The strategy focused on several prongs of attack. The first was putting the finalised guidelines, along with supplementary information sheets and suggestions on how to implement a new policy, onto the Commission's Web site . There is also an e-mail list, called Privacy Connections Network, which sends details of new developments, news of upcoming seminars and other information.
The Commission's main marketing technique has been to partner with peak bodies, such as the Australian Medical Association and the Australian Information Industry Association, to assist it in helping its members to be prepared for the new legislation.
-It's been a rocky road because of the different guidelines being brought out, and the huge stress of introducing new legislation in such a short time frame," said Tim Dixon, chairman of the Australian Privacy Federation. -The resources of the centre are quite limited, $4 million a year, which is less than the budget of most banks on this issue. The Privacy Commission office employs around 35 people, whereas NAB alone have over 100 people working on their privacy policy."
In a bid to shore-up industry-wide support for the project, the final guidelines were developed after an intensive consultation process with the private sector, according to Commissioner Crompton.
-The guidelines reflect a very deep, rich amount of input from outside the Privacy Commissions office," he said.
This regulation will cover all health businesses and any business that turns over more than $3 million a year. This accounts for about three percent of the two million businesses in Australia, but around 70 percent of all business activity.
-Most business people do is with large companies, such as telcos, power companies and other utilities, and finance services. At the other end of the scale, it won't affect the corner store," Crompton explained.
There is no real way to measure the percentage of companies that are compliant with the new regulation, but recent figures are promising. The draft legislation experienced 64,000 downloads, and the finalised legislation, available from September to November, has had 41,000 downloads. More than 70,000 information sheets have also been downloaded.
-We think there are about 60,000 businesses in Australia that have to comply to the new laws, so this is up around the number we are hoping to reach." Said Crompton.
Dixon sees a big gap between those businesses that are ready for the legislation, and those that aren't. -A lot of companies have done nothing at all, especially medium sized companies," he said.
He added, -Some people seem to think all they need is a disclaimer, such as 'We're not going to comply with the privacy regulations and you agree with that.' You simply cannot do that. You can't put in a disclaimer saying 'We're going to break the law'."
There has been a lot of media coverage of the new laws, which Crompton finds encouraging. -Every day we see magazines and newspapers carry articles about the new privacy law, so this must be doing something to raise awareness," he said.
Dixon agreed. -You'd have to be pretty switched-off not to have heard about it by this stage, but there are still some people who say to me 'what's this privacy thing?'"
Failure to be compliant can have huge consequences, according to Crompton. -When we follow a complaint, it is to put matters right. Sometimes that is a simple apology with assurances that the breach won't happen again. In other cases, for instance a woman in America had her insurance agency give the results of a genetic test that showed she had Huntington's disease to her work, and this resulted in her dismissal. In that case we would be chasing compensation in the hundreds of thousands of dollars."
-Those organisations that are not compliant are exposed to complaints about their privacy practice, they're opening themselves to unnecessary risk," said Crompton. He added -It's not often a big deal, but when it is a big deal the power under the act is to fix things."
-The biggest damage is to the [uncompliant] company's reputation," said Crompton. -The loss of consumer trust and confidence can have big impacts. Our policy survey clearly demonstrates that good privacy is good business. People want to know their personal details are safe, and want to be in control of their privacy."
Dixon sees the consumer as instrumental in lobbying companies to conform to the legislation.
-If a company can't provide a company policy, if it doesn't respond quickly to requests for access to personal information, it will be obvious it doesn't comply with the regulations."
He said that the large problems would emerge six to twelve months down the track. -Privacy is a long term issue, not a December 21 issue."
Businesses who wish to ensure they are compliant by the deadline should visit the Privacy Commissioners Web site, www.privacy.org.au or call the hotline on 1300 363 992.
