Privacy Policy Review

Karen Finzel52:21

That's unanimous. All in favour? Thank you. Thank you staff. Thank you Councillors. Thank you. Back to the agenda. Now we're up to item 7.4, the privacy policy review. And we've got government staff here to answer any of our questions.

Thank you, Dean. All right, I'll take you through a summary of the report and the policy. So as you know, as you all know, the governance branch regularly reviews. Governance related Council policies and procedures for improvements, legislative compliance, to ensure they're fit for purpose and best practice. Recently, we focused on reviewing this year our existing 2014 privacy policy. To ensure Council continues to basically strengthen its governance framework and to deliver on its specific operational plan objective. Another key driver of the policy review are the recent privacy policy reforms specific specifically the Information Privacy and Other Legislation Amendment Act 2023 very long legislative name so I call it IPOLA which has come into effect. The first stage of these reforms are going to be coming into effect mid next year and we'll place new legislative requirements that obviously we must comply with. Following extensive internal and external review of the policy and consultation with law firms, local government sector and training specifically received on the IPOLA reforms from. Several key policy changes are proposed in this updated version. I'm just going to touch on some of them just to highlight those key changes so basically a new modern format and approach to make the content more user friendly for our community. In essence I acknowledge, and you've heard me say this many times, privacy law is a complex area of law. Therefore the changes proposed are all about placing the policy into new Q&A style format where questions are introduced that explain privacy law concepts to the everyday user so they can be more easily digested. Digestible and understood. For example, rather than simply stating that Council complies with the privacy principles, we go that step further. We explain how we're complying with those principles through that Q&A format so people can understand it. We've also aligned our new policy to Council's policy development framework that's just been launched and best practice model so that means you will see new elements in the privacy policy that the 2014 policy did didn't have, such as a new statement of intent, a clearer statement, a purpose and scope around the policy. We've also introduced a new section covering surveillance technology which you briefly spoke about in the last item as well to acknowledge the work and function Council this area and the impact it may have on privacy obligations in that space. We're also making it easier for the community to understand who and how to contact us if they have a query, a privacy query or a complaint or a concern and that previous policy really didn't have that. We need to have contact details. Our in policies for the community. And finally, we're now responding, to these new legislative reforms that are coming in as well. We're adding in particular items in there to address legislative requirements. So for instance, you're going to see seen new legal definitions that are now embedded in the policy. A new definition for personal information has been updated, for example, so it aligns with the new IPOLA reforms and other terms like privacy breaches is now in that policy version. We're also aligning to the new Queensland privacy principles. You'll see the term QPPs floating around a lot more in the near future, which replaces the former information privacy principles for Queensland. And we've also introduced, and this is the really critical part of it, an entire section on breaches, from privacy breaches to how we will respond specifically to a data breach. And this is a critical part of the law reforms that we've expanded in appendix A to the policy, so it's quite a large section in that area, but it really is in response to. And these new law reforms that state agencies, including Council, need to explain how we will respond to a privacy breach in that space. And finally, we are aware that further potential legislative changes. May require us to revisit. This policy work again in 2025-26 and undertake another review of this policy. However, upon the advice of external experts and the State regulator, we've started making staged changes now. Are proposed so that we are in step with our legislative obligations. That's it.

For anyone who may be listening and have those concerns yeah I understand that we get that question a lot especially if a member of the public is concerned and wants to know before they tell us their concerns and the complaint what will happen personal information as you can see this policy is a very broad term and if someone makes a complaint to Council it is considered their personal information so it's classified as personal information of that person which means we must protect their information and preserve their privacy so we would not be advising anyone out there in the community which shouldn't you know who made a complaint about them that kind of thing that it's definitely not allowed it's protected under.

Karen Finzel70:42

Thank you for the report. We'll move to the recommendation that Council anote the report by the governance manager. The Services & Organisation Committee Meeting dated 10th December 2024 and b adopt the updated Council privacy policy provided as attachment 1 to the report to be removed. Thank you. That's moved by Councillor Wilson, seconded by Councillor Phillips. Would you like to speak too?

Absolutely. And we take. Information, you know, information privacy as a very serious. Of training for our staff. We roll out regular training to make sure that people are across the rules. They're reminded on a regular basis and they know that this is quite serious. And, you know, we're entrusted with so much as you've seen in policy and the workshops we've been through. We're entrusted with a lot of information, a lot of personal information because of the work we do. So it's really critical that staff feel comfortable. Understand the rules, are aware and know how to apply for it. Equally they know where to go to if they need advice.