Privacy Policy PRIVACY POLICY NSW Charitable Organisation Collection of Data NSW public sector agencies need to collect, store and use clients’ personal and health information to provide services such as transport, health care and meals. COA is legally required to abide by certain principles to ensure a client’s privacy is protected. COA is bound by the Australian Privacy Principles introduced 12 March 2014 (previously under the Privacy Act (Commonwealth) 1988 as amended by the Privacy Amendment (Private Sector) Act 2000), and includes all amendments to the principles as they become available. Recording and Correction of Personal Information Volunteers and Service Recipients For the purposes of allowing their access to service COA needs to collect and record personal information about volunteers and service recipients and use that information when providing and recording use of COA services supplied to these people. Such information can include: name, address, contact details. birth date, marital status, gender, occupation. next of kin, family, carer, responsible person or advocacy details. medical, psychological and health information and records. congregation and organisational affiliations. instructions received. The sources of such information will include: the recipient. the RAS and client’s My Aged Care record. family, friends, carers and other responsible persons or advocates. medical practitioners and other agencies and health care providers. Failure to collect and record this information will prevent COA from providing its services effectively. COA may also sometimes be required to disclose that information (or part of that information) to:- appropriate organisations, including government departments and hospitals. medical practitioners, other agencies and health service providers. HCP providers and case managers of shared clients. professional advisers. other appropriate persons, such as relatives, friends, guardians or other responsible persons under the Guardianship Act. COA will seek the consent of each service applicant and volunteer for its collecting, recording, using and disclosing of information, as COA feels appropriate subject to this Privacy Policy. Absence of consent may not necessarily preclude COA from collecting, recording, using or disclosing any such information as may be appropriate or required in exceptional circumstances. If any recipient notifies COA in writing that he or she wishes to limit the disclosure COA may make, COA will seek to give effect to such limitations to the extent that it reasonably can do so whilst performing its legal obligations and maintaining and protecting the health and welfare of recipients. Data Quality and Security All reasonable efforts are made to ensure the accuracy of personal information collected, recorded, used, or disclosed by COA. Only authorised staff may access personal information. Access is only to be provided on a “need to know” basis, and all cabinets containing hardcopies of personal information are kept locked. Access, Correction and Complaints If an individual makes a written request for access to their information, COA shall allow the person to inspect their personal records and take notes or may make available a hard copy. Such requests are to be met within 14 days of a written request. Where COA is satisfied that information recorded is incorrect, COA’s records are to be corrected as soon as reasonably possible. If an individual believes there has been a breach of privacy he/she should contact COA’s CEO or a COA Board member. A written confirmation of the complaint may be requested and the complainant may be asked to provide proof of identity. Every endeavour will be made to deal with complaints expeditiously and, as far as reasonably possible, within 21 days of COA’s receipt of the written complaint, and following COA’s Complaints and Grievance procedure. Collection and Disclosure of Personal Information This procedure was created in accordance with the HRIP Act of 2002, which regulates how public and private sector organisations collect and handle information: Updated on 12 July 2007. It has been reviewed in light of the Australian Privacy Principles of 2014. Lawful collection of personal information COA as an agency must not collect personal information unless: the information is collected for a lawful purpose that is directly related to a COA function or activity. the collection of the information is reasonably necessary for that purpose. COA must not collect personal information by any unlawful means. Collection of personal information directly from individual COA must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: the individual has authorised collection of the information from someone else. in the case of information relating to a person who is under the age of 16 years, or a client suffering from dementia and information must be provided by a parent, guardian or advocate of the person. Requirements when collecting personal information If COA collects personal information from an individual, COA must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete. the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. Retention and security of personal information COA as a public sector agency that holds personal information must ensure: that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used. that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information. that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse. that, if it is necessary for the information to be given to a person in connection with the provision of a service by COA, everything reasonably within the power of COA is done to prevent unauthorised use or disclosure of the information. Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personal identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activitiy the following will apply: Your data will be made available to our website provider The data that may be available to them includes any of the data we collect as described in this policy Our website provider will not transfer your data to any other third party They will store data for a maximum 7 years This processing does not affect your rights as detailed elsewhere in this privacy policy Information about personal information held by COA COA, as a public sector agency that holds personal information, must take such steps as are reasonable to enable genuine enquirers to ascertain whether COA holds personal information relating to a particular person, and must disclose: the nature of that information. the main purposes for which the information is used. that person’s entitlement to gain access to the information. Access to personal information held by COA COA must, at the request of individuals to whom the information relates, and without excessive delay or expense, provide the individual with access to the information it holds. Alteration of personal information COA must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information: is accurate. having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. If COA is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, COA must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by COA. COA must check the accuracy of personal information before use COA, as a public sector agency that holds personal information, must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. Limits on use of personal information COA, as a public sector agency that holds personal information, must not use the information for a purpose other than that for which it was collected unless: the individual to whom the information relates has consented to the use of the information for that other purpose. the other purpose for which the information is used is directly related to the purpose for which the information was collected. the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. Limits on disclosure of personal information COA must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: the disclosure is directly related to the purpose for which the information was collected, and COA disclosing the information has no reason to believe that the individual concerned would object to the disclosure. the individual concerned is reasonably likely to have been aware, or has been made aware that information of that kind is usually disclosed to that other person or body. COA believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. If personal information is disclosed to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. Special restrictions on disclosure of personal information COA must not disclose personal information relating to an individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person. Exemptions where non-compliance would benefit the individual concerned COA is not required to comply with nondisclosure if compliance by COA would, in the circumstances, prejudice the interests of the individual to whom the information relates. Requirement to give information The Privacy Commissioner may, in connection with the exercise of the Privacy Commissioner’s functions, require any person or public sector agency: to give the Privacy Commissioner a statement of information. to produce to the Privacy Commissioner any document or other thing. to give the Privacy Commissioner a copy of any document. A requirement under this section must be in writing, must specify or describe the information, document or thing required, and must specify the time and manner for complying with the requirement. All clients should be informed: At the time of assessment that although they have signed the Assessment form the information on this form is provided as a unique coded identifier when statistics are sent in to the funding body and that no actual names appear. That information to other agencies will only be passed on when that information relates to another service that the client requires. That should they not wish to sign for permission for information to be passed on to other agencies then this is flagged on the assessment and on the computer. That when a home support worker is put in place, only the information relating to the duties required will be passed on to that worker.