Personal information update May 2017 – new OAIC guide, Productivity Commission report and open data announcement for banking
OAIC Guide
In early May, just ahead of Privacy Awareness Week, the Office of the Australian Information Commissioner (OAIC) launched a new guide "What is personal information?" The announcement on the OAIC website noted that further to the 19 January Federal Court of Australia decision in Privacy Commissioner v Telstra there remained a need for further guidance to be available to businesses and agencies on applying the definition of personal information.
This guide provides some question and answer scenarios, a number of examples and some real life case studies, and deals with some of the more difficult issues about whether information is "about an individual" or more than one individual, and whether in certain circumstances information may be personal information in the hands of one person but not in the hands of another. The guide explores some of these permutations with useful examples, such as guidance on small business information that might be both commercial information and personal information, and so needs to be treated as personal information.
The release of this guide is consistent is with a number of movements that are currently occurring in the personal data space.
Productivity Commission Report
The Productivity Commission's final report, Data Availability and Use was provided to Parliament on 31 March and publicly released on 8 May.
The report contains a range of recommendations in relation to the governance and regulation of data including the recognition and regulation of a new class of data, being consumer data, which overlaps to a significant degree with the definition of personal information and was the subject of a submission by the OAIC in relation to the Productivity Commission draft report in December 2016.
The Report also considers the concept of data portability and its interaction with competition.
The Federal Budget
The Federal Budget contained an announcement that it will fund an inquiry into open data for banks with the intention that open banking in Australia be improved to increase consumer choice and competition. The funding for the review announced in the budget will consider how the banking system can be more competitive by providing customers with greater access to and control over their banking data.
This falls short of simply moving to implement the recommendations of the Productivity Commission It is however a concrete step towards broader data portability. The announcement which funds a $1.2 million review into the most appropriate implementation model for an open banking regime mirrors what has been occurring in Europe in relation to open data generally.
This is in line with the Global Data Protection Regulation, known as GDPR, coming into place in Europe next year and Article 29 -the right to data portability, which is the subject of a working party seeking to determine how data portability will apply in the European context.
Where to from here?
Based on all of the policy considerations that are occurring both in Australia and in Europe it is likely that there will be more guidance and more prescriptive statements in relation to the management of personal information.
This publication does not deal with every important topic or change in law and is not intended to be relied upon as a substitute for legal or other advice that may be relevant to the reader's specific circumstances. If you have found this publication of interest and would like to know more or wish to obtain legal advice relevant to your circumstances please contact one of the named individuals listed.