IAPP Certified Information Privacy Professional, Australia

Privacy duties vary by who holds the data and where. You compare state and territory privacy and health records laws, and the obligations of federal agencies under the Agency Privacy Code.

• State and territory privacy statutes
• Health records laws
• Surveillance devices and listening laws
• Federal agencies and the Agency Privacy Code
• Government contractors and outsourcing
• Working out which law governs an activity

You build A jurisdiction map for an organization that operates across several states.

You apply existing privacy, consumer and discrimination law to AI systems and follow how Australian policy on AI is developing, so that you can advise on a new project before the rules settle.

• How the Privacy Act applies to AI training and use
• Automated decision-making and transparency
• Consumer and discrimination law for AI
• Government guidance on safe and responsible AI
• Facial recognition and biometric data
• Assessing an AI project for privacy risk

You build A privacy risk assessment of an AI feature under Australian law.

The first five principles set the front end. You build open and transparent practices, offer anonymity where practical, collect only what is reasonably necessary, handle unsolicited information, and notify people of collection.

• APP 1: open and transparent management and privacy policies
• APP 2: anonymity and pseudonymity
• APP 3: collection of solicited information
• APP 4: unsolicited personal information
• APP 5: notification of collection
• Consent and sensitive information

You build A privacy policy and collection notice that meet APPs 1, 3 and 5.

The middle principles control what happens to data once it is held. You decide when use and disclosure are allowed, market within the rules, handle cross-border disclosure, and treat government identifiers with care.

• APP 6: use and disclosure, and secondary purposes
• APP 7: direct marketing and opt-out
• APP 8: cross-border disclosure and overseas recipients
• APP 9: government related identifiers
• Consent, reasonable expectations and permitted general situations
• Contracts with service providers

You build A use-and-disclosure register for one organization’s main data flows.

The final principles cover the quality of data and the rights of individuals. You keep information accurate, secure it and destroy it when no longer needed, and answer access and correction requests.

• APP 10: quality of personal information
• APP 11: security, destruction and de-identification
• APP 12: access to personal information
• APP 13: correction
• Handling requests, refusals and fees
• Complaint handling inside the organization

You build An access and correction procedure with templates and timeframes.

The Notifiable Data Breaches scheme requires action when serious harm is likely. You assess suspected breaches, decide whether they are eligible, and notify the OAIC and individuals within the rules.

• What is an eligible data breach
• Assessing a suspected breach within the time allowed
• Likely risk of serious harm and remedial action
• Statements to the OAIC and notices to individuals
• Breach response plans and drills
• Reading the OAIC’s breach reports

You build A breach assessment and notification pack for a simulated incident.

The Office of the Australian Information Commissioner regulates privacy. You study its functions, investigations and enforcement powers, the escalation model, civil penalties, and how it works with other regulators.

• The OAIC’s roles and functions
• Complaints and investigations
• Determinations, enforceable undertakings and injunctions
• Civil penalties and the escalation model
• Working with the ACCC, ACMA and other regulators
• Learning from determinations and court cases

You build A case study of one OAIC determination, with the controls that would have prevented it.

Some settings add rules on top of the APPs. You apply the extra requirements for health information, credit reporting and finance, children, employee data and surveillance, including state-specific laws.

• Health information and My Health Record
• Credit reporting and financial services
• Children’s privacy and online safety
• Employee records and workplace surveillance
• Surveillance devices and CCTV
• State-specific rules in each setting

You build A special-cases checklist for a health or finance business.

A scenario brings the pieces together. You advise an organization that holds health, financial and employee data, uses AI, and has a breach to manage, and give the written advice a privacy adviser would give.

• Establishing facts and coverage
• Applying the APPs to the data flows
• Handling the breach and the regulator
• Reviewing AI use and special cases
• Writing and defending the advice

You build A written compliance opinion for an Australian organization.