The government’s funding and resourcing of its national data and privacy office has been questioned again, as it was revealed that there are only five staff members handling the new data breach notification scheme.
The Office of the Australian Information Commissioner faced a Senate estimates hearing late last week, with a number of Senators voicing concerns over the agency’s “very overworked” team.
Acting Australia Information and Privacy Commissioner Angelene Falk also revealed that the OAIC’s investigation into Facebook handling of the data of Australian users is expected to go well into next year.
The government’s funding and resourcing of its national data and privacy office has been questioned again, as it was revealed that there are only five staff members handling the new data breach notification scheme.
The Office of the Australian Information Commissioner faced a Senate estimates hearing late last week, with a number of Senators voicing concerns over the agency’s “very overworked” team.
Acting Australia Information and Privacy Commissioner Angelene Falk also revealed that the OAIC’s investigation into Facebook handling of the data of Australian users is expected to go well into next year.
The senate estimates hearing heard that the OAIC’s workload is rapidly increasing year-on-year, and the agency will be forced to re-evaluate its current processes in order to cope with this in the coming months.
The OAIC has seen a 13 per cent increase in privacy complaints from last year and has handled nearly 15,000 privacy inquiries and completed eight privacy assessments. It has also completed 400 pieces of external policy advice for government, an increase of 71 year-on-year. There was also a 25 percent increase in the number of FOI review requests in the last year.
The OAIC was handed an additional $2.8 million in 2018-19 to assist with the Consumer Data Right, with this funding bringing its permanent staffing levels of 75 to 92.
“We are in a fortunate position of actually being able to go out and recruit and we are making arrangements now to make that go forward,” Ms Falk said.
But concerns still surround the OAIC’s ability to complete all of its important roles as the number of privacy and data complaints continue, and the general public’s knowledge of these matters improves.
Centre Alliance Senator Rex Patrick said he believes the OAIC is a “very overworked office”, while Ms Falk admitted that the growing workload was “challenging”.
“We are receiving an increased number coming through the door and despite the fact we’re able to resolve more and more efficiently, there is a gap between the two. We are doing some work internally over the next couple of months to look at our process and if there’s anything else we can realign,” Ms Falk said.
“There has been an increased workload. We have had to put in place different systems and processes and have had to use our IT environment in new ways to increase some efficiencies there. There’s definitely a workload increase across the board at our office, and we’re very thankful of our staff. We’ve made a commitment to look at the ongoing needs in the future and are in discussions with the department in relation to that.”
The OAIC is now also overseeing the mandatory notifiable data breaches scheme, which launched in February. Despite the added workload of this, and the issue of data handling and security being at the forefront of global news this year, the department has not been given any extra funding to do so.
At the estimates hearing, Ms Falk revealed that only five staff members are overseeing the scheme, along with other duties.
“We had foreseen an increase of around 500 reports for the year and we’re expecting that to be on track at the moment. We prioritise our resources in order to deal with matters that arise. One of the issues that arises with the breaches scheme is that matters are coming to our attention in a way that’s far greater than before,” Ms Falk said.
“We’re an agile organisation. We shift our resources as need be. It’s early days and we’re learning lessons as we go along and seeing where an increased workload may come. With enhanced visibility of issues, there’ll be a number of different strategies that we’ll need to invoke.”
There have been growing concerns this year over the level of funding and resourcing provided to the OAIC as its importance and workload grows. Earlier this year, former Victorian Privacy Commissioner David Watts said the OAIC is facing “unprecedented challenges” and is “stretched beyond breaking point” due to a lack of funding and resources.
It was also revealed during the estimates hearing that it is expected that the OAIC’s investigation into Facebook will continue well into next year. The office officially launched an investigation in April when it was confirmed that the personal data of 300,000 Australians had been caught up in the Facebook and Cambridge Analytica scandal.
Ms Falk said that other commissioner-initiated investigations are usually wrapped up within six to eight months, but due to the Facebook investigation’s “complexities” it is likely to take longer. The acting commissioner also confirmed that the OAIC has been liaising with its international counterparts in the US, UK, Ireland, Canada and the Philippines.
“We seek to finalise investigations within around six to eight months. We anticipate this one may take a little longer depending on the complexities of issues that arise. That’s just an indicative timeline,” Ms Falk said.
“It’s early days in terms of the investigation. Under our Privacy Act, global corporate entities need to comply with our privacy obligations. In terms of whether Facebook is compliant with it, there’s an active investigation that’s currently underway. I’ll need to go through the process of that investigation and then arrive at that finding. It’s an open question in relation to the allegations that have been made.”
At the hearing, it was also confirmed that the new Australian Information and Privacy Commissioner is likely to be appointed within weeks.
Do you know more? Contact James Riley via Email.