For example, it could simply involve running through a standard form checklist of potential issues. A privacy audit is simply a check of forms, procedures and policies. This may be carried out either in- house, provided it is done by someone who has the necessary expertise, or by an independent consultant. Unlike privacy impact assessments and privacy audits which are generally one-off procedures, a privacy compliance programme should be implemented to ensure ongoing monitoring of compliance with the Privacy Act. However they can be of significant benefit in reducing a business's downstream costs and exposure to liability.
Complaints handling The actual handling of privacy inquiries and complaints is very important.
A recent example of inappropriate handling of an inquiry or complaint is salutary. It concerned a request for information pursuant to the Health Information Privacy Code. A hospital held a nine hour video recording of the complainant's son, which had been made to assist with his diagnosis. The complainant wanted to use the information to obtain an independent assessment of her son's condition. The request was declined on the basis that it was difficult to edit out other individuals who appeared on the tape.