Who will be involved in the process of developing a scheme?
177. Ideally, the scheme should be developed by a group that is representative of all types of organisations that handle personal information, and of consumers, employees and the general public. The extent to which representatives of government agencies (Federal, State and Territory) should be involved is less clear. Most of these interested parties could perhaps be included in a larger circle of organisations to which periodic reports of progress and drafts can be sent.
178. The Canadian Standards Association process which developed a Model Privacy Code released in 1996 was based on a committee with around 40 members from industry, academia, consumer and employee groups, and government agencies. Sticking points were resolved by dividing into small but representative sub-committees. The intention in Australia is to be as inclusive as possible by seeking input from all interested parties, but there will need to be some way of confining the membership of the scheme development committee to a manageable size.
179. One issue is whether members of any scheme development committee should participate as delegates of particular organisations, with responsibilities to consult with their constituencies as work proceeds. It is suggested that this would not be desirable, and could lead to the exercise losing momentum. Peak organisations and groups could be asked to nominate suitable members, but on the clear understanding that they would participate as individuals. It should be recognised that some peak organisations may have difficulty with this approach.
180. At appropriate stages in the process, drafts could be circulated to interested organisations for the normal process of consultation with their membership or governing bodies, although it would be preferable to limit the number of such stages, given the delays inherent in many internal processes.
181. The private sector organisations that participate in the development of the scheme may not be the same as those that ultimately agree to be bound by the scheme, although it is expected that there would be a significant overlap.
182. To initiate the process, the Privacy Commissioner could invite nominations for membership of a scheme development committee, and could, perhaps together with one or two others, sift through the nominations and propose an initial composition - perhaps with alternates and a second list of people who could be called on to participate in specific sub-committees if and when they become necessary. Where no nominees were forthcoming spontaneously from an important sector or group, the Privacy Commissioner would undertake to approach relevant organisations to find a suitable member.
What are the prospects for participation?
183. The Privacy Commissioner has had extensive consultations, since April, with a range of organisations about the general approach now brought together and presented in this paper. It is necessary to recognise that some groups have had significant reservations about becoming involved in a process designed to bring about a national privacy scheme on a self-regulatory basis. Consumer groups and privacy advocates have generally felt that participation could relieve the pressure for the legislation which they consider necessary. Some of them have taken the view to date that they would prefer to remain outside the process, and concentrate their limited resources on lobbying for statutory protection and on other priorities.
184. Some business groups and individual businesses are also non-committal. They fear that participation will lock them into a process which may lead to unacceptable standards or mechanisms, and while they need not sign up to a self-regulatory scheme they feel that they could be setting themselves up for public criticism if they withdrew at any stage, without any obvious compensatory benefits. Some business groups have also stated that they see little point in participating unless consumer groups are also involved.
185. All of these reactions have simply confirmed that gaining commitment to the process, even before the attempt to build a consensus, will not be easy. However, it is hoped that the arguments put forward in this paper, and the way in which it addresses previous criticisms, may help to persuade key interests to become involved.
186. The Commissioner also hopes that, whatever their reservations, interested parties will think seriously about the consequences if there is no general commitment to proceed with the process. The alternative is continuing uncertainty, the almost certain imposition of a variety of different standards in different sectors or jurisdictions, and a continued growth of public concern and pressure for government action. In this environment, electronic commerce and electronic service delivery initiatives are likely to be held up, either by public resistance to adoption, or by an unwillingness on the part of business to make significant investment decisions without greater certainty about the information handling rules that will apply.
Resources
187. The Privacy Commissioner would be able to provide the secretariat for the scheme development committee, but could not be expected to pay expenses. Representatives of commercial sectors and professional bodies could reasonably be expected to meet their own expenses. Consumer organisations may find this difficult, given their limited funding, and the fact that many consumer and privacy advocates are unpaid volunteers. Case by case negotiation of financial support for particular nominees would seem appropriate.
Ground rules for participation
188. It is assumed that, in accordance with the Prime Minister's request, the Privacy Commissioner will continue to lead the process of developing a national privacy scheme.
189. It will be important for participants to agree on some ground rules, for instance about the balance between publicity and confidentiality in the work of the scheme development committee, responsibility for media comment if any, implications of withdrawal from participation (hopefully not needed), etc. Views on these issues are invited at any time, but will also be appropriate for discussion at the first formal meeting.
Timetable and next steps
190. Initial comments on this paper are requested, either in writing, by electronic mail, or orally, by 15 September 1997.
191. In the meantime, the Commissioner will convene two further meetings, one with consumer and privacy advocates, and one with business/professional interests, in early September. These will provide an opportunity to assess the level of support for the suggested process, and to receive preliminary feedback on the suggested principles and mechanisms.
192. The Commissioner would then convene a series of forums, to be held in each State/Territory capital in October, to explain the proposal to a much broader range of potentially interested parties, and to invite nominations for membership of the scheme development committee. The Privacy Commissioner would consult widely about nominations and, where necessary, recruit additional members; and would seek agreement from all interested parties on an initial composition.
193. The Privacy Commissioner will then convene the first meeting of a provisional scheme development committee later in the year, to commence work on the detailed development of the scheme, according to a process and timetable to be set by the committee.
194. It would be important for there to be a clear timetable and deadline, and milestones for the development of the scheme. While it would be premature to set these in advance of the early meetings, there is a clear sense of urgency about this task, and the Commissioner sees a need for substantial progress during the first half of 1998.