Technological developments mean agencies can collect, store and share vast quantities of data. But with this comes responsibility, writes NSW Privacy Commissioner Samantha Gavel.

We can use data to develop innovative projects, such as apps to tell us when our train is approaching, or to inform policy proposals, develop and evaluate government programs.

With this ability to collect and use data, comes ever increasing privacy challenges. Some data will contain personal information, which is subject to legislative requirements under State and Commonwealth privacy regimes. In NSW agencies must comply with these requirements and must also ensure that the public retains confidence in their role as custodians of citizens’ personal information.

Good privacy practice is critical to any work which involves the use of personal information. It also enables agencies to have confidence in their management and use of personal information and to promote citizen trust in that management and use of personal information.

The introduction of new technology raises important privacy questions such as how can we ensure that privacy rights are protected, while at the same time embracing the benefits of digital innovation. With robust privacy settings in place, you can do both. Privacy is an enabler of this work, rather than a barrier.

Privacy law in Australia and in my jurisdiction of NSW is generally concerned with how organisations collect, use, disclose and store personal information. Technology enables us to do these things faster and on a far greater scale than has ever been possible before. Advances in technology bring new ways to use data – and new privacy challenges.

Even rubbish bins are getting smart

For example, the introduction of smart rubbish bins by local councils, where a microchip is embedded in each smart bin. This type of technology enables councils to check that the bins have been emptied and send a truck to empty any bins that may have been inadvertently missed. The technology assists councils to manage any bin replacements.

As with many technological developments, the introduction of smart bins is likely to have positive benefits for the community, including cost and environmental benefits. Similar to other “smart” technology, however, smart bins may raise privacy questions about the collection of information and whether it can be considered to be “personal” information and therefore covered under privacy law.

So how do we respond to the privacy challenges arising from technological advances including   developments in Artificial Intelligence, machine learning and smart technology, such as smart bins?

Privacy by design

First and foremost is the need to take a privacy-by-design approach to all projects that may involve the collection and use of personal information. Privacy by design means ensuring that privacy risks are considered and mitigations built in, during the development, implementation and delivery phases of a project. It is much more difficult and in some cases impossible to bolt privacy protections on during the latter stages of a project.

Central to a privacy-by-design approach is for agencies to undertake a Privacy Impact Assessment (PIA) for projects that may have privacy implications. Taking a privacy-by-design approach and conducting a PIA enables agencies to identify and mitigate privacy risks and thereby promote community trust in relation to projects that may have privacy implications.

Building privacy culture

Overall, agencies should look to build a privacy respectful culture throughout the organisation which is led from the top down. Agencies should also ensure they have sufficient privacy capability to enable them to manage their privacy requirements, whether they are carrying out their core functions or are engaged in developing innovative digital projects.

Taking these measures will enable agencies to embrace digital innovation, while minimising privacy risks.

With the increasing pace of technological change, privacy considerations will continue to be at the forefront of much of the work being done by government agencies to deliver digital services to citizens, share and analyse data in order to improve outcomes, inform policy development and evaluate government programs.

Good privacy practice promotes community trust in government projects and service delivery, and enables agencies to manage new technology and service delivery for the benefit of citizens – whether it is digital service delivery or new smart technology such as smart bins.

Samantha Gavel spoke about data and privacy at the Australian Government Data Summit in on March 19-21.

Comment below to have your say on this story.

If you have a news story or tip-off, get in touch at editorial@governmentnews.com.au.  

Sign up to the Government News newsletter