Peter A Clarke

The Office of the Victorian Information Commissioner (OVIC) has released its 2nd annual report.  The transition from separate privacy commissioner and Freedom of Information Commissioner offices to a combined office seems to be working.  It was inevitable after a similar approach has been taken at a Federal level and in Queensland and New South Wales.

The remit of OVIC is limited to public service agencies.  Enforcement action is limited with compliance notices being the most serious action that can be taken.  The Privacy and Data Protection Act makes the OVIC a gatekeeper in any action taken under the Act in VCAT.  That has been problematical.  As with the Federal Information Commissioner, much is made of the conciliations and finalising of complaints but little is published about the nature of the breaches and what remedial action is taken beyond a few case studies in the Annual Report.

The Information Commissioner, Seven Bluemmel, has proved to be a very active participant in the various privacy seminars throughout the year and has hosted seminars on a fairly regular basis.  Generally they are of quite good standard.  The Privacy and Data Protection Commissioner, Rachel Dixon, is also a regular presence at functions and has no doubt been an important part of the list of publications throughout the year.  She is well read and thoughtful but has an annoying habit of being so keen about predication and where technology is going as to give the impression that it is almost a wasted effort to try to enforce privacy.  Whether that is done for effect or not is not clear.  It tends to be wrong and definitely annoys more than a few privacy practitioners.  Given the work privacy regulators are doing overseas this Henny Penny analysis tends to be superficial and counterproductive.

Regarding privacy :

• OVIC “..finalised 75% of complaints without the need to refer the complaint to VCAT, compared to 47% last year 33% the year before.” [24]
• OVIC received 86 complaints; a 59% increase compared to last year, where 54 complaints were received;
• OVIC processed 76 complaints, compared to 36 last year;
• the average time to finalise complaints was 185 days, compared to 189 days last y e a r.

Of the matters referred to VCAT

• OVIC declined to entertain complaint in 1 case (1% of cases)
• OVIC decided conciliation was inappropriate in 6 cases (8% of cases)
• Conciliation failed in 12 cases (16% of cases)

Of the matters not referred to VCAT:

• 12 were formally conciliated (17%)
• 30 were withdrawn by complainant (39%)
• OVIC declined to entertain complainant in 2 cases (11%)
• OVIC decided conciliation was inappropriate in 2 cases (3%)
• Conciliation failed in 11 cases (14%)

Regarding Data Breach Notifications, which are not covered by the Federal Data Breach Notification laws OVIC stated that it had received 83 data breach notificatoins from Victorian Public Sector organisations, a 28% increase compared to last year [30].  That is a 28% on last year, where there were 65 notifications.  There has been a noticeable and statistically significant increase in data breach notifications, from 13 in 2014 – 15, 27 in 2015-16, 35 in 2016-17 and 65 in 2017 – 18.

The Report has a chapter on Data Protection which is in the main a discussion of processes in publicservantspeak.  What is interesting is the contrast between the quite anodyne discussion about Victoria Police and the various structures in place, such as the Commissioner for Law Enforcement Data Security, and the Police Security Incident Register, with OVIC receiving weekly reports, and a nifty table setting out the implementation of recommendations by the Victoria Police.   All rather positive.  Very much public service blancmange .  The problem is that the somewhat rosey picture presented is in stark contrast to  IBACs report of poor data practices by the Victoria Police titled Unauthorised access and disclosure of information held by Victoria Police.  IBAC does not have nearly as an optimistic outlook on what is happening on the ground as OVIC’s focus on the processes set out on paper.