Functions of the OPC
Organising model
Strategy and insights
Legislation and policy
“We understand trends and technological
inform
“We build the privacy system and make
developments to be relevant in the future”
the rules”
update
inform
align
Commissioner
Advocacy and education
Over-
see
Compliance and Monitoring
“We exert influence for better
“We improve the privacy practice of
privacy choices”
inform
agencies”
coordinate
inform
Investigations and complaints
“We help individuals with their privacy rights”
1
Strategy and insights
“We understand trends and technological developments to be
relevant in the future”
Mandate
Measures of success
Key activities
The Office is expected to monitor
• Invitations to international and
• Identify best practices, trends
trends, develop insights, conduct
national speaking events on
and challenges to privacy in NZ
research and report back on it.
topics of public interest and
and internationally
(Section 12/1/ j, k, m, n, q)
future trends
• Lead privacy research and
• Media coverage
technological assessments
• Informed internal decision
• Develop and communicate
making
strategy internally
• Orchestrate business
intelligence activities
Processes and tasks
• Develop and coordinate delivery of a governance strategy.
• Develop and own the relationship management strategy.
Strategy
• Facilitate informed SLT decision making. Coordinate, monitor and
communicate strategy implementation.
• Lead statistics and business analytics practices.
Tactics
• Engage in literature reviews and commissioning of research.
• Asses technological changes and coordinate with international.
counterparts on analysis and evaluations.
Operations
• Coordinate international engagements and relations.
2
Legislation and policy
“We guide the privacy system and make the rules”
Mandate
Measures of success
Key activities
The Office has a role in reviewing
• Privacy supportive
•
Provide advice to government,
draft legislation and commenting
legislation
Ministers, Parliament and
on both government’s and the
• Policies and proposals that
private sector
private sector’s policy proposals.
take a privacy by design
•
Prepare reports and
The Office must also report on the
submissions
operation of its own Act. (Section
approach
•
Implement strategy around
13(1) (f, j, k, l, o, q, r) and Section
• Legal powers that support
areas for policy focus
26)
the Office’s mandate
Processes and tasks
• Prepare and deliver advice to agencies on policy proposals
Strategy
• Report on areas affecting individual privacy
• Report on the operation of the Privacy Act
• Prepare submissions to Parliament and HRRT
Tactics
• Work on OIA requests and ombudsman consults
Operations
3
Compliance and Monitoring
“We improve the privacy practice of agencies”
Mandate
Measures of success
Key activities
The Office has a role in promoting
• Engaged and cooperative
• Identify systemic compliance
compliance with its Codes, notices,
agencies
issues and (negative) trends
directions, information sharing
programs and principles. The Office
• Improved identification and
• Develop and prioritise a
also has a role in conducting inquiries
response to systemic issues
programme of work for
into matters affecting the privacy of
• Improved business
audits/ OMIs
individuals.
intel igence
• Monitor and fol ow up on
(Section 13(1) (b, k, m, s), 96W, 96 X
compliance
and clause 96A, 124)
Processes and tasks
• Receive input from investigations/complaints function and business intel igence
Strategy
• Align on legislative implications from policy function
• Prepare compliance work plan
• Prepare compliance reports for information sharing programs and Codes
• Monitor trends in policy and complaint work
Tactics
• Review data breach reporting and fol ow up on outcomes
• Monitor compliance with compliance notices/access directions
• Undertaking audits of information systems at agencies request
Operations
• Undertake own motion inquiries
4
Advocacy and education
“We exert influence for better privacy choices”
Mandate
Measures of success
Key activities
The Office has a role in
• Network strategy to work with
• Understand the privacy challenges
educating both agencies and
key multipliers and opinion
and risks of different individuals in NZ
leaders (non-profit and private
• Deliver on networked information and
individuals about privacy good
sector organisations)
education strategy
practice. The Office also has a
• Strength of inter-agency
• Liase with other agencies on
role in advocating for privacy
networks and ability to set
government agenda setting
positive behaviours and
government agendas
• Advocate for privacy to be part of
technology.
• Number of young NZers reached
school curriculums and academic
(Section 13(1) a, g, h, n)
meaningfully
research areas
• PR and media engagement
Processes and tasks
• Develop and coordinate delivery of an education and information
strategy, including
Strategy
a) Identify key sectors, demographic groups and vulnerable NZers the
Office wishes to reach
b) Develop clear and consistent messages,
Tactics
c) Align with government, non-profit and private sector organisations on
areas of joint interest and cooperation opportunities
d) Engage with network of multipliers to disseminate key messages
Operations
• Set up and work through inter-agency groups (e.g. Privacy as Human
Right, Consumer Protection, Education)
• Develop and execute PR and media strategy and ad hoc engagements
5
Investigations and complaints
“We help individuals with their privacy rights”
Mandate
Measures of success
Key activities
The Office has a role in
• Length of the complaint backlog
• Process complaints
investigating complaints about
• Service quality provided
• Run analytics on complaints
• Systemic issues identified for
• Monitor service levels and
non-compliance with the Act
the compliance and monitoring
customer satisfaction
from individuals. The Office has
function
• Make tactical changes to
a strong dispute resolution
processes based on contextual
focus.
factors
(Part 8)
• Manage data breach notifications
Processes and tasks
• Handle complaints and follow investigations procedures
• Provide training and continuous improvement opportunities for staff
Strategy
• Gather team insights on systemic challenges to support the business
analysis function
• Workshop solutions for contextual responses
Tactics
• Receive and process data breach notifications
Operations
6
Document Outline
