COVID-19: OAIC publishes privacy guidance for the pandemic

The Office of the Australian Information Commissioner (OAIC) has now published some guidance to assist organisations manage compliance with the Privacy Act 1988 (Cth) (Privacy Act) during the COVID-19 pandemic.

This is particularly relevant for private sector health service providers.  

The OAIC and state and territory privacy regulators have created a National COVID-19 Privacy Team to respond to the significant challenges that organisations are faced with to stop the spread of the coronavirus.  Privacy laws at both the state and federal levels contain mechanisms that allow the exchange of health information in such circumstances.

The OAIC has reiterated the importance for organisations to conduct short-form privacy impact assessments to help ensure that personal information is handled in a way that is necessary, reasonable and proportionate. 

The OAIC has recommended that organisations: 

• Only use or disclose personal information on a “need-to-know” basis
• Only collect, use or disclose the minimum of personal information reasonably necessary to prevent or manage the virus
• Consider pro-actively taking steps to inform staff members about how they will handle their information in responding to any suspected or actual case of COVID-19 in the workplace
• Take reasonable steps to ensure that personal information is kept secure, including where employees are working remotely.

Click here to read more.

For advice on handling personal information in connection with COVID-19 or if you would like assistance in conducting a short-form privacy impact assessment, contact a PB Lawyer today.