Decision on Ipswich City Council’s application for privacy principles waiver
On 11 March 2021, the Office of the Information Commissioner (OIC) decided to refuse an application by the Ipswich City Council (ICC) for a waiver from compliance with the privacy principles, under section 157 the Information Privacy Act 2009 (IP Act).
ICC made the application to enable council to publish historical personal information contained in financial and expenditure data (from 2010-2020) on its Transparency and Integrity Hub, which went live on 1 July 2020. A Privacy Impact Assessment had found that ICC had not yet set clear expectations and made explicit the specific personal information it intended to publish to enable the proactive disclosure approach envisaged by ICC.
Under the IP Act, a waiver may be granted by OIC if it is satisfied that the public interest in an agency’s compliance with the privacy principles is outweighed by the public interest in waiving or modifying council’s compliance with the privacy principles.
OIC supports strategies and initiatives, such as open data, that maximise disclosure of government-held information to the community and provide appropriate protections for the community’s personal information. Release of open datasets under open government data initiatives, such as ICC’s hub, is one mechanism for increasing transparency and accountability of government.
Striking the right balance between greater data availability and use, as well as the protection of an individual’s privacy and personal data, is critical for achieving greater openness and transparency and enhanced levels of trust in government.
Waivers of compliance with the privacy principles under section 157 of the IP Act are granted in specific circumstances only where the public interest test is met, and not for expediency or to overcome a perceived hindrance caused by the privacy principles.
Detailed reasons for OIC’s decision not to grant ICC’s application for a waiver from compliance with the privacy principles are set out in the decision.
In summary, OIC found that public interest considerations related to transparency and accountability, effective oversight of public funds and informing the community of ICC’s operations has been substantially discharged. This was due to the volume of information already in the public domain regarding ICC’s past behaviour including misuse of council funds and the level of independent oversight and scrutiny by a range of external bodies, including the Courts.
On balance, these public interest considerations did not outweigh the public interest in ICC complying with the privacy principles.
The decision also demonstrates the importance of undertaking a Privacy Impact Assessment to identify the impacts a project might have on individuals as well as controls to mitigate identified privacy risks.
Since the introduction of the IP Act in 2009, few waivers for specific issues have been granted, the most recent in 2013. A waiver has not been previously given to publish personal information in a public dataset under the IP Act.