INDEPENDENT PRIVACY IMPACT ASSESSMENT (APRIL 2018)
In July 2017, the ABS (on behalf of MADIP agencies) engaged privacy experts Galexia to undertake an independent Privacy Impact Assessment (PIA) of MADIP. The PIA assessed MADIP’s compliance with the Australian Privacy Principles, to ensure all privacy risks have been identified and mitigated in preparation for the project becoming fully operational under the Data Integration Partnership for Australia (DIPA) in July 2018. The ABS is currently conducting an update to the MADIP PIA - more information about this is provided below.
The Galexia independent PIA was finalised in March 2018 and is published here along with the MADIP agencies’ response.
The independent PIA acknowledges there are strong measures in place to protect privacy for the MADIP, including legislative safeguards, the separation principle, and restricting the use of data to research and statistical purposes which benefit the Australian community. The PIA also identified some areas for improvement and provides strategies for managing, minimising, or eliminating residual privacy risks.
Targeted stakeholder consultation (2017)
To support the independent PIA process, the ABS held a series of targeted consultations with key stakeholders, on behalf of MADIP partner agencies. The aim of these sessions was to understand stakeholder views on key data integration issues, and contribute to building community trust and understanding of MADIP as the project develops.
The consultations also provided an opportunity for privacy and advocacy groups, government, academics, and civil society groups to raise any issues or concerns about the project, and discuss the benefits of data integration and future development of MADIP.
The feedback received during these consultations was provided to Galexia to further inform the independent PIA and direction of MADIP. This consultation process also forms part of ongoing consultations held with community stakeholders about the work of the ABS.
What was the focus of the consultation meetings?
As part of the discussion, the ABS sought comments from stakeholders on three core issues, for each of which stakeholders were asked about their concerns, what could be done to minimise those concerns, and what benefits they perceived from existing arrangements:
- 1. MADIP data security and protection of privacy
2. The benefits and possible risks of combining key national public sector datasets
3. Data access arrangements and use
How were stakeholders selected for consultation?
Stakeholders were selected based on their:
- Involvement (potential or actual) in the project;
- Representativeness of key sector(s) of Australian society;
- Special interest or expertise (including privacy and security); and/or
- Prior contribution to government consultation processes.
For more information about MADIP consultations, email firstname.lastname@example.org
Implementation report (April 2019)
The ABS (on behalf of MADIP agencies) published the below implementation report to communicate progress made against the recommendations of the independent PIA since its publication in April 2018.
MADIP independent PIA - Implementation Report April 2019.pdf
The MADIP agencies are committed to upholding the privacy, secrecy, and security of personal information, and to being transparent and open about the project.
UPDATE TO MADIP PIA (NOVEMBER 2019)
The ABS is conducting an update to the 2018 MADIP PIA on behalf of the MADIP Board, and has engaged privacy experts Maddocks to independently assure the final PIA report and provide privacy advice throughout the PIA process.
Why is an update to the PIA required?
MADIP is an evolving project. Since the publication of the PIA in April 2018, more data of the same broad type has been linked to MADIP and there have been developments in project governance, infrastructure, data access and use, and transparency.
The MADIP PIA is being updated to formally consider these developments in the project and to prepare for the inclusion of some new types of data in MADIP.
Has consultation been undertaken?
Consultation was an essential part of conducting the PIA Update, and was an opportunity to inform stakeholders about MADIP and its development and to hear stakeholder views on MADIP and its privacy management arrangements.
The ABS held consultation sessions with a broad range of stakeholders during August and September 2019.
The key findings from these sessions will feed into the update of the PIA by assisting in the identification and assessment of privacy risks and mitigation strategies.
The ABS is planning to publish a consultation summary report on the ABS website in late November.
When will the updated PIA be published?
The ABS is planning to publish the MADIP PIA Update report along with a response to the PIA from the MADIP Board on the ABS website in late November. The Independent Assurance Report from Maddocks will also be published on the ABS website when it becomes available.