This Information Standard outlines the requirements for Queensland Government agencies to responsibly collect, store, use and disclose personal information in the Queensland Government public sector. This information Standard must be read and implemented in-conjunction with the Queensland Government Information Privacy Principles (link to be developed) and the Information Privacy Guidelines (link to be developed).
Information Privacy (IS42) fits within the Information Management domain of the Government Information Architecture (GIA) Reference Framework.
This information standard excludes the following forms of personal information:
Personal information held by Queensland agencies must be responsibly and transparently collected and managed (including any transfer or sale of personal information held by agencies to other agencies, other levels of Government or the private sector) in accordance with the requirements of the Queensland Government Information Privacy Principles (IPPs) (link to be developed).
The government’s privacy scheme is designed to increase public confidence in the security of information held by Queensland Government agencies. It is essential that information in the possession of the Queensland Government is appropriately disclosed and that it is adequately protected and used for the purposes for which it was provided and/or intended, except when required by law.
Personal information is to be managed in accordance with the Information Privacy Principles (IPPs) (link to be developed) adapted from the public sector IPPs contained in the Commonwealth Government Privacy Act 1988, and all other relevant legislative or statutory obligations under which an agency operates.
Information Standard 42 is administratively based. Where conflicting requirements exist any legislative requirements will supercede compliance with this Information Standard. Implementation is subject to any existing outsourcing arrangements, contracts and licenses. Any future outsourcing arrangement, contracts and licenses must conform to the provisions of this Information Standard.
This standard is currently under Review for Comment.
The authority for the implementation of the mandatory principles of Information Standards is primarily derived from Sections 22 and 56 of the Financial Management Standard 1997 (FMS). The FMS is subordinate legislation to the Financial Administration and Audit Act 1977 (FAAA). As such, Information Standards apply to accountable officers and statutory bodies operating under the sections of this legislation.
This Information Standard will also apply to any statutory Government Owned Corporation (GOC) and its subsidiaries where the shareholding minister has given notification pursuant to s. 123 of the Government Owned Corporations Act 1993.
The mandatory principles and the Queensland Government IPP’s were approved by Cabinet in September 2001. This cabinet decision endorsed that:
The following bodies are exempt from Information Standard 42:
The implementation of this Standard must be consistent with the requirements outlined in the FMS. Existing mandatory requirements of the previous version (V1.00.01) remain unchanged. Version 2.00.01 has been amended for consistency with other Queensland Government Information Standards.
To ensure the management of personal information is applied appropriately and consistently, agencies must adopt and follow the Department of Justice and Attorney General Queensland Government IPPs (link to be developed) when collecting, handling, using and disclosing personal information. These principles are (all links below to be developed) :
Implementation advice To ensure that personal information held by the agencies is responsibly and transparently collected and managed in accordance with the Queensland Government IPPs (link to be developed) , agencies must establish effective management and review processes. At a minimum, agencies must:
The following implementation checkpoints can be used by agencies to assist in implementing the mandatory principles of the standard
The Queensland Government IPP’s are administered and managed by the Department of Justice and Attorney General (JAG). Agencies should seek further advice from JAG or refer to the JAG Privacy Website for information relating to the implementation of all mandatory principles and the 11 IPPs. Information Privacy Guidelines (link to be developed) have also been developed and are maintained by JAG to assist agencies with the implementation of the Queensland Government IPPs.
Queensland Government IPPs
The Queensland Government IPPs administered and managed by JAG consist of a set of 11 Information Privacy Principles based on the Commonwealth Privacy Act 1988 (Cth). In summary these IPPs deal with:
Guidelines for the Disclosure of Personal Information to Members of Parliament or their Staff Acting on Behalf of Constituents have been developed to support Information Privacy (IS42). These Guidelines are to be used as additional reference material by Queensland Government Members of Parliament in the performance of their duties when members act on behalf of their constituents and receive information from government about (or on behalf of) constituents.
There are several pieces of legislation which regulate the disclosure of private and personal information that is agency-specific. As legislation takes precedence over the administratively based Information Standards, agencies will need to ascertain those laws which specifically relate to their activities in disclosing and using private and personal information.
The development of privacy codes of practice are permitted under Information Standard 42. A privacy code of practice may modify the application of any one or more of the IPPs to an agency, but may not modify IPPs themselves.
Codes can apply to any one or more of the following:
Codes of practice are to be developed by the responsible agency, approved by JAG and then issued by the responsible agency. Once issued, codes should be published together with the agency privacy plan on the agency website. Further information can be found in the Information Privacy Guidelines (link to be developed).
There are a number of implementation activities that need to be undertaken to meet Information Standard 42 requirements. The JAG Information Privacy Guidelines contains information on implementation activities that includes privacy plan development and management, writing a privacy and security statement, notice formats and conducting an audit of personal information. The Information Privacy Guidelines (link to be developed) are located in the Information Privacy (IS42) Toolbox.
The privacy plan should outline the responsibilities and processes in relation to collection, storage, use and disclosure of personal information. The purpose of the agency's privacy plan is to ensure that personal information held by the agency is responsibly and transparently collected and managed in accordance with the Queensland Government IPPs. Details on the content and activities to be addressed with developing the agency plan can be found in the Information Privacy Guidelines (link to be developed).
A privacy contact officer (PCO) should be the first point of contact for privacy issues within the agency. The PCO may also, at the discretion of the agency CEO, be the first point of contact for any privacy complaints made to the agency. Suggested responsibilities for the agency PCO in the development of the agency privacy plan are outlined in the Information Privacy Guidelines (link to be developed).
Where an agency engages a contractor to perform a service on its behalf and for its benefit, the agency must take steps to ensure the contractor observes the agency practices regarding the management of personal information. Agencies should assess on a case-by-case basis how security and privacy issues need to be addressed in contracts and offers, however agencies should consider the inclusion of clauses relating to privacy of personal information when engaging with third parties. Agencies should refer to Information Standards, Information Security (IS18) and ICT Procurement (IS13) for information relating to this issue.
Privacy notices must be given in accordance with the Queensland Government IPP 2. However, web pages present challenges as to how to meet the requirements of this principle. Details of Standard text for web page notices (link to be developed) that relate to the information collected about the Internet user simply accessing and moving about the site can be found in the Information Privacy (IS42) Toolbox.
The Information Privacy Guidelines (link to be developed) contain a model privacy and security statement, which agencies can use as a starting point for privacy and security statements. The model statement should be viewed as the minimum agencies should provide, however agencies should feel free to provide more information if they believe it will be of use, or of interest to the public. Agencies should also refer to Information Standard, Internet (IS26) for further information regarding legal notices.
Any monitoring of employee use of information and communication technology facilities and devices must be in accordance with the relevant department or agency’s Privacy Plan.
Further advise regarding privacy issues in relation to the monitoring of email are currently been investigated and will be updated as information becomes available. Interim advice is located in the Use of Communication and Information Devices (IS38) Toolbox (Toolbox to be developed).
A fundamental part of the Shared Service Initiative is the disclosure of personal information about a participating agency’s employee to the shared service provider. Shared service providers should also ensure all policies and procedures reflect the principles contained in Information Standard 42. Shared service providers should refer to the SSIO Information Classification and Control Better Practice Guide (document is being finalised by SSIO and link to be developed) for further information regarding the treatment of personal information.
Individuals have the right to access and amend their personal information, which has limitations under the Freedom of Information Act 1992. Agencies should at a minimum ensure the relevant process and procedures for an individual to obtain access to and correction of their personal information is included in the agency privacy plan. Further details can be found in the Information Privacy Guidelines (link to be developed).
If a person believes that an agency has not dealt with their personal information in accordance with an IPP they may make a complaint in writing to the agency. As a minimum the nominated complaints resolution officer should ensure the complaints procedures and review process as outlined in the Information Privacy Guidelines (link to be developed) is included in the agency privacy plan.
Last updated 8 Feb 2005
