than merely information privacy.  The Australian Privacy Charter (which is on the Foundation's site, at
http://www.privacy.org.au/About/PrivacyCharter.html) draws attention to the multiple dimensions of "privacy of [one's] own body, private space, privacy of communications, information privacy ..., and freedom from surveillance".  A similar analysis is provided by one of the Foundation's Board Members at:
http://www.anu.edu.au/people/Roger.Clarke/DV/Intro.html#Priv.

The Foundation supports the many aspects of the document that show that the OFPC's intention is to encompass all aspects of privacy, not merely information privacy.

However, the Foundation urges the further adaptation of the Draft to ensure that readers do not mistakenly slip into a narrow interpretation.

1.3	Scope – Business Processes as well as Personal Information

It is also very important that PIAs be understood by all organisations to be about business processes generally, rather than merely specific information-handling activities such as collection, use and disclosure.

The Foundation supports the many aspects of the document that show that this is the OFPC's intention.

However, the Foundation urges the further adaptation of the Draft to ensure that readers do not mistakenly slip into a narrow interpretation.

1.4	Scope – Other Impacts

An agency that invests resources into an assessment of a project's privacy impacts may be able to achieve greater returns if it broadens the scope beyond just privacy.  In various circumstances, the following may be relevant:
•	availability of service (e.g. 9-5 on workdays, or '24/7');
•	reliability of service (e.g. percentage of uptime);
•	robustness of service (e.g. recovery time from outages);
•	reach of service (e.g. locations from which available);
•	accessibility of service (e.g. connection requirements);
•	consumer rights impacts (e.g. risk-bearing in the event of malfunction or fraud);
•	choice in relation to the use of the scheme as a whole, including benefits foregone if it is not used, and penalties for non-use;
•	consent in relation to the use of the scheme as a whole, versus legal and/or technical compulsion;
•	job-market and industry structure impacts;
•	geographical equity impacts, e.g. differential servicedepending on location or access to facilities;  and
•	social equity impacts, e.g. differential service depending on ethnic background, lingual skills, education or physical limitations.

It is clear that many of these fall outside the OFPC's domain.  On the other hand, it would be helpful to agencies to draw to their attention the potential for a PIA to be undertaken as an integral part of a broader stakeholder, client or social impact assessment process.

2.	The Excessive Emphasis on Legal Compliance

It is especially important that a PIA be understood by all organisations to be about much more than merely compliance with the law.

The Foundation supports the many aspects of the document that show that this is the OFPC's intention.

However, the Foundation urges the further adaptation of the Draft to ensure that readers do not mistakenly slip into a narrow interpretation.

Generally, the Foundation suggests that a clear distinction be drawn between a Privacy Law Compliance Audit and a Privacy Impact Assessment.

Most critically, the early appearance of compliance in section 2.1 can easily be interpreted by readers as a reduction in scope from an analysis of privacy impact to merely an analysis of compliance.  The Foundation urges that section 2.3, which stresses the breadth of the activity, be moved in front of the present section 2.1.

In addition, the Checklist focuses entirely on information privacy. Many data-handling activities, particularly collection, use and disclosure, also impact on the privacy of personal behaviour, and in some cases also on the privacy of the physical person.   It is highly desirable that it be drawn to the attention of readers that the Checklist addresses only a sub-set of what a PIA needs to be concerned with.

3.	The Limited Scope of the Checklist

The Foundation is very concerned about the misleading title 'Privacy Impact Checklist (PIC)'.  In its present form, the Checklist would be correctly described as a 'Privacy Act Compliance Checklist', i.e. its scope is very narrow.

The scope of privacy impacts that need to be considered in a PIA is far, far broader than this, in the following ways:
•	there are many other privacy protections, including those:
•	in each agency's governing statutes;
•	in other statutes;  and
•	in the common law.
	It would be misleading in an important way to even call the document a 'Privacy Law Compliance Checklist', because its scope is so restrictive;
•	there is considerable public expectation in relation to information privacy that is not currently subject to legal protection.  These other aspects need to be considered by agencies when they are conducting a PIA, because they may result in dissatisfaction by affected individuals, possibly resulting in rejection by them of the feature or system, and possibly also resulting in adverse publicity;  and
•	as discussed in section 1.2 above, there are many dimensions of privacy additional to information privacy, which need to be considered as part of a PIA.

The Foundation submits that it is not merely in the interests of individuals to ensure that PIAs adopt broad interpretations of privacy, but that it is also critical to the effectiveness of PIAs from the agency's perspective as well.

The Foundation accordingly urges that the text in section 2.2 and elsewhere be amended, and the Checklist be re-titled appropriately, by:
•	substituting the word 'compliance' for 'impact';  and
•	substituting the expression 'Privacy Act 1988' for 'Privacy'.

Correctly titled, the Foundation welcomes the Checklist as a useful document to assist agencies in the audit of their compliance with that statute.  But agencies must not be lulled into the false belief that working through that limited checklist is equivalent to performing a PIA.

4.	Benefits

The set of objectives enunciated in section 6 appears to the Foundation to be incomplete in important ways.

It is fundamental to a PIA that it recognise the interests of all parties affected by the project.  As a result, the benefits that are sought need to be viewed from multiple perspectives, not just that of the project's sponsor.

The Foundation draws to OFPC's attention a set of objectives for PIAs that were enunciated in 1998 by one of its Board Members.  These are couched in terms that encompass the interests of the sponsor and the affected parties.  See:
http://www.xamax.com.au/DV/PIA.html#Obj.

The Foundation is also aware of comprehensive sets of objectives for a PIA that were prepared by a consultancy for NOIE/AGIMO as part of projects in 2003 and 2004 relating to the Australian Government Authentication Framework.  There are additional potentials in those lists that are not in the present Draft. 

The Foundation accordingly submits that section 6:
•	be adapted so as to reflect the perspectives of all affected parties;  and
•	be expanded to reflect the additional benefits that are achievable by means of a PIA process of appropriate scope and style. 

5.	Process

5.1	Elements of a PIA

The outline of the PIA process in section 7 could be usefully expanded.  In particular, the Foundation submits that:
•	element 2 (Mapping) should refer to "business processes" as well as "the flows of personal information";
•	element 4 (Analysis) should include reference to consultation with stakeholders;  and 
•	element 4 (Analysis) should have a second phase, viz. the search for and assessment of ways of "eradicating or mitigating the privacy risks", i.e. these are part and parcel of the analysis rather than suddenly emerging in the final step.

The Foundation welcomes the early mention of consultation and project description in sections 8 and 9.

However, the Foundation is very concerned that the steps described in the main body of Part B (sections 10-15) are limited to the data protection aspects of a PIA. 

Moreover, these do not constitute 'steps', but rather a checklist of issues that may need to be worked through as part of a PIA.  The checklist needs to be complemented by descriptions of actual steps that agencies can usefully take in order to perform an effective PIA process.

The Foundation draws to OFPC's attention a phase model of the PIA process that was put forward in 1998 by one of its Board Members.  See:
http://www.xamax.com.au/DV/PIA.html#Ph.

The Foundation suggests that it would be helpful to agencies to offer them a series of steps of this nature, with the existing sections 10-15 re-badged as a checklist including guidance on issues that frequently arise in such activities.

5.2	Organisational Commitment

There is a tendency for processes of this kind to become 'routinised', and performed by junior staff, contractors or consultants.  In order to be effective for the agency, a PIA needs to be directed by senior executives, and be linked to the corporate mission, strategy and business plan.  The Foundation suggests that the Guidelines draw this explicitly to the reader's attention.

5.3	Emphasis on Process Rather Than Product

PIA reports can be valuable, in that they provide a basis for public debates about future projects.  On the other hand, most such reports are little more than documentation of the outcomes of a completed process.

The Foundation suggests that the Guidelines place greater emphasis on the fact that most of the value of a PIA derives from the performance of the process, and the insights gained by participants into the perspectives of other parties.

5.4	A Living Process

Major projects have a life of their own.  They seldom conform to the image and plan of the people who conceived them, but instead adapt as they progress.  And they result in transformations in the organisation and in its interactions with stakeholders.

In order to deliver value, a PIA should not be perceived as a one-time event.  PIA-related activities are needed at the outset of a project, and at key stages along the project's path.  Typically, a fairly abstract (and possibly internal-only) PIA is appropriate at the stage of project conception and initiation;  a more detailed (and very probably open) PIA is needed during the phase in which analysis of requirements is undertaken, and another during the conceptual and logical design of the new arrangements.  These stages are embodied in the description drawn to attention above, at http://www.xamax.com.au/DV/PIA.html#Ph.

The Foundation suggests that the Guidelines make clear to the reader that the PIA process is a multi-task activity that parallels the project as a whole, rather than being a single task.

It is also important that PIAs be re-visited as part of post-implementation reviews, and periodic reviews, to determine whether the design as implemented actually satisfies the requirements.

6.	Consultation

6.1	The Centrality of Consultation

The Foundation welcomes the inclusion of references to consultation as being a vital component of the PIA process.

It is concerned, however, that the message appears for the first time too late, in section 8, and that insufficient use is made of opportunities to reinforce the message.

It is also concerned that insufficiently detailed guidance is given concerning the elements of effective consultation.

The Foundation draws to OFPC's attention the discussion of participation in PIA processes at http://www.xamax.com.au/DV/PIA.html#Part.

The Foundation is also aware of a comprehensive stakeholder analysis and consultation strategy for a PIA that were prepared by a consultancy for NOIE/AGIMO as part of projects in 2003 and 2004 relating to the Australian Government Authentication Framework.

The Foundation submits that:
•	the importance, and benefits, of consultation should be emphased more firmly, and more frequently;  and
•	further guidance should be given in relation to the features of effective consultative processes.

6.2	The Scope of Consultative Processes

The Foundation is concerned that little guidance is given as to the kinds of organisations that agencies should involve in the consultation process.  Stakeholder analysis is an art-form that is understood and well-practised in some agencies, and it would be beneficial for the Guide to offer something in this area.

The Foundation suggests that the following categories of consultee are important to the effectiveness of many PIAs:
•	other relevant agencies of the Australian government;
•	relevant agencies of State and Territory governments;
•	any relevant business enterprises or industry associations (not least so that they can appreciate the perspectives of the various stakeholders);
•	relevant regulatory agencies, including not only the OFPC, but perhaps also ACMA, and relevant consumer regulatory agencies such as the Ombudsman and the TIO;  and
•	representatives of, and advocates for, the various categories of individual affected by the project.

Achieving cost-effective consultation with affected individuals can be challenging.  The Foundation suggests that guidance be provided in relation to consultative processes involving:
•	individuals themselves (typically by means of focus groups);  and
•	representative bodies, and relevant public interest advocacy bodies.  Experiences of lead-agencies such as Centrelink and AGIMO could be usefully drawn on in order to provide a template for effective consultations with these groups.

6.3	Inhibitors to Consultation

A significant problem experienced in PIA processes in recent years has been the difficulty of getting the attention of the representatives and advocates who have the appropriate expertise. This is very important to the effectiveness of the process, and to the value of the information that is secured by the agency during the process.

The Foundation draws attention to the need many representative and advocacy organisations have for support, in order to be able to mobilise the resources to evaluate discussion materials, analyse problems, form views, and participate in consultative processes.

It urges that the Guide advise agencies to consider budgeting for financial support for participation by representatives and advocates, including not only travel costs, but also 'sitting fees' (or similar) in order to off-set the loss of income incurred by some participants.

The Foundation is well aware of the limitations on the resources of the OFPC.  It accordingly suggests that consideration be given to suggesting to agencies that they also consider budgeting for payment to OFPC, to enable the OFPC's participation in their PIA and consultation processes.

7.	Other Matters

7.1	Identity Management, and Anonymity

Section 16 addresses 'Identity Management', and contains the advice "Don't authenticate identity unless necessary".  The Foundation supports this approach.

However, it is necessary to go further than this.  It is more than just an information privacy issue, because it may affect the privacy of the physical person, and of personal behaviour.

It is desirable from the perspective of individuals to be able to conduct communications and transactions without disclosing their identity, and there are many transaction-types for which this creates little or no difficulty. Although the Anonymity Principle made its first appearance in the NPPs, and is not yet in the IPPs, it is highly desirable that this aspect of privacy interests be directly drawn to the reader's attention.

7.2	Applications of the Principle of Proportionality

In section 19, the Draft refers to Proportionality, encouraging agencies to ensure that privacy infringement is justified, and is proportional to the benefits arising from the infringement.  The Foundation supports this.

However, we draw attention to another application of that Principle: the scale of investment in a PIA needs to reflect the extent to which the privacy interest of individuals is actually affected by the project.  

This gives rise to some important implications:
•	projects with potentially substantial impacts justify use of the full range of features described in the Guide;
•	projects with quite limited impact justify the conduct of assessments with quite limited scope, which might even be undertaken wholly internally;  and
•	cost-effective means can be sought for projects whose impacts fall between the two.  In particular, an agency that has established a panel of representatives and advocates (as both NOIE/AGIMO and Centrelink have done) is in a position to communicate with  those organisations electronically and only use face-to-face consultations if the need to do so is demonstrated.

7.3	Managing Risks

In section 4 above, the Foundation drew attention to the way in which the Guide's section 6 (Benefits) was too narrowly focussed on benefits to the agency that is sponsoring the project.

The Foundation is concerned that section 19 (Managing risks) also fails to reflect the perspectives of the individuals affected by the project.

It accordingly urges the addition of further bullet-points that address the risks in a more holistic manner, by reflecting the risks that are perceived by and borne by other stakeholders, especially affected individuals.

Examples include such questions as what affected individuals and their representatives and advocates for their interests think of the project, and of specific features, and of specific measures intended to ameliorate harmful impacts; and the extent to which various categories of individual are differentially affected compared with other categories.

_________________________________________________________

The contact-person for this matter is Roger Clarke, Board Member
(02) 6288 1472  –Roger.Clarke@xamax.com.au

Contact Details for the Australian Privacy Foundation and its Board Members are at:
http://www.privacy.org.au/About/Contacts.html

References to Non-Government Sources

Becker H. & Vanclay F. (2003)  'The International Handbook of Social Impact Assessment'  Cheltenham: Edward Elgar, 2003
Clarke R. (1996) 'Privacy and Dataveillance, and Organisational Strategy', Proc. Conf. I.S. Audit & Control Association (EDPAC'96), Perth, 28 May 1996, at http://www.anu.edu.au/people/Roger.Clarke/DV/PStrat.html
Clarke R. (1997) 'Introduction to Dataveillance and Information Privacy, and Definitions of Terms', Xamax Consultancy Pty Ltd, August 1997, at ttp://www.anu.edu.au/people/Roger.Clarke/DV/Intro.html
Clarke R. (1998a) 'Privacy Impact Assessments', Xamax Consultancy Pty Ltd, 10 February 1998, at http://www.anu.edu.au/people/Roger.Clarke/DV/PIA.html
Clarke R. (1998b) 'Privacy Impact Assessment Guidelines', Xamax Consultancy Pty Ltd, 10 February 1998, at http://www.xamax.com.au/DV/PIA.html
Clarke R. (2004a) 'A History of Privacy Impact Assessments', Xamax Consultancy Pty Ltd, 5 February 2004, at http://www.anu.edu.au/people/Roger.Clarke/DV/PIAHist.html
Clarke R. (2004b) 'The Search for Balance:  The Past, Present and Future of Privacy Impact Assessments'  Abstract and Slides, 16 May 2004, at http://www.anu.edu.au/people/Roger.Clarke/DV/PIAPPF.html
Flaherty D.H. (2000) 'Privacy Impact Assessments: an essential tool for data protection', October 2000, A presentation to a plenary session on “New Technologies, Security and Freedom,”  at the 22nd Annual Meeting of Privacy and Data Protection Officials held in Venice, September 27-30, 2000.  Reprinted in Privacy Law & Policy Reporter 7,5 (2000) 85-90 (November 2000), at http://www.austlii.edu.au/au/journals/PLPR/2000/45.html
Greenleaf G. (2002) ‘Canada makes privacy impact assessments compulsory’Privacy Law & Policy Reporter  8, 10 (June 2002)  189-190, at 
Karol T.J. (2001)  'A Guide to Cross-Border Privacy Impact Assessments', Deloitte & Touche, March 2001, at http://www.itgi.org/cbprivacyguide.doc
Longworth E. (1996)  'Notes on Privacy Impact Assessments'  Privacy Issues Forum, Christchurch, NZ, 13 June 1996, in NZPC (1997)
Marcella A.J. & Stucki C. (2003)  'Privacy Handbook:  Guidelines, Exposures, Policy Implementation, and International Issues'  Wiley, 2003
Stewart B. (1996a)  'Privacy impact assessments'  Privacy Law & Policy Reporter 3, 4 (July 1996)  61-64, at http://www.austlii.edu.au/cgi-bin/disp.pl/au/journals/PLPR/1996/39.html
Stewart B. (1996b) 'PIAs – an early warning system'  Privacy Law & Policy Reporter  3, 7 (October/November 1996)  134-138, at http://www.austlii.edu.au/cgi-bin/disp.pl/au/journals/PLPR/1996/65.html
Stewart B. (1999)  'Privacy impact assessment:  towards a better informed process for evaluating privacy issues arising from new technologies'  Privacy Law & Policy Reporter  5, 8 (February 1999) 147-149, at http://www.austlii.edu.au/cgi-bin/disp.pl/au/journals/PLPR/1999/8.html
Stewart B. (2002) ‘Privacy impact assessment roundup’ Privacy Law & Policy Reporter  9, 5 (October 2002)  90-91, at http://www.austlii.edu.au/au/journals/PLPR/2002/41.html
Waters N. (2001) 'Privacy impact assessment - traps for the unwary'   - Privacy Law & Policy Reporter  10, 7 (July,2001) 176, at http://www.austlii.edu.au/au/journals/PLPR/2001/10.html