Document ID: chunk:federal_register_of_legislation:F2017L01396:body:0:p3
Version: federal_register_of_legislation:F2017L01396
Segment Type: other
Provision Reference: 
Character Range: 5119–8078

on privacy matters in an agency.

        (5) An agency must ensure that the following Privacy Officer functions are carried out:

            (a) handling of internal and external privacy enquiries, privacy complaints, and requests for access to and correction of personal information made under the Act;

            (b) maintaining a record of the agency's personal information holdings;

            (c) assisting with the preparation of PIAs conducted under section 12;

            (d) maintaining the agency's register of PIAs as required by section 15; and

            (e) measuring and documenting the agency's performance against the privacy management plan at least annually as required by section 9.

11 Privacy Champion

        (1) An agency must, at all times, have a designated Privacy Champion.

        (2) An agency may designate an officer as a Privacy Champion by reference to a position or role within the agency.

        (3) The Privacy Champion must be a senior official within the agency.

        (4) An agency must ensure that the following Privacy Champion functions are carried out:

            (a) promoting a culture of privacy within the agency that values and protects personal information;

            (b) providing leadership within the agency on broader strategic privacy issues;

            (c) reviewing and/or approving the agency's privacy management plan, and documented reviews of the agency's progress against the privacy management plan; and

            (d) providing regular reports to the agency's executive, including about any privacy issues arising from the agency's handling of personal information.

     (5) An agency's designated Privacy Officer may also be its designated Privacy  Champion.

PART 3—PIAs

12 Conduct of PIA

        (1) An agency must conduct a PIA for all high privacy risk projects.

        (2) For the purposes of this section, a project may be a high privacy risk project if the agency reasonably considers that the project involves any new or changed ways of handling personal information that are likely to have a significant impact on the privacy of individuals.

        Note: 'Privacy impact assessment' is defined in section 33D of the Act. This section of the Act also requires an agency to conduct a PIA if directed to do so by the Commissioner.

13 Publication of PIA

    An agency may publish a PIA conducted under section 12, or a summary version or an edited copy of the PIA, on the agency's website.

14 Joint PIA

    If two or more agencies participate in the same project, they may conduct a joint PIA. Each agency must retain a copy of the PIA.

15 Register of PIAs

        (1) An agency must maintain a register of the PIAs it conducts. An agency must publish the register, or a version of the register, on its website.

        (2) An agency may provide a copy of the register, and any PIAs that are listed on the register, to the