Alec Christie, Partner, DLA. Piper Australia 26 October 2014

Transcription

1

2 hat franchisors need to know bout privacy, the cl oud and big ata Alec Christie, Partner, DLA Piper Australia 26 October 2014

3 hat we will cover today! Privacy: What has changed? (What hasn't?) The "new" Privacy Act Overview of the most relevant of the new APPs Key privacy risks of the Cloud Big Data, big privacy concerns! Conclusions (practical tips) Questions?

4 rivacy: What has changed? A more comprehensive (and organic) national privacy regime that extends to all federal agencies and the private sector and the handling of all personal information held by them More significant on-going compliance obligations, enhanced role and powers of Privacy Commissioner Harsher consequences for interferences with privacy, but potentially more guidance and "education" to assist with compliance

5 he new Privacy Act e Act regulates: the handling of "personal information" (including "sensitive information", Tax File Numbers and credit information) by public sector agencies and private sector organisations, by requiring compliance with a set of privacy principles the breach of which h principles constitutes an interference with privacy

6 hat information is covered? Personal information - infor rmation or opinion about an individual whose identity is apparent or can reasonably be ascer rtained from the information or opinion Sensitive information - information or an opinion about a person's characteristics (e.g. racial origin, political opinions, religious or philosophical p beliefs, sexual preference or criminal record) or health

7 verview of the new APPs Open and transparent management Anonymity and pseudonymity 8. Cross-border disclosure 9. Adoption, use or disclosure of government related identifiers Collection of solicited personal information Dealing with unsolicited personal information 10.Quality of personal information 11.Security of personal information Notification of collection 12.Accesss to personal information Use or disclosure 13.Correction of personal Direct marketing informa ation

8 anagement Obligation to actively "maintain" i " a privacy policy Specific information to be include ed in privacy policies Obligation to implement internal practices, procedures res and systems stems to ensure compliance, including: training complaints procedures identif fi fying risks ik compliance issues

9 PP 3 Collection of solicited ersonal informationn Personal information can only be collected if reasonably necessary for a business activity/function Sensitive information can only be collected with consent and if reasonably necessary for a business activity/function Collection must be by lawful and fair means Collection must be from the indiv vidual, unless unreasonable or impractical

10 tters to be notified at or before the time of collection: identity and contact t details of collectin ng entity purposes for collection if collected from a third party, the circumstances of that collection main consequences (if any) if all or so ome of the information is not provided the entities/persons or types of entities/persons to which the kind of information collected is usually disclosed that the privacy policy contains information about how to get access or seek correction and about how to mak ke a complaint about a breach of the APPs and how the entity will deal with such complaint whether the entity is likely to disclose the personal information to overseas recipients (and, if so, the specific countries in which the recipients are located) if collection is required pursuant to an order Australian law or court/tribunal

11 PP 6 Use and disclosure Use for primary purpose(s) of collection only Limits on use of sensitive information Unless consent obtained or other exceptions apply

12 PP 8 Cross border disclosure Cross border data flows permitted as long as "reasonable steps" are taken to ensure recipient does not breach the APPs (unl ess limited exceptions apply) Sender has ongoing accountability/liability (unless the limited exceptions apply) A list of foreign jurisdictions tha at have comparable privacy laws expected to be published by OAIC

13 eed to take "reasonable steps" to rotect personal informatio on from isuse, loss and unauthorised access, se and ddisclosure and dinte erference estroy or de-identify ersonal information hen no longer needed for any authorised purpose AIC guidance issued

14 hat is Cloud computing? From delivering basic office applications to individuals or small businesses at one end of the spectrum to major bespoke combined service offerings to large corporates & Government at the other All models involve information technology services which are: delivered via the Internet de-centralised IT infrastructure truly elastic/scalable on-demand

15 There is a perception that the Cloud is inherently less secure th han traditional IT models of data stored on hardware located at the premises or a specific data centre e of the customer

16 ey privacy risks of the Cloud (2) Loss of physical control over data Data is often stored in the most cost effective location(s), which may: be offshore; and not have privacy protections comparable to those of Australia Compliance with the APPs in relation to personal information Protection of company da ata (and business sensitive information)

17 ey privacy solutions for the loud nsure: quality and capacity of upstream a nd downstream parties you know and consider where the data is stored all required privacy and security arrangements are reflected in the agreement(s) access and audit rights to verify compliance that all individuals are informed of/ /provide their consent to relevant disclosure es, offshore transfers and the Cloud

18 ig Data, big privacy concerns! What is Big Data? What is it used for? What are the privacy issues or gaps? What are the risks?

19 ey privacy solutions for Big ata Audit existing databases/uses and re-identification Focus on transparency/a clear and concise privacy policy Continuous and flexible consent regimes/de-couple Big Data consents from 'essential' uses of information Ensure security measures in place and training

20 onclusions (practical tips)

21 uestions?

22 ow to contact Alec Alec Christie DLA Piper Australia No.1 Martin Place SYDNEY NSW 2000 Tel: alec.christie@dlapiper.com