The Privacy Act 1988 - Revision history

Dahaddican at 22:23, 19 January 2020

2020-01-19T22:23:45Z

← Older revision		Revision as of 22:23, 19 January 2020
Line 11:		Line 11:
	****[[File & Folder Naming Conventions]]		****[[File & Folder Naming Conventions]]
	****[[Double-Zipping Files and Folders]]		****[[Double-Zipping Files and Folders]]
	*****[[Instructions on how to Zip ~~and Encrypt a file or folder~~]]		*****[[Instructions on how to Double-Zip]]
	***[[Collection of Data]]		***[[Collection of Data]]

Dahaddican at 02:19, 16 January 2020

2020-01-16T02:19:56Z

← Older revision		Revision as of 02:19, 16 January 2020
Line 10:		Line 10:
	****[[Preferred Deposit Formats]]		****[[Preferred Deposit Formats]]
	****[[File & Folder Naming Conventions]]		****[[File & Folder Naming Conventions]]
	****[[Zipping ~~and Encrypting~~ Files and Folders]]		****[[Double-Zipping Files and Folders]]
	*****[[Instructions on how to Zip and Encrypt a file or folder]]		*****[[Instructions on how to Zip and Encrypt a file or folder]]
	***[[Collection of Data]]		***[[Collection of Data]]

Dahaddican at 00:31, 18 September 2019

2019-09-18T00:31:46Z

← Older revision		Revision as of 00:31, 18 September 2019
Line 10:		Line 10:
	****[[Preferred Deposit Formats]]		****[[Preferred Deposit Formats]]
	****[[File & Folder Naming Conventions]]		****[[File & Folder Naming Conventions]]
	****[[~~Double-~~Zipping Files and Folders]]		****[[Zipping and Encrypting Files and Folders]]
	*****[[Instructions on how to ~~Double-~~Zip a file or folder]]		*****[[Instructions on how to Zip and Encrypt a file or folder]]
	***[[Collection of Data]]		***[[Collection of Data]]

Dahaddican at 23:01, 26 August 2019

2019-08-26T23:01:28Z

← Older revision		Revision as of 23:01, 26 August 2019
Line 46:		Line 46:

	Privacy Amendment (Notifiable Data Breaches) Act 2016:		Privacy Amendment (Notifiable Data Breaches) Act 2016:

	~~= Next Page =~~
	*[[De-Identification]]

	~~= Previous Page =~~
	*[[Preparation of Data]]

	~~== Next Section ==~~
	*[[Creation of 'Shell Dataverse & Dataset']]

	~~== Previous Section ==~~
	* [[ADA Collection Policy Criteria Assessment]]

Dahaddican at 23:01, 26 August 2019

2019-08-26T23:01:06Z

← Older revision		Revision as of 23:01, 26 August 2019
Line 1:		Line 1:
			*[[2. Deposit Preparation]]
			**[[Collect and Prepare Data File(s)]]
			***[[Preparation of Data]]
			****[[The Privacy Act 1988]]
			****[[De-Identification]]
			****[[Primary Risks Associated with Data Breach]]
			****[[Common Disclosure Risk Factors]]
			****[[Data Protections]]
			****[[Data Treatment Techniques]]
			****[[Preferred Deposit Formats]]
			****[[File & Folder Naming Conventions]]
			****[[Double-Zipping Files and Folders]]
			*****[[Instructions on how to Double-Zip a file or folder]]
			***[[Collection of Data]]

	The Privacy Act 1988 details the Australian Privacy Principles (APP's) that must be complied with by organisations or entities who collect, use, disclose and store [[Glossary of Terms\|Personal Information]]. These principles therefore apply to both [[Glossary of Terms\|Data Owners]] and [[Glossary of Terms\|Data Custodians]]. Where this [[Glossary of Terms\|Personal Information]] (including that contained in data files) has been appropriately [[Glossary of Terms\|de-identified]], it renders information that would otherwise be subject to the Privacy Act 1988 into a form that is no longer identifiable. In doing so, it releases the information from the APP restrictions, allowing it to be used or shared more freely. However, de-identification is context dependent as you will see in the [[De-Identification]] section. Therefore a limited number of the APP's may still need to be considered when determining if the data should be released.		The Privacy Act 1988 details the Australian Privacy Principles (APP's) that must be complied with by organisations or entities who collect, use, disclose and store [[Glossary of Terms\|Personal Information]]. These principles therefore apply to both [[Glossary of Terms\|Data Owners]] and [[Glossary of Terms\|Data Custodians]]. Where this [[Glossary of Terms\|Personal Information]] (including that contained in data files) has been appropriately [[Glossary of Terms\|de-identified]], it renders information that would otherwise be subject to the Privacy Act 1988 into a form that is no longer identifiable. In doing so, it releases the information from the APP restrictions, allowing it to be used or shared more freely. However, de-identification is context dependent as you will see in the [[De-Identification]] section. Therefore a limited number of the APP's may still need to be considered when determining if the data should be released.

Dahaddican: Created page with "The Privacy Act 1988 details the Australian Privacy Principles (APP's) that must be complied with by organisations or entities who collect, use, disclose and store Glossary..."

2019-08-26T21:45:59Z

Created page with "The Privacy Act 1988 details the Australian Privacy Principles (APP's) that must be complied with by organisations or entities who collect, use, disclose and store Glossary..."

New page

The Privacy Act 1988 details the Australian Privacy Principles (APP's) that must be complied with by organisations or entities who collect, use, disclose and store [[Glossary of Terms|Personal Information]]. These principles therefore apply to both [[Glossary of Terms|Data Owners]] and [[Glossary of Terms|Data Custodians]]. Where this [[Glossary of Terms|Personal Information]] (including that contained in data files) has been appropriately [[Glossary of Terms|de-identified]], it renders information that would otherwise be subject to the Privacy Act 1988 into a form that is no longer identifiable. In doing so, it releases the information from the APP restrictions, allowing it to be used or shared more freely. However, de-identification is context dependent as you will see in the [[De-Identification]] section. Therefore a limited number of the APP's may still need to be considered when determining if the data should be released.

[[Glossary of Terms|Sensitive Information]] is considered to be a sub-set of [[Glossary of Terms|Personal Information]] under the Privacy Act 1988, and is therefore also subject to the APP's. In fact, often more stringent obligations are placed upon entities who handle [[Glossary of Terms|Sensitive Information]] and therefore it is especially important to [[Data Protections|protect this data]] accordingly.

The Privacy Act 1988 does not require the [[Glossary of Terms|de-identification]] process to remove the risk of re-identification entirely, in most cases this would make data useless. However those sharing or releasing the data must reduce the risk to such a level that there is no reasonable likelihood of [[Glossary of Terms|re-identification]]. The [[De-Identification]] section of the wiki provides additional guidance in this area.

Described in the [[Data Protections]] section are a number of techniques that may be employed to help [[Glossary of Terms|de-identify]] data, and therefore to minimise the likelihood of [[Glossary of Terms|re-identification]]. If you are unsure as to the best or most appropriate method of [[Data Protections|data protections]] for your study, you should [[Contact the ADA|contact the ADA]] for expert advice.

= Risk Management with respect to the APP's =
All of the APP’s apply to [[Glossary of Terms|Personal Information]] that has not been [[Glossary of Terms|de-identified]]. However, as has been mentioned, even following [[Glossary of Terms|de-identification]], in some cases the APP’s still need to be considered to minimise the risk of [[Glossary of Terms|re-identification]] and [[Glossary of Terms|disclosure]]. Specifically this includes APP’s 6, 8 and 11.

*'''APP6 – Use and disclosure''', states that [[Glossary of Terms|Personal Information]] can be used or disclosed (shared/released) only for the same purpose for which it was obtained, unless an exception applies. This APP will not typically be relevant in relation to [[Glossary of Terms|de-identified]] information, provided that the change in environment associated with its disclosure does not change the status of the information to [[Glossary of Terms|personal information]].

*'''APP8 – Overseas transfers''', prohibits the disclosure (sharing or release) of [[Glossary of Terms|Personal Information]] with an entity outside of Australia unless certain steps have been taken. This APP may be equally relevant for [[Glossary of Terms|de-identified]] data, preventing its release outside of Australia where there is no control over its use.

*'''APP11 – Security''', states that entities must take reasonable steps to protect [[Glossary of Terms|Personal Information]] from ‘misuse, interference and loss’ and ‘unauthorised access, modification or disclosure’. This is probably the most important APP to keep in mind when handling [[Glossary of Terms|de-identified]] data. As for all valuable data, [[Glossary of Terms|de-identified]] data should, as a matter of risk management, be protected and stored securely to prevent any unauthorised access. Particularly so in light of the obligations which now apply as a result of the commencement of the Privacy Amendment (Notifiable Data Breaches) Act 2016.

= Other Specific Privacy Act 1988 Regulations =
In addition to the above information regarding [[Glossary of Terms|de-identification]] and risk management with respect to the APP’s, there are some specific context cases under the Privacy Act 1988 that [[Glossary of Terms|Data Owners]] and [[Glossary of Terms|Data Custodians]] need to ensure are adhered to. These relate to the specific regulations regarding Tax File Numbers (TFNs), Credit Related Research and Health Information Research.

*'''TFNs''' - [[Glossary of Terms|Data Owners]] should be aware of the obligations imposed by the Privacy (Tax File Number) Rule 2015 issued under Section 17 of the Privacy Act 1988. An entity is required to take reasonable steps to securely destroy or permanently [[Glossary of Terms|de-identify]] TFN information that is no longer required to be retained by law, or is no longer necessary for a purpose under taxation law, personal assistance law or superannuation law.

*'''Credit Related Research Rule''' - [[Glossary of Terms|De-identification]] obligations for credit reporting bodies and credit providers also apply in relation to credit-related [[Glossary of Terms|Personal Information]]. Credit reporting bodies must comply with Section 20M of the Privacy Act 1988, which prevents the use and [[Glossary of Terms|disclosure]] of [[Glossary of Terms|de-identified]] credit reporting information except when that use and [[Glossary of Terms|disclosure]] is for the purpose of conducting research in accordance with the Privacy (Credit Related Research) Rule 2014.

*'''Health Information for Research for Public Health or Safety Purposes''' - Entities cannot collect health information about individuals for one of the research or public health or safety purposes permitted under Section 16B(2) of the Privacy Act 1988 if [[Glossary of Terms|de-identified]] information would serve the same purposes. If [[Glossary of Terms|de-identified]] information would not serve the same purpose (and if other conditions imposed in Section 16B(2) have been met), the entity can only collect the information in accordance with guidelines approved by the Information Commissioner under Section 95A about use of health information for research or public health or safety purposes.

==Notes==
Privacy Act 1988: [[Privacy Act 1988|https://www.legislation.gov.au/Details/C2019C00025]]

Australian Privacy Principles:

Privacy Amendment (Notifiable Data Breaches) Act 2016:

= Next Page =
*[[De-Identification]]

= Previous Page =
*[[Preparation of Data]]

== Next Section ==
*[[Creation of 'Shell Dataverse & Dataset']]

== Previous Section ==
* [[ADA Collection Policy Criteria Assessment]]