The Privacy Committee of South Australia (Privacy Committee) was established by Proclamation in the Government Gazette on 6 July 1989 and most recently updated on 11 June 2009.

The functions of the Privacy Committee, as described in the Proclamation, are:

• (a)  to advise the Minister as to the need for, or desirability of, legislation or administrative action to protect individual privacy and for that purpose to keep itself informed as to developments in relation to the protection of individual privacy in other jurisdictions
• (b)  to make recommendations to the Government or to any person or body as to the measures that should be taken by the Government or that person or body to improve its protection of individual privacy
• (c)  to make publicly available information as to methods of protecting individual privacy and measures that can be taken to improve existing protection
• (d)  to keep itself informed as to the extent to which the Administrative Scheme of Information Privacy Principles are being implemented
• (g)  to refer written complaints concerning violations of individual privacy received by it (other than complaints from employees of the Crown, or agencies or instrumentalities of the Crown, in relation to their employment) to the appropriate authority
• (h)  such other functions as are determined by the Minister.

The Committee may, under clause 4 of the Proclamation, ‘exempt a person or body from one or more of the Information Privacy Principles on such conditions as the Committee thinks fit’.

Clause 1(2) of the Proclamation establishes its membership. The Privacy Committee is to consist of six members appointed by the Minister. Of the six members:

• three are nominated by the Minister [the Attorney-General] (one of whom must not be a public sector employee, and one must have expertise in information and records management)
• one is to be nominated by the Attorney-General
• one is to be nominated by the Minister responsible for the administration of the Health Care Act 2008, and
• one is to be nominated by the Commissioner for Public [Sector] Employment.

Members of the Privacy Committee during the 2023-24 reporting year were:

Changes to the Privacy Committee

No changes to the Committee occurred during 2024-25.

Executive support to the Privacy Committee

Executive support to the Committee is delivered within the resources of State Records of South Australia.

The Committee reports to the Hon Kyam Maher MLC as Attorney-General.  The Attorney-General is also responsible for other information management regulation including the State Records Act 1997 and the Freedom of Information Act 1991.

South Australia’s Information Privacy Principles Instruction (IPPI) was introduced in July 1989 by means of Cabinet Administrative Instruction 1/89, issued as Premier & Cabinet Circular No. 12 (external site) (PDF).  The IPPI includes a set of ten Information Privacy Principles (IPPs) that regulate the way South Australian public sector agencies collect, use, store and disclose personal information.

The Privacy Committee has a function to “refer written complaints concerning violations of individual privacy received by it (other than complaints from employees of the Crown, or agencies or instrumentalities of the Crown, in relation to their employment) to the appropriate authority”.

In 2024-25 the Privacy Committee received six complaints.

Of the six complaints received during 2024-25, three are closed and three remain ongoing as at 30 June 2025.

Since 2018, state government agencies have been required to comply with the Personal Information Data Breaches Guideline (external site) (PDF) (external site) (PDF) (external site) (PDF) (external site) (PDF) (external site) (PDF)developed to provide advice on how to deal with unauthorised access to personal information (privacy breaches). One action within the Guideline is to notify the Committee so that it can:

• keep itself informed as to the extent to which the Information Privacy Principles are being implemented, and
• make recommendations of the measures that should be taken by the government to improve its protection of individual privacy.

The Committee received 225 notifications during the 2024-25 reporting year.

Since the introduction of the notification scheme the number of breach notifications has increased each year.  The increase can be attributed to a strong reporting culture from the health sector who submit the largest number of breaches.

Improved awareness to notify the Committee by other sectors has also contributed to the number of notifications.

Human error continues to dominate the cause of breaches, with emails sent incorrectly and documents physically provided to the wrong person (excluding by post) accounting for over half of all breaches.

The Committee reviews each breach it receives and provides agencies with suggestions for improvements to process and practices where necessary.

Affected parties by cause of breach

The Committee strongly encourages agencies to advise affected parties of a breach unless there is a significant reason not to do so. This ensures affected parties are aware of any possible implications and builds trust through transparency and accountability by the agency.

State Records continues to support the Committee by reviewing the notifications process to ensure it is delivering the required benefits.  A review of the governments Personal Information Breach Guideline occurred over 2024-25 which included agency consultation.

The updated guideline:

• expands on what characterises a breach and how it impacts affected parties
• prescribes the steps to be taken when a breach occurs
• clarifies the information required to be reported to the Committee and other authorities and when a breach should be reported
• includes a breach risk assessment to assist agencies to determine the severity of breaches, and
• provides example scenarios to further assist agencies.

The Personal Information Breach Notification template was also updated.

State Records also continues to educate agencies on the importance of only collecting the personal information needed to perform a service and to avoid retaining it longer than legally required, thereby minimising the risk of harm should a breach occur.

Principal officers of state government agencies have the responsibility to ensure the IPPI is implemented, maintained, and observed for, and in respect of, all personal information for which their agency is responsible.

Advice is provided to state government agencies to help them comply with the IPPI and ensure privacy is considered in the development of new projects and initiatives.  Policy and other guidance materials are issued to support agencies.

State Records developed and published a new training course, “An introduction to the Information Privacy Principles Instruction”. This course provides an overview of the principles contained within the IPPI and will help the user to:

• recognise privacy and personal information
• apply the IPPI
• interpret the IPPs
• understand the Committee’s functions
• apply other privacy governance in South Australia.

State Records has begun developing a new General Disposal Schedule (GDS) authorising the disposal of certain identity verification documents under the State Records Act 1997.  This GDS and supporting guidance, provides agencies with an opportunity to reduce the retention of personal information no longer needed for a business purpose, thereby reducing the risk of a privacy breach.  Consultation and release of the guidance and new GDS is set to occur in the second half of 2025.

The Committee is represented by the Presiding Member on Privacy Authorities Australia (PAA).  State Records staff participate in three PAA working groups on policy, complaints and enforcement, and communications.

This exemption is from compliance with Principle 10, allowing the disclosure of personal information obtained by an on duty member of SAPOL at National Australian Football League (AFL) matches to an authorised AFL officer (AFLO) for the purpose of the AFLO issuing an AFL Banning Notice.

The personal information to be disclosed by SAPOL to an AFLO relates to patrons who have been arrested, reported and/or evicted from an AFL match by an on duty member of SAPOL.

The information to be disclosed is; family name, given name(s), current residential address, date of birth, photograph (if taken).

All other Principles continue to apply.

Conditions

Exemption is granted on the condition that information disclosed to the AFL by SAPOL is only used for the purpose of issuing of a banning notice.

Exemption is granted on the condition that once transferred and disclosed, the AFL will store the personal information securely and the information will only be accessed by members of the AFL Integrity and Security Department.

SAPOL is responsible for the secure transfer of personal information in line with the IPPs.

Exemption approved 14 May 2025 to 31 December 2026.

This exemption is from compliance with Principle 10, allowing SA Health DLU to disclose personal information included in the SA NT DataLink Master Linkage File to the ABS, as a third-party Accredited Linkage Agency, to enable the linkage of the Commonwealth Person Level Integrated Data Asset (PLIDA) platform to the SA Better Evidence, Better Outcomes, Linked Data (BEBOLD) platform.

The personal information is limited to file type ID, project specific linkage key, project specific record ID, surname, first name, middle names, date of birth, date of death, sex, address, suburb, postcode, state.

All other Principles continue to apply.

Conditions

The information is only to be used for the creation of Master Linkage Keys in the further development of the Master Linkage File as part of the SA NT Data Linkage System. The exemption is provided on the condition the personal information is only to be accessed by officers of SA Health within the Data Linkage Unit.

SA Health remains responsible for the secure transfer and storage of personal information in line with the IPPs.

This exemption is conditional on SA Health DLU or successor having a current Agreement in place or undertaking to establish an Agreement with parties in the data linkage process.

Exemption approved 24 July 2024 – backdated 9 July 2024 to 30 June 2025.

This exemption applies to both the Department for Energy and Mining (DEM) and the Department for Infrastructure and Transport (DIT), concerning personal information contained in drawn representations of the underground on-site sanitary plumbing work within a specific property (also described as historical as-constructed sanitary drainage drawings) held by the Office of the Technical Regulator within DEM.

This is an exemption from Principles 6 and 9 in relation to the drawings. This is also an exemption from Principle 10 for the purpose of disclosing the drawings:

• between DEM and DIT for the purpose of creating online access to the drawings by the public, and
• to the public.

The personal information consists of the name of persons who currently or previously owned a property, the address of that property, the name and contact details of the plumber who undertook the plumbing work to install the sanitary drains on the property and the location of the sanitary drains on the property.

All other Principles continue to apply.

Conditions

Where possible, the name of the property owner and name and contact details of the plumber are deleted from the sanitary drain drawings prior to release to DIT or the public, and

The process is maintained that allows a person to apply to have the sanitary drain drawing of a property that he or she owns, or lives in, suppressed from access by the public.

DEM and DIT remain responsible for the secure transfer of personal information in line with the IPPs.

Extension approved 17 September 2024 – 1 January 2025 to 31 December 2028.

All were approved on the condition the information is only to be used for the creation of Master Linkage Keys in the further development of the Master Linkage File as part of the SA NT Data Linkage System. The exemption is provided on the condition the personal information is only to be accessed by officers of SA Health within the Data Linkage Unit.

Exemption A

This exemption applies to the SA Health DLU and Consumer and Business Services (CBS) in the Attorney General’s Department.  It is an exemption from compliance with:

• Principle 10, allowing CBS to disclose personal information to the SA Health DLU, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely in the establishment of the Master Linkage File as part of the Data Linkage System.

The personal information to be used is from South Australian births and deaths datasets, and is limited to:

Death Dataset: Unique record identifier (registration number); names (all names where available including surnames, surnames at birth, given names and given names at birth); date of birth; date of death; age at death; place of birth; place of death; sex; Aboriginality and/or Torres Strait Islander indicator; full residential address, including geocodes, where available; correction indicator (if a record previously reported is being re-reported due to a correction in the register); father/co-parent (type, surnames, surnames at birth, given names, occupation); and mother (type, surnames, surnames at birth, given names, occupation). The personal information to be used from the deaths dataset is limited to death records created after 1/1/1990.

Birth Dataset: Unique record identifier (registration number); Names (all names where available including surnames, surnames at birth, given names and given names at birth); Full residential address, including geocodes where available; Sex; Date of birth; Place of birth; Mother’s Aboriginal indicator; Mother’s Torres Strait Islander indicator; Father’s/Co-parent’s Aboriginal indicator; Father’s/Co-parent’s Torres Strait Islander indicator; Mother’s date of birth; Father’s/Co-parent’s date of birth; Birth weight (in grams); Plurality – order (only available for multiple births e.g. twins); Plurality – total (only available for multiple births e.g. twins); Mother’s occupation title; Father’s/Co-parent’s occupation title; correction indicator (if a record previously reported is being re-reported due to a correction in the register); marriage type; date of marriage; place of marriage; and previous children of this relationship (given names, sex, date of birth, living indicator).

The personal information to be used from the births dataset is limited to birth records created after 1/1/1944. The disclosure will include any of the above information provided for other family members that is included in these records.

All other Principles continue to apply.

Exemption C

This exemption applies to SA Health DLU and the Department for Human Services (DHS) Youth Justice branch.  It is an exemption from compliance with:

• Principle 10, permitting DHS Youth Justice to disclose personal information to SA Health DLU, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely the creation of master linkage keys as part of the SA NT Data Linkage System by the Data Linkage Unit.

The personal information is limited to: Unique record identifier (i.e. episode reference number); Unique person identifier where available; Given name(s) (including all ‘akas’, aliases and nicknames); Date of birth; Sex; Aboriginality and/or Torres Strait Islander indicator; Country of birth; Full address including geocodes where available; and the full name and date of birth of the mother and father of the child or young person where available.

All other Principles continue to apply.

Exemption D

This exemption applies to SA Health DLU and the Department for Education (DE).  It is an exemption from compliance with:

• Principle 10, permitting DE to disclose personal information to SA Health DLU, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information.

The personal information to be used is from the DE Public Schools Enrolment dataset, including preschools and is limited to: Record Identifier; Personal Identifier; Names; Date of Birth; Sex; Aboriginality, Torres Strait Islander Indicator; Country of Birth; Full address including Geocodes if available; Parent / Guardian Identifier; Date Enrolled; Date Left; Destination School; Census year; Census term; 85 File Number; and any of the above information provided for other family members and included in these records including family code.

All other Principles continue to apply.

Exemption E

This exemption applies to SA Health DLU and Department for Education (DE).  It is an exemption from compliance with:

• Principle 10, permitting DE to disclose personal information to SA Health DLU for the purpose of enabling a more complete understanding of the early childhood sector and pathways in child health and development when developing policy, research and strategic plans, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – for the purposes of data linkage.

The personal information to be used is from DE preschool enrolment census data for non-government and private schools. The personal information to be used was initially for the period between 2012 and 2017, representing approximately 110,000 students, with annual updates being sought, with an expectation that each update is to include approximately 18,500 new students.

The personal information includes linkage variables of: Record identifier; Personal identifier; Names – all names including nicknames, aliases and aka; Date of birth; Sex; Aboriginality, Torres Strait Islander Indicator; Country of birth; Full address including geocodes if available; Site name; Site ID; and Census year.

All other Principles continue to apply.

Exemption F

This exemption applies to SA Health DLU and the Electoral Commission of South Australia (ECSA). It is an exemption from compliance with:

• Principle 10, permitting ECSA to disclose personal information to SA Health DLU, and
• Principles 2 and 8, allowing SA Health DLU to collect and use personal information for a purpose that was not the purpose of the collection of that information.

The personal information to be used is from the ECSA South Australian Electoral Roll dataset and is limited to: Elector Number; Title; Family Name; Given Names; Date of Birth; Country of Birth (3 character code); Sex; Address Line 1, 2 and 3 (including State and postcode); and any of the above information provided for other family members and included in these records.

Excluded from the dataset is information relating to ‘silent electors’ and those individuals who have sought to be ‘provisionally enrolled’.

All other Principles continue to apply.

Exemption G

This exemption applies to SA Health DLU and the South Australian Housing Authority (SAHA). It is an exemption from compliance with:

• Principle 10, permitting SAHA to disclose personal information from the Housing SA dataset and the Homelessness to Home (H2H) dataset to SA Health DLU, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely for the creation of master linkage keys as part of the establishment of the Data Linkage System.

The personal information from the Housing SA dataset is limited to: Unique Person Identifier; System Date; Names, all names including nicknames, aliases and aka; Date of Birth; Sex; Title; Aboriginality and/or Torres Strait Islander identifier; Country of Birth; Full address including geocodes if available; and any of the above information provided for other family members and included in these records.

The personal information from the Homelessness to Home (H2H) dataset is limited to: H2H customer number; Housing SA customer number; Given names; Surname; Date of birth; Sex; Aboriginality and/or Torres Strait Islander indicator; Country of birth; Full address details, including past addresses where available; System date; and any of the above information provided for other family members and included in these records.

All other Principles continue to apply.

Exemption H

This exemption applies to SA Health DLU and the Department for Correctional Services (DCS). It is an exemption from compliance with:

• Principle 10, permitting DCS to disclose personal information to SA Health DLU, and
• Principle 8, allowing SA Health DLU to use personal information for a purpose that was not the purpose of the collection of that information – namely to enable researchers and policy analysist to develop and disseminate a more comprehensive understanding of health, education and justice system pathways and outcomes.

The personal information to be disclosed by DCS relates to individuals who have been sentenced to a period of supervision, either in a custodial setting or in the community and is limited to: DCS IDs; JIS PIN; Entry and exit dates; Surnames (including previous names and maiden names); Given Name(s) (all including “aka’s”, aliases and nicknames); Date of Birth (DD/MM/YYYY); Sex; Residential address and postcodes (including previous addresses); and Aboriginal and Torres Strait Islander indicator.

All other Principles continue to apply.

Exemption I

This exemption applies to SA Health DLU and the Department of Human Services (DHS) – SA Concessions. It is an exemption from compliance with:

• Principle 8, allowing SA Health DLU to use the personal information received from DHS – SA concessions for a purpose that was not the primary purpose of the collection of that information; and

• Principle 10, permitting SA Health DLU to disclose personal information from the DHS – SA concession dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to dataset name, Unique ID, record date, person ID, name(s) including alias and nicknames, date of birth, Aboriginal Torres Strait Islander Status, address and previous address where available and phone number.

All other Principles continue to apply.

Exemption J

This exemption applies to SA Health DLU and the Department of Human Services (DHS) – Child and Family Support System Pathways (CFSS). It is an exemption from compliance with:

• Principle 8, allowing SA Health DLU to use the personal information received from DHS – Child and Family Support System Pathways (CFSS)  for a purpose that was not the primary purpose of the collection of that information; and
• Principle 10, permitting SA Health DLU to disclose personal information from the DHS – Child and Family Support System Pathways (CFSS)  dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to name, date of birth, place of birth, sex, Aboriginal Torres Strait Islander Status, family ID, family name, family start date, address, site name, site State.

All other Principles continue to apply.

Exemption K

This exemption applies to SA Health DLU relating to information from SA Department for Health and Wellbeing (DHW) Flinders Medical Centre – Flinders First Infant Risk Study. It is an exemption from compliance with:

• Principle 8, allowing SA Health DLU to use the personal information received from DHW Flinders Medical Centre – Flinders First Infant Risk Study for a purpose that was not the primary purpose of the collection of that information; and
• Principle 10, permitting SA Health DLU to disclose personal information from DHW Flinders Medical Centre – Flinders First Infant Risk Study dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to family ID (urn), name, date of birth, sex, plural, birth order, birth outcome, date of death, birth weight, gestational weeks, postcode, maternal name, maternal date of birth, deliver date time, date admitted, date discharged, maternal partner name.

All other Principles continue to apply.

Exemption L

This exemption applies to SA Health DLU relating to information from Department for Health and Wellbeing (DHW) – Chronic Obstructive Pulmonary Disease cohort. It is an exemption from compliance with:

• Principle 8, allowing SA NT DataLink to use the personal information received from DHW – Chronic Obstructive Pulmonary Disease cohort for a purpose that was not the primary purpose of the collection of that information; and
• Principle 10, permitting SA NT DataLink to disclose personal information from DHW - Chronic Obstructive Pulmonary Disease cohort dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to name, date of birth, sex, patient ID.

All other Principles continue to apply.

Exemption M

This exemption applies to SA Health DLU relating to information from SA Department for Health and Wellbeing (DHW) – Coronary Angiogram Database of SA. It is an exemption from compliance with:

• Principle 8, allowing SA Health DLU to use the personal information received from DHW – Coronary Angiogram Database of SA for a purpose that was not the primary purpose of the collection of that information; and
• Principle 10, permitting SA Health DLU to disclose personal information from DHW – Coronary Angiogram Database of SA dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to name, date of birth, sex, patient ID, event dates.

All other Principles continue to apply.

Exemption N

This exemption applies to SA Health DLU relating to information from SA Department for Health and Wellbeing (DHW) – SA Biopsy Positive Giant Cell Arteritis. It is an exemption from compliance with:

• Principle 8, allowing SA Health DLU to use the personal information received from DHW – SA Biopsy Positive Giant Cell Arteritis for a purpose that was not the primary purpose of the collection of that information; and
• Principle 10, permitting SA Health DLU to disclose personal information from DHW – SA Biopsy Positive Giant Cell Arteritis dataset to the Data Linkage Unit within SA NT DataLink and successors.

The personal information is limited to name, date of birth, sex, patient ID, event dates.

All other Principles continue to apply.

Exemption O

This exemption applies to SA Health DLU relating to information from the University of Adelaide – North West Adelaide Health Study. It is an exemption from compliance with:

• Principle 2, where SA Health DLU has collected or received personal information from the University of Adelaide – North West Adelaide Health Study; and
• Principle 8, allowing SA Health DLU to use the personal information received from the University of Adelaide – North West Adelaide Health Study for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to name, date of birth, age, gender, address, previous address, study flag.

All other Principles continue to apply.

Exemption P

This exemption applies to SA Health DLU relating to information from the University of Adelaide – Florey Adelaide Male Ageing Study. It is an exemption from compliance with:

• Principle 2, where SA Health DLU has collected or received personal information from the University of Adelaide – Florey Adelaide Male Ageing Study; and
• Principle 8, allowing SA Health DLU to use the personal information received from the University of Adelaide – Florey Adelaide Male Ageing Study for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to name, date of birth, age, gender, address, previous address, study flag.

All other Principles continue to apply.

Exemption Q

This exemption applies to SA Health DLU relating to information from the University of Adelaide – The South Australian Dental Longitudinal Study cohort 1 and 2. It is an exemption from compliance with:

• Principle 2, where SA Health DLU has collected or received personal information from the University of Adelaide – The South Australian Dental Longitudinal Study cohort 1 and 2; and
• Principle 8, allowing SA Health DLU to use the personal information received from the University of Adelaide – The South Australian Dental Longitudinal Study cohort 1 and 2  for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to name, age at baseline, sex, address.

All other Principles continue to apply.

Exemption R

This exemption applies to the SA Health DLU relating to information from The Australian Centre for Social Innovation (TACSI). It is an exemption from compliance with:

• Principle 2, where SA Health DLU has collected or received personal information from The Australian Centre for Social Innovation (TACSI); and

• Principle 8, allowing SA Health DLU to use the personal information received from The Australian Centre for Social Innovation (TACSI) for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to ID, name, date of birth, Aboriginal Torres Strait Islander Status, person creation date, family ID, family name, gender, family created date, family start date, address, site State, site name.

All other Principles continue to apply.

Exemption S

This exemption applies to SA Health DLU relating to information from Good Start Early Learning - GoodStart. It is an exemption from compliance with:

• Principle 2, where SA Health DLU has collected or received personal information from Good Start Early Learning - GoodStart; and
• Principle 8, allowing SA Health DLU to use the personal information received from Good Start Early Learning - GoodStart for a purpose that was not the primary purpose of the collection of that information.

The personal information is limited to ID, child_group, family_ID, child name, child gender, child first attended date, primary contact name, primary contact relationship, primary contact date of birth, primary contact address, SA1 code, SA2 code.

All other Principles continue to apply.

Exemption U

This exemption applies to SA Health DLU relating to information from the Northern Territory and various third party datasets. It is an exemption from compliance with:

• Principle 2, allowing SA Health DLU to collect personal information from third parties outside the South Australian government for the purpose and connected with the technical data linkage functions of the SA NT DataLink; and

Principle 8, allowing SA Health DLU to use that personal information for a purpose that was not the primary purpose of the collection of that information.

*in keeping with the Separation Principle of Data Linkage. SA NT DataLink’s Master Linkage File only holds person and record identifiers; the Researcher is provided with de-identified data Content data by the Data Custodian, appended to Project Specific Linkage Keys generated by SA NT DataLink.

Data provided by the Data Custodians in the NT subject to the information ACT (NT).

All other Principles continue to apply.