Collection of Data Principles

1. SISS Data Services owns the data collected, created, and provided via its services.
2. A delegated Data Steward is responsible to ensure the ongoing confidentiality, integrity, availability and quality of information collected and provided.
3. There is at least one Data Steward identified for each data type collected, created and provided by SISS Data Services.
4. SISS Data Services will obtain consent from individuals for the processing, storing, and transfer of personally identifying information where applicable and relevant as required by the Privacy Act.
5. Consent from an individual must be information and explicit.
6. SISS Data Services will never utilise screen scraping to obtain or collect information.

Assess Classification Principles

Open Banking in Australia was created to give consumers the power to control their own data. As holders of this data, every bank has a responsibility to ensure data protection when the data is shared across various data holders and recipients. A key aspect of building trust is through transparency. A few things you can do include

1. SISS Data Services will ensure the accuracy and integrity of the information provided via its services.
2. Data is classified as public or protected.
   1. Public data is any data that is made publicly available in accordance with compliance requirements such as media releases or is already directly available via public systems.
   2. Protected data is all SISS Data Services Data Resource that is not considered public.
3. Data classified as public will require no special treatment or imposition of access controls.
4. Data classified as protected will be stored securely and only made accessible where a suitable business need or justification has been demonstrated by the authorised party.
5. The principles of least privilege and need to know are adhered to by SISS Data Services.
   1. Only authorised parties are provided access to data they require access to.
   2. Unauthorised parties are not provided access to any SISS Data Services Data Resource.
   3. Suitable business justification must be provided prior to access being authorised, enforcing the principle of "need to know".

Disposal of Data Principles

1. Data that is no longer of value to SISS Data Services or its customers is securely destroyed within a reasonable time frame.
2. All data, unless there no longer exists a value of personally identifying information, will undergo a de-identification process or be destroyed.
3. All entities using SISS Data Services API or other interfaces to access SISS Data Services Data Resources must implement appropriate and reasonable information security protections and controls.
4. Personally identifiable information will be destroyed in accordance with the Privacy Act 1988, ensuring PII is destroyed when it is no longer required.
5. SISS Data Services will comply with appropriate legislation, for any requests made by an individual for the extraction, correction, or deletion of their own records.
6. SISS Data Services provides individuals with the right to be forgotten (delete all data) when an individual has been identified accurately, via their financial institution or via an authorised third-party.
   1. SISS Data Services will, at their discretion, either destroy the client information where any record may result in or cause harm to an individual or anonymise it such that the individual can no longer be identified.