Annual Report 2018-19 Authorised by the OFFICE of the VICTORIAN INFORMATION COMMISSIONER
Total Page:16
File Type:pdf, Size:1020Kb
Annual Report 2018-19 Authorised by the OFFICE OF THE VICTORIAN INFORMATION COMMISSIONER PO Box 24274 Melbourne, Victoria 3001 Australia Tel: 1300 006 842 Email: [email protected] Website: ovic.vic.gov.au © State of Victoria (Office of the Victorian Information Commissioner) You are free to re-use this work under a Creative Commons Attribution 4.0 licence, provided you credit the State of Victoria (Office of the Victorian Information Commissioner) as author, indicate if changes were made and comply with the other licence terms. The licence does not apply to any branding, including Government logos. Copyright queries may be directed to [email protected] Published October 2019 Designed and typeset by Dean Bardell-Williams Printed by Finsbury Green Annual Report 2018-19 LETTER OF TRANSMITTAL To: The Honourable Gavin Jennings MLC, Special Minister of State and: The Honourable President of the Legislative Council and: The Honourable Speaker of the Legislative Assembly I am pleased to transmit, in accordance with section 64(5) of the Freedom of Information Act 1982, the annual report of the Office of the Victorian Information Commissioner for the financial year ending 30 June 2019, for presentation to Parliament. This report has been prepared in accordance with section 64 of the Freedom of Information Act 1982 and section 116 of the Privacy and Data Protection Act 2014. Sven Bluemmel Information Commissioner CONTENTS Commissioner's foreword 1 Year at a glance 3 Guiding statements 6 1 3 OFFICE OF THE DATA PROTECTION 37 VICTORIAN INFORMATION At a glance 38 COMMISSIONER 5 The Victorian Protective Data Security Framework 40 Who we are 7 Monitoring and assurance 41 What we do 8 Review of the VPDSF and VPDSS 43 Our staff 9 Engagement 44 Organisational chart 10 Law enforcement data security 45 Finances 11 Crime Statistics Agency 45 Governance 15 Victoria Police 45 Complaints about OVIC 17 Regulatory action and investigations 19 Enhancing public sector and community engagement 21 2 4 PRIVACY 23 FREEDOM OF INFORMATION 49 At a glance 24 At a glance 50 Enquiries 25 Reviews 52 Complaints 26 Review decisions 57 Data breach notifications 30 Complaints 67 Policy initiatives 31 Key projects 78 Agency guidance 33 Engagement 33 Annual Report 2018-19 5 REPORT ON THE OPERATION OF THE FOI ACT 81 At a glance 82 Government bodies covered by FOI 83 The data 83 Accuracy of Data 83 The past five years 83 Requests and appeals 83 Sources of FOI requests 85 Timeliness of decision making 86 FOI decisions 87 Five years of FOI decisions by sector 88 Exemptions 89 Application fees and access charges 90 Top 30 agencies 91 Administration of the FOI Act 92 6 APPENDICES 95 OVIC Disclosure Index 97 Appendices to Part 5 99 Explanation of appendices 99 Agencies and Ministers that received FOI requests 100 Agencies that did not receive FOI requests 114 Outcome of all appeals received or decided by VCAT 119 Exemptions cited 121 Names and titles of decision makers 138 Fees and charges 160 COMMISSIONER'S FOREWORD Established on 1 September 2017, the Office of the Victorian Information Commissioner (OVIC) is the primary, independent regulator of information rights with combined oversight of freedom of information (FOI), privacy and data protection in Victoria. OUR RESPONSIBILITIES AS CUSTODIANS OF INFORMATION Members of the Victorian community interact with government every day. These interactions can range from the mundane to the profound; and in almost every interaction, information is created or collected. Government agencies must think of themselves not as owners, but as custodians of information. As custodians, we have a responsibility to ensure that the right information is available to the right people, at the right time and through the right channels. Upholding these responsibilities is essential to a fair, inclusive and democratic society. A central part of OVIC’s role as a regulator is to guide Victorian government departments and agencies to do the right thing by handling information responsibly, holding it securely and providing fair access to it where appropriate. OUR SECOND YEAR OF OVIC Over the past year we have seen an enormous amount of change. Government is increasingly turning to emerging technologies to carry out functions, inform policy and deliver services. With the adoption of new technologies comes an emergence of new challenges. This year OVIC started to guide the Victorian public sector through increasingly complex challenges across FOI, privacy and data protection. Public awareness in privacy grew, along with significant developments to the information privacy landscape. OVIC received an increase in data breach notifications and developed several guidance materials including a new Privacy Impact Assessment template. Requests for access to government information also grew and OVIC dealt with a record caseload of FOI reviews and complaints this year. We streamlined and integrated our case management processes to deal with the increasing caseload. As the threat landscape changed, OVIC continued to educate the Victorian public sector on data protection. The first reporting cycle for agencies under the Victorian Protective Data Security Framework was successfully completed, with the aim of facilitating ongoing improvement of data security practices across government. 1 Annual Report 2018-19 OUR REGULATORY POWERS By addressing new and complex challenges this year, OVIC had the opportunity to define, solidify and mature its role as a regulator. We published our Regulatory Action Policy, outlining how OVIC will use its statutory powers to investigate serious or concerning practices under both the Freedom of Information Act 1982 (Vic) (FOI Act) and the Privacy and Data Protection Act (PDP Act). By clearly defining our regulatory powers, we aim to engage effectively with both the public sector and the community. OUR FOCUS - EMBEDDING CULTURAL CHANGE This year we continued our focus on providing education, guidance and constructive feedback. We provided free FOI and privacy training to Victorian public sector staff and developed a stakeholder engagement strategy to guide our activities. By engaging effectively with stakeholders across the Victorian public sector, we aim to promote and embed a culture of fair public access to information while ensuring its proper use and protection. OUR FUTURE - LOOKING AHEAD How government and regulators respond to technological developments will have a large and lasting impact on our society. As the Victorian public sector’s uptake of emerging technologies increases, we must consider the challenges these technologies pose for privacy, data protection and freedom of information. It is critical to encourage technological innovation, but we must also design our systems in a way that considers the importance of upholding the publics’ right to information privacy, protection and access where possible. By doing so, we will build trust in government handling of information and build a stronger democratic foundation for our society. 2 YEAR AT A GLANCE 2018-19 JULY AUGUST SEPTEMBER Information Privacy Awareness Presentations on FOI and OVIC opens new co-tenanted 2018 training is piloted. Privacy are given to the office. Victorian Ports Authority. 2017-18 Annual Report is tabled OVIC hosts the Privacy in Parliament. Authorities Australia meeting. Privacy and Data Protection OVIC hosts a public forum Deputy Commissioner, on Privacy with the Health Rachel Dixon, presents at the Complaints Commissioner. Information Systems Audit and Control Association (ISACA) Protective Data Security Plans Oceania CACS conference on 3 are submitted, marking the end September. of the first reporting period for agencies. OVIC celebrates Right to Know Day by hosting a public forum The first Information Access on FOI with Monash University Series seminar is held on on 24 September. sections 25A(1) and (5) of the FOI Act. JANUARY FEBRUARY MARCH 3 year strategic plan OVIC Acting Public Access Deputy Public consultation for the 2019 launches and major stakeholder Commissioner, Joanne Professional Standards engagement project kicks off. Kummrow presents at the commences. Association of Information OVIC participates in discussions Access Commissioners (AIAC) about digital accessibility with meeting in New Zealand. the Office of the Australian Information Access Series Information Commissioner seminar on Secrecy and (OAIC). Confidentiality in a time of Information Access Series openness is held on 27 February. seminar on working with OVIC- consultation and notification under the FOI Act is held on 28 March. OVIC holds a public forum on online safety and privacy. 3 Annual Report 2018-19 OCTOBER NOVEMBER DECEMBER Privacy and Data Protection Information Commissioner OVIC celebrates International Deputy Commissioner presents presents at the International Human Rights Day. 2018 at the Australian Information Association of Privacy Privacy and Data Protection Security Association’s (AISA) Professionals (IAPP) ANZ Deputy Commissioner attends Australian Cyber Security summit on 1 November. the Asia Pacific Privacy Conference on 10 October. OVIC’s Public Access team host Authorities (APPA) forum in Information Commissioner a meeting with the Department Wellington. Sven Bluemmel discusses of Health and Human Services. Data, Privacy and General Data Projection Regulation on ABC Radio National’s Big Ideas program. OVIC hosts a Victorian Privacy Network meeting. APRIL MAY JUNE OVIC hosts a Victorian Privacy OVIC celebrates Privacy Proposed FOI Professional