Balancing data quality and other privacy interests

27.30 In its review of the private sector provisions of the Privacy Act (the OPC Review), the OPC noted that some organisations consider that their obligations under NPP 3 to keep personal information up-to-date and accurate are absolute, and could be used to justify intruding upon an individual’s privacy.^[29] In other words, compliance with the ‘Data Quality’ principle could result in intrusions upon an individual’s privacy.

27.31 A question arises, therefore, whether the ‘Data Quality’ principle should be amended to make it clear that the obligation to maintain data quality is qualified. An express provision to this effect is included, for example, in the data quality principles in the OECD Guidelines^[30] and in Canadian privacy legislation.^[31]

27.32 In the OPC Review, the OPC stated that it is not reasonable to take steps to ensure data accuracy where this has no privacy benefit for the individual. It considered that legislative amendment of NPP 3 was unnecessary, but indicated that it would issue further guidance to organisations about their obligations under NPP 3 to ensure a proportional approach is taken to compliance.^[32]

27.33 This approach was supported by a large number of stakeholders that made submissions in response to IP 31^[33] and DP 72.^[34] The Australian Privacy Foundation and the Cyberspace Law and Policy Centre also suggested that a statement should be included in a note to the principle or in the relevant Explanatory Memorandum that, in assessing what is ‘reasonable’ in the context of the ‘Data Quality’ principle, regard should be given to the potential for errors to result in detrimental consequences for the individual whose personal information is held.^[35]

ALRC’s view

27.34 Many stakeholders submitted that it was unnecessary for the ‘Data Quality’ principle to make it clear that there is no absolute obligation on agencies and organisations to ensure that personal information they collect, use or disclose is up-to-date and accurate.

27.35 In the ALRC’s view, it is unnecessary to insert a note or include in the Explanatory Memorandum a provision that stipulates that the obligations in the ‘Data Quality’ principle are not absolute. Such a note or provision runs the risk of causing more confusion than it resolves. The OPC has already undertaken to provide further guidance on this issue and this guidance should adequately address the issue.