The next set of draft Australian Privacy Principle (APP) guidelines have been released for public feedback by the Office of the Australian Information Commissioner (OAIC).
APPs 1 to 5 were published in August. This covered new requirements for agencies and enterprises about how they manage personal information, including the requirement to have a clearly expressed and up-to-date privacy policy.
Australian Information Commissioner Professor John McMillan said the guidelines outline how the OAIC will interpret and apply the APPs which come into law on 12 March 2014.
Australian Privacy Commissioner Timothy Pilgrim said the second stage of these draft guidelines gives guidance about new requirements for agencies in how they use or disclose personal information, undertake direct marketing activities and send data off-shore.
"The direct marketing principle, APP 7, says that organisations may only use or disclose personal information for direct marketing purposes in particular circumstances. Generally, this will be where the individual has a reasonable expectation that their information will be used for direct marketing or where the individual has consented to their information being used for this purpose," he said in a statement.
"Organisations must also give people a simple means to opt-out of receiving further communications,"
Pilgrim added that another change is the off shore disclosure of data covered in APP 8. New accountability requirements will apply to organisations ,including Australian government agencies, that send personal information to an overseas recipient.
"I understand that being held accountable for the mishandling of personal information disclosed to an organisation overseas may be a concern. However, I imagine the cost of an overseas data breach is equally concerning. These new requirements provide a compelling business case for organisations to protect their business when planning to send personal information overseas," Pilgrim said.
The following APPs have been released for public consultation:
- APP 6 – use or disclosure of personal information
- AAP 7 – direct marketing
- AAP 8 – cross-border disclosure of personal information
- AAP 9 – adoption, use or disclosure of government related identifiers
- AAP 10 – quality of personal information
- AAP 11 – security of personal information.
Submissions can be sent to consultation@oaic.gov.au. The deadline for replies is 21 October 2013.
Follow Hamish Barwick on Twitter: @HamishBarwick
Follow Computerworld Australia on Twitter: @ComputerworldAU, or take part in the Computerworld conversation on LinkedIn: Computerworld Australia