------------------------------------------------------------------------------------------------------------
PRIVACY NEWSLETTER 4
Action Plan For Compliance With The New Private Sector Privacy Legislation

Each private sector organisation is going to need to go through a checklist of questions to establish the degree to which action is required to comply with the new legislation.

The following list of questions was developed by Blake Dawson Waldron (www.bdw.com.au), some time ago. Some tips on the answers are included below based on the understanding of ARS Recruitment, however, for a complete understanding of the actions required in your organisation you should see these as tips. You really need to go back to a clean sheet of paper and start again.

What Steps Should Be Taken To Ensure Compliance

Will the new legislation apply to you?
YES, unless you are a small business operator with an annual turnover last year of less than $3million, and do not trade in personal information.

The receipt of personal information by you triggers the need for compliance.

The assignments you handle using you own resources, expose you to compliance in respect of all applicants, whether this be 10 or 50.

The assignments where you use a recruitment consultancy, only expose you to compliance in respect of the shortlisted candidates about whom you receive any 'personal information'. (In this case the consultant has the full exposure.)

When will the new legislation apply to you?
From December 21st 2001.

Are any of your activities likely to be exempt?
The key exemption applies to 'employee records'. An organisation will not be required to comply with the Act in relation to 'employee records' in matters directly related to a current or former employment relationship.

Do your existing information handling practices satisfy the requirements of the National Privacy Principles?
This will require a review of your existing practices against the requirements of the NPP's. These were included in our Privacy Newsletter No.2. This will need to include;

1. Information collection, use and disclosure practices - to determine what is collected, how, when, for what purpose and to whom it is disclosed.

2. Accessibility, storage and security of information collected in your organisation.

3. Requirement for new documentation to meet the legislation, e.g. Privacy Policy, Collection Statement etc.

TOP

What new procedures are necessary for ongoing compliance?
In the light of the above review, most organisations will have to put new procedures in place to comply. These will include;

1. Issuance routines for Privacy Policy and any Collection Statement.

2. Guidelines for storage and security of information.

3. Procedures for handling requests to access personal information.

Which of your current practices will have to be changed to ensure compliance?

1. Guidelines for collection, use and disclosure of personal information.

2. Adherence with the Anti Discrimination legislation will need to be reinforced across the organisation with everybody in the applicant handling and selection chain needing to be up-to-date and compliant.

MAJOR EXPOSURE HERE - REFRESHER TRAINING PROBABLY REQUIRED

It is likely that your greatest exposure from the Privacy Legislation is in fact that casual comments made/or recorded in the recruitment process, may be interpreted as discrimination by an unsuccessful candidate, with action then taken against you under that legislation, supported by discovery under the Privacy Act.

3. Current policies of document retention on unsuccessful candidates may need to be reviewed with clear document destruction policies put in place. (Destruction of personal information should be by the use of a shredder or by incineration, normal rubbish processes are not adequate.)

Would you be better served by developing your own Privacy Code? This requires approval of this alternative privacy code. The time certainly does not exist to do this before December 21st. However, it may be an option that could cut in later.

If so, you would still need to cover all of the principles above.

The Bottom Line For Most Organisations?
Most organisations will require:

• Executive resources diverted to understanding the legislation in depth,
  
• detailed analysis and modification of current practices,
  
• development of new procedures to comply with the legislation.
  
• Education programme for Managers and involved staff on Privacy laws
  
• Re-training regarding anti discrimination legislation.
  

It is to be hoped that it does not become a new source of litigation, this time with unsuccessful candidates, as they vastly outnumber those employed.

See ARS Recruitment Newsletter 5 for a summary of Anti Discrimination Exposure.

TOP

This publication has been prepared exclusively for the information of clients and consultants of ARS Recruitment and should not be relied upon as a substitute for legal advice. The owners and consultants of ARS Recruitment expressly disclaim all and any liability flowing from any act done or omitted to be done in reliance upon the whole or part of the contents of this newsletter