• Peter Achterstraat
• The Audit Office of New South Wales

Read the full text

21 October 2010The Government of New South Wales is not able to provide assurance that it is safeguarding its holdings of sensitive personal information because its policy has not been properly implemented, concludes this audit.

The public sector legitimately gathers and uses personal information about citizens, and shares it within and outside government. But personal information can be misused with potentially serious consequences. If the wrong people get access to sensitive personal information an individual can suffer financial loss or damage to their credit rating, have their medical records compromised, or suffer from threats and harassment.

The people of NSW have every right to expect their and their families’ private details are secure regardless of which government agency holds it. The Government’s current policy on Security of Electronic Information acknowledges its duty to safeguard its large information holdings and to provide credible assurance that it is doing so. Under the policy, agencies were to establish and maintain an Information Security Management System (ISMS) that complies with the international standard and covers all electronic information. They were to get and keep the main parts of their ISMS, including the parts that hold sensitive private information, certified to that standard. And the Government Chief Information Office was to survey agencies each year and report to Cabinet.

This audit assesses the extent to which the Government can provide assurance that it is safeguarding its holdings of sensitive personal information. The audit does this by examining how well the Government’s policy has been implemented.

It concludes that the NSW Government is not able to provide assurance that it is safeguarding its holdings of sensitive personal information because its policy has not been properly implemented. This is likely to remain the case until there are clear, mandatory, minimum standards that agencies sign up to, and scrutiny of performance against these standards is strengthened.