How do you protect people’s privacy?
In the Privacy section of the Open Data Certificate questionnaire, you answer one or more questions about how you protect people’s privacy in the data you publish. The questions you are shown are based on your answers to previous questions – the logic is shown in this flowchart.
Start with question 1 to work through the questions relevant to you.
1. Is this data about people or their activities?
No, the data is not about people or their activities
Data that is not about people or their activies is not subject to privacy law. Check that your data is not another type of sensitive data.
Data about people or their activies may be subject to privacy law.
Personal Information Resources
These Guides can help you determine if the data is personal information:
- Dataset publication and privacy by the Queensland Office of the Information Commissioner.
- DataVic Access Policy Guidelines for the Victorian public sector by the Victorian Department of Treasury and Finance.
- Privacy and Open Data Guideline by the Privacy Committee of South Australia.
In Australia, privacy laws do not bind everyone. For example:
- the Commonwealth Privacy Act 1988 binds Commonwealth Government departments and businesses with a turnover greater than $3 million and private health service providers.
- the Queensland Information Privacy Act 2009 binds Queensland Government Ministers, Departments, Local Governments, public authorities, and their bound contracted service providers. Not all areas of government are bound, for example, Government Owned Corporations, courts or tribunals in relation to their judicial or quasi-judicial functions, among other exemptions.
Some sectors, particularly health services, may be bound by more than one privacy law.
The Australian Government provides a list of links to privacy regulation in the States and Territories and other Australian laws that relate to privacy.
The Open Data Certificate questionnaire focuses on privacy. Other elements of data sensitivity include:
- cultural heritage
- environmental security.
It is important to consider all aspects of data sensitivity when publishing data.
These resources may assist you to address other elements of data sensitivity:
2. Has the data about individuals been de‑identified?
No, it contains data that could identify individuals.
Individual identities are visible in the data or could be reasonably ascertained through cross-referencing with other available information.
De-identification techniques such as aggregation, data masking, pseudonymisation, and reducing the precision of information can reduce the risk of individuals being identified in the data.
Data De-identification Resources
These Guides describe how you may be able to publish the data if you can de-identify individuals:
- De-identification of data and information by the Office of the Australian Information Commissioner
- Dataset publication and de-identification techniques by the Queensland Office of the Information Commissioner
- De-identification by the New South Wales Office of Finance & Services/li>
- Confidentiality by the Tasmanian Department of Premier and Cabinet
- Confidentiality: managing identification risks by the National Statistical Service
3. Do you have permission to publish this personal data online?
You may be able to publish data about individuals online if either, the data is required or permitted to be published by law, or you have permission from the affected individuals.
If permission is not granted by all individuals, you should inform data re-users that the dataset is incomplete.
You should only publish personal data without de-identification if you are required or permitted to do so by law or the affected individuals have granted permission.
Have you published without permission?
If you have already published the data without permission, you should review the Privacy Breach Resources to determine your next steps to protect people’s privacy
Examples of laws that may permit you to publish personal data online
To Do: Confirm these laws provide permission.
A number of laws may permit or require you to publish personal data online, including:
- Council of Australian Governments Agreements
- National Frameworks, such as the National Framework for Protecting Australia’s Children
- Public Health Act 2005 (Qld)
- Queensland Multicultural Recognition Act 2016 (Qld)
- National Health and Medical Research Council Funding Rule 9.3 Dissemination of Scientific Results (Open Access Policy)
- NHMRC Statement on Data Sharing (Grants and Funding Policy)
- NHMRC Open Access Policy (Grants and Funding Policy)
To Do: Individual Consent Resources
These guides (yet to be identified / written) help you to ask for an individual’s consent. Guides may cover the following scenario and provide real-life examples:
- A government agency conducts a survey concerning its services. Participants are informed that the survey results will be published online and this can include their names and contact details. Participants are given the option to provide anonymous responses. Those who do not take up this option have agreed to the publishing of their details online.
- The Open Data Census submission page can be used as a example however your can only see the page after logging in. Seek a public example.
4. Where do you document your right to publish this data?
Provide a URL to the law or individual permission that allows you to publish this data about individuals.
Disclosure Rationale URL
Reference the Law
To help people use the data with confidence, in the data description or documentation provide a reference to the law that permits the data publication. Include:
- the name of the law
- a reference to the clause in the law that permits the data publication
- a hyperlink to the law or clause within the law.
The Queensland Financial Accountability Act 2009 (section 63) requires all departments and statutory bodies prepare annual reports for tabling in the Legislative Assembly. The supporting Financial and Performance Management Standard 2009 (section 49 (5)) requires that the annual report includes information defined in the Annual report requirements for Queensland Government agencies prepared by the Department of the Premier and Cabinet. A number of annual reporting requirements are addressed through publication of information through the Queensland Government Open Data website and some datasets include the names of officers who travelled overseas, their position, the destination, reason for travel, cost of travel, etc.
The data documentation in this case could include the following statement:
The Department of Transport and Main Roads 2015–16 Annual Report – Overseas Travel data is required to be published under the Financial Accountability Act 2009 (section 63) and as specified in the Annual report requirements for Queensland Government agencies.
To do: Reference Individual Constent
These guides help you to show that you have consent from affected individuals to publish the data.
- Yet to be identified / written
5. Has your de-identification process been independently audited?
6. Have you assessed the privacy risks of publishing this data?
You should assess the likelihood of personal data being disclosed and the consequences to individuals of the disclosure.
7. Where is your risk assessment published?
Provide a URL to where people can check how you have assessed the privacy risks to individuals.
Risk Assessment URL
8. Has your privacy risk assessment been independently audited?
Privacy Risk Assessment Independent Audit Resources
- Section 10 in the Guide to undertaking privacy impact assessments by the Office of the Australian Information Commissioner, discusses the benefits of an independent audit of your privact impact assessment.
9. Are you prepared to respond if publishing this data compromises the privacy of individuals?
Have you documented the steps you will take in the event of a privacy breach?
You should document the steps you will take in the event of a privacy breach
Privacy Breach Resources
If the publishing of your dataset online results in the identity of the individuals whose data is contained in the dataset being reasonably ascertainable – you have potentially breached the privacy of these individuals. In the event that this comes to your attention, there are a number of steps that can be take to remedy a privacy breach.
Guides to help you plan for a possible privacy breach:
- Privacy breach management and notification by the Queensland Office of the Information Commissioner.
- Data breach notification — A guide to handling personal information security breaches by the Office of the Australian Information Commissioner.