Recommendation 7: Regularly assess the risk that the Department might be disclosing ‘new’ personal information about clients to service providers in the reporting context. APP 10 - quality of personal information The Department must take such steps (if any) as are reasonable in the circumstances to ensure that the personal information that the Department collects is accurate, uptodate and complete (APP 10.1). The Department must take such steps (if any) as are reasonable in the circumstances to ensure that the personal information that the Department uses or discloses is, having regard to the purpose of the use or disclosure, accurate, uptodate, complete and relevant (APP 10.2). Analysis As mentioned above in relation to APPs 3 and 6, the Department collects personal information in client-unit level records from, and discloses such information to, service providers who are using the web-based portal as a client management system. As also mentioned above in relation to APP 3: a list of possible data values for each mandatory priority requirement data item in a client-level unit record is provided on page 44 of the DSS Data Exchange Protocols document under the heading record mandatory priority ‘Client – and requirements’; a list of possible data values for each data item that makes up the voluntary extended requirements in a client-level unit record is provided on pages 46 to 47 of the DSS Data Exchange Protocols document under the heading ‘The voluntary extended data set the partnership – approach’. In the present context, we think that the key consideration in relation to APP 10 is whether the personal information being collected by the Department from relevant service providers, and disclosed by the Department to relevant service providers, is accurate and relevant. Given that reporting requirements for grants programme reporting effectively require service providers to report any personal information to the Department in accordance with the DSS Data Exchange Protocols document, the accuracy and relevance of personal information collected by the Department from providers, and disclosed by the Department to providers, will depend on the nature of the reporting requirements that the Department has placed on service providers through the Protocols document. Section 5 of the DSS Data Exchange Protocols document imposes detailed requirements on service providers in relation to collecting mandatory priority requirement data items from clients. Many of the mandatory priority requirement data items have possible data values that are, essentially, set These codes, and the associated definitions, have ‘codes’. been established by other entities (for example, the Australian Institute of Health and Welfare), and have been adopted by the Department. An example is the
Recommendation 7: Regularly assess the risk that the Department might be disclosing ‘new’ personal information about clients to service providers in the reporting context. APP 10 - quality of personal information The Department must take such steps (if any) as are reasonable in the circumstances to ensure that the personal information that the Department collects is accurate, uptodate and complete (APP 10.1). The Department must take such steps (if any) as are reasonable in the circumstances to ensure that the personal information that the Department uses or discloses is, having regard to the purpose of the use or disclosure, accurate, uptodate, complete and relevant (APP 10.2). Analysis As mentioned above in relation to APPs 3 and 6, the Department collects personal information in client-unit level records from, and discloses such information to, service providers who are using the web-based portal as a client management system. As also mentioned above in relation to APP 3: a list of possible data values for each mandatory priority requirement data item in a client-level unit record is provided on page 44 of the DSS Data Exchange Protocols document under the heading ‘Client record – mandatory priority requirements’; and a list of possible data values for each data item that makes up the voluntary extended requirements in a client-level unit record is provided on pages 46 to 47 of the DSS Data Exchange Protocols document under the heading ‘The voluntary extended data set – the partnership approach’. In the present context, we think that the key consideration in relation to APP 10 is whether the personal information being collected by the Department from relevant service providers, and disclosed by the Department to relevant service providers, is accurate and relevant. Given that reporting requirements for grants programme reporting effectively require service providers to report any personal information to the Department in accordance with the DSS Data Exchange Protocols document, the accuracy and relevance of personal information collected by the Department from providers, and disclosed by the Department to providers, will depend on the nature of the reporting requirements that the Department has placed on service providers through the Protocols document. Section 5 of the DSS Data Exchange Protocols document imposes detailed requirements on service providers in relation to collecting mandatory priority requirement data items from clients. Many of the mandatory priority requirement data items have possible data values that are, essentially, set ‘codes’. These codes, and the associated definitions, have been established by other entities (for example, the Australian Institute of Health and Welfare), and have been adopted by the Department. An example is the