Consumer data right boosts OAIC staff levels

The impending consumer data right will see the biggest influx of staff into the Office of the Australian Information Commissioner in more than five years.

The office’s workforce is pitched to rise from 75 average staffing level (ASL) in 2017-18 to 92 over the next financial year, according to this month’s federal budget, in preparation to handle new workloads.

The recruitment drive will return the privacy and freedom of information authority to staffing levels last seen before the federal government's 2014 plan to dissolve the office, which it subsequently backed down from in 2016.

But the remit of the office has also grown to include the notifiable data breach (NDB) scheme and the forthcoming consumer data right.

At budget estimates last week, acting information and privacy commissioner Angelene Falk said the forthcoming staffing increase “takes account of the ... budget measure on the consumer data right”.

The office was allocated $12.9 million in the budget to handle the consumer data right complaints process – in partnership with the ACCC – over the next four years.

The right will provide consumers open access to their banking, energy, and telco data, with bank data the first to be targeted via the broader open banking initiative.

“We’re in a fortunate position of actually being able to go out and recruit, and we’re at moment making arrangements to move that forward,” Falk said.

The office has operated at below 80 ASL since 2013-14, though its workforce has climbed steadily from its 64 in 2014-15.

In the meantime, the office’s staple work is also continuing to grow due, particularly on the privacy front due to what Falk says is an “increase in community awareness”.

Privacy complaints increased by 14 percent to 2157 in the current financial year up to 31 March, compared with the amount the office had received for the same period last year.

The office also finalised 20 percent more privacy complaints during the period.

Falk said the office was looking to conduct forward planning on the “workload that is likely to occur over the next 12 months”.

While no extra funding has been provided to handle the NDB scheme, Falk said the office was poised to handle the increase in work, which was “commensurate with what [the office] had anticipated”.

“We had done some research in terms of the rollout of similar schemes internationally,” she said.

“We had looked particularly at the Dutch Data Protection Commissioners' Office and also the UK Information Commissioners' Office and Canada.

“We had foreseen an increase of around 500 reports for the year, and we’re expecting that to be on track at the moment.”

Around five staff have been tasked with handling the NDB scheme, but they also juggle other workloads including “proactive Commissioner initiated investigations” like the ongoing Facebook investigation and privacy complaints casework.

On the ongoing Facebook/Cambridge Analytica investigation, Falk said it could “take a little longer” than the six-to-eight months it usually takes to finalise Commissioner-initiated investigations.

“We seek to finalise Commissioner initiated investigations within around six to eight months,” she said.

“I anticipate that this one may take a little longer, depending on the complexity of the issues that arise, but that’s the indicative timeframe.”