Privacy 108’s Top 10 Blog Posts for 2022

Employee Photos and Privacy: Privacy 108 Guidelines

Our most-read blog post for 2022 was our guide to managing employee photos and privacy.

Some of the key takeaways from the post include:

• Employee photos may be personal information for the purposes of the Privacy Act, particularly if they are taken at social events (and so unlikely to be part of an ‘employee record’).
• Although not necessarily required, the Australian Privacy Commissioner recommends that consent to the use of all photographic images (including videos) be obtained.
• That consent may be withdrawn, so you should be prepared to take down images where that happens.
• If the photographic images are personal information, then notice of collection should be provided, as well as your usual privacy notice.

How do I Prepare for the CISM Certification Exam?

Our preparation guide includes helpful resources, tips for studying smarter, and a guide to answering the questions well.

Is a Work Email Address Covered by Privacy Laws?

We’re often asked about the privacy laws that cover work email addresses.

As is often the case in privacy, the answer is … it depends.  The treatment of business email addresses changes depending on the privacy law that applies.

5 Tips on Preparing For The CIPP/E Exam

The IAPP’s CIPP/E certification is one of the most sought-after privacy qualifications. As an accredited training provider, we compiled some tips to help exam takers prepare for the notoriously tough exam.

This post also includes details about our course guarantee: If you don’t pass the exam for any reason, you can take the course again at any time for no charge.

Using Biometrics In Australia: What’s the Status?

Our status update on biometrics in Australia covered the definition of collection, as well as protections under the Privacy Act and through workplace laws. We also outlined additional factors organisations should consider before implementing biometrics:

• Is the collection justifiable (reasonably necessary for one of the functions or activities of the organisation)?
• How will notice of collection by given?
• How will access to the organisation’s Privacy Notice be provided?
• How is the data going to be stored? How long will it be kept? How will it be disposed of?