<ul>
<li> About the OAIC </li>
<li> Our corporate information </li>
<li> Plans, policies and procedures </li>
<li> Privacy policy </li>
</ul> Privacy policy Contents<ul>
<li>About this policy</li>
<li>Overview</li>
<li>Collection of your personal information<ul>
<li>Collecting sensitive information</li>
<li>Indirect collection</li>
<li>Anonymity</li>
<li>Collecting through our websites</li>
<li>Social networking services</li>
<li>Smartforms and CDR forms</li>
</ul>
</li>
<li>Disclosure<ul>
<li>Complaints and reviews</li>
<li>Data breach notifications</li>
<li>Review of OAIC decisions</li>
<li>Publication of decisions and reports</li>
<li>Disclosure to the media</li>
<li>Disclosure to service providers</li>
<li>Disclosure of sensitive information</li>
<li>Disclosure to other regulators or external dispute resolution schemes</li>
<li>Disclosure of personal information overseas</li>
</ul>
</li>
<li>Quality of personal information</li>
<li>Storage and security of personal information</li>
<li>Accessing and correcting your personal information</li>
<li>How to make a complaint</li>
<li>Contact us</li>
<li>Supplementary material<ul>
<li>OAIC information technology security practices</li>
</ul>
</li>
<li>Related pages<ul>
<li>Privacy policy summary</li>
<li>Human resources privacy policy</li>
</ul>
</li>
</ul>Contents Listen <p>Publication date: Version 3.1, July 2020</p>About this policy<p>The <em>Privacy Act 1988</em> (Cth) requires entities bound by the Australian Privacy Principles (APPs) to have a privacy policy.
This privacy policy outlines the personal information handling practices of the Office of the Australian Information Commissioner (OAIC).
OAIC employees and prospective employees should also refer to our Human resources privacy policy.
The OAIC also has a summary privacy policy.</p>
<p>This policy is written in simple language.
The specific legal obligations of the OAIC when collecting and handling your personal information are outlined in the Privacy Act and in particular in the APPs found in that Act.
We will update this privacy policy when our information handling practices change.
Updates will be publicised on our website and through our email lists.</p>Overview<p>We collect, hold, use and disclose personal information to carry out functions or activities under the <em>Australian Information Commissioner Act 2010 </em>(AIC Act), the Privacy Act and the <em>Freedom of Information Act 1982 </em>(FOI Act) and other legislation that confer powers or functions on the OAIC including the <em>My Health Records Act 2012</em> (Cth) (My Health Records Act), and the <em>Competition and Consumer Act 2010 </em>(Cth) (CC Act)</p>
<p>These functions and activities include:</p>
<ul>
<li>handling privacy and freedom of information (FOI) complaints, FOI reviews, and Consumer Data Right (CDR) complaints</li>
<li>taking other regulatory action under the Privacy, FOI, and CC Act</li>
<li>providing advice on privacy, FOI, CDR and information policy issues</li>
<li>consulting with stakeholders, for example, on privacy, FOI or CDR guidance</li>
<li>maintaining registers, such as organisations that have opted-in to Privacy Act coverage</li>
<li>responding to access to information requests</li>
<li>communicating with the public, stakeholders and the media including through websites and social media</li>
<li>assessing suitable candidates for career opportunities within the OAIC.</li>
</ul>Collection of your personal information<p>At all times we try to only collect the information we need for the particular function or activity we are carrying out.</p>
<p>The main way we collect personal information about you is when you give it to us.
For example, we collect personal information such as contact details and complaint, review, request, data breach notification or report details when you:</p>
<ul>
<li>contact us to ask for information (but only if we need it)</li>
<li>make a complaint about a privacy breach to us</li>
<li>make a complaint about the way an agency has handled an FOI request or seek a review of an FOI decision</li>
<li>make a complaint about the way an entity has handled your CDR data under the CDR scheme</li>
<li>ask for access to information the OAIC holds about you or other information about the OAIC’s operation</li>
<li>notify the OAIC about a data breach</li>
<li>report a matter for investigation</li>
<li>apply for a job vacancy at the OAIC.</li>
</ul>
<p>We may also collect information from you when we investigate or review a privacy, FOI or a CDR matter.
If we open a file about your matter, it will often include our opinion on your matter.</p>
<p>We may also collect contact details and some other personal information if you are on our committees or participating in a meeting or in consultation with us.</p>Collecting sensitive information<p>Sometimes we may need to collect sensitive information about you, for example, to handle a complaint.
This might include information about your health, racial or ethnic origin, political opinions, association memberships, religious beliefs, sexual orientation, criminal history, genetic or biometric information.</p>Indirect collection<p>In the course of handling and resolving a complaint, data breach notification, review or an investigation, we may collect personal information (including sensitive information) about you indirectly from publicly available sources or from third parties such as:</p>
<ul>
<li>your authorised representative, if you have one</li>
<li>applicants, complainants, respondents to a complaint, investigation, application or data breach notification or the third parties’ employees and witnesses.</li>
</ul>
<p>We also collect personal information from publicly available sources to enable us to contact stakeholders who may be interested in our work or in participating in our consultations.</p>Anonymity<p>Where possible, we will allow you to interact with us anonymously or using a pseudonym.
For example, if you contact our Enquiries line with a general question, we will not ask for your name unless we need it to adequately handle your question.</p>
<p>However, for most of our functions and activities we usually need your name and contact information and enough information about the particular matter to enable us to fairly and efficiently handle your inquiry, request, complaint or application, or to act on your report.</p>Collecting through our websites<p>The OAIC’s public website, www.oaic.gov.au, is hosted in Australia.
There are a number of ways in which we collect information though our website.</p>Web analytics<p>We use Matomo to collect data about your interaction with our website.
The main purpose of collecting your data in this way is to improve your experience when using our site.
We also use this data to understand and report on which content pages and downloads are accessed by visitors.</p>
<p>The types of data we collect with these tools include:</p>
<ul>
<li>your device’s IP address (collected and stored in an anonymized format)</li>
<li>search terms and pages visited on our website</li>
<li>date and time when pages were accessed</li>
<li>downloads, time spent on page, and bounce rate</li>
<li>referring domain and out link if applicable</li>
<li>device type, operating system and browser information</li>
<li>device screen size</li>
<li>geographic location (city).</li>
</ul>
<p>If your web browser has Do Not Track enabled, Matomo will not track your visit.
We host Matomo ourselves within Australia.</p>Cookies<p>Cookies are small data files transferred onto computers or devices by websites for record-keeping purposes and to enhance functionality on the website.
Most browsers allow you to choose whether to accept cookies or not.
If you do not wish to have cookies placed on your computer, please set your browser preferences to reject all cookies before accessing our website.</p>
<p>The cookies from our website are generally created by Matomo and start with _pk_ref, _pk_ses or _pk_id.</p>Embedded videos on our website<p>We use Google’s YouTube site to host videos which are embedded on our website.
Embedded videos on our website use YouTube’s Privacy Enhanced Mode.
When you play an embedded video from our website, the video and associated assets will load from the domain www.youtube-nocookie.com, and other domains associated with Google’s YouTube player.</p>
<p>YouTube collects information about user activity including videos watched and interactions with content and ads.
These analytics are made available to the OAIC, and we use this information to understand how our videos perform.
You can access the privacy policy for YouTube on the Google website.</p>Email lists, registrations and feedback<p>We will collect information that you provide to us when signing up to mailing lists and registering for our events, or when submitting feedback on your experience with our website.</p>
<p>We use Vision6 to manage our mailing lists and event registrations.
You can access Vision6’s privacy policy here.
When subscribing to one of our mailing lists, you will be asked to give your express consent that Vision6 may use your data for analytics purposes.
Analytics are performed when you click on links in the email, or when you download the images in the email.
They include which emails you open, which links you click, your mail client (e.g.
‘Outlook 2016’ or ‘iPhone’), if your action occurred on ‘mobile’ or ‘desktop’, and the country geolocation of your IP address (the IP address itself is not stored).</p>
<p>We also use TryBooking to manage event registrations.
You can access TryBooking’s privacy policy here.
When registering for an event, you may be required to give TryBooking personal information including your name, address, telephone number and email address.
You may also be required to provide financial information, including credit card number and expiration date, if you make a payment for an event.
TryBooking may share with us some of your personal information, including information about whether a particular registered individual has made payment, but we do not receive your financial information.</p>
<p>We use the services of Hotjar to collect voluntary feedback on your experience with our website.
We also use Hotjar to conduct anonymous stakeholder surveys to gather feedback to help us improve our performance.
We do not collect personal information via Hotjar.
Information about how Hotjar manages personal information is available in the privacy and data collection policies on its website.</p>Social networking services<p>We use social networking services such as Twitter, Facebook and YouTube to communicate with the public about our work.
When you communicate with us using these services we may collect your personal information, but we only use it to help us to communicate with you and the public.
The social networking service will also handle your personal information for its own purposes.
These services have their own privacy policies.
You can access the privacy policies for Twitter, Facebook and YouTube (a Google company) on their websites.</p>Smartforms and CDR forms<p>The OAIC uses the Australian Government’s SmartForm service to enable you to, for example, lodge a privacy complaint, application, data breach notification, enquiry or apply for a job.</p>
<p>When you save or submit a form using this service it is encrypted and stored in a secure server located in Australia and controlled by the Department of Industry, Innovation and Science (DIIS) until we download it.
After we download a submitted form, it is deleted from that server.
Saved forms that have not been submitted within the timeframe specified on the form will also be deleted from the server.
We will not access or download your saved forms before you submit them unless you consent or unless there is a technical issue that requires investigation.</p>
<p>DIIS cannot view your information except in very limited circumstances when there is a technical issue that requires investigation.
In these circumstances DIIS must seek our permission to do so.</p>
<p>The OAIC uses separate forms for CDR enquiries, reports and complaints, which are available on the CDR website.
A link to the CDR complaint form is also available on the OAIC’s website.
When you save and submit these forms, the user credentials are encrypted and stored in a secure server located in Australia and controlled by the OAIC.</p>Disclosure<p>Common situations in which we disclose information are detailed below.</p>Complaints and reviews<p>If you make a privacy, FOI, or CDR complaint, or apply for an FOI review, we will usually give a copy of the complaint or application to the respondent and, where relevant, affected third parties.</p>
<p>If a complainant or applicant requests that only limited information is disclosed to the respondent, we may not have enough information to be able to fairly proceed with the matter.
The respondent must have sufficient information to respond to the matter in a meaningful way.</p>Data breach notifications<p>If you notify the OAIC about a data breach we will not disclose personal information about you unless you agree, or would reasonably expect us to.
If the breach relates to the My Health Records Act, we may disclose your personal information to the My Health Records System Operator under s 73A of that Act.</p>Review of OAIC decisions<p>We may disclose personal information to another review body if a complainant, applicant or respondent seeks an external review of the OAIC’s decision or makes a complaint to the Commonwealth Ombudsman.</p>Publication of decisions and reports<p>Generally, when we publish decisions, determinations or reports (on the OAIC website and on the Australasian Legal Information Institute website) if you are a party who is an individual we will not publish your name unless you ask for it to be published.</p>
<p>We may also publish other information about cases that we have resolved without a formal decision.
We will not publish your name.</p>Disclosure to the media<p>We generally only provide the media with personal information relating to a complaint if you have agreed.</p>Disclosure to service providers<p>The OAIC uses a number of service providers to whom we disclose personal information.
These include providers that host our website servers, manage our IT and manage our human resources information.</p>
<p>To protect the personal information we disclose we:</p>
<ul>
<li>enter into a contract or MOU which requires the service provider to only use or disclose the information for the purposes of the contract or MOU</li>
<li>include special privacy requirements in the contract or MOU, where necessary.</li>
</ul>Disclosure of sensitive information<p>We only disclose your sensitive information for the purposes for which you gave it to us or for directly related purposes you would reasonably expect or if you agree, for example, to handle a complaint.</p>Disclosure to other regulators or external dispute resolution schemes<p>We may disclose information that relates to complaints or investigations to other Australian or international regulators, or to external dispute resolution (EDR) schemes.
We will generally only disclose your personal information to other regulators or EDR schemes if you agree and where the information will assist the OAIC to investigate matter, or will assist the other regulator or EDR scheme to investigate a matter where we are authorised or required to do so by or under law.</p>
<p>As part of our CDR functions, we may disclose personal information contained in enquiries or complaints to the ACCC in its capacity as our co-regulator of the CDR Scheme, under s 29 of the <em>Australian Information Commissioner Act 2010</em> (Cth).
We may also transfer CDR complaints directly to EDR schemes in accordance with s 50 of the Privacy Act.
We will notify you where we refer such CDR matters to the ACCC or an EDR Scheme.</p>Disclosure of personal information overseas<p>Generally, we only disclose personal information overseas so that we can properly handle the complaint or application.
For example, if:</p>
<ul>
<li>the complainant or respondent to a complaint is based overseas</li>
<li>an Australian-based respondent is a related body corporate to an overseas company</li>
<li>you have complained to an overseas entity and the OAIC about the same or a related matter.</li>
</ul>
<p>Web traffic information is disclosed to Google Analytics when you visit our websites.
Google stores information across multiple countries.</p>
<p>When you communicate with us through a social network service such as Facebook or Twitter, the social network provider and its partners may collect and hold your personal information overseas.</p>Quality of personal information<p>To ensure that the personal information we collect is accurate, up-to-date and complete we:</p>
<ul>
<li>record information in a consistent format</li>
<li>where necessary, confirm the accuracy of information we collect from a third party or a public source</li>
<li>promptly add updated or new personal information to existing records</li>
<li>regularly audit our contact lists to check their accuracy.</li>
</ul>
<p>We also review the quality of personal information before we use or disclose it.</p>Storage and security of personal information<p>All personal information collected is held on our cloud storage, on servers located in Australia.
We retain effective control over any personal information held on our cloud, and the information is handled in accordance with the Australian Privacy Principles.</p>
<p>We take steps to protect the security of the personal information we hold from both internal and external threats by:</p>
<ul>
<li>regularly assessing the risk of misuse, interference, loss, and unauthorised access, modification or disclosure of that information</li>
<li>taking measures to address those risks, for example, we keep a record (audit trail) of when someone has added, changed or deleted personal information held in our electronic databases and regularly check that staff only access those records when they need to</li>
<li>conducting regular internal and external audits to assess whether we have adequately complied with or implemented these measures.</li>
</ul>
<p>For further information on the way we manage security risks in relation to personal information we hold see our supplementary material on information technology security practices, below.</p>
<p>We destroy personal information in a secure manner when we no longer need it.
For example, we generally destroy complaint records after three years, in accordance with the OAIC’s Records Disposal Authority.</p>Accessing and correcting your personal information<p>Under the Privacy Act (APPs 12 and 13) you have the right to ask for access to personal information that we hold about you, and ask that we correct that personal information.
You can ask for access or correction by contacting us and we must respond within 30 days.
If you ask, we must give you access to your personal information, and take reasonable steps to correct it if we consider it is incorrect, unless there is a law that allows or requires us not to.</p>
<p>We will ask you to verify your identity before we give you access to your information or correct it, and we will try to make the process as simple as possible.
If we refuse to give you access to, or correct, your personal information, we must notify you in writing setting out the reasons.</p>
<p>The steps appropriate to verify an individual’s identity will depend on the circumstances.
We will seek the minimum amount of personal information needed to establish an individual’s identity.
For example, during a telephone contact it may be adequate for us to request information that can be checked against our records.</p>
<p>If we make a correction and we have disclosed the incorrect information to others, you can ask us to tell them about the correction.
We must do so unless there is a valid reason not to.</p>
<p>If we refuse to correct your personal information, you can ask us to associate with it (for example, attach or link) a statement that you believe the information is incorrect and why.</p>
<p>You also have the right under the FOI Act to request access to documents that we hold and ask for information that we hold about you to be changed or annotated if it is incomplete, incorrect, out-of- date or misleading.
For further information see the Access our information page on the OAIC website or see our contact details below.</p>How to make a complaint<p>If you wish to complain to us about how we have handled your personal information you should first complain to us in writing.
If you need help lodging a complaint, you can contact us - see ‘How to contact us’ below.</p>
<p>If we receive a complaint from you about how we have handled your personal information we will determine what (if any) action we should take to resolve the complaint.</p>
<p>If we decide that a complaint should be investigated further, the complaint will usually be handled by a more senior officer than the officer whose actions you are complaining about.</p>
<p>We will assess and handle complaints about the conduct of an OAIC officer using the APS Values and Code of Conduct and the guidelines issued by the Australian Public Service Commission.</p>
<p>We will tell you promptly that we have received your complaint and then respond to the complaint within 30 days.</p>
<p>If you are dissatisfied with the outcome of the complaint or the way in which the complaint was handled, then you may contact the Commonwealth Ombudsman https://www.ombudsman.gov.au/for advice about your complaint.</p>Contact us<p>You can contact us by:</p>
<p>Website:</p>
<p>See our Online Enquiries Form</p>
<p>Telephone:</p>
<p>1300 363 992 (from overseas +61 2 9942 4099)</p>
<p>Assisted Contact:</p>
<p>National Relay Service:</p>
<ul>
<li>TTY users phone 133 677 then ask for 1300 363 992.</li>
<li>Speak and Listen users phone 1300 555 727 then ask for 1300 363 992.</li>
<li>Internet relay users connect to the NRS then ask for 1300 363 992.</li>
</ul>
<p>Translating and Interpreting Service: 131 450 then ask for 1300 363 992.</p>
<p>Apart from the local call cost these are free services for you.</p>
<p>Post:</p>
<p>GPO Box 5288<br> Sydney NSW 2001</p>
<p>Facsimile:</p>
<p>+61 2 6123 5145</p>Supplementary materialOAIC information technology security practices<p>The Australian Human Rights Commission (the AHRC) provides information technology services to the OAIC under a Memorandum of Understanding (MOU).
The AHRC is also responsible for the safe keeping and maintenance of OAIC material it holds.
All of this material is stored in Australia.</p>
<p>In providing information technology services to the OAIC, the AHRC follows Commonwealth and industry best practice in ICT Security Management, including:</p>
<ul>
<li>Protective Security Policy Framework</li>
<li>Australian Government Information Security Manual</li>
<li>ISO/AS/NZS 31000: 2018 – Risk Management – Principles and Guidelines</li>
<li>ISO/IEC 27001:2013 – Information Technology – Security Techniques – Information Security Management Systems – Requirements</li>
<li>ISO/IEC 27040:2015 — Information Technology – Security Techniques – Storage security</li>
</ul>
<p>For the list of mandatory requirements that cover governance, personnel, information and physical security, please visit the Protective Security Policy Framework website.</p> Related pages Privacy policy summary Human resources privacy policy Did you find this helpful? Yes No Share Facebook Twitter Linkedin