12Conduct of PIA

12 Conduct of PIA

(1) An agency must conduct a PIA for all high privacy risk projects.

(2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.

Note: ‘Privacy impact assessment’ is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.

13 Publication of PIA

An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency’s website.

14 Joint PIA

If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.

15 Register of PIAs

(1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.

(2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the Commissioner on request from the Commissioner.