Common administrative practices

Case Note Citation

Case Note Citation — Printable version (22 KB)

Adopted:

24th APPA meeting, Melbourne, Australia, 17 November 2005

Abstract:

This statement outlines agreed elements of a system for citing reports of complaints handled by privacy authorities. The citation system seeks to maximise the collective regional benefits of individual report series published by particular privacy authorities by making it easier to clearly identify and refer to reported cases.

Special terms used:

“Case note” is intended to encompass any report outlining the outcome of an investigation, conciliation or determination of a complaint that is contained in a series of reports released by a privacy authority.

Background information:

Graham Greenleaf, “Reporting Privacy Complaints Part 1: A Proposal for Systematic Reporting of Complaints in Asia-Pacific Jurisdictions” 9/3 Privacy Law & Policy Reporter 41-48, available online at http://www.austlii.edu.au/au/journals/PLPR/2002/30.html.

Statement on citation of case notes

Many privacy authorities issue instructive case notes on a selection of complaints that have been handled. It is desirable that all those who wish to refer to a case note can do so by an official citation that unambiguously refers to the same note and has an accepted designator for the privacy authority or other body publishing the report.

APPA particularly wishes to encourage good citation systems given the clear benefit to privacy authorities in the region in the ability to cite reports from other offices. Others engaged in interpreting and applying privacy law will similarly benefit.

It is agreed that all case notes should be issued with a citation including the following elements:

A descriptor of the case
The year of publication
A standard abbreviation for the privacy authority
A sequential number.

Some variety exists in case descriptors currently used by privacy authorities in the region. This diversity is compatible with this statement of common administrative practice. Current approaches include:

Australia and Victoria: reference to complainant by letter of the alphabet and respondent through a general description (e.g. J v Superannuation Provider [2005] PrivCmrA 7)
New South Wales: reference to complainant by letters followed by respondent department’s name (e.g. KJ v Wentworth Area Health Service [2004] NSWPrivCmr 7) New Zealand, Korea and Hong Kong: a short generalised characterisation of the complaint (e.g. Mobile telecom company provided the details of telephone conversation of a customer to a third party without her consent [2004] KRPIDMC 4);
New Zealand and Hong Kong citations add an internal reference number e.g. Man upset that employer disclosed epilepsy to other employees (Case Note 16723) [2003] NZPrivCmr 11).

The year of the note appears in brackets, followed by the abbreviation of the issuing authority and the sequential case note number.

The following abbreviations have been adopted for APPA participants:

HKPrivCmr — Hong Kong Privacy Commissioner for Personal Data
KRPIDMC — Korean Personal Information Dispute Mediation Committee
NSWPrivCmr — New South Wales Privacy Commissioner
NTICmr — Northern Territory Information Commissioner
NZPrivCmr — New Zealand Privacy Commissioner
PrivCmrA — Privacy Commissioner of Australia (changed on 1 November 2010 to AICmrCN — Office of the Australian Information Commissioner)
VPrivCmr — Victorian Privacy Commissioner

Case Note Dissemination

Case Note Dissemination — Printable version (22 KB)

Adopted:

26th APPA meeting, Hong Kong, 9 November 2006

Abstract:

This statement outlines recommended steps for disseminating privacy case notes. These steps seek to maximise the collective regional benefits of individual case note series published by particular privacy authorities by making it easy to obtain case notes on-line and by facilitating re-publication.

Special terms used:

‘Case note’ encompasses any report outlining the outcome of an investigation, conciliation or determination of a complaint that is contained in a series of reports released by a privacy authority.

Related statement:

APPA Statement of Common Administrative Practice on Case Note Citation adopted at the 24th Meeting, Melbourne, Australia, 17 May 2005.

Statement on dissemination of case notes

Many privacy authorities issue instructive case notes on a selection of complaints that have been handled in their jurisdiction.
Privacy authorities disseminate their case notes domestically in a variety of ways depending upon their priorities, budget and target audiences. For instance, some:

maintain a distribution list to which printed copies of case notes are mailed
reprint the text of case notes in annual reports
publicise summaries in newsletters
post case notes on their own website
distribute electronic copies through RSS feeds or email subscription lists
cooperate in re-publication by local legal publishers
periodically publish indexed compilations.

APPA actively encourages privacy authorities to make their case notes widely available to increase comparative knowledge and stimulate research and debate.

This statement is focused upon steps that facilitate the dissemination or availability of case notes throughout the region.

APPA encourages privacy authorities:

to cooperate with third party publishers who wish to re-publish their case notes, and
to make their case notes available, in an electronic form suitable for re-publication, to a recognised regional consolidated point of access.

Third party publishers

APPA recognises that third party publishers can enable case notes to be made more widely available to the public, specialist bodies, professional advisers and researchers.

Privacy authorities should facilitate re-publication of case notes by third party publishers. This should be done by giving a general licence for re-publication of their case notes with proper acknowledgement.

The general licence can be made subject to revocation if inappropriate (e.g. salacious) use is made.

The general licence should be included within the usual copyright notice posted on each privacy authority’s website.

Consolidated point of access

APPA sees considerable value in having a consolidated point of access for case notes. An access point now exists in the World Legal Information Institute’s Privacy Law Library. The single point of access brings a variety of benefits including the ability to search across a range of case note series from within and beyond the region.

Privacy authorities should supply electronic case notes to WorldLII at the same time as they distribute the case notes in the ordinary way or as soon as reasonably practicable after that.

Recommended Common Core Questions for Community attitude surveys

41st APPA Meeting, Seoul, 17-18 June 2014

Abstract:

This statement specifies questions that are recommended for inclusion in community attitude surveys undertaken by APPA member authorities. Use of these common questions will benefit member authorities individually and collectively by enabling meaningful cross jurisdictional comparisons. Over time the resulting data may enable the development of regional benchmarks that could be useful in planning and performance monitoring.

Scope:

This note relates only to surveys of individuals (i.e. community attitude surveys) and not to surveys of organisations.

Background information:

The 25th APPA meeting set up the Asia Pacific Comparative Privacy Statistics Project to:

share knowledge of best statistical practices amongst APPA members;
promote standardisation in statistical practices so as to facilitate comparisons;
enable answers to be given to important questions; and
establish regional statistics and benchmarks.

Earlier projects have included a baseline survey (2006) and an external reference group review of the published statistics of member authorities (2007). The 40th APPA meeting (2013) resolved to develop common core survey questions.

Other useful references: The OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (2013) recommend that “countries should encourage the development of internationally comparable metrics to inform the policy making process related to privacy and transborder flows of personal data”.

Statement on common core questions in surveys:

Many privacy enforcement authorities periodically undertake community attitude surveys. While the scope of these surveys may change from year to year there is a core set of questions that are similar across economies and over time. This core area concerns such matters as public awareness of the privacy law and the enforcement authority. Authorities survey these topics as the answers are useful for planning and in measuring performance. Informed citizens and consumers who are aware of the existence of privacy law or the authority responsible for enforcement are in a position to exercise their privacy rights.

Statistics on community awareness levels and attitudes need to be set in context by comparison with other statistics such the levels recorded in another time or place. To be comparable the other statistics should be generated by asking the same question.

APPA has determined that there will be individual benefit to member authorities, and collective benefit to all APPA members, if the survey results gathered in the core area were to be comparable across jurisdictions. Accordingly, where member authorities undertake community attitude surveys APPA recommends that the questions set out in the schedule be used.

APPA further recommends that member authorities that use these survey questions deposit a copy of the results of these questions with the APPA Secretariat together with details of the survey methodology used and the margin of error. This will facilitate comparison.

Notes in relation to the use of the common questions:

Some departure from the recommended text is permissible so long as the altered question is sufficiently similar to be directly comparable.
The APPA Secretariat will take steps to make the statistics deposited with it available to members and the public. Where sufficient results are available the Secretariat may develop presentations of the statistics that compare the figures and plot trends.
Where sufficient comparable results have been deposited, the Secretariat will calculate and publish regional ‘benchmark’ figures. To ensure comparability the Secretariat will generally only include results within a margin of error of ±4%. At suitable intervals the Secretariat will update the benchmarks to incorporate new data. Authorities are free to use these benchmark figures as targets for internal or external reporting purposes.

Schedule: Recommended common core survey questions

Description of question	Text of question
Prompted: Awareness of privacy law	Are you aware of the [name of privacy law]?
Prompted: Awareness of privacy enforcement authority	Have you heard of the [name of privacy enforcement authority]?

APPA may from time to time adopt additional recommended common core survey questions

Survey results

National Institute for Transparency, Access to Information and Data Protection, Mexico (National Survey on Access to Public Information and Personal Data Protection, January 2015 to April 2016)
Description of question	Text of question	Result — Yes	Result — No
Prompted: Awareness of privacy law	Do you know or have you heard about the existence of a Law in charge of guaranteeing the Right of Access to Public Information?	50.6%	49.4%
Prompted: Awareness of privacy enforcement authority	Do you know or have you heard about the existence of a government institution that guarantees the Right of Access to Public Information and Personal Data?	50.6%	49.4%

Office of the Privacy Commissioner, New Zealand — March/April 2016
Description of question	Text of question	Result — Yes	Result — No	Result — Unsure
Prompted: Awareness of privacy law	Are you aware of the Privacy Act?	65%	33%	2%
Prompted: Awareness of privacy enforcement authority	Have you heard of the Privacy Commissioner?	77%	19%	4%

Office of the Privacy Commissioner of Canada — December 2016
Description of question	Text of question	Result — Yes	Result — No	Result — Unsure
Prompted: Awareness of privacy law	How would you rate your knowledge of your privacy rights?	65%	17%	18%

Personal Information Protection Commission, Korea (Survey on Public Awareness of Data Protection, 2016)
Description of question	Text of question	Result — Yes	Result — No
Prompted: Awareness of privacy law	Are you aware of the Personal Information Protection Act?	91.8% (74% ‘have heard of it’ and 17.8% ‘well aware of it’)	8.3%
Prompted: Awareness of privacy enforcement authority	Are you aware of the Personal Information Protection Commission?	64.6% (54.8% ‘have heard of it’ and 9.8% ‘well aware of it’)	35.5%

Office of the Information and Privacy Commissioner, British Columbia, Canada — February 2017
Description of question	Text of question	Result — Yes	Result — No
Prompted: Awareness of privacy law	Are you aware of the Freedom of Information and Protection of Privacy Act (also referred to as FOIPPA or FIPPA)?	62%	38%
Prompted: Awareness of privacy law	Are you aware of the Personal Information Protection Act (also referred to as PIPA)?	43%	57%
Prompted: Awareness of privacy enforcement authority	Before today, had you heard of the Office of the Information and Privacy Commissioner of BC?	50%	50%

Office of the Australian Information Commissioner — May 2017
Description of question	Text of question	Result — Yes	Result — No	Result — Unsure
Prompted: Awareness of privacy law	Were you aware that an Australian Government Privacy Commissioner exists to uphold privacy laws and to investigate complaints concerning the misuse of personal information?	47%	45%	8%

National Privacy Commission, Philippines — June 2017
Description of question	Text of question	Result — Yes	Result — No
Prompted: Awareness of privacy law	Are you aware of the Data Privacy Act 2012 of the Philippines?	13%	87%
Prompted: Awareness of privacy enforcement authority	Are you aware of the National Privacy Commission or NPC?	11%	89%

Regional benchmarks for awareness of privacy law and privacy authorities

Question	Average	Range
Are you aware of the [name of privacy law]?	67%	43-91%
Have you heard of the [name of privacy enforcement authority]?	60%	47-77%

The APPA Regional Benchmarks for Community Awareness of Privacy Law and Privacy Authorities have been compiled from the results of surveys undertaken by APPA member authorities using similar questions that generate comparable results.

APPA has chosen to establish benchmarks for levels of awareness of privacy law and of privacy authorities as it believes that measurement of these matters may be useful for APPA members in planning and in measuring performance. Informed citizens and consumers who are aware of the existence of privacy law or the authority responsible for enforcement are in a position to exercise their privacy rights.

It is common for public bodies, including privacy authorities, to set targets for their performance. These can be maintained as internal targets for the use of staff and management. Or they can be set as external performance indicators and reported publicly or reported as an accountability measure to oversight bodies such as Legislatures. Targets are usually set to be realistically achievable but also to ‘stretch’ the public body and encourage it to aim to do better. Public bodies may also find it useful to measure their performance against their peers. Targets that are set by reference to international standards may have particular credibility in the eyes of stakeholders.

The APPA benchmarks may be useful to APPA members in several ways, including:

In setting an internal target for the first time, the APPA ‘range’ benchmark may help APPA authorities to devise a target that appears to be realistic to achieve.
APPA authorities can use the benchmark to stretch themselves in internal targets e.g. in relation to public communications work an ambitious target might be set to achieve awareness levels ‘at least 10% higher than the APPA benchmark’.
In setting an external performance indicator an authority could rate themselves against levels achieved across the region e.g. ‘To maintain awareness levels equalling or exceeding the regional average measured in the APPA benchmark’.