Data Governance and Privacy

As an entity responsible for a large and unique cross-agency dataset, Family and Community Services Insights, Analysis and Research (FACSIAR) within the Department of Communities and Justice (DCJ) relies on strong data governance to perform its functions effectively and maintain a trusted reputation amongst its data partners, stakeholders and the general community.

The data governance framework outlines arrangements which apply to data, collected and/or enhanced in connection with the Project, collected on our behalf (for example under collaborative or contractual agreements), and data obtained from all external sources.

The creation and use of the Human Services Data set (HSDS) is enabled by the Public Interest Direction and Health Public Interest Direction (PIDs) made for the Their Futures Matter Project by the NSW Privacy Commissioner under the PPIP Act and the HRIP Act.

Under section 41(1) of the Privacy and Personal Information Protection Act 1998 (PPIP Act) and section 62(1) of the Health Records and Information Privacy Act 2002 (HRIP Act), the NSW Privacy Commissioner may make a public interest direction that exempts a public sector agency from the requirement to comply with one, or more information protection principles (IPPs), or health privacy principles (HPPs), or which modifies the application of an IPP or HPP.

Section 41(3) of the PPIP Act and section 62(3) of the HRIP Act provide that the Privacy Commissioner can only make a public interest direction where satisfied that the public interest in requiring the agency to comply with the IPPs or HPPs, is outweighed by the public interest in making the direction.

The PIDs govern the extent to which FACSIAR and participating agencies may depart from the IPPs and HPPs for the purposes of the Project. This permits government agencies to collect, use and disclose data in ways that would otherwise be precluded by privacy legislation. In the case of the HSDS, the PIDs permit the collection and linkage of administrative datasets across government agencies, so that the data can be re-used to design and deliver better government services for vulnerable children or young persons and their families.

The PIDs contain clear and defined Approved Purposes for which data can be disclosed, collected and used. FACSIAR and participating agencies cannot depart from the Approved Purposes and must maintain the modifications and exemptions granted.

FACSIAR reports annually to the NSW Privacy Commissioner on compliance with the PIDs.

The PIDs will expire on 13 July 2024. The Project Team is developing a Privacy Codes of Practice and Health Privacy Codes of Practice as a long-term replacement for the PIDs.

FACSIAR and its contracted entities must comply with specific privacy, data sharing and records legislation, and with relevant NSW Government frameworks and policies.

Key policies include:

• Human Services Dataset Data Breach Policy PDF, 566.03 KB

This policy sets out procedures for responding to and managing data breaches in connection with the Human Services Dataset.

• Data Governance Framework. Coming soon.

The Data Governance Framework defines the roles and responsibilities for the data collected and used for the Project.

• Human Services Dataset De-Identification and Five Safes Framework Policy PDF, 469.96 KB

This policy outlines how the De-Identification Decision-Making Framework and NSW Government’s Data Sharing Principles (based on the Five Safes Framework) have been incorporated in managing disclosure risk when data is released to approved data users for research and analysis for or made publicly available.

• Privacy and Security Audit and Assurance Regime. Coming soon.

This regime outlines the auditing and risk assessment activities that the Project Team will undertake to ensure compliance the Public Interest Direction and Health Public Interest Direction. This policy also outlines the adequacy of the security systems and processes in place to protect personal information and data that is collected by the Project.

• Privacy Stance. Coming soon.

This stance confirms our commitment to privacy and security in our management of data, and the priority we place on protecting the privacy of individuals

NSW Community Attitudes Survey on Privacy and Data Sharing

In 2020, Family and Community Services Insights, Analysis and Research (FACSIAR) commissioned a NSW Community Attitudes Survey on Data Sharing and Privacy Risks, as a part of our work in developing the Privacy Codes.

The objective of the research was to enable us to:

• better understand what the NSW community thinks about data sharing, and in particular, the benefits of sharing and using de-identified, linked government datasets
• establish the acceptable scope of data sharing and release and
• establish community understanding of the risks associated with data sharing, including of de-identified government datasets, and identify expected safeguards for protecting individual privacy.

View the NSW Community Attitudes Survey on Privacy and Data Sharing December 2020

Your personal information is extremely valuable. Here, you will find our Privacy Policy and information:

1. Privacy policy
2. Enquiries
3. Privacy complaints (internal review)
4. Application to access or correct Personal or Health Information

Human Services Dataset Privacy Policy

Human Services Dataset Privacy Policy PDF, 545.62 KB

Please refer to this policy to find out:

• what Personal and Health Information is collected and shared as part of the Project;
• how Personal and Health Information is collected, stored, used and disclosed;
• how you can apply to access or correct your Personal and Health Information;
• how to lodge a privacy complaint (Internal Review).

Enquiries

If you have any enquiries about the Project, Privacy or about the Human Services Dataset. Direct them to the Project Privacy Officer. Contact details provided below.

Email: dataprivacy@dcj.nsw.gov.au

Postal address: NSW Department of Communities and Justice, FACSIAR, Data Privacy and Governance Team, Locked Bag 5000 Parramatta NSW 2124

Privacy complaint (Internal Review)

You have a right to seek an Internal Review if you think your Personal and/or Health Information has been mishandled as part of the Project in contravention of the Information Protection Principles and/or the Health Privacy Principles as modified by the Public Interest Directions.

To request an internal review, fill out the Internal Review Form available at the end of our Human Services Dataset Privacy Policy PDF, 545.62 KB and send it to the Project Privacy Officer. Contact details provided below.

Email: dataprivacy@dcj.nsw.gov.au

Postal address: NSW Department of Communities and Justice, FACSIAR, Data Privacy and Governance Team, Locked Bag 5000 Parramatta NSW 2124

Please refer to our Human Services Dataset Privacy Policy PDF, 545.62 KB for further details.

Application to access or correct Personal or Health Information

To find out how to access or correct your Personal and Health Information collected for the Project. Contact the Project Privacy Officer, details provided below.

Email: dataprivacy@dcj.nsw.gov.au

Postal address: NSW Department of Communities and Justice, FACSIAR, Data Privacy and Governance Team, Locked Bag 5000 Parramatta NSW 2124

Please refer to our Human Services Dataset Privacy Policy for further details.