The Privacy Act and your printers.

What APP 11 says

The Office of the Australian Information Commissioner (OAIC) summarises Australian Privacy Principle 11, security of personal information, this way: an APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure. The OAIC also notes that an entity has obligations to destroy or de-identify personal information in certain circumstances.

APP 11 does not list printer settings. It asks for reasonable steps. Whether you are an APP entity, and what is reasonable for your organisation, are questions for your privacy officer or legal adviser. What we can describe is how print fits into the steps you take.

The Notifiable Data Breaches scheme

Under the Notifiable Data Breaches (NDB) scheme, the OAIC explains that any organisation or agency the Privacy Act 1988 covers must notify affected individuals and the OAIC when a data breach is likely to result in serious harm to an individual whose personal information is involved.

The OAIC describes a data breach as personal information being lost or subjected to unauthorised access or disclosure. Its examples include a device with personal information being lost or stolen, and personal information being mistakenly given to the wrong person. Both can happen through printing: a printed document collected by the wrong person, or a device holding stored documents leaving the organisation.

Print controls that support your obligations

The most useful print controls are the ones that remove everyday opportunities for personal information to end up in the wrong hands. They are also straightforward to explain to staff, which matters as much as the technology.

• Secure release: jobs wait until their owner authenticates at the device, so documents are not left in trays
• Audit trails: a record of who printed, copied or scanned what, and when, so you can answer questions after the fact
• Encrypted transmission between devices, users and print queues
• Automatic document purging, so sensitive information does not remain on device storage
• Consistent configuration and security across a mixed fleet, so one device is not the weak point
• A plan for device storage when a device is replaced or removed

How Print Fleet Management helps

Print Fleet supports Privacy Act 1988 obligations through secure release and audit trails. We use AES-256 (256-bit) encryption, secure release and audit trails across the fleet, security patches are rolled out in under 24 hours, and automatic document purging prevents sensitive information from remaining on device storage.

In healthcare settings, the same controls also support My Health Records Act 2012 obligations. We do not provide legal advice; we work alongside your privacy officer so the print environment reflects the steps your organisation has decided are reasonable.

Questions to ask about your own print environment

These questions help identify where personal information is most exposed. They are useful whoever manages your printers.

• Where are documents containing personal information printed, and who can reach those devices?
• Can you tell who printed or scanned a particular document, and when?
• Do any devices store copies of jobs, and what happens to that storage when a device is replaced?
• Are scan-to-email destinations controlled, or can a scan be sent anywhere?
• Are printer security settings and patches managed with the same care as other devices on your network?