Section Sch6-3 — Privacy Act 2020: Technical standards

3 Technical standards (1) The agency primarily responsible for the operation of an authorised information matching programme must establish and maintain detailed technical standards to govern the operation of the programme. (2) The technical standards established by an agency in accordance with subclause (1) must deal with the following matters: (a) the integrity of the information to be matched, with particular reference to— (i) key terms and their definition; and (ii) relevance, timeliness, and completeness: (b) the matching techniques to be used in the programme, with particular reference to— (i) the matching algorithm: (ii) any use of unique identifiers: (iii) the nature of the matters being sought to be identified by the matching process: (iv) the relevant information definitions: (v) the procedure for recognising matches: (c) the controls being used to ensure the continued integrity of the programme, including the procedures that have been established to confirm the validity of matching results: (d) the security features included within the programme to minimise and audit access to personal information, including the means by which the information is to be transferred between agencies. (3) The technical standards established in accordance with subclause (1) must be incorporated in a written document (in this clause, a Technical Standards Report ), and copies of the Technical Standards Report must be held by all agencies that are involved in the authorised information matching programme. (4) Variations may be made to a Technical Standards Report by way of a Variation Report appended to the original report. (5) The agency that prepares a Technical Standards Report must forward a copy of that report, and of every Variation Report appended to that report, to the Commissioner. (6) The Commissioner may at any time direct that a Technical Standards Report be varied, and that direction must be complied with by the agency that prepared the report. (7) Every agency involved in an authorised information matching programme must comply with the requirements of the associated Technical Standards Report (including any variations made to the report).