After 18 years,NSW to get a full time Privacy Commissioner

Attorney General Mark Speakman has announced the proposed appointment of Samantha Gavel as NSW Privacy Commissioner. The Joint Parliamentary Committee on the Ombudsman, the Law Enforcement Conduct Commission and the Crime Commission gets  to confirm the appointment... or otherwise.

And the good news, many years late, is that the government will make the position full time. 

The Commissioner has  been part-time since the first appointment in 1999  and for long periods there was an Acting Commissioner, including 2003-07 and 2009-2011. 

“Ms Gavel is a leader in privacy protection who is currently the National Health Practitioner Ombudsman and Privacy Commissioner, and was previously the Private Health Insurance Ombudsman for six years,” Mr Speakman said in a Media release 

Paris Cowan in IT News in February recounted how privacy regulation everywhere around the country is under resourced.

Budgeted expenditure for the Information and Privacy Commission in 2017-18 is $5.6 million, a 1.3% reduction. 

Looks like expenditure on a full time commissioner will involve a snip elsewhere.

Thanks for managing a tough assignment to departing Privacy Commissioner Dr Elizabeth Coombs. 

New information commissioner and a new external review tribunal in NSW.

And with the GIPA act up for statutory review this year, 2014 could be a big one here.

Information Commissioner
Elizabeth Tydd replaces Deirdre O'Donnell who stood down last July. Ms Tydd was most recently the executive director of the Office of Liquor, Gaming and Racing, a real hot seat in Sydney in recent times. And before that assistant commissioner of the Compliance and Legal Group at the Office of Fair Trading, and deputy chairperson of the Consumer, Trader and Tenancy Tribunal, now part of the newly minted NSW Civil and Administrative Tribunal

It's a big job with much to be done to lead the open government 'revolution' foreshadowed in 2010. How far things have moved in that direction is an open question with plenty of suggestions from users that it's not far and certainly not enough.

But information about agency performance in NSW is patchy, and anecdotal. No reports on the operation of the GIPA act across all agencies required each year of the commissioner by section 37 of the Government Information (Information Commissioner) Act have been published. As to the much mooted 'culture change', ???
 
The commission annual report (pdf) 2012-2013 is as thin as those that have gone before regarding the performance of the commission and the effect and impact of a no doubt busy year.

The basic stats are 46 formal GIPA matters finalised, 237 information access reviews, one investigation, 50 ADT matters, 58 complaints, 388 requests for assistance, and 161 privacy internal reviews.

The measures cited in the report as performance measures provide little insight into what has been achieved or efficiency, effectiveness, or quality in delivering the goods. Timeliness in dealing with GIPA reviews is an acknowledged source of agency and applicant dissatisfaction. 

On this score the restructure referred to in the report, with employee numbers down to 25 from 33 a year ago must have played a role.The financials assign $496, 370 to 'voluntary redundacy'.

However after ploughing through the report this reader is none the wiser about the state of the game. A sample of unanswered questions: the state government agencies, local councils or ministers' offices at the upper end of the scale for GIPA review applications and complaints; the number/% of finalised review decisions or negotiated resolutions that substantially affirmed the agency decision or recommended or flowed from reconsideration; the % of GIPA review matters where the agency accepted the OIC recommendation to undertake further review and the names of agencies that did not act on those recommendations (the IPC is limited to recommendations and does not make determinative decisions-therein lies a problem); the correlation between the OIC view and the ADT where a matter followed that course; the average cost of an IPC review and time taken in resolving review and complaint matters and the duration of matters that make up the backlog.

Tribunal
NCAT commenced operating on 1 January 2014 replacing more than 20 of the State's existing tribunals including the Administrative Decisions Tribunal. (Super tribunals are the Admin law flavour of the decade: the establishment of NCAT, follows the creation of VCAT, QCAT, and (WA) SAT. And SA was thinking about it some years back.)

Mr Robertson Wright SC, the inaugural NCAT President,was sworn in as a Supreme Court Judge before assuming the position. Prior to his appointment Mr Justice Wright was a barrister for 30 years and a part time judicial member of the Administrative Decisions Tribunal since 2007.

The ADT deputy president (full time from commencement of operations in 1998) Magistrate Nancy Hennessy heads the Deputy President of NCAT responsible for management of the internal appeals list. 

Most members of the merged tribunals are probably making the transition but for whatever reason deputy president Higgins isn't listed. Members include experienced FOI/GIPA and privacy hands Steve Montgomery, Peter Molony and Naida Isenberg in addition to Deputy President Hennessy.

In the final ADT annual report Judge O'Connor's reflections include that in 1998, ten years after the FOI act commenced in NSW with the FOI review function allocated to the District Court, there was no body of FOI case law to guide decision making. The ADT in 15 years published around 400 FOI decisions.

In 2012-2013, the ADT had 96 GIPA filings and 43 privacy matters, around the same number as the previous year. Average disposal time 28 weeks. 

The significant appeal cases noted in the report include two GIPA decisions: NSW Office of Liquor Gaming and Racing v Fahey [2012] NSWADTAP 55, and Department of Family and Community Services v Edwards [2013] NSWADTAP 17.

Steady budget allocation for NSW Information and Privacy

Wikimedia Commons Cimexus

The NSW Information and Privacy Commission received an allocation of $5.4 million in the 2011-2012 Budget yesterday (Budget Paper 3 Attorney General and Justice pages 2-62 to 2-68) for the first full year of operations for the combined entity. Last year the Information Commissioner received a total of $4.5 million.The allocation for Privacy NSW, then a business unit of the Department Justice and Attorney General, was not mentioned separately but buried somewhere in departmental accounts. The Privacy NSW Annual Report for 2009-2010 suggests annual expenditure of around $1 million, so in a tight budget Treasury no doubt would see $5.4 million for both in 2011-2012 as reasonable, although privacy has been skinny on resources for years and won't get any big boost out of this.

The comparison with the two offices that currently combine these functions elsewhere are Office of Australian Information Commissioner $12.6 million, and Queensland Information Commissioner $5.9 million

The "intermediate results" the commission is working towards, like last year, raise some interesting challenges for measurement:

This  service group contributes to protection and advocacy of rights in the community, and an open and accountable government, by working towards a range of intermediate results that include:
▪ privacy rights and rights to access information understood by the public
▪ increased access to information
▪ improved protection of personal information
▪ fewer complaints over conduct of government agencies in releasing information
▪ fewer formal applications for access to information
▪ fewer people seeking review of agency decisions
▪ improved information management by agencies
▪ effective stakeholder relationships.

The published performance information, essentially a few outputs (page 2-64), throws little light on the most important milestones on this journey.

The commission has a staff of 32 (33 in 2011-2012) and in the last 12 months undertook 302 reviews compared to the forecast 100, investigated 60 complaints (100), had 438,000 hits on its website (120,000) and received 419 privacy complaints. Only three agency audits were undertaken as against a forecast 10, with only three planned in the year ahead. Not anywhere near enough to my mind to keep agencies on their toes.