Privacy Policy

Compliance Purpose

This Council complies with the Victorian Government Information Privacy Act No. 98/2000 and the Health Records Act 2001.

The main purposes of these Acts are:

• To establish a regime for the responsible collection, storage, handling and disclosure of personal information; (definition of personal information on page 2)
• To provide individuals with rights of access to information about themselves which is held by council;
• To provide individuals with the right to request an organisation to correct, amend and transfer information about them held by council, including information held by contracted service providers.
• To protect the Privacy of an individuals health information that is held in council

Council will conform with the privacy principles contained in the Act, listed as follows:

• Principle 1 – Collection
• Principle 2 – Use and Disclosure
• Principle 3 – Data Quality
• Principle 5 – Openness
• Principle 6 – Access and Correction
• Principle 7 – Unique Identifiers
• Principle 8 – Anonymity
• Principle 9- Trans-border Data Flows
• Principle 10- Sensitive Information
• Principle 11 – Transfer/Closure of the practice of a health service provider
• Principle 12 – Making information available to another health service provider

Definition of Personal Information

“personal information” means information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the. information or opinion, but does not include information of a kind to which schedule 2 of the information Privacy Act 2000 applies (ie. Health information which is regulated by the Health Records Act 2001) For example, “personal information”‘ includes:

• name, age, weight, height;
• income, purchases and spending habits;
• blood type, DNA code, fingerprints;
• marital status and religion;
• education;
• home address and phone number;
• employee details

In other words “personal information” is information directly related to the personal affairs of an individual that enables or could enable the person to be identified. This includes personal information relating to both clients of Council and Council staff. While the definition of personal information is broad, the Act excludes certain types of information from the definition. The most significant exceptions relate to health information such as the physical, mental or psychological health of an individual) and personal information that is contained in a document that is a generally available publication.

PRINCIPLE 1 – Collection

Council shall only collect personal information that is necessary for specific and legitimate functions and activities. This information will be collected by fair and lawful means and not in an unreasonably intrusive way. Council will indicate:

• why it is collecting personal information;
• how that information can be accessed;
• the purpose for which the information is collected;
• with whom the Council shares this information;
• any relevant laws; and
• the consequences for the individual if all or part of the information is not collected.

Under normal circumstances Council will collect personal information about an individual only from that individual.

However, if Council collects personal information about an individual from someone else, Council will take all reasonable steps to ensure that individual is informed of his or her rights relating to the information collected. The exception is when making the individual aware of the matters would pose as serious threat to the life or health of an individual. Council provides a wide range of services to the community within a broad legislative environment. Council holds personal information for the purposes of enabling subsequent contact, ascertaining correct property ownership within Councils’ boundaries and allocating rate liability and further, undertaking specific client functions within various service environments.

PRINCIPLE 2 – Use and Disclosure

Council will not use or disclose personal information for a purpose other than the primary purpose except for those conditions specified in the Act or where the use or disclosure is specifically authorised under an Act.

• the secondary purpose is related to the primary purpose of collection
• the individual would reasonably expect council to use or disclose the information for the secondary purpose which is related to the primary purpose or
  • the individual has consented to council to use and disclosure the information; or
  • if the use or disclosure is necessary for research, or compilation or analysis of statistics in the public interest, other than for publication in a form that identifies the individual
  • the use or disclosure is for the purpose of funding, management, planning, monitoring, improvement or evaluation of health services
  • if a serious imminent threat to an individuals life, health, safety or welfare or a serious threat to public health, public safety, or public welfare or
  • council has reasons to suspect that unlawful activity has been or is being engaged under law enforcement

PRINCIPLE 3 – Data Quality

Council will take reasonable steps to make sure that the personal information it collects, uses or discloses, is accurate, complete and up-to-date.

PRINCIPLE 4 – Data Security & Data Retention

Council will take reasonable steps to protect all personal information it holds from misuse, loss, unauthorised access, modification or disclosure. Council will take reasonable steps to lawfully and responsibly destroy or permanently de-identify personal information when it is no longer needed for any purpose taking into consideration the Public Records Act and the Health Records Act.

PRINCIPLE 5 – Openness

Council will make publicly available its policies relating to the management of personal information. Council will, on request, take reasonable steps to provide individuals with general information on the types of personal information it holds and for what purposes and how it collects, holds, uses and discloses that information.

PRINCIPLE 6 – Access and Correction

Council will provide access to information held by Council about an individual on request except in specific circumstances as outlined within the Act.

• providing access would pose a serious and imminent threat to life or health of any individual
• providing access will have an unreasonable impact on the privacy of other individuals; or
• the request is frivolous or vexatious; or
• the information relates to existing legal proceedings between council and the individual
• providing access would reveal the intentions of the organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
• denying access is required by law; or
• providing access would likely to prejudice an investigation
• the information is subject to confidentiality (under section 27 of the Act)

Where Council holds personal information about an individual and the individual is able to establish that information is incorrect) Council will take reasonable steps to correct information as soon as practicable but within 45 days of the request. If, however, Council denies access or correction, Council will provide reasons. In the event that Council and an individual disagree about the accuracy of personal information held by Council, Council will take reasonable steps to record a statement relating to the disputed information if requested by the individual.

PRINCIPLE 7 – Unique Identifiers

Council will not assign, adopt, use, disclose or require unique identifiers from individuals except for the course of conducting normal Council business or if required by law. Council will only use or disclose unique identifiers assigned to individuals by other organisations if the individual consents to the use and disclosure or the conditions for use and disclosure set out in the Act are satisfied.

PRINCIPLE 8 – Anonymity

Council will, where it is lawful and practicable, give individuals the option of not identifying themselves when entering into transactions with Council.

PRINCIPLE 9 – Transborder Data Flows

Council may transfer personal information outside of Victoria only if the recipient of the information is subject to a law that is substantially similar to the Privacy Principles or other conditions outlined in the Act.