Each row in the following table summarises the key requirements of each of the privacy principles and outlines some key questions or considerations you should address. A risk assessment table can help you identify the privacy risks relevant to your initiative. The accompanying Risk and Mitigation Table (see Appendix B) provides a more detailed explanation of how the project fits with the privacy principles. Either cut and paste from the Risk and Mitigation Table into this section of the PIA Report (and then omit those details from the assessment” section of this report, to save repetition), or provide a brief “Risk overview here and then expand on it in the assessment” section. “Risk It is useful to consider the privacy principles even if your agency is one of the few that doesn’t have to comply with the Privacy Act (for instance, if you’re a news agency collecting, using or publishing information for news purposes; or you’re a court or tribunal exercising judicial functions). Your activity may be legally compliant, but understanding how the Privacy Act deals with a matter can better inform you as to the likely privacy impacts of your proposal, and how privacy concerns can best be accommodated. # Description of the Summary of personal Assessment Link to risk privacy principle information involved, use of assessment and process to manage compliance (if required) (These can be deleted from your final report if they’re not relevant to your project but – you should at least consider each principle) 1 Principle 1 - Purpose of the Identify each element of Note for each collection of personal personal information and principle information satisfy yourself that it is whether the necessary for the project. project Only collect personal What is the purpose of complies or information if you really collecting the personal risks being need it information involved here? non-compliant How will that enable the organisation to do what it needs to do? Are you only collecting what you actually need? For example, do you really need of birth”, “date or will or 18” be “age” “over enough? 2 Principle 2 Source of How is the information – personal information collected, and who from? If personal information is Get it directly from the collected from some source people concerned wherever other than the individual, is possible this appropriate and justifiable?
Each row in the following table summarises the key requirements of each of the privacy principles and outlines some key questions or considerations you should address. A risk assessment table can help you identify the privacy risks relevant to your initiative. The accompanying Risk and Mitigation Table (see Appendix B) provides a more detailed explanation of how the project fits with the privacy principles. Either cut and paste from the Risk and Mitigation Table into this section of the PIA Report (and then omit those details from the “Risk assessment” section of this report, to save repetition), or provide a brief overview here and then expand on it in the “Risk assessment” section. It is useful to consider the privacy principles even if your agency is one of the few that doesn’t have to comply with the Privacy Act (for instance, if you’re a news agency collecting, using or publishing information for news purposes; or you’re a court or tribunal exercising judicial functions). Your activity may be legally compliant, but understanding how the Privacy Act deals with a matter can better inform you as to the likely privacy impacts of your proposal, and how privacy concerns can best be accommodated. # Description of the privacy principle (These can be deleted from your final report if they’re not relevant to your project – but you should at least consider each principle) Summary of personal information involved, use and process to manage Assessment of compliance Link to risk assessment (if required) 1 Principle 1 - Purpose of the collection of personal information Only collect personal information if you really need it Identify each element of personal information and satisfy yourself that it is necessary for the project. What is the purpose of collecting the personal information involved here? How will that enable the organisation to do what it needs to do? Are you only collecting what you actually need? For example, do you really need “date of birth”, or will “age” or “over 18” be enough? Note for each principle whether the project complies or risks being non-compliant 2 Principle 2 – Source of personal information Get it directly from the people concerned wherever possible How is the information collected, and who from? If personal information is collected from some source other than the individual, is this appropriate and justifiable?
Template-2-PIA-Report-Part-2-Appendix-A.docx