BACKGROUND
With the enactment of the Information privacy Act 2000 and the Health Records Act 2001, Victorian councils are required to comply with the privacy principles set out in the Acts and adopt policies on the management and handling of personal and health information of individuals.
PURPOSE
This Privacy Policy explains how the Wyndham City Council will collect, hold, use and disclose personal and health information of individuals, how individuals can gain access to their information, and correct inaccuracies, and how an individual may complain about possible breaches of privacy.
DEFINITIONS
Personal information - means information or opinion, whether true or not and whether recorded in material form or not, about a living individual whose identity is apparent, or can reasonably be ascertained from the information or opinion.
Sensitive Information – means information or opinion about an individuals ethnic origins, religious beliefs, political opinions or association, philosophical beliefs, membership of professional association or trade union, sexual preferences or practices and criminal record.
Health information – means information or opinion about the physical, mental, psychological health of an individual, disability of an individual or a health service provided or to be provided to an individual, but does not include information about an individual who has been deceased for more than 30 years.
POLICY STATEMENT
The Wyndham City Council is committed to protecting individuals right to privacy and the responsible and fair handling of personal and health information, consistent with the Information Privacy Act 2000 and the Health Records Act 2001. Accordingly, Council will adhere to the Information Privacy and Health Privacy Principles when undertaking its statutory functions and activities, so that the privacy of individuals can be protected.
POLICY INITIATIVES/ACTIONS
Personal Information
As part of the services provided to the community, the Wyndham City Council may hold personal information that is necessary for its function and activities. For example:
- Name, address, property, bank account and other financial details of ratepayers for undertaking its rating and valuation services, town planning and building statutory functions and other property related services and enforcement activities.
- Name, address and contact details of individuals who contact the Council with respect to requests or complaints related to Council services.
- Age, physical disabilities, health related and other sensitive information of individuals receiving Council services related to Child care, Maternal and Child Health, Pre-school, Youth, Leisure and Aged Care.
- Personal information of employees and contract service providers, relevant to their employment or contract with the Council.
Collection
Council will collect personal information lawfully and fairly, in a number of ways, including:
- directly from the individual via an application form or correspondence or in response to a request from Council.
- from third parties, such as contracted service providers, health service providers or the individual’s authorised representatives or legal advisers
- from publicly available sources of information
- when legally required to do so.
- far as it is practicable to do so, Council will collect personal information about an individual directly from that individual. It will also inform the individual of the purposes for which the information is collected, whom it will be disclosed to and how he/she is able to gain access to the information.
Council will not collect sensitive or health related information unless:
- the individual has consented
- it is required by law
- it is necessary to prevent or lessen a serious and imminent threat to the life, health or safety of an individual or the public
- it is necessary for the establishment, exercise or defence of a legal claim
- it is necessary for research, compilation and analysis of statistics relevant to government funded community programs.
Council will take reasonable steps to retain confidentiality of any personal information given in confidence about an individual, by another person or a health service provider, in relation to the provision of care or health services to the individual.
Upon collection Council will inform the individual:
- why the information is being collected
- to whom the information will may be disclosed and why
- any law that requires Council to collect the information
- the consequences for the individual if all or part of the information is not collected
- the fact that he/she is able to gain access to the information
If Council collects personal information about an individual from someone else, it will take reasonable steps to ensure that the individual is made aware of it.
Council will collect personal information about a child under the age of 18, only with the consent of the child’s parent or guardian.
However in certain circumstances Council may exercise discretion in obtaining parental/guardian consent for the collection of young persons information where parental/guardian involvement may hinder the delivery of services to a young person.
Use and Disclosure
Council will only use personal information for the primary purpose for which it was collected (for example, levying rates, billing, collection of debts, property valuation, town planning and building approvals, provision of family services, community services and waste management services, enforcement activities and asset management) and any related purpose the individual would reasonably expect the Council to use or disclose the information to, or where the individual has consented to the use or disclosure.
The information may be disclosed:
- To Council’s contracted service providers who manage the services provided by Council, including, Garbage collection, Meals preparation for Aged Care Services, Management of Leisure Centres, Management of Pre-schools, Environmental health inspections and Infrastructure maintenance. Council will also require these service providers to maintain the confidentiality of the information and comply with the privacy principles in all respects.
- To Statutory Bodies (eg VicRoads, AGL) for the purposes of targeted consultation processes on major projects that could affect residents.
- To City West Water for the purposes of ensuring that data held by both is maintained as correct and up-to-date as possible.
- To individuals for the purpose of serving a “notice to fence” as required by the Fences Act.
- To VEC, AEC for compilation of Voters Rolls
- To Statutory Bodies (e.g. Centrelink, Child Support) for purposes required by relevant legislation.
- To Police, Fire Department or SES for emergency or law enforcement purposes only.
- Where appropriate under another Act, including Freedom of Information Act 1982.
- In public registers that need to be maintained in accordance with other Acts, as a release of information relevant for the purpose for which the registers exist.
- To an individual’s authorised representatives, health service providers or legal advisers.
- To Council’s professional advisers, including accountants, auditors and lawyers.
- To organisations assisting the Council to perform statistical analyses for improving the services being delivered to the community. However, where practicable and reasonable, steps will be taken to de-identify the information.
- To an immediate family member of the individual, for emergency reasons or if it is necessary to provide the appropriate care or health service to the individual.
- To any recipient outside Victoria, only if they are governed by substantially similar privacy principles, or the individual has consented to the transfer or would be likely to give it, if it was practicable to obtain that consent.
Quality and Security
- Prior to the use and disclosure of personal information, reasonable steps will be taken to ensure that the information is relevant and to the extent necessary, accurate, complete and up-to-date for the purpose for which it is to be used.
- Council will endeavour to maintain a secure system for storing personal information and will utilise appropriate technologies, security methods, operational policies and procedures to protect the information from unauthorised access, improper use, alteration, unlawful or accidental destruction and accidental loss.
- All personal and health information will be removed from Council systems, if it is no longer needed for any purpose, except where it needs to be retained in accordance with the Heath Records Act 2001 and the Public Records Act 1973.
Access and Correction
- Council will provide individuals with access to their personal and health information on written request to the Privacy Officer, except in specific circumstances as outline within the Acts and the Freedom of Information Act.
- Council may charge an access fee for recovering the costs of retrieving the required personal information.
- If an individual is able to establish that the personal information is inaccurate, incomplete or out-of-date, the Council will take reasonable steps to correct the information.
- If access or correction of the personal or health information needs to be denied, as required by law or relates to legal proceedings, or the release would pose a serious threat to the life or health of any person, or is classified as confidential information, the Council will give the individual the reasons for that decision as soon as practicable, but no later than 45 days after receiving the request.
- In the event that Council and an individual disagree about the veracity of the personal or health information held by Council, Council will take reasonable steps to record a statement relating to the disputed information, if requested by the individual.
Identifiers and Anonymity
- Council will not adopt as its own identifier, an identifier that has been assigned by another government agency.
- Council will not use or disclose the identifier assigned to an individual by another government agency, unless the consent of the individual has been obtained or it is required by law to do so.
- Whenever it is lawful and practicable, individuals may exercise the option of not identifying themselves when supplying information or entering into transactions with the Council
Complaints
An individual may lodge a complaint with the Council’s Privacy Officer regarding the handling of personal and health information. The Council will investigate the complaint as soon as possible and provide a response within 7 working days. Such response may be interim in nature if time is insufficient to give a full reply.
Alternatively, individuals may lodge a complaint with the Office of the Victorian Privacy Commissioner for personal information or the Health Services Commissioner for health information, about a Council act or practice that may be an interference with their privacy. However, the Commissioners may decline to entertain the complaint, if the complainant has not first complained to the Council.
Future Changes
The Wyndham City Council may make amendments to this policy from time to time, to reflect technological changes, legislative amendments and community feedback.
Further Information
Copies of this policy are readily available from all Council offices. Further information with respect to the Wyndham City Council’s Privacy Policy and its handling of personal and health information, can be obtained from Council’s Privacy Officer.
RELATED DOCUMENTS
Legislative requirements:
Local Government Act 1989
Information Privacy Act 2000
Health Records Act 2001
Freedom of Information Act 1982
Public Records Act 1973
Strategies/Plans of Action:
Privacy Implementation Project Plan
Internal Information Audit
Procedures:
Privacy Procedures Manual