Welcome back! This is where you left us. Not what you wanted?
20 minutes
This module will cover how you can collect, use and disclose personal information, and how you can handle personal information in your day-to-day work in a way that complies with the APPs. It will also cover agency obligations around keeping personal information secure, and retaining and destroying personal information.
At the end of this topic you should be able to:
Ready? Click the Play button to start the video.
If you handle personal information in your work, it is essential that you consider privacy — including how personal information should be collected, used and disclosed, and properly secured.
The Australian Privacy Principles set out requirements for the handling of personal information, to ensure that your agency:
It is also important to remember that even if you are legally permitted to handle personal information in a certain way, it doesn’t necessarily mean you should. Agencies rely on public trust — it enables them to carry out their functions. Trust is also essential to support innovative uses of personal information.
Using personal information in unexpected ways can damage trust and your agency’s reputation.
If you need more information, talk to your agency’s Privacy Officer or visit www.oaic.gov.au.
Whenever you collect someone’s personal information, it is very important that you understand why you are collecting it (the purpose of collection), as this relates directly to what your agency can do with it.
If you are clear about why you are collecting personal information, your agency will be able to better communicate with individuals about this purpose and the later uses or disclosures that are planned for this information.
There are several questions you need to ask when collecting personal information. Click on each to find out more.
What information do I need to collect?
Make sure you understand what specific information you need to collect before you collect it.
Why do I need this information? What is the purpose of the collection?
Any information your agency collects needs to be reasonably necessary for, or directly related to, its functions and activities. If the information is not reasonably necessary for, or directly related to, your functions or activities, then you should not collect it.
Is this collection lawful and fair?
Agencies can only collect personal information by ‘lawful and fair means’. A ‘fair means’ of collecting information must not involve intimidation or deception and should not be unreasonably intrusive. You should also be aware of other laws that may affect your collection of information.
What might be an unlawful purpose?
Something that is prohibited by law is an unlawful purpose. For example, collecting information in order to commit a crime is clearly unlawful. Collecting information which breaches another law is also unlawful. For example, threatening damage to a person unless information is provided, collecting information using telephone interception or a listening device except under the authority of a warrant, or requesting or requiring information in connection with, or for the purpose of, an act of discrimination.
Does the information need to be identifiable?
Consider whether the information that you collect needs to identify a person. Individuals should have the option of remaining anonymous or using a pseudonym, unless this is not possible. You should also consider whether you could collect or use de-identified information.
Who are we collecting the information from?
Generally, personal information should only be collected directly from the individual concerned. This ensures that the person knows that information is being collected about them. This also allows the person to know – and to have some control – over what information is collected.
There are some exceptions to this, including:
If you have to collect personal information, you should take reasonable steps to confirm that the information that you collect is accurate, complete and up to date. In some circumstances — such as where you collect the information directly from the person themselves — it may be reasonable to take no steps.
The requirements that apply to the collection of sensitive information are even higher. Unless an exception applies, you may only collect sensitive information where it is both reasonably necessary for, or directly related to, your agency’s functions or activities, and the individual concerned consents to your collection.
There are some exceptions. For example, you can collect sensitive information without consent if you are taking appropriate action in relation to suspected unlawful activity or serious misconduct, or the collection is required or authorised by law.
Incorrect.
Date of birth, address and marital status are highly unlikely to be needed for the consultation process. The person providing feedback should have the option to remain anonymous if possible.
Correct!
In this scenario, people should have the option of making anonymous comments. The date of birth, address and marital status of the person providing feedback are unlikely to be required for the consultation process.
Let’s look at the why, when and how of notifying individuals about collection.
It is important for individuals to know who has collected their personal information. You should generally notify individuals before you collect their personal information or at the time of collection. If that cannot be done, you should notify them as soon as possible after the collection.
Notice can be given in several ways, including:
It is important that the person’s attention is drawn to this notice. If the notice is provided on a form to be completed by the person, they should be able to either take a copy with them or access the information elsewhere, for example, on your agency’s webpage.
You will need to notify individuals about a range of things, including:
It is important to remember that notifying a person of what you intend to do with their information is not the same as seeking their consent to do those things.
Sometimes there is a good reason not to notify an individual about a collection. It is your agency’s responsibility to justify not taking any steps to notify in these circumstances. For example, if a doctor informs a patient that they will send the patient’s health information to the specialist they have been referred to, then it is reasonable for the specialist not to take any steps to notify as well. Similarly, where notification may jeopardise a law enforcement agency undertaking lawful surveillance of an individual in connection with a criminal investigation, or where notification would breach another legal obligation (such as a client’s legal professional privilege), then notification may not be required.
Your agency’s Privacy Officer can provide more specific advice on how your agency handles notifications. Module 3 has more information about Privacy Officers and their responsibilities.
Use and disclosure are two separate things.
Generally, an agency ‘uses’ personal information when it maintains control of the information when it handles or manages it. For example, searching records for personal information, or accessing and reading personal information.
An agency ‘discloses’ information when it makes it accessible or visible to others outside the agency, which means the agency no longer controls that information. Examples include accidentally providing personal information to an unintended recipient or displaying your computer screen so that another person can read the personal information.
So how should you be using and disclosing personal information?
Generally, you may use or disclose personal information for the primary purpose of its collection. This means you can use or disclose personal information for the same reason it was collected.
If you want to use or disclose the information for another purpose (a secondary purpose), you can only do so where the individual consents or where another exception applies.
Here are some examples of where your agency may use or disclose personal information for a secondary purpose without consent:
Remember: just because you are legally allowed to use personal information in a certain way, doesn’t mean that you necessarily should. It is important to remember that agencies rely on the trust of the public. Using personal information in unexpected ways can damage that trust.
If you need help working out whether you can (or should) use personal information for a secondary purpose, you should contact your Privacy Officer.
Now let’s look at how to keep personal information safe.
Agencies must take reasonable steps to keep personal information secure. Your agency will likely have a range of different security safeguards in place.
For example:
There are also things that you can do in your day-to-day work to keep personal information safe and reduce the risk of data breaches caused by human error. Click on each to find out more.
Make sure people don’t tailgate you when you walk into a secure workspace.
Lock your computer when you walk away from your desk.
Don’t leave your documents unattended at the printer.
See Preventing data breaches: advice from the Australian Cyber Security Centre for more information on malicious or criminal attacks, and how to prevent these.
Don’t have conversations involving personal information in public places or places where unauthorised people can overhear.
You should only transport personal information where necessary. If you are using portable ICT equipment, it must be appropriately secured and protected. Make sure portable storage devices are encrypted and password protected so the information on them can’t be accessed if lost or stolen.
Don’t leave hard copy documents with personal information on your desk. Lock them in a drawer.
If you’ve finished with a hardcopy document, shred it or put it in a secure disposal bin. Speak to your agency’s record manager about securely disposing electronic records.
Click on all the potential security risks at this unattended desk.
Let’s look at the obligations that apply when information is no longer needed.
Generally, personal information that is no longer needed should be destroyed or de-identified, unless it’s required for a record-keeping or legal purpose.
However, agencies have specific retention obligations for personal information that forms part of a Commonwealth record. Commonwealth records are regulated by the Archives Act 1983 (the Archives Act) which sets out how long Commonwealth records must be kept and when information may be disposed of.
If you have further questions about information retention or disposal in your agency, contact your Privacy Officer, Records Management Officer or the National Archives of Australia.
You are now ready for the final Module 2 knowledge check. Answer the five questions.
