The Privacy Committee of South Australia (Privacy Committee) was established by Proclamation in the Government Gazette on 6 July 1989 and most recently updated on 11 June 2009. The functions of the Privacy Committee, as described in the Proclamation, are:

• (a)       to advise the Minister as to the need for, or desirability of, legislation or administrative action to protect individual privacy and for that purpose to keep itself informed as to developments in relation to the protection of individual privacy in other jurisdictions
• (b)       to make recommendations to the Government or to any person or body as to the measures that should be taken by the Government or that person or body to improve its protection of individual privacy
• (c)        to make publicly available information as to methods of protecting individual privacy and measures that can be taken to improve existing protection
• (d)       to keep itself informed as to the extent to which the Administrative Scheme of Information Privacy Principles are being implemented
• (g)       to refer written complaints concerning violations of individual privacy received by it (other than complaints from employees of the Crown, or agencies or instrumentalities of the Crown, in relation to their employment) to the appropriate authority
• (h)       such other functions as are determined by the Minister.

The Privacy Committee may, under clause 4 of the Proclamation, ‘exempt a person or body from one or more of the Information Privacy Principles on such conditions as the Committee thinks fit’.

Clause 1(2) of the Proclamation establishes its membership. The Privacy Committee is to consist of six members appointed by the Minister. Of the six members:

• three are nominated by the Minister [the Attorney-General] (one of whom must not be a public sector employee, and one must have expertise in information and records management)
• one is to be nominated by the Attorney-General
• one is to be nominated by the Minister responsible for the administration of the Health Care Act 2008, and
• one is to be nominated by the Commissioner for Public [Sector] Employment.

Members of the Privacy Committee during the 2023-24 reporting year were:

Changes to the Privacy Committee

During 2023-24, the terms of Deslie Billich, Prue Reid and Abbie Eggers expired 30 January 2024. All three members were approved for a further term, with an expiry of 30 January 2028.

Executive support to the Privacy Committee

Executive support to the Privacy Committee is delivered within the resources of State Records of South Australia. This is in line with other State Records activities including research and policy advice, web hosting and responses to enquiries for both agencies and the public.

The Privacy Committee reports to the Hon Kyam Maher MLC as Attorney-General. The Attorney-General is also responsible for other information management regulation including the State Records Act 1997 and the Freedom of Information Act 1991.

South Australia’s Information Privacy Principles Instruction (IPPI) was introduced in July 1989 by means of Cabinet Administrative Instruction 1/89, issued as Premier & Cabinet Circular No. 12 (external site) (PDF) (external site) (PDF) (external site) (PDF) (external site) (PDF). The IPPI includes a set of ten Information Privacy Principles (IPPs) that regulate the way South Australian public sector agencies collect, use, store and disclose personal information.

The Privacy Committee has a function to “refer written complaints concerning violations of individual privacy received by it (other than complaints from employees of the Crown, or agencies or instrumentalities of the Crown, in relation to their employment) to the appropriate authority”.

In 2023-24 the Privacy Committee received three complaints.

Of the three complaints received during 2023-24, two are closed and one (received in June 2024) remains ongoing as at 30 June 2024.

Since 2018, state government agencies have been required to comply with the Personal Information Data Breaches Guideline (external site) (PDF) (external site) (PDF) (external site) (PDF) (external site) (PDF)developed to provide advice on how to deal with unauthorised access to personal information (privacy breaches). One action within the Guideline is to notify the Privacy Committee so that it can:

• keep itself informed as to the extent to which the Information Privacy Principles are being implemented, and
• make recommendations of the measures that should be taken by the government to improve its protection of individual privacy.

The Privacy Committee received 195 notifications during the 2023-24 reporting year.

Since the introduction of the notification scheme the number of breach notifications has increased each year. The increase can be attributed to a strong reporting culture from the health sector who submit the largest number of breaches. Improved awareness to notify the Privacy Committee by other sectors has also contributed to the number of notifications.

While human error still dominates the cause of breaches, a surge in unauthorised system access (mainly employees accessing information inappropriately) has seen malicious, deliberate, or criminal activity increase significantly.

The Privacy Committee reviews each breach it receives and provides agencies with suggestions for improvements to process and practices where necessary.

Affected parties by cause of breach

The Privacy Committee strongly encourages agencies to advise affected parties of a breach unless there is a significant reason not to do so. This ensures affected parties are aware of any possible implications and builds trust through transparency and accountability by the agency.

State Records continues to support the Privacy Committee by reviewing the notifications process to ensure it is delivering the required benefits. A review of the governments Personal Information Data Breach Guideline with a revised draft being released for agency consultation during 2023-24. The review is intended to:

• clarify what characterises a breach and how to respond
• facilitate the assessment of risk to affected parties, and
• ensure the guideline meets the Privacy Committees expectations for breach notifications.

State Records also continues to educate agencies on the importance of only collecting the personal information needed to perform a service and to avoid retaining it longer than legally required, thereby minimising the risk of harm should a breach occur.

Principal officers of state government agencies have the responsibility to ensure the IPPI is implemented, maintained, and observed for, and in respect of, all personal information for which their agency is responsible.

Advice is provided to state government agencies to help them comply with the IPPI and ensure privacy is considered in the development of new projects and initiatives.  Policy and other guidance materials are issued to support agencies.

State Records also developed and published a new training course, “Handling Personal Information”. This course is aimed at improving privacy awareness for government staff who handle personal information, by helping them:

• identify personal information, recognise it’s value and the consequence of inappropriate disclosure
• identify, avoid and respond to an information privacy breach and complaint, and
• identify legislation and policies that apply to their work.

The Privacy Committee is represented by the Presiding Member on Privacy Authorities Australia (PAA). State Records staff participate in three PAA working groups on policy, complaints and enforcement, and communications.

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and third party providers.

It is an exemption from compliance with principles 2 and 8, allowing SA Health DLU to collect and use personal information for a purpose that was not the purpose of the collection of that information.

The personal information to be collected and used from NT Department of the Attorney General & Justice, and is limited to:

The personal information to be collected and used from NT Police, Fire and Emergency Services, and is limited to:

The personal information to be collected and used from NT Department of Health, and is limited to:

The personal information to be collected and used from Territory Families, Housing and Communities, and is limited to:

The personal information to be collected and used from NT Department of Housing, and is limited to:

The personal information to be collected and used from NT Department of Education, and is limited to:

The personal information to be collected and used from Menzies School of Health Research, and is limited to:

The personal information to be collected and used from Central Australian Aboriginal Congress, and is limited to:

The personal information to be collected and used from Katherine West Health Board, Miwatj Aboriginal Health Corporation, Ngaanyatjarra Health Service (WA) and Danila Dilba Health Service, and is limited to:

The personal information to be collected and used from Australia and New Zealand Dialysis and Transplant Registry, and is limited to:

The personal information to be collected and used from Commonwealth of Australia acting through the Department for Education, and is limited to:

The personal information to be collected and used from Australian Coordinating Registry, QLD BDM, and is limited to:

The personal information used from these datasets will enable existing operations to continue once SA NT DataLink has transitioned to an agency that falls within the full scope of application of the IPPI.

All other Principles continue to apply.

SA NT DataLink and these third parties remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This exemption is granted from 15 December 2023 to 31 December 2024.

Extension approved 25 June 2024, back-dated to 1 June 2024.

This exemption applies to both the Department for Energy and Mining (DEM) and the Department for Infrastructure and Transport (DIT), concerning personal information contained in drawn representations of the underground on-site sanitary plumbing work within a specific property (also described as historical as-constructed sanitary drainage drawings) held by the Office of the Technical Regulator within DEM.

The personal information consists of the name of persons who currently or previously owned a property, the address of that property, the name and contact details of the plumber who undertook the plumbing work to install the sanitary drains on the property and the location of the sanitary drains on the property.

This is an exemption from Principles 6 and 9 in relation to the drawings. This is also an exemption from Principle 10 for the purpose of disclosing the drawings:

• between DEM and DIT for the purpose of creating online access to the drawings by the public, and
• to the public.

All other Principles continue to apply.

This exemption is granted on the condition that:

• where possible, the name of the property owner and name and contact details of the plumber are deleted from the sanitary drain drawings prior to release to DIT or the public, and
• the process is maintained that allows a person to apply to have the sanitary drain drawing of a property that he or she owns, or lives in, suppressed from access by the public.

DEM and DIT remain responsible for the secure transfer of personal information in line with the IPPs.

This extension is granted from 1 June 2024 to 31 December 2024.

Exemption extensions A to H were approved 2 December 2022, granted from 1 January 2023 to 31 December 2023. All were approved on the condition that:

• the information is only to be used for the creation of Master Linkage Keys in the further development of the Master Linkage File as part of the SA NT Data Linkage System. The exemption is provided on the condition that the personal information is only to be accessed by officers of SA Health within the Data Linkage Unit.
• the exemption is conditional on SA NT DataLink having a current Joint Venture Consortium Agreement in place.

Exemption A

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and Consumer and Business Services (CBS) in the Attorney General’s Department.  It is an exemption from compliance with:

• Principle 10, allowing CBS to disclose personal information to the SA NT DataLink, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely in the establishment of the Master Linkage File as part of the Data Linkage System.

The personal information to be used is from South Australian births and deaths datasets, and is limited to:

Death Dataset: Unique record identifier (registration number); names (all names where available including surnames, surnames at birth, given names and given names at birth); date of birth; date of death; age at death; place of birth; place of death; sex; Aboriginality and/or Torres Strait Islander indicator; full residential address, including geocodes, where available; correction indicator (if a record previously reported is being re-reported due to a correction in the register); father/co-parent (type, surnames, surnames at birth, given names, occupation); and mother (type, surnames, surnames at birth, given names, occupation). The personal information to be used from the deaths dataset is limited to death records created after 1/1/1990.

Birth Dataset: Unique record identifier (registration number); Names (all names where available including surnames, surnames at birth, given names and given names at birth); Full residential address, including geocodes where available; Sex; Date of birth; Place of birth; Mother’s Aboriginal indicator; Mother’s Torres Strait Islander indicator; Father’s/Co-parent’s Aboriginal indicator; Father’s/Co-parent’s Torres Strait Islander indicator; Mother’s date of birth; Father’s/Co-parent’s date of birth; Birth weight (in grams); Plurality – order (only available for multiple births e.g. twins); Plurality – total (only available for multiple births e.g. twins); Mother’s occupation title; Father’s/Co-parent’s occupation title; correction indicator (if a record previously reported is being re-reported due to a correction in the register); marriage type; date of marriage; place of marriage; and previous children of this relationship (given names, sex, date of birth, living indicator).

The personal information to be used from the births dataset is limited to birth records created after 1/1/1944. The disclosure will include any of the above information provided for other family members that is included in these records.

All other Principles continue to apply.

SA Health and CBS remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.

Exemption B

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and the Department for Child Protection (DCP). It is an exemption from compliance with:

• Principle 10, permitting DCP to disclose personal information to the Data Linkage Unit within SA NT DataLink, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely to support the linkage with DCP data on Alternative Care, Care and Protection Orders, and Child Protection.

The personal information is limited to: Record identifier; Names – all names including nicknames, aliases and aka; Date of birth; Sex; Aboriginality, Torres Strait Islander indicator; Cultural group; Full address including geocodes where available; Client File Number (85 File Number for Client Information System (CIS) records within the Justice Information System (JIS) – a flag indicating that this child was under the Guardianship of the Minister); and any of the above information provided for other family members and included in these records, i.e. full name and date of birth of the mother and father of the child or young person.

All other Principles continue to apply.

SA Health and DCP remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.

Exemption C

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and the Department for Human Services (DHS) Youth Justice branch.  It is an exemption from compliance with:

• Principle 10, permitting DHS Youth Justice to disclose personal information to the Data Linkage Unit within SA NT DataLink, and
• Principle 8, allowing the SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely the creation of master linkage keys as part of the SA NT Data Linkage System by the Data Linkage Unit.

The personal information is limited to: Unique record identifier (i.e. episode reference number); Unique person identifier where available; Given name(s) (including all ‘akas’, aliases and nicknames); Date of birth; Sex; Aboriginality and/or Torres Strait Islander indicator; Country of birth; Full address including geocodes where available; and the full name and date of birth of the mother and father of the child or young person where available.

All other Principles continue to apply.

SA Health and DHS remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.

Exemption D

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and the Department for Education (DE).  It is an exemption from compliance with:

• Principle 10, permitting DE to disclose personal information to the Data Linkage Unit within SA NT DataLink, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information.

The personal information to be used is from the DE Public Schools Enrolment dataset, including preschools and is limited to: Record Identifier; Personal Identifier; Names; Date of Birth; Sex; Aboriginality, Torres Strait Islander Indicator; Country of Birth; Full address including Geocodes if available; Parent / Guardian Identifier; Date Enrolled; Date Left; Destination School; Census year; Census term; 85 File Number; and any of the above information provided for other family members and included in these records including family code.

All other Principles continue to apply.

SA Health DLU and DE remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.

Exemption E

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and the Department for Education (DE).  It is an exemption from compliance with:

• Principle 10, permitting DE to disclose personal information to the Data Linkage Unit within SA NT DataLink for the purpose of enabling a more complete understanding of the early childhood sector and pathways in child health and development when developing policy, research and strategic plans, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely for SA NT DataLink for the purposes of data linkage.

The personal information to be used is from DE preschool enrolment census data for non-government and private schools. The personal information to be used was initially for the period between 2012 and 2017, representing approximately 110,000 students, with annual updates being sought, with an expectation that each update is to include approximately 18,500 new students.

The personal information includes linkage variables of: Record identifier; Personal identifier; Names – all names including nicknames, aliases and aka; Date of birth; Sex; Aboriginality, Torres Strait Islander Indicator; Country of birth; Full address including geocodes if available; Site name; Site ID; and Census year.

All other Principles continue to apply.

SA Health DLU and DE remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.

Exemption F

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and the Electoral Commission of South Australia (ECSA).  It is an exemption from compliance with:

• Principle 10, permitting ECSA to disclose personal information to the Data Linkage Unit within SA NT DataLink, and
• Principles 2 and 8, allowing SA Health DLU to collect and use personal information for a purpose that was not the purpose of the collection of that information.

The personal information to be used is from the ECSA South Australian Electoral Roll dataset and is limited to: Elector Number; Title; Family Name; Given Names; Date of Birth; Country of Birth (3 character code); Sex; Address Line 1, 2 and 3 (including State and postcode); and any of the above information provided for other family members and included in these records.

Excluded from the dataset is information relating to ‘silent electors’ and those individuals who have sought to be ‘provisionally enrolled’.

All other Principles continue to apply.

SA Health DLU and ECSA remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.

Exemption G

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and the South Australian Housing Authority (SAHA).  It is an exemption from compliance with:

• Principle 10, permitting SAHA to disclose personal information from the Housing SA dataset and the Homelessness to Home (H2H) dataset to the Data Linkage Unit within SA NT DataLink, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely for the creation of master linkage keys as part of the establishment of the Data Linkage System.

The personal information from the Housing SA dataset is limited to: Unique Person Identifier; System Date; Names, all names including nicknames, aliases and aka; Date of Birth; Sex; Title; Aboriginality and/or Torres Strait Islander identifier; Country of Birth; Full address including geocodes if available; and any of the above information provided for other family members and included in these records.

The personal information from the Homelessness to Home (H2H) dataset is limited to: H2H customer number; Housing SA customer number; Given names; Surname; Date of birth; Sex; Aboriginality and/or Torres Strait Islander indicator; Country of birth; Full address details, including past addresses where available; System date; and any of the above information provided for other family members and included in these records.

All other Principles continue to apply.

SA Health DLU and SAHA remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.

Exemption H

This exemption applies to the SA NT DataLink Data Linkage Unit within SA Health (SA Health DLU) and the Department for Correctional Services (DCS).  It is an exemption from compliance with:

• Principle 10, permitting DCS to disclose personal information to the Data Linkage Unit within SA NT DataLink, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely to enable researchers and policy analysist to develop and disseminate a more comprehensive understanding of health, education and justice system pathways and outcomes.

The personal information to be disclosed by DCS relates to individuals who have been sentenced to a period of supervision, either in a custodial setting or in the community and is limited to: DCS IDs; JIS PIN; Entry and exit dates; Surnames (including previous names and maiden names); Given Name(s) (all including “aka’s”, aliases and nicknames); Date of Birth (DD/MM/YYYY); Sex; Residential address and postcodes (including previous addresses); and Aboriginal and Torres Strait Islander indicator.

All other Principles continue to apply.

SA Health and DCS remain responsible for the secure transfer and storage of personal information in line with the IPPs.

This extension is granted from 1 January 2023 to 31 December 2023.