Low privacy complaint numbers made new hires hard to justify.
Victoria Police provided no privacy training to its members for more than a year, because the central team responsible for education had no staff.
The lack of staff in one of Victoria’s largest government agencies, also contributed to the near-collapse of an internal information handling community of practice of nearly 650 people, because there was no one to keep the community engaged.
A report [pdf] released by the Office of the Victorian Information Commissioner (OVIC) on Monday revealed a problematic cycle of events at Victoria Police: a lack of staff to run education programs; a lack of specific training to members, whose knowledge may be years out of date; and an apparent lack of privacy complaints to justify increased staffing levels.
OVIC found that “as of February 2022, Victoria Police had not provided any privacy-specific training … for its members for more than a year.”
“This is in part due to the lack of staff resources within the Security, Information and Privacy Division (SIPD),” the commissioner found.
“SIPD has a dedicated security, education and compliance unit (education unit), and a privacy unit, which are responsible for guidance and education in the privacy and information handling space.
“However, the examination found that – as of February 2022 – no staff were employed in these teams. All positions in both the education unit and the privacy unit were vacant.
“The staff shortages within these two teams seriously diminished the training and guidance function of Victoria Police around information handling and privacy.”
Police said that in February it had approval to recruit one person into each of the privacy and education units at a VPS 4 level, which has a pay range between $90,067 and $102,192.
“Following this recruitment, the privacy unit would still be at 50 percent capacity,” OVIC said.
“Effective resourcing of the privacy unit – over and above the two roles envisaged – will provide greater confidence and support to sworn members, and the public, that sensitive and delicate personal information is being handled appropriately.”
Justifying headcount
The way privacy complaints are handled by Victoria Police contributed to the staffing issues, OVIC found.
As it stands, “any Victoria Police officer can receive a privacy complaint from a member of the public” and can exercise discretion to manage it locally.
Only complaints that can’t be resolved locally are passed to the SIPD, meaning the central unit likely does not have the full picture of complaints received across the force. It reports low double-digit numbers every year via a central register.
The low privacy complaints numbers made it difficult to justify staffing in the central privacy unit.
“Victoria Police discussed the implications of low recorded numbers of privacy complaints on bids for resourcing,” OVIC said.
“It was noted that low privacy complaint numbers reduced the likelihood of making a successful business case for increased resourcing.”
Community of practice ‘inactive’
The lack of resourcing also caused other information handling initiatives to become inactive.
The largest of these is the protective security portfolio holder (PSPH) network, over 650 people that act “as a liaison between SIPD and the sworn member cohort.”
“Victoria Police told OVIC that the network has been inactive and ‘treading water’ for over a year … due to a lack of staff in the education unit to maintain the network through regular engagement,” OVIC reported.
“It was noted that reinvigoration of the PSPH network would require considerable effort given the network had been inactive for so long.
“Victoria Police also noted that the reinvigoration of the PSPH network would involve re-requesting existing staff, or seeking new portfolio holders, to undertake the role due to the length of inactivity.”
OVIC said the network – effectively a community of practice – could “be highly valuable”, and that without it, SIPD had issues engaging with sworn members in the regions on information protection and privacy topics.
“More resources in the education unit would ensure that the PSPH network is maintained and able to carry out its function of providing guidance and resources to staff about privacy and information security,” OVIC said.
In an annexure to the report, dated August 11, Victoria Police’s acting chief commissioner Ross Guenther agreed to focus efforts in privacy training, and said that the privacy team had been given a recent “uplift in resourcing”, though current staffing levels weren’t disclosed.
Family violence the exception
OVIC did note that while “no dedicated privacy training was available to Victoria Police members” for over a year, “there was a range of training available to Victoria Police personnel that touched on information handling principles including cyber security and information security.”
It also found that Police were well-drilled on information handling practices regarding family violence cases, as a result of “extensive work” since a 2016 Royal Commission.
Information Commissioner Sven Bluemmel said that showed Victoria Police “can deliver effective training on handling sensitive and personal information when this is prioritised and appropriately resourced.”
A Victoria Police spokesperson said the force had accepted OVIC’s findings ” and will strive to implement all recommendations.”
“Victoria Police is committed to protecting the personal and health information of anyone it interacts with,” the spokesperson said.
“We’ve improved and have committed to reviewing privacy and information handling education annually to ensure up-to-date knowledge is maintained across the organisation.
“Additionally, we have improved resourcing for Victoria Police’s privacy team.
“This is on top of the significant uplift in privacy and information handling training Victoria Police has already achieved in the area of family violence as favourably noted in the examination’s findings.”