FOIREQ24/00623 137
Appendix B – Historical funding profile & composition
Page
6 of
9
FOIREQ24/00623 138
Appendix C – Historical appropriation funding – terminating versus non-terminating
Page
7 of
9
FOIREQ24/00623 139
Appendix D - Description of funding components
Component
Description
OAIC Base Privacy
Total funding from 2009 to 2016, Is solely Privacy funding from 2017 onwards after the transfer back from AHRC and AGD.
Additional Privacy Funding
This includes various terminating measures since 2017, being:
• Privacy/Social Media - First 3 years - a new privacy regime for social media/online platforms that trade in personal
information, underpinning new penalties/enforcement powers under the Privacy Act, ensuring that there are
appropriate safeguards and penalties for the misuse of private information, including by major social media platforms.
• Shared service transition & federal court costs - transition costs to DEWR/SDO/SAP and ongoing social media litigation.
• Privacy/Social Media - Second 2 years - to process privacy complaints and enhance the OAIC's capacity to take regulatory
action for breaches of privacy, e.g. litigation against social media platforms. Funding until end of Privacy Act Review.
• Strengthening Privacy – NDB work/incl. major investigations, data capability, strategic review and Privacy Commissioner.
OAIC Base FOI
Comprises the FOI funding returned to the OAIC after the reorganisation, being:
(2017 onwards)
• 2017 - funding returned from AHRC and AGD
• 2018 - funding returned from AAT (incl. merits reviews, document management and dealing with ex AAT clients
FOI Commissioner
To fund the FOI Commissioner and support staff.
(2022 onwards)
CDR
Combines the various CDR components, being:
(2019 onwards)
• The OAIC and Australian Competition and Consumer Commission (ACCC) co-regulate the CDR scheme. The OAIC is the
primary complaint-handler and has responsibility for overseeing the privacy aspects of the scheme. The OAIC also works
closely with the ACCC to deliver a consumer education campaign and to publish guidance for consumers and industry.
• VDR Enhancement & Future Directions - Continued regulation of the CDR scheme reflecting the expansion of the scheme
to include new sectors.
Page
8 of
9
FOIREQ24/00623 140
Component
Description
National Security
Regulatory oversight of privacy implications arising from the Counter-Terrorism Legislation Amendment (Foreign Fighters) Act
(2016, 2017 to 2019 in AHRC) 2014 and the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015. Oversight includes
provision of guidance material, assessments, advice and complaint handling activities.
Welfare data matching
To provide regulatory oversight of privacy implications arising from the Department of Human Services’ (DHS) Increased
(2016 to 2019)
Welfare Compliance from Data Matching NPP
MBS/PBS
Complaint handling for the guaranteeing Medicare regime, and the mechanism through which consumers can seek a formal
(2019 onwards)
remedy to redress a breach of their privacy and respond to general enquiries from the community. This includes investigating
and taking enforcement action in relation to breaches of the scheme, including the conduct of Commissioner-Initiated
Investigations. The funding also enables the OAIC to undertake two privacy assessments (audits) per year to proactively
monitor whether information subject to the arrangements is being maintained and handled in accordance with the relevant
legislative obligations and recommend how areas of non-compliance can be addressed and privacy risks reduced.
Digital Identity
To acquit the statutory requirements of the digital identity scheme while also appropriately focusing on the timely
investigation and enforcement of high-privacy risks. From January 2024 relates to the implementation of the new Digital
Identity framework with the aim to have the framework in place from July 2024. This was extended for one year in the 2024-
25 budget to commence the operation of the new Digital Identity framework.
MyHealth Record
To continue to undertake the My Health Record privacy regulatory functions. This is done to provide the community with
confidence in the handling of digital health information.
Optus
To support the OAIC’s response to the Optus incident in the form of an investigation into the personal information handling
practices of Optus companies.
Page
9 of
9
Related HTB: Nil
FOIREQ24/00623 141
ESTIMATES BRIEF
Staffing – Figures are as at 6 November 2024
Key Points
• Current budgeted 2024/25 ASL: 172 (2023-24: 200)
• Figures as at 6 November 2024
o FTE number: Payrol = Total 173.5
o Headcount: Payrol = Total 194
(Definition: Includes ongoing, non-ongoing, casual, secondments out of the agency paid for by OAIC,
extended leave of 3 months or more paid/unpaid absence, maternity leave paid/unpaid. Excludes
staff on section 26 temporary transfers out of the OAIC, and external staff)
• Vacancies: The OAIC is currently undertaking an organisational restructure. There are no
identified vacancies at this time, however as vacancies arise, internal staff wil be
considered prior to conducting external recruitment processes.
• Staff sentiment data: See brief ‘
OAIC APS Census Results’ for recent high-level results
• Expenditure on staff training as at end of Period 1: $70,000
Page
1 of
4
FOIREQ24/00623 142
Branch
Headcount
FTE
Separations
FYTD
Dispute Resolution
52
48.0
4
Regulation and Strategy
37
31.8
2
Freedom of Information
36
29.3
3
Corporate
27
26.1
1
Corporate - Legal
17
16.8
2
Executive
15
14.9
4
Major Investigations
11
10.6
1
Digital ID Implementation Team
7
6.4
2
Total
202 183.9
19
Page
2 of
4
FOIREQ24/00623 143
Page
3 of
4
FOIREQ24/00623 144
Substantive
FTE
Classification
SOH
3.0
SEB 2
SEB 1
6.9
EXEC 2
33.5
EXEC 1
54.7
APS 6
54.8
APS 5
20.0
APS 4
8.6
APS 3
APS 2
2.4
Total
183.9
Update ‘Current at’ date below
Cleared by:
Action officer:
fol owing each update
Brenton Attard
Mark Smolonogov
Current at: 20 November 2024
Phone number:
Action officer number:
02 9942 4046
02 9942 4243
Page
4 of
4
FOIREQ24/00623 146
• However the results may also reflect significant program of change
within the OAIC that commenced in 2023 and wil continue to be
delivered over the next 12 months.
• Our highest rankings as an agency were in Leadership for SES Manager
and Immediate Supervisor:
o The OAIC ranked 22nd and 35th respectively out of 104 agencies
o Positioned above the APS score for these indexes
• Our lowest rankings as an agency were in Employee Engagement and
Enabling Innovation:
o The OAIC ranked 49th and 76th respectively out of 104 agencies
o Our Employee Engagement index was positioned above the APS
index
o Our Enabling Innovation index fel below the APS index
Current action
• Receiving feedback from Executive
• Communication of draft priorities to staff
• Integrate feedback into proposed 2024 Census Action Plan (Roadmap)
• Share Census Action Plan and settle (mid-Nov)
• Publish agency results and Roadmap on OAIC’s website (late Nov)
Key Focus Areas to inform Census Roadmap
• Embedding the new structure
• Building leadership capability
• Teamwork for the Executive
• Change Management
• Health and Wel being
Page 2 of 3
FOIREQ24/00623 147
• Access to tools and resources
• Enhance integrity culture
Expected next steps/dates
• The OAIC is currently going through a period of significant change and
moving from a current to future state structure through an
organisational redesign project.
• The key focus for the Transformation and People and Culture teams
leading the organisational redesign work is to ensure the new structure
is embedded smoothly, and to provide staff with as much certainty as
possible.
Background: public matters only
Issues of note for OAIC: Nil
Page 3 of 3
FOIREQ24/00623 149
OAIC received initial list of OAIC matters affected
13 June 2023
by cyber attack
OAIC placed a statement on its website in relation 15 June 2023
to HWLE data breach
First tranche of documents provided to OAIC by
17 June 2023
HWLE
First notification by OAIC
3 July 2023
Second notification by OAIC
11 July 2023
Assessment of personal information and risk of
July-August-
serious harm
September-October
HWLE notified s 47E(d)
17 October 2023
HWLE contacted a third party whose customers’
20 October 2023
information was compromised in the breach
Third party responded to HWLE stating that al of
20 November 2023
their affected customers have been notified
No further updates
beyond this date
Expected next steps/dates
• n/a
Background: public matters only
Issues of note for OAIC
• OAIC has a CI underway, refer to separate briefing.
Page 2 of 2
Related HTB: Nil
FOIREQ24/00623 150
ESTIMATES BRIEF
External Legal expenditure
(Al costs up to 31 October 2024 and are including disbursements and excluding GST)
Key statistics
• The OAIC received the following funding allocations for litigation:
o 20/21 $2.42M s 47E(d)
o 21/22 $2.32M
o 22/23 $4.29M
o 23/24 $10.43M s 47E(d)
contingent
privacy litigation funding
o 24/25 s 47E(d)
contingent privacy litigation funding
• Total contingent privacy litigation funding s 47E(d)
• The OAIC spent the fol owing on external legal costs (per the annual OLSC reports) (broken down by
enforcement actions and remitted matters)
o 20/21 $0.922M (plus internal $1.483M)
o 21/22 $1.032M (plus internal $1.276M)
o 22/23 $5.700M (plus internal $1.703M)
o 23/24 $8.089M (plus internal $3.327M)
• Our budget for external legal expenditure in 24/25 is $2.5M
Significant litigation
• The mos
een involved are:
o s 47E(d)
In 2020, AIC filed civil penalty proceedings
against Facebook, alleging contraventions of s 13G in relation to APP 6 and APP 11.1. The
Commissioner alleges that the personal information of Australian Facebook users was disclosed to
the This is Your Digital Life app for a purpose other than the purpose for which the information was
col ected, and that Facebook did not take reasonable steps to protect its users’ personal information
from unauthorised disclosure.
o s 47E(d)
. AIC filed for civil penalty proceedings against ACL
for contraventions of s13G in relation to APP 11.1 and the notifiable data breach regime. The
Commissioner alleges that ACL failed to take reasonable steps to protect personal information it held
from unauthorised access, failed to carry out a reasonable and expeditious assessment of whether
there had been an eligible data breach and failed to notify the AIC of an eligible data breach as soon
as practicable.
o s 47E(d)
- Mr Patrick has applied to the High Court of
Australia for special leave to appeal a Full Federal Court’s decision affirming that there was not
unreasonable delay in handling his IC Reviews under the Administrative Decisions (Judicial Review)
Act 1977 (Cth).
o s 47E(d)
. AIC filed for civil penalty proceedings against
Medibank for contraventions of s13G in relation to APP 11.1. Details below.
• Spend against contingent litigation fund
o s 47E(d)
o Balance of the fund not expended s 47E(d)
Key messages
• The OAIC is progressing enforcement action in a targeted and fiscally conscious manner.
• Litigation funds remain available to the OAIC.
Page
1 of
2
FOIREQ24/00623 151
Significant investigations
• The OAIC also incurs external legal costs in the course of undertaking significant investigations. The major
investigations involving considerable external legal expenditure to date include:
o s 47E(d)
Data breach involving the unauthorised access to
Optus systems and exfiltration of the personal information of more than 9.5 million individuals,
including identification information such as driver licences, passports and Medicare numbers. Matter
is currently under investigation.
o s 47E(d)
Data breach involving unauthorised access to
Medibank’s systems and exfiltration of personal information, affecting approximately 9.7 million
individuals. Matter in litigation.
o s 47E(d)
. An allegation relating to AMEX’s failure to
protect personal information from unauthorised access on several occasions.
o s 47E(d)
Data breach involving unauthorised access and
exfiltration of data from HWLE’s systems.
o s 47E(d)
Data breach involving unauthorised access to
Latitude’s systems and exfiltration of personal information of approximately 14.1 million individuals
in Australia and New Zealand. Investigation conducted jointly with Office of the Privacy
Commissioner New Zealand. Matter is currently under investigation.
Key messages
• These investigations are at various stages with each being managed according to an investigation
plan.
Update ‘Current at’ date below
Cleared by: Elizabeth Tydd
Action officer: David Moore
fol owing each update
Current at: 23 October 2024
Phone number: 02 99420436
Action officer number: 02 9942 4131
Page
2 of
2
FOIREQ24/00623 153
July – Oct 2020
• The OAIC and five other data protection and privacy
regulators set out principles to address some key
privacy risks
with video teleconferencing and issued
guiding principles.
April 2020
• Federal Court granted leave to serve
commencement proceedings on
Facebook. Ongoing
matter fol owing High Court revocation of leave.
June 2020 -
•
COVIDSafe assessment program: 5 assessments
August 2022
following the information lifecycle of COVID app
data, 6 monthly reports under s 94ZB (last Nov
2022). External costs $725K.
October 2020
•
Privacy Act Review commenced and underwent two
rounds of public consultation with an initial Issues
Paper (2020) fol owed by a Discussion Paper in
October 2021. The OAIC engaged closely with the
Department throughout the review process and
made significant submissions to both of those
consultations to ensure Australia’s privacy
framework is fit for purpose in the digital age.
October 2020
• The OAIC and the UK ICO presented a
Resolution on
Facial Recognition Technology at the Global Privacy
Assembly (GPA) Closed Session Conference. The
OAIC worked with other GPA members to develop
principles and expectations for the appropriate use
of personal information in FRT.
• The Resolution for the principles was passed at the
44th GPA in Istanbul in October 2022.
July 2021
• Privacy determination fol owing CI into
Uber
Technologies and Uber BV
September 2021 • Determination fol owing CI into
7-Eleven
October 2021
• Privacy determination fol owing CI into
Clearview AI
October 2021
• The OAIC took part in the
Global Privacy
Enforcement Network (GPEN) Sweep 2020–21
which examined how privacy considerations have
been taken into account by organisations
responsible for various COVID-19 solutions and
initiatives, including in the deployment of contact
tracing mobile apps.
December 2019 – • The OAIC worked closely with the Attorney-
March 2022
General’s Department in developing the Privacy
Page 2 of 3
FOIREQ24/00623 154
Legislation Amendment (Enhancing
Online Privacy
and Other Measures) Bil .
• The OAIC continued to liaise closely with the
Department as it then developed the
Privacy
Legislation Amendment (Enforcement and Other
Measures) Act 2022, which introduced increased
penalties for serious and repeated privacy breaches
and other targeted measures to enhance the OAIC’s
ability to protect Australian’s privacy in the digital
environment.
November 2021
• Determination fol owing CI into
Australian Federal
Police’s use of Clearview.
March 2022
•
Digital Platforms Regulators Forum (DP-REG) was
(ongoing)
established.
August 2023
•
Global expectations of social media platforms and
other sites to safeguard against unlawful data
scraping – the OAIC and 11 other international data
protection and privacy regulators released a joint
statement to address the issue of data scraping on
social media platforms and other publicly accessible
sites.
January 2024
• On 19 January 2024, the OAIC sent preliminary
inquiries to TikTok.
January 2024
• The OAIC took part in the
Global Privacy
(ongoing)
Enforcement Network (GPEN) Sweep 2024 which is
examining deceptive design patterns (also known as
“dark patterns”).
Ongoing
•
Global Privacy Assembly – participate in annual GPA
conference and engages with the GPA’s Working
Groups, including the Digital Citizen and Consumer
Working Group and the International Enforcement
Working Group.
Page 3 of 3
FOIREQ24/00623 156
• Senator James McGrath (Lib) asked the NDIS about its processes for
protecting privacy when using third party contractors. Questions
included ‘does the NDIS have internal requirements that "classified or
sensitive" work be kept onshore for confidentiality reasons? and how
does the NDIS ensure that al "classified and sensitive" information that
is provided to third party providers for the purposes of completing work
is kept confidential?4
• Senator Paterson (Lib) asked Home Affairs about progress of the
cybersecurity plan.5
Background: public matters only
Issues of note for OAIC
• None. Key issues are in transcript of OAIC’s appearance at previous
estimates.
4 https://www.aph.gov.au/api/qon/downloadattachment?attachmentId=47be13a4-0d52-4bca-b2a5-
7cb9a6b5e396
5 https://www.aph.gov.au/api/qon/downloadattachment?attachmentId=072b8e82-40a0-4a7b-9a1b-
dad931dad69c
Page 2 of 2
FOIREQ24/00623 158
• On 17 and 18 October 2024, OAIC notified 60 staff that their roles may be
‘excess’ (i.e., more staff than roles available) and would be invited to
complete an expression of interest for available roles.
• Fol owing the completion of the EOI process on 18 November 2024, 47 of
the 60 staff were placed in roles, while 5 had resigned from the OAIC to
pursue other opportunities. This means there were 8 staff not placed in
roles. The OAIC is having individual discussions with these staff through via
the ‘excess employee’ provisions in OAIC’s enterprise agreement.
• These arrangements also include opportunities for transfers to other
agencies – this program of work has facilitated a number of placement of
staff in other agencies and reduced the ‘potential excess’ staff.
Recent developments
• Nil to note.
Expected next steps/dates
• October 2024 to early November – finalisation of expressions of interest.
• 3 December 2024 – staff begin working in new organisational structure.
• November 2024 to February 2024 – redeployment processes for excess
staff, and potential redundancies.
Background
Budget and expenditure reduction
• The May 2024 Budget resulted in a reduction of the OAIC’s total operating
budget by 23% ($11.1m) and its staffing cap by 13% (26.3 ASL).
• OAIC did not immediately reduce its staffing on the belief that additional
funded activities would be conferred in MYEFO 2025 which it would need
current staff to deliver.
• However, it became apparent in July 2024 that additional funding would
not be available. This necessitated rapid reductions as OAIC’s rate of
expenditure at the start of 2024/25 put it on track for a deficit of
approximately $14m.
• OAIC’s incoming commissioners and leadership team have acted quickly to
reduce expenditure, including cutting supplier costs, closing OAIC’s
Canberra office, and returning seconded staff to home agencies. Applying
Page 2 of 4
FOIREQ24/00623 159
these measures, OAIC is on track to post a manageable deficit for 2024/25
that can be covered by OAIC’s cash reserves.
• OAIC has also refocused an ongoing organisational change project,
Designing the Future OAIC, towards supporting OAIC to operate
sustainably and with maximum effectiveness at a smal er scale.
Designing the Future OAIC and OAIC Strategic Review
• Designing the Future OAIC arose from a Strategic Review of the OAIC
conducted by an external consultancy, Nous Group, in late 2023. The
review was overseen by a Steering Group including the Attorney-Generals’
Department and the Department of Finance.
• The Strategic Review report was delivered to the Australian Information
Commissioner and the Secretary of the Attorney-Generals’ Department on
19 February 2024.
• The report has been released in part under the FOI Act. This release
includes al recommendations addressed to the OAIC. A decision about the
release of the balance of the report would be a matter for Government.
• The report made 11 recommendations. This included a recommendation
to redesign the OAIC’s structure to better reflect the 3-Commissioner
model. To achieve this recommendation and deliver more efficient and
effective regulatory functions OAIC has been conducting a restructure
project, Designing the Future OAIC, since June 2024.
• The redesign project and related organisational structure reflects the:
o strategic review findings in relation to a revised OAIC regulatory
focus on proportionality; education and enforcement together with
a less risk adverse approach and more streamlined procedures;
o promotion of Commissioner priorities;
o OAIC Four Operating Pil ars: Purpose; People Orientated;
Proportionate and Proactive;
o adjustment of our staffing profile to support mandatory front-line
regulatory services with appropriate staffing levels and a
commensurate reduction in executive level staff.
Staffing level reductions
• After OAIC became aware of the need to reduce its staffing level, the
change project was refocused towards an objective of reducing OAIC’s
staffing level, from approximately 200 to approximately 165 FTE, to
operate within in the 2024/25 budgetary parameters.
Page 3 of 4
FOIREQ24/00623 160
• Consultations under OAIC’s Enterprise Agreement were conducted on a
proposed structure between 3 and 20 September 2024.
• OAIC’s future structure and staffing levels wil be announced to staff on 9
October 2024, and ‘excess employee’ consultation processes with
individual staff wil begin on 16 October 2024 and run through to early
2025.
• OAIC is redeploying staff to other roles within and outside the OAIC where
possible to minimise job losses. However, some voluntary and involuntary
redundancies are likely to affect approximately 5-10% of the OAIC’s
workforce between October 2024 and February 2025. Management and
senior executive roles are most affected.
Impact on OAIC due to staffing reductions
• The scale of these staffing reductions and disruption from the change wil
reduce OAIC’s activity levels and performance this financial year. This wil
be most pronounced in the first half of the 2025 calendar year, during
which OAIC wil be operating below its ideal staffing level.
• The OAIC’s leadership plan is designed to ensure that performance wil
stabilise and improve from the second half of 2025, when the benefits of
the change project underway wil be realised.
• OAIC is seeking to minimise disruption to services, especial y mandatory
casework services (FOI reviews and privacy complaints). By prioritising this
work, OAIC seeks to avoid growth in case backlogs and minimise direct
impacts on the community.
Page 4 of 4
