Privacy (Australian Government Agencies — Governance) APP Code 2017
In ForceCTH
Jurisdiction
Commonwealth
Collection
legislative instrument
Plain English Summary
4/10 complexity
This code requires Australian Government agencies (not Ministers) to put in place concrete privacy governance: keep a privacy management plan, appoint a Privacy Officer and a senior Privacy Champion, run privacy impact assessments for high‑risk projects, publish and register PIAs, provide staff training and regularly review privacy processes (ss9–17). Agencies pay the compliance costs and decide when a project is ‘high privacy risk’ under a ‘reasonable’ standard; the OAIC can be notified of contacts, request registers and investigate (ss10(3),12(2),15,8).
This instrument is a registered APP code titled the Privacy (Australian Government Agencies , Governance) APP Code 2017, coming into force on 1 July 2018 (ss 1-2). It is made under section 26G of the Privacy Act 1988 (s 3). Its Parts 2-4 specify how agencies must comply with APP 1.2 of the Act (s 8). The code is explicitly binding on all agencies as defined in the code (s 7), with the caveat that for these purposes an agency does not include a Minister (s 5).
Mechanically, the code does the following (primary operative duties appear in Parts 2-4):
Requires every agency to adopt a documented privacy management plan and to measure and document performance against that plan at least annually (s 9).
Requires agencies to designate, at all times, a Privacy Officer and a Privacy Champion and to ensure specified functions for each role are carried out; the agency must notify the OAIC in writing of the Privacy Officer’s contact details (s 10-11).
Requires agencies to conduct privacy impact assessments (PIAs) for all high privacy risk projects as assessed reasonably by the agency, to keep a register of PIAs and publish the register (s 12, 15). Publication of an actual PIA, or summary/edited version, is permitted (s 13). Agencies may conduct joint PIAs when multiple agencies participate in the same project, but each must retain a copy (s 14).
Requires agencies to include privacy training in induction and to take reasonable steps to provide appropriate privacy education annually to staff with access to personal information (s 16).
Requires regular review and updating of privacy practices, procedures and systems and monitoring of compliance; the scope of review must include the agency’s privacy policy (for APP 1) and privacy notices (for APP 5) (s 17).
Current sections
Direct links to the current provisions in Privacy (Australian Government Agencies — Governance) APP Code 2017.
26
Part 1
Introduction
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
1
Name
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2
Commencement
2 Commencement
This APP code comes into force on 1 July 2018.
3
Authority
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5
Definitions
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6
Objectives
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that a
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
(b) enhance the privacy capability and a
(b) enhance the privacy capability and accountability of agencies;
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
(c) promote good privacy governance with
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
(d) build community trust and confidence
(d) build community trust and confidence in the personal information handling practices of agencies.
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
7
Agencies bound by this APP code
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8
Application of this APP code to APP 1.2
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2
Privacy management and governance
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
9
Privacy management plan
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
(1) An agency must have a privacy manage
(1) An agency must have a privacy management plan.
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
(2) A privacy management plan is a docum
(2) A privacy management plan is a document that:
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
(a) identifies specific, measurable priv
(a) identifies specific, measurable privacy goals and targets; and
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
(b) sets out how an agency will meet its
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10
Privacy Officer
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external pr
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11
Privacy Champion
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3
PIAs
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
12
Conduct of PIA
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4
Internal privacy capability
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
16
Privacy education and training
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17
Regular review of internal privacy processes
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
Source text: opening excerpt
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
Part 1 Introduction
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
The code sets out its objectives: to specify requirements for compliance with APP 1.2, enhance capability and accountability, promote privacy governance and build community trust (s 6). It links to the Act’s investigative powers by noting that the Commissioner may investigate acts or practices that may breach APP 1 (note in s 8 referencing subsection 40(2) of the Act). The code further notes the Act’s definition of a PIA and that the Commissioner may direct an agency to conduct a PIA under section 33D of the Act (s 12 note).
The instrument therefore converts broad APP 1.2 governance obligations into specific administrative duties for agencies: documented plans, named roles with prescribed functions, mandatory PIAs for high-risk changes, registers and publication obligations, and training/review cycles. It creates reporting and recordkeeping touchpoints with the Office of the Australian Information Commissioner (OAIC), and makes the agency itself responsible for assessing whether a project is “high privacy risk” (s 12(2) uses the agency’s reasonable consideration).
Main concepts
The code builds on concepts defined in the Privacy Act and supplements them with operational definitions and duties. Key concepts in the text and their operative meaning in the code are:
Agency: Has the meaning in s 6(1) of the Privacy Act, but expressly excludes a Minister for the purposes of this code (s 5). The code is binding on agencies as so defined (s 7).
APP and APP 1.2: APP refers to the Australian Privacy Principles in the Act; the code specifies how agencies are to comply with APP 1.2 (s 5, s 8). APP 1 is described in the preamble as the foundation principle; the code positions compliance with APP 1.2 (the governance element) as essential for privacy by design (preamble).
Privacy management plan: A document the agency must have (s 9(1)). The code defines the plan as identifying specific, measurable privacy goals and targets and setting out how the agency will meet its compliance obligations under APP 1.2 (s 9(2)). The agency must measure and document performance against the plan at least annually (s 9(3)).
Handling personal information: Defined in the code to mean dealing with personal information in any way, including managing, collecting, holding, using or disclosing it (s 5).
Privacy Officer: A designated officer (one or more permitted) who is the agency’s primary point of contact for privacy advice; the agency must notify the OAIC in writing of the contact details for the Privacy Officer (s 10(1)-(4)). The code sets out specific functions the Privacy Officer must ensure are carried out (s 10(5)).
Privacy Champion: A senior official designated to promote privacy culture and provide leadership on strategic privacy issues; the Champion must review/approve the privacy management plan and report regularly to the agency’s executive (s 11).
PIA (privacy impact assessment): A PIA is defined in the Act (s 33D); the code requires agencies to conduct PIAs for all "high privacy risk projects" (s 12). A project may be high risk if the agency reasonably considers it involves new or changed personal information handling likely to have a significant impact on privacy (s 12(2)). The code also deals with publication, joint PIAs and a register (ss 13-15).
OAIC and Commissioner: OAIC (Office of the Australian Information Commissioner) is the specified authority. The code is made under s 26G of the Act (s 3), and it records the Commissioner’s investigative power under subsection 40(2) of the Act in relation to breaches of APP 1 (note in s 8).
Two interpretive points from the code’s text affect implementation. First, the code repeatedly uses "must" for many duties (privacy management plan, designated roles, PIAs for high risk projects, register, training, review) making them mandatory. Second, where the code uses "may" (for example publication of a PIA, s 13), that creates discretionary space for agencies to choose publication formats or whether to publish an actual PIA versus a summary.
The code also relies on terms from the Act (for example “privacy impact assessment” and the Commissioner’s directions) rather than redefining them; cross-references to the Act appear in notes and operative sections (ss 3, 8, 12 note, 15(2)).
Who it affects
Primary subjects: all agencies as defined under section 5 of this APP code (s 7). The code expressly excludes Ministers from the code’s definition of agency (s 5), so a Minister acting in that capacity is not bound by the code’s obligations.
Within an affected agency, the code directly creates mandatory positions and roles:
Privacy Officer(s): the agency must designate at least one and is required to keep the OAIC notified in writing of the contact details for one of them if there are more than one (s 10(1)-(3)). The Privacy Officer is the primary internal and external point of contact for privacy queries (s 10(4)) and must carry out/ensure functions specified in s 10(5).
Privacy Champion: must be designated at all times and must be a senior official within the agency (s 11(1)-(3)). The code requires the Privacy Champion to perform leadership and reporting functions (s 11(4)).
Operational units effected:
Executive leadership: required to receive regular reports from the Privacy Champion and to have the Champion review/approve the privacy management plan (s 11(4)(c)-(d)).
All staff with access to personal information: must be included in induction privacy training, and the agency must take reasonable steps to provide annual privacy education or training to those staff (s 16(1)-(2)).
Project teams: any project that involves new or changed handling of personal information that may have significant privacy impact must be assessed for PIA requirements (s 12). The agency itself performs the reasonable assessment as to whether a project is high privacy risk (s 12(2)).
External parties and oversight:
The OAIC/Commissioner: the agency must notify the OAIC of contact details for its Privacy Officer (s 10(3)); the agency must provide a copy of its PIA register, and any PIAs listed, to the Commissioner on request (s 15(2)). The code notes the Commissioner’s investigatory power under subsection 40(2) of the Act for acts or practices that may breach APP 1 (s 8 note 1). The code also references section 33D of the Act which provides that the Commissioner may direct an agency to conduct a PIA (s 12 note).
Practical effect on agency operations: the code creates responsibilities that fall on corporate governance, compliance, privacy, human resources and project management functions. Agencies will bear work and documentation burdens: drafting and maintaining a privacy management plan, measuring and documenting performance annually, designating and supporting named roles, running PIAs and maintaining and publishing a register, delivering training and performing regular reviews and monitoring (ss 9-17).
Who does not appear to be affected: private-sector entities are not the target of this code; it is binding on agencies as defined in the code. The code does not apply to Ministers under its own definition (s 5).
Key duties and rights
The instrument sets out a set of mandatory duties for agencies and functions for designated roles. The code does not confer private rights of action or state civil penalties within its text; instead it prescribes administrative obligations and recordkeeping requirements. Below is an itemised breakdown of duties and the practical rights and process flows the code establishes.
Duties imposed on agencies (principal operative sections):
Privacy management plan: An agency must have a privacy management plan (s 9(1)). The plan must identify specific, measurable privacy goals and targets and set out how the agency will meet its compliance obligations under APP 1.2 (s 9(2)). The agency must measure and document its performance against the plan at least annually (s 9(3)).
Privacy Officer: An agency must have a designated Privacy Officer at all times; it may have more than one (s 10(1)). Agencies may designate by position or role, including by reference to a position or role in another agency (s 10(2)). The agency must notify the OAIC in writing of contact details for the Privacy Officer (s 10(3)). The Privacy Officer’s functions include handling internal and external privacy enquiries, complaints and access/correction requests under the Act; maintaining a record of the agency’s personal information holdings; assisting with PIAs; maintaining the agency’s PIA register; and measuring/documenting performance against the privacy management plan at least annually (s 10(4)-(5)(a)-(e)).
Privacy Champion: An agency must have a designated Privacy Champion, who must be a senior official (s 11(1)-(3)). The Champion must promote a privacy-respecting culture, provide leadership on strategic privacy issues, review/approve the privacy management plan and documented progress, and provide regular reports to the agency’s executive about privacy issues (s 11(4)(a)-(d)). The Privacy Officer may also be the Privacy Champion (s 11(5)).
PIAs: An agency must conduct a PIA for all high privacy risk projects (s 12(1)). The definition of “may be a high privacy risk project” is set out in s 12(2): the agency’s reasonable consideration that the project involves new or changed personal information handling likely to have a significant impact on individuals’ privacy. The code notes that the Act (s 33D) also requires a PIA if directed by the Commissioner (s 12 note). Agencies may publish PIAs or summaries/edited copies on their website (s 13). Agencies participating in a common project may conduct a joint PIA but each must retain a copy (s 14).
Register of PIAs: Agencies must maintain a register of PIAs they conduct and publish the register or a version on the agency’s website (s 15(1)). The agency must provide the register and any PIAs listed on it to the Commissioner on request (s 15(2)).
Training: Agencies must include appropriate privacy education/training in any staff induction program and must take reasonable steps to provide annual privacy education/training to all staff who have access to personal information in performance of their duties (s 16(1)-(2)).
Review and monitoring: Agencies must regularly review and update privacy practices, procedures and systems to ensure currency and adequacy for APP compliance; the review must include privacy policy for APP 1 and privacy notices for APP 5 (s 17(1)(a)-(b)). Agencies must monitor compliance with their privacy practices, procedures and systems regularly (s 17(2)).
Rights and process flows implied by the code:
Right of the Commissioner to request: the Commissioner can request and the agency must provide a copy of the PIA register and any PIAs listed on it on request (s 15(2)). The code also records the Commissioner’s investigatory power under subsection 40(2) of the Act for acts or practices that may breach APP 1 (s 8 note 1).
Discretion to publish PIAs: agencies may elect to publish PIAs or edited/summarised versions on their website (s 13). Publication of the PIA itself is optional; publication of the register is mandatory (s 15(1)).
Delegation and cross-agency designation: the code allows the agency to designate Privacy Officers by reference to a position or role in another agency (s 10(2)) and allows joint PIAs when multiple agencies participate in a project (s 14). These provisions provide administrative flexibility for shared services or inter-agency projects.
Limitations and delegations: The code relies heavily on agency judgement and reasonable steps standards (for example “reasonable steps” in training and “reasonably considers” for high privacy risk); it does not supply detailed templates, thresholds or metrics. Agencies must ensure functions are carried out but the code does not prescribe who within the agency must perform particular operational tasks beyond the requirement to designate roles and ensure functions (ss 9-11, 10(5)).
Procedural interactions with the Act: the code is intended to be how agencies comply with APP 1.2 (s 8) and is made under s 26G of the Act (s 3). It also references the Act’s definition of PIA and the Commissioner’s direction powers (s 12 note).
Penalties and enforcement
The text of the APP code does not itself prescribe civil or criminal penalties, pecuniary fines or private rights of action. Enforcement and oversight mechanisms set out in the code are administrative and supervisory rather than punitive within the code’s own text. The following are the enforcement-relevant mechanisms the code creates or references:
Binding nature: The code is binding on agencies as defined in the code (s 7). The effect of “binding” is operationalised through reporting, recordkeeping and the OAIC’s oversight powers set out in the Act.
Commissioner investigative power: The code expressly notes the Commissioner’s authority under subsection 40(2) of the Privacy Act 1988 to investigate, on the Commissioner’s own initiative, an act or practice that may be a breach of APP 1 if the Commissioner thinks it desirable that the act or practice be investigated (s 8 note 1). That note links the code to the Act’s investigatory framework.
Requests for PIAs and register: The Commissioner may request the agency provide a copy of its PIA register and any PIAs listed on it; the agency may provide those to the Commissioner on request (s 15(2)). This creates a direct compliance disclosure pathway to the OAIC.
Direction to conduct PIAs: The code notes that section 33D of the Act requires an agency to conduct a PIA if directed by the Commissioner (s 12 note). That is an enforcement lever under the Act that the Commissioner can use in addition to the code’s requirements.
Notification requirement to OAIC: Agencies must keep the OAIC notified in writing of the contact details for the Privacy Officer (s 10(3)). This supports OAIC’s ability to liaise and to monitor compliance.
What the code does not do, within its text:
It does not specify pecuniary penalties, civil remedies or criminal sanctions for breach of the code. Those enforcement options, if any, would derive from the Act or other legislation, but they are not set out in the code’s text.
It does not set out a compliance timetable or transitional carve-outs; it comes into force on 1 July 2018 (s 2).
Practical enforcement risks and realities that follow from the code (as written):
The OAIC is given information access and monitoring paths (notification of Privacy Officer, ability to request PIAs/registers). Those mechanisms enable the Commissioner to investigate or to require PIAs under the Act (s 10(3), s 15(2), s 12 note, s 8 note 1).
The code’s reliance on “reasonable steps” and the agency’s “reasonable consideration” for high privacy risk projects creates enforcement judgement calls; the Commissioner would likely need to make a factual assessment of whether the agency’s processes met those standards during any investigation under subsection 40(2) or under other Act provisions referenced in the code.
Because the code does not specify penalties, non-compliance would most directly expose agencies to OAIC scrutiny and potential remedies available under the Privacy Act rather than to immediate penalties described in the code.
Users of this code should therefore treat the OAIC as the practical enforcement point and note the code’s requirements for disclosure and cooperation (s 10(3), s 15(2), note referencing s 40(2) and s 33D of the Act).
How it interacts with other laws
The code is explicitly a code under the Privacy Act 1988. Its operation is anchored in several specific provisions of the Act which the text references directly or by note. The text creates cross-links and references to Act provisions that affect interpretation and the legal effect of specific duties.
Direct statutory foundations and cross-references:
Made under s 26G of the Privacy Act 1988: The code states it has been developed under section 26G of the Act (s 3). That situates the code within the Act’s framework for registered APP codes.
Application to APP 1.2: Parts 2-4 of the code set out how APP 1.2 is to be complied with by agencies (s 8). This means the code operationalises APP 1.2; compliance with the code is a prescribed path to compliance with that APP.
Commissioner investigatory power (s 40(2) of the Act): The code notes that the Commissioner can investigate on his or her own initiative any act or practice that may be a breach of APP 1 where the Commissioner thinks an investigation desirable (s 8 note 1). This links the code’s obligations to the Act’s investigative regime.
PIA definition and Commissioner’s direction (s 33D of the Act): The code notes that "privacy impact assessment" is defined in section 33D of the Act and that the Act requires a PIA if directed by the Commissioner (s 12 note). Therefore the code’s PIA duties operate alongside and supplement the Act’s existing PIA regime.
Scope of the Act , Part II Division 3 and s 7 of the Act: The code explicitly notes that it does not affect the operation of Part II Division 3 of the Act, which sets out what acts and practices fall within the scope of the Act (s 7 of the Act is given as an example in the note to s 7 of the code). This emphasises that the code does not expand or restrict the Act’s substantive scope of application; it prescribes governance measures for agencies within that scope (s 7 note).
Requests and disclosures to the Commissioner: The code permits agencies to provide PIA registers and PIAs to the Commissioner on request (s 15(2)), which functions within the Act’s OAIC oversight architecture.
Operational interactions and potential overlaps:
Administrative law and public sector governance: The code imposes duties on agencies that intersect with general public sector governance obligations: designated senior official (Privacy Champion) reporting to executive, retention of registers, publication of registers and PIAs. These measures will interact with agencies’ broader statutory obligations regarding recordkeeping, transparency and administrative decision-making, although the code does not amend those other statutory regimes; it operates within them.
Employment law and HR processes: The training and induction obligations (s 16) and the designation of roles (ss 10-11) will interact with internal employment agreements and HR policies. Agencies choosing to designate existing positions for Privacy Officer or Privacy Champion need to observe applicable employment law and delegated authority frameworks.
Freedom of Information and publication obligations: The code requires publication of the PIA register (s 15(1)) and permits publication of PIAs (s 13). That interacts with FOI and classification regimes; agencies will need to consider confidentiality and information sensitivity rules when publishing PIAs or registers, although the code does not itself alter FOI law.
Inter-agency projects and information sharing: The joint PIA provision (s 14) facilitates compliance when multiple agencies participate in a project, but agencies must retain copies of the PIA. Data-sharing arrangements and inter-agency information exchange statutes will still apply; the code does not alter those arrangements, it requires privacy governance processes to be applied to them.
Other APPs: The code explicitly references APP 1 (governance) and APP 5 (privacy notices) in the required review scope (s 17(1)(a)-(b)). Agencies must ensure the code’s governance duties work alongside compliance with all APPs.
What the code does not change about other laws:
The code does not create new substantive information-handling rights for individuals beyond what the APPs and the Privacy Act already provide. Its focus is governance and process within agencies (s 6 objectives).
The code does not describe how conflicts between its publication or disclosure duties and other statutory secrecy or confidentiality obligations should be resolved. Agencies will need to resolve such conflicts using the Act’s general framework and other relevant statutes.
In short, the code sits as an operational governance instrument under the Privacy Act, creating mandatory internal obligations for agencies while relying on the Act for definitional elements, investigatory powers and any directions to conduct PIAs. Agencies must treat the code as part of their statutory compliance landscape, integrated with other administrative, FOI and confidentiality laws.
Amendment history
The text provided records the instrument’s name, commencement and authority: it is titled the Privacy (Australian Government Agencies , Governance) APP Code 2017 (s 1), it commences on 1 July 2018 (s 2), and it has been developed under section 26G of the Privacy Act 1988 (s 3). The instrument’s preamble and substantive provisions are included in the document.
The code as provided does not contain any expressed amendments, amendment dates, or notes of repeal or substitution in the text supplied. There are no amendment clauses, no schedules indicating transitional provisions, and no subsequent dates or variant versions included in the material provided. The code therefore appears, in the supplied text, as the 2017 code commencing 1 July 2018 without recorded amendments inside this excerpt.
What is recorded in the text that pertains to change management or future directions:
The code requires agencies to regularly review and update their privacy practices, procedures and systems (s 17(1)). That is an administrative mechanism to keep agency policies current, but it is an operational duty rather than an amendment to the code itself.
The code allows the Commissioner to direct an agency to conduct a PIA under the Act (s 12 note). Any such directions would be operational actions rather than textual amendments to the code.
If an agency needs to know whether the code has been amended since commencement, the code itself does not supply that history. Users must consult official legislative registers, the Federal Register of Legislation, or the OAIC for any registered amendments, revocations, or replacement codes after 1 July 2018. The code’s text, as provided, contains only the original commencement date and no recorded amendment history.
Litigation history
The supplied text contains no case citations, reported disputes or decisions. It does not name any litigation, judicial reviews, or determinations concerning the code. It also does not supply any OAIC determinations, schedules of compliance directions, or enforcement proceedings.
The code does reference the Commissioner’s investigatory power under subsection 40(2) of the Privacy Act (s 8 note 1) and the Commissioner’s power under s 33D of the Act to require a PIA (s 12 note), but the code text does not include any examples of these powers having been exercised, nor does it list any litigation that has arisen from the code.
For practitioners seeking litigation or interpretive history:
The code itself provides no litigation history. To discover whether the code has been the subject of judicial review, administrative decisions, OAIC determinations or enforcement proceedings, one must consult case law databases, OAIC published determinations, and administrative law reports beyond the instrument text.
The code’s obligations (for example, the agency’s reasonable assessment of high privacy risk under s 12(2) and the “reasonable steps” standard in s 16(2)) create factual and legal questions about reasonableness that could, in practice, become the subject of investigation or litigation. However, the supplied text does not contain examples or precedent.
Therefore, based solely on the instrument supplied, there is no litigation history to report.
Gotchas
Several features of the code create practical risks, ambiguities and potential compliance pitfalls. The following points draw attention to operational areas where agencies and advisers should be cautious, based directly on the code’s text.
“High privacy risk” is assessed by the agency’s reasonable consideration (s 12(2)). The code makes the agency the initial judge of whether a project is high risk, using a reasonableness standard. That creates two related issues:
A factual-judgement risk: If the agency incorrectly assesses a project as not high privacy risk, it will be non‑compliant with s 12(1) when a court or Commissioner later concludes the project was high risk. The code does not prescribe a specific test or thresholds; agencies must document the basis for their reasonableness assessment.
Recordkeeping burden: Because the assessment is fact‑intensive, agencies should document the considerations and evidence supporting the determination to mitigate later scrutiny under subsection 40(2) of the Act (s 8 note 1).
“Reasonable steps” language in training and elsewhere (s 16(2)) is flexible but indeterminate. What constitutes “reasonable” will depend on agency size, risk profile and functions. The code imposes an annual requirement to take reasonable steps to provide training to staff who have access to personal information (s 16(2)). Agencies must set and document criteria for “reasonable steps” to demonstrate compliance.
Mandatory publication of the PIA register vs optional publication of PIAs:
Agencies must publish the register of PIAs (s 15(1)). The register’s publication is mandatory and creates transparency obligations.
By contrast, publication of individual PIAs is optional (s 13: "may publish"). Agencies must balance transparency with confidentiality and security. Publication may trigger additional disclosure obligations under FOI laws or reveal sensitive operational details. The code does not supply exemptions or redaction guidelines beyond allowing edited copies or summaries (s 13).
Notification requirement to OAIC is narrow but mandatory (s 10(3)). Agencies must keep the OAIC notified in writing of contact details for the Privacy Officer. Failure to do so is a compliance breach under the code. The code does not specify the format or frequency of updates beyond a requirement to keep OAIC notified in writing.
Role duplication and resourcing:
The code permits the same person to be Privacy Officer and Privacy Champion (s 11(5)). However, the Privacy Champion must be a senior official (s 11(3)), while the Privacy Officer handles day-to-day functions (s 10(5)). Agencies should ensure workload and independence considerations do not undermine the Champion’s strategic oversight.
Smaller agencies may face resource constraints in maintaining distinct senior oversight and operational roles; the code allows delegation across agencies for Privacy Officer designation (s 10(2)), but cross-agency arrangements will require formalisation.
Joint PIAs require each participating agency to retain a copy (s 14). This creates duplication where a joint project involves many agencies. Agencies must agree on governance, version control and confidentiality for joint PIAs.
Interaction with secrecy/confidentiality and FOI laws is not spelled out. The code requires publication of registers and permits PIA publication but does not provide a mechanism for resolving conflicts with secrecy provisions or FOI exemptions. Agencies must conduct their own legal assessments when publishing.
The code is silent on enforcement penalties within its text. While it is binding on agencies (s 7), consequences for non-compliance are not set out in the code itself, and agencies will need to consider the Act’s enforcement mechanisms referenced in the code (s 8 note 1 and s 12 note) for potential outcomes of investigations.
Scope clarity and exclusion of Ministers. The code excludes Ministers from the definition of agency (s 5). Agencies interacting directly with a Minister’s office should check whether particular activities of ministerial offices fall within the Act or the code’s scope through other Act provisions,because the code does not change the Act’s substantive scope (s 7 note referencing Part II Division 3).
No express transitional or compliance timetable in the text. The code commenced on 1 July 2018 (s 2). If agencies adopted internal practices at varying rates, the code itself provides no grace periods or transitional compliance steps; agencies should document when measures were implemented to demonstrate compliance if investigated.
These “gotchas” indicate places where procedural documentation, clear policy, and internal controls are essential. The code establishes structural duties but leaves considerable discretion and judgment to agencies; that discretion is the primary source of later compliance risk.
How to comply
The code prescribes concrete duties; compliance therefore requires operational steps that translate those duties into policies, processes and documented evidence. Below is a pragmatic compliance checklist mapped to the code’s sections and functions.
Governance and documentation
Draft and maintain a privacy management plan meeting s 9: the plan must identify specific, measurable privacy goals and targets and set out how the agency will meet APP 1.2 obligations (s 9(2)). Ensure the plan includes timelines, responsibility assignments, risk assessments and measurable KPIs.
Establish a process to measure and document performance against the plan at least annually: schedule annual reviews, track KPIs and retain documentation evidencing measurement (s 9(3)).
Designate and resource roles
Appoint a Privacy Officer(s) at all times (s 10(1)). Document the appointment by position/role and, if cross-agency, document the authority to reference another agency’s position (s 10(2)).
Notify the OAIC in writing of the Privacy Officer’s contact details and update the OAIC when details change (s 10(3)).
Ensure the Privacy Officer performs or oversees the functions in s 10(5): complaint handling, access/correction requests under the Act, maintaining a record of personal information holdings, assisting with PIAs, maintaining the PIA register, and annual performance measurement against the privacy management plan.
Appoint a Privacy Champion who is a senior official (s 11(1)-(3)). Record the seniority and reporting lines and ensure the Champion performs duties in s 11(4): promoting a privacy culture, providing executive-level leadership, reviewing/approving the privacy management plan and reporting regularly to the agency’s executive.
Consider whether the Privacy Officer and Privacy Champion roles should be combined or separated, and document rationale and safeguards (s 11(5)).
PIAs and project management
Embed a PIA trigger in the project lifecycle: for all projects involving new or changed personal information handling, require a documented assessment of whether the project is “high privacy risk” as per s 12(2). Record the facts and rationale for the agency’s reasonable consideration.
If a project is assessed as high privacy risk, conduct a PIA in accordance with the Act’s definition (s 12(1) and s 12 note referencing s 33D of the Act). Keep a standard template and guidance for PIAs to ensure consistency and completeness.
Maintain a register of PIAs and publish the register (s 15(1)). Determine an appropriate published version that balances transparency with confidentiality. For PIAs themselves, establish procedures for deciding whether to publish an edited summary or full PIA (s 13).
For inter-agency projects, set a template for joint PIAs that ensures each participating agency retains its own copy and agreement on confidentiality, ownership and publication (s 14).
Training and capability building
Include privacy education and training in staff induction programs (s 16(1)). Create standard induction materials covering the agency’s privacy obligations, policies and procedures.
Implement annual privacy training for staff who have access to personal information (s 16(2)). Keep attendance records and evidence of training content and updates to demonstrate “reasonable steps”.
Train project managers and procurement teams specifically on PIA triggers and PIA processes.
Review, monitoring and continuous improvement
Establish scheduled reviews of privacy practices, procedures and systems to ensure they remain current and adequate for APP compliance (s 17(1)). Ensure reviews include the agency privacy policy (APP 1) and privacy notices (APP 5) (s 17(1)(a)-(b)).
Implement a compliance monitoring program, including audits, spot checks and remedial plans for deficiencies identified (s 17(2)).
Maintain an audit trail of reviews, decisions, PIA outcomes and remediation actions to support compliance evidence in case of OAIC review or Commissioner investigation.
OAIC engagement and disclosure
Keep OAIC notified in writing of Privacy Officer contact details and any changes (s 10(3)).
Be prepared to provide the PIA register and listed PIAs to the Commissioner on request (s 15(2)). Maintain mechanisms for secure disclosure: redaction, legal assessment and approval processes for material to be provided.
Document responses to Commissioner requests and any directions under s 33D of the Act to conduct PIAs.
Policy alignment and cross-regulatory checks
Align privacy management plan and policies with other statutory obligations, including FOI, public sector recordkeeping, information security and confidentiality law. For each publication decision (PIAs or registers), perform a confidentiality/FOI/legal check.
Where the agency uses shared or outsourced services, incorporate privacy governance requirements into contracts and service-level agreements; ensure third parties are required to support PIA processes and privacy training when they handle personal information.
Recordkeeping and evidentiary posture
Keep written records of all determinations of whether projects are high privacy risk, PIAs conducted, PIA registers, privacy management plan revisions and training logs. These records are the principal evidence of compliance with the code.
Ensure version control over the privacy management plan and that the Privacy Champion’s review/approval is recorded.
Resource and capability planning
Budget for privacy governance activities: staff time for a Privacy Officer/Champion, costs of PIAs (internal or external), training delivery, and systems for register publication and secure disclosure.
For small agencies or agencies with shared services, assess whether designation of a Privacy Officer by reference to a role in another agency (s 10(2)) is appropriate and formalise arrangements.
Prepare for investigation and enforcement
Given the Commissioner’s investigative power under subsection 40(2) of the Act (s 8 note 1), ensure an internal incident response process, evidence preservation, and an escalation path to executive leadership when investigations are notified.
Ensure a legal officer or privacy counsel is involved in decisions about disclosure and PIA publication to manage confidentiality and legal risk.
In sum, compliance requires translating the code’s duties into documented policies, a clear governance structure with named senior oversight, routine project-level PIA triggers and documentation, a publication strategy for the PIA register, regular training and monitoring, and clear OAIC engagement procedures. The code leaves reasonableness to agencies; agencies must therefore design conservative, well-documented procedures to support that judgment if scrutinised.
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs as required by section 15; and
(e) measuring and documenting the agency’s performance against the privacy management plan at least annually as required by section 9.
11 Privacy Champion
(1) An agency must, at all times, have a designated Privacy Champion.
(2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.
(3) The Privacy Champion must be a senior official within the agency.
(4) An agency must ensure that the following Privacy Champion functions are carried out:
(a) promoting a culture of privacy within the agency that values and protects personal information;
(b) providing leadership within the agency on broader strategic privacy issues;
(c) reviewing and/or approving the agency’s privacy management plan, and documented reviews of the agency’s progress against the privacy management plan; and
(d) providing regular reports to the agency’s executive, including about any privacy issues arising from the agency’s handling of personal information.
(5) An agency's designated Privacy Officer may also be its designated Privacy Champion.
PART 3—PIAs
12 Conduct of PIA
(1) An agency must conduct a PIA for all high privacy risk projects.
(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.
Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.
13 Publication of PIA
An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.
14 Joint PIA
If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.
15 Register of PIAs
(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.
(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.
PART 4—Internal privacy capability
16 Privacy education and training
(1) An agency must include appropriate privacy education or training in any staff induction program it provides. The privacy education must address the privacy obligations of agency staff, and agency policies and procedures relating to privacy.
(2) An agency must take reasonable steps to provide appropriate privacy education or training annually to all staff who have access to personal information in the course of performing their duties as a staff member.
17 Regular review of internal privacy processes
(1) An agency must regularly review and update its privacy practices, procedures and systems, to ensure their currency and adequacy for the purposes of compliance with the APPs. The scope of the review must include any:
(a) privacy policy prepared for the purposes of APP 1; and
(b) privacy notice prepared for the purposes of APP 5.
(2) An agency must monitor compliance with its privacy practices, procedures and systems regularly.
1 Name
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that a (a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
Part 1—Introduction
1 Name
(1) This APP code may be cited as the Privacy (Australian Government Agencies — Governance) APP Code 2017.
(2) This APP code may also be cited as the Australian Government Agencies Privacy Code.
2 Commencement
This APP code comes into force on 1 July 2018.
3 Authority
This APP code has been developed under section 26G of the Privacy Act 1988.
4 Preamble
APP 1 is the foundation principle that assists agencies to achieve compliance with the APPs. Compliance with APP 1 is essential to ensure good privacy management and governance practices, which can build community trust and confidence in those practices.
APP 1 implicitly promotes a ‘privacy by design’ approach to ensure that privacy compliance is included in the design of information systems and practices from their inception. It does this by requiring agencies to take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs and any binding registered APP code.
5 Definitions
Note: A number of expressions used in this APP code are defined in the Act, and have the same meaning in this APP code, including the following:
Note: (a) APP code;
Note: (b) Commissioner;
Note: (c) personal information;
Note: (d) privacy impact assessment; and
Note: (e) sensitive information.
In this APP code:
Act means the Privacy Act 1988.
Agency has the meaning given in section 6(1) of the Act, but for the purposes of this APP code, does not include a Minister.
APP means an Australian Privacy Principle as set out in the Act.
handling personal information means dealing with personal information in any way, including managing, collecting, holding, using or disclosing personal information.
OAIC means the Office of the Australian Information Commissioner.
PIA means privacy impact assessment.
Privacy Champion has the meaning given by section 11.
privacy management plan has the meaning given by section 9.
Privacy Officer has the meaning given by section 10.
6 Objectives
The objectives of this APP code are to:
(a) set out specific requirements that agencies must comply with as part of their compliance with APP 1.2;
(b) enhance the privacy capability and accountability of agencies;
(c) promote good privacy governance within agencies to create and embed a culture that respects privacy and treats personal information as a valuable asset; and
(d) build community trust and confidence in the personal information handling practices of agencies.
7 Agencies bound by this APP code
This APP code is binding on all agencies as defined in section 5 of this APP code.
Note: This APP code does not affect the operation of Part II, Division 3 of the Act which sets out the acts and practices which come within the scope of the Act and those acts and practices that do not come within the scope of the Act. As an example, section 7 of the Act sets out the extent to which a reference in the Act to an 'act or practice' is an act or practice of an agency for the purposes of the Act.
8 Application of this APP code to APP 1.2
For the purposes of paragraph 26C(2)(a) of the Act, Parts 2 to 4 of this APP code set out how APP 1.2 is to be complied with by agencies.
Note 1: Under subsection 40(2) of the Act the Commissioner, on his or her own initiative, may investigate an act or practice if the act of practice may be a breach of APP 1 and the Commissioner thinks it is desirable that the act or practice be investigated.
Note 2: In addition to complying with this APP code, an agency may need to take additional steps in order to satisfy its obligations under APP 1.2.
Part 2—Privacy management and governance
9 Privacy management plan
(1) An agency must have a privacy management plan.
(2) A privacy management plan is a document that:
(a) identifies specific, measurable privacy goals and targets; and
(b) sets out how an agency will meet its compliance obligations under APP 1.2.
(3) An agency must measure and document its performance against its privacy management plan at least annually.
10 Privacy Officer
(1) An agency must, at all times, have a designated Privacy Officer. An agency may have more than one Privacy Officer.
(2) An agency may designate an officer as a Privacy Officer by reference to a position or role, including by reference to a position or role in another agency.
(3) An agency must keep the OAIC notified in writing of the contact details for the Privacy Officer, or if an agency has more than one Privacy Officer, for one of those Privacy Officers.
(4) Privacy Officers are the primary point of contact for advice on privacy matters in an agency.
(5) An agency must ensure that the following Privacy Officer functions are carried out:
(a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;
(b) maintaining a record of the agency's personal information holdings;
(c) assisting with the preparation of PIAs conducted under section 12;
(d) maintaining the agency’s register of PIAs a
This is an opening excerpt, not the complete document.