Source: Privacy Commissioner
Privacy Commissioner Michael Webster says agencies using data anonymisation and de-identification techniques are accountable for making sure they protect peoples privacy. The Privacy Act allows anonymised information to be disclosed if it doesnt risk revealing personal details about identifiable people. The Commissioners expectation is that information would be successfully anonymised and there be no reasonable likelihood of re-identification. Care is needed because the inadvertent release of personal information through re-identification may result in serious harm to individuals. Protective steps that can be taken include:
Ensuring a Privacy Impact Assessment (PIA) is done for any significant project that uses peoples personal information to fully understand the scope of how personal information could be re-identified. Removing any information that could potentially be used to re-identify an individual. Where information is being provided to a third party, ensure you and they understand and comply with their privacy obligations.
