Implementation of Privacy in Government

1

Implementation of Privacy in Government NRE
Privacy Implementation Strategy Jennifer
Berensen, Manager Privacy, NRE
2
Why Privacy?

• ID theft rampant options limited
  By
  Bob Sullivan
  MSNBC
• May 29 The State of California leaks the direct
  deposit records of 260,000 employees. A BankOne
  employee sells hundreds of customer records to a
  ring of identity thieves. Criminals gain access
  to Ford Motor companys credit
  reference firm and order 13,000 credit reports.
  An insurance company whose name still has not
  been disclosed gives information on patient
  illnesses to a marketing firm. Its been a bad
  month for personal privacy, a good one for
  identity thieves. And it has experts asking Will
  all of us eventually be victims?

3
Privacy Legislation

• 3 new privacy statutes come into force within 10
  months
• Privacy Amendment (Private Sector) Act
  2000(21/12/2001)
• Information Privacy Act (Vic) 2000(1/9/2002)
• The Health Records Act (Vic) 2000(1/7/2002)

4
New Style of Legislation

• Light touch, principle based, technology neutral,
  self regulatory ie require application of
  professional judgement, tests of reasonableness
  person in the street expectations
• More control in the hands of the data subject
• Require openness, transparency and respect from
  organisations

5
Resistance to Change

• Privacy requirements are not necessarily a
  restriction - they can be an opportunity
• Increased accountability
• Understanding and optimising data management and
  information flow
• Intellectual rigor Funding

6
4 Key Change Management Themes

• Environment the enabling of change through the
  development of a privacy aware culture and
  communication strategies
• Education the provision of sufficient knowledge
  and understanding for staff to successfully
  interpret the legislation and implement it in
  their workplace
• Engineering the provision of tools to undertake
  analysis of current information handling
  activities, analyse privacy risks and develop
  privacy compliant work practices
• Enforcement the monitoring and auditing of
  compliance

7
Privacy and NRE

• NRE collects a range of Personal Information
• Over 200 services
• Customer Service Centre
• Ecommerce/ebusiness initiatives
• Personnel Records
• Business Partners also collect personal
  information

8
NRE Privacy Strategy

• Privacy Communication Strategy Branding, news
  articles, awareness presentations, publications,
  website launch, flyers, stickers, posters,
  telephone hotline and email enquiry function as
  well as Ministerial and Executive briefings
• Privacy Training Cross departmental training for
  functional groups,staff development training
  calendar (Privacy Training for managers and
  staff), web based privacy orientation training
• Privacy Tools (web and paper) Privacy Policy,
  NRE specific guidelines, privacy checklists,
  privacy audit questionnaire and implementation
  framework etc.
• Privacy Consultancies (Personal Information
  Audit, Privacy Risk analysis, Privacy Improvement
  Plans)
• Privacy Audit (inclusion in organisational
  reporting)

9
Key Success Factors

• Identification and engagement of key stakeholders
• Integration with existing communication channels,
  management forums, risk management/audit
  frameworks, and procedures
• Leverage, Leverage, Leverage with the use of
  technology
• Build on existing good practice to meet
  compliance requirements
• Translation of the privacy principles into plain
  English for day to day workplace activities- use
  anecdotes

10
(No Transcript)
11
Implementation Check List

• Appoint a responsible officer
• Assess all personal information holdings against
  IPPs/HPPs
• Review websites and data basses
• Know and understand your own Acts
• Develop a Privacy Action Plan
• Conduct Information and Training Sessions
• Develop a public privacy policy document

12
Privacy Implementation Check List cont..

• Review and vary all contracts with contracted
  service providers
• Review internal and external communication
  protocols
• Incorporate privacy considerations in new
  information systems and services
• Audit and monitor privacy on a regular basis

13
Watch this space

• For updates and further information
• Jennifer Berensen 9637 8697
• www.nre.vic.gov.au/privacy-policy