Guidance on the ‘Anonymity and Pseudonymity’ principle

20.66 In DP 72, the ALRC proposed that the OPC should provide guidance to agencies and organisations on the ‘Anonymity and Pseudonymity’ principle. Such guidance could cover: when it is and is not lawful and practicable to give individuals the option to transact anonymously or pseudonymously; when it would be misleading for an individual to transact pseudonymously with an agency or organisation; and what is involved in providing a clear option to transact anonymously or pseudonymously.[88]

20.67 The proposal for OPC guidance received significant support from stakeholders.[89] Some stakeholders, however, suggested that the OPC should be required to consult with relevant stakeholders when preparing this guidance.[90] For example, the Department of Human Services submitted that the OPC should consult with the Department and its agencies to ensure that the guidance takes into account the nature of Departmental business and the operations of service delivery agencies.[91] Similarly, Optus recommended that the OPC consult with affected businesses to ensure that significant compliance costs do not arise from actions taken to comply with this guidance.[92]

20.68 A small number of stakeholders did not support the proposal for OPC guidance.[93] GE Money, for example, did not agree that the OPC should issue guidance on when it is and is not lawful and practicable to permit an individual to transact with it anonymously or pseudonymously.[94] It submitted that these considerations will depend on a range of different obligations on organisations to identify their customers, such as anti-money laundering legislation. These primarily will not be requirements under privacy laws.[95]

ALRC’s view

20.69 Guidance from the OPC will be integral to the application of the ‘Anonymity and Pseudonymity’ principle. In particular, this guidance will assist agencies and organisations to assess the types of interactions where anonymous and pseudonymous options are suitable. Such guidance also will help to clarify the factors an agency or organisation should take into account when determining whether the balance between the requirement that the option be ‘practicable’ and the potential compliance burden that implementation of such an option would have on agencies and organisations has been met.

20.70 The ALRC agrees that some industry sectors will have particular obligations that the OPC should take into account when it is developing guidance on the application of the ‘Anonymity and Pseudonymity’ principle. These may include those agencies and organisations that are subject to the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and agencies involved in service delivery. The Privacy Commissioner is required, in performing his or her functions, to recognise ‘the right of government and business to achieve their objectives in an efficient way’.[96] In some situations, the OPC’s compliance with this objective will include consulting with affected agencies and organisations when it develops guidance.[97]

Recommendation 20-2 The Office of the Privacy Commissioner should develop and publish guidance on:

(a) when it is and is not ‘lawful and practicable’ to give individuals the option to interact anonymously or pseudonymously with agencies or organisations;

(b) what is involved in providing a ‘clear option’ to interact anonymously or pseudonymously; and

(c) the difference between providing individuals with the option to interact anonymously and pseudonymously.

[88] Ibid, Proposal 17–4.

[89]Australian Privacy Foundation, Submission PR 553, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Optus, Submission PR 532, 21 December 2007; Suncorp-Metway Ltd, Submission PR 525, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Office of the Victorian Privacy Commissioner, Submission PR 493, 19 December 2007.

[90]Australian Government Department of Human Services, Submission PR 541, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007; Optus, Submission PR 532, 21 December 2007.

[91]Australian Government Department of Human Services, Submission PR 541, 21 December 2007.

[92]Optus, Submission PR 532, 21 December 2007.

[93]BPay, Submission PR 566, 31 January 2008; Australian Direct Marketing Association, Submission PR 543, 21 December 2007; GE Money Australia, Submission PR 537, 21 December 2007.

[94] GE Money Australia, Submission PR 537, 21 December 2007.

[95]Ibid.

[96]Privacy Act 1988 (Cth) s 29(a).

[97] The Office of the Privacy Commissioner is discussed in Part F.