Privacy Management Plan Purpose This privacy management plan supports the AOFM to meet and monitor its ongoing compliance pursuant to Australian Privacy Principle (APP) 1.2. It does this by identifying areas where compliance has been met, and specific, measurable goals and targets that the AOFM will take to implement the four steps outlined in the Office of the Australian Information Commissioner’s (OAIC’s) Privacy Management Framework. Step 1. Embed: a culture of privacy that enables compliance Action Responsibility Status Due Adopt a by design’ approach Privacy Officer In progress 30 June 2018 ‘privacy Assign key and responsibilities for Privacy Champion Complete N/A privacy management Assign staff responsibility for managing Privacy Champion Complete N/A privacy Create reporting mechanisms that ensure senior staff are routinely informed about Privacy Officer Complete N/A privacy issues Ensure staff understand their privacy Privacy Officer In progress 30 June 2018 obligations and the roles of the OAIC The AOFM embeds a culture of privacy through a number of mechanisms including its Privacy Policy, Employment Policy and Procedures, Security Policy and value statements. Taken together, these ensure that staff take responsibility for their actions and undertake their duties bearing in mind the need to comply with obligations and expectations of the Government, APS, market participants and public. We monitor compliance in accordance with the Assurance Policy and performance systems, and are subject to external independent reviews. The Privacy Officer will develop a privacy impact assessment (PIA) template (to be added as an attachment to this document) and training material to ensure that staff maintain an awareness of the current obligations, including the considerations relevant to identifying, assessing and managing privacy risks. Privacy risks will be managed at the Business Unit, project or contract management level commencing with the PIA. If deemed material, privacy risks for a particular matter can be elevated to the Enterprise Risk Register. 2. Establish: robust and effective privacy practices, procedures and systems Action Responsibility Status Due Keep information about your business’s Business Unit Heads Complete N/A personal information holdings up to date Develop and maintain processes around the Business Unit handling of personal information prior to Heads, Privacy Complete N/A collection, while personal information is Officer held, and once it is no longer needed Integrate privacy into staff training and Privacy Officer In progress 30 June 2018 induction processes
Privacy Management Plan Purpose This privacy management plan supports the AOFM to meet and monitor its ongoing compliance pursuant to Australian Privacy Principle (APP) 1.2. It does this by identifying areas where compliance has been met, and specific, measurable goals and targets that the AOFM will take to implement the four steps outlined in the Office of the Australian Information Commissioner’s (OAIC’s) Privacy Management Framework. Step 1. Embed: a culture of privacy that enables compliance Action Responsibility Status Due Adopt a ‘privacy by design’ approach Privacy Officer In progress 30 June 2018 Assign key and responsibilities for privacy management Privacy Champion Complete N/A Assign staff responsibility for managing privacy Privacy Champion Complete N/A Create reporting mechanisms that ensure senior staff are routinely informed about privacy issues Privacy Officer Complete N/A Ensure staff understand their privacy obligations and the roles of the OAIC Privacy Officer In progress 30 June 2018 The AOFM embeds a culture of privacy through a number of mechanisms including its Privacy Policy, Employment Policy and Procedures, Security Policy and value statements. Taken together, these ensure that staff take responsibility for their actions and undertake their duties bearing in mind the need to comply with obligations and expectations of the Government, APS, market participants and public. We monitor compliance in accordance with the Assurance Policy and performance systems, and are subject to external independent reviews. The Privacy Officer will develop a privacy impact assessment (PIA) template (to be added as an attachment to this document) and training material to ensure that staff maintain an awareness of the current obligations, including the considerations relevant to identifying, assessing and managing privacy risks. Privacy risks will be managed at the Business Unit, project or contract management level commencing with the PIA. If deemed material, privacy risks for a particular matter can be elevated to the Enterprise Risk Register. 2. Establish: robust and effective privacy practices, procedures and systems Action Responsibility Status Due Keep information about your business’s personal information holdings up to date Business Unit Heads Complete N/A Develop and maintain processes around the handling of personal information prior to collection, while personal information is held, and once it is no longer needed Business Unit Heads, Privacy Officer Complete N/A Integrate privacy into staff training and induction processes Privacy Officer In progress 30 June 2018
AOFM-Privacy-Management-Plan-2018-04-1.docx