Regulatory priorities

OVIC has identified four regulatory priorities for 2022-25:

These priorities reflect two existing and two new emerging issues and their potential impact on the information rights of Victorians. They will guide regulatory action we take in line with our Regulatory Action Policy –  to promote fair public access to information while ensuring its proper use and protection.

OVIC is more likely to take proactive action or respond to a breach or incident where an agency’s activity is identified as a key OVIC regulatory priority.

OVIC’s regulatory priorities for 2022-25

Compliance with the FOI Professional Standards

The FOI Professional Standards were introduced in December 2019 to ensure the consistent administration of the FOI Act by responsible agencies.

This regulatory priority recognises OVIC’s shift from the release of the standards to ongoing monitoring and assurance of the standards.

Privacy and security when outsourcing

There are inherent privacy and information security risks involved when engaging contracted third-party service providers as agencies cannot ‘contract out’ accountability for privacy and information security.

This priority remains an important focus as outsourcing arrangements continue to be a central part of regulatory activity conducted by OVIC.

Information governance during crises

It is often necessary for agencies to act quickly when responding to a crisis situation. For example, COVID-19 restrictions or an extreme weather event. This may require agencies to rapidly develop and deliver processes and systems relating to information governance.

This priority recognises the challenges raised by crisis situations and the need to review responses and prepare for these eventualities to ensure information is appropriately handled.

Privacy, security and transparency in emerging technologies

The use of artificial intelligence and other emerging technologies can create risks and increase community concern about transparency of decision making and invasive handling of personal information.

This regulatory priority acknowledges the use of emerging technologies and seeks to address the potential for regulatory action in this space over the coming three years.