1.1 The City of Adelaide (“the Council”) is committed to maintaining a culture that respects each individual’s right to privacy. This Policy sets out the policies of the Council in relation to its management of personal information.
1.2 The Privacy Act 1988 sets out the principles that must be followed by Commonwealth Government agencies and many private organisations in relation to the collection, use, storage and disclosure of personal information. The provisions of the Privacy Act do not apply to this Council or any other council, but it is the intention of the Council that its policies and practices in relation to privacy should be, so far as is reasonably practicable, consistent with the Information Privacy Principles and the National Privacy Principles set out in the Act.
1.3 The South Australian Government has not implemented a statutory scheme that imposes privacy obligations upon councils. This Policy is, therefore, an informal measure which is intended to promote what the Council considers to be “best practice”.
2. POLICY OBJECTIVES
To establish a Policy that forms the basis for the practices and procedures of the Council in relation to the collection, use, storage and disclosure of personal information by all Council employees and the Lord Mayor and Councillors.
3.1 Access means providing to an individual, information about himself or herself that is held by the Council. This may include allowing that individual to inspect personal information or to obtain a copy.
3.2 Collection means gathering, acquiring or obtaining personal information from any source and by any means, including information that the Council has come across by accident or has not asked for.
3.3 Consent means voluntary agreement to some act, practice or purpose.
3.4 Disclosure means the release of information to persons or organisations outside the Council. It does not include giving individuals information about themselves.
3.5 Local Government Act means the Local Government Act 1999.
3.6 Personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about a natural living person whose identity is apparent, or can reasonably be ascertained, from the information or opinion, including a photograph or other pictorial representation of a person, but does not include information that is in:
• Generally available publications;
• Material kept in public records and archives such as the Commonwealth or State archives; or
• Anything kept in a library, art gallery or museum for the purpose of reference, study or exhibition.
3.7 Privacy Act means the Privacy Act 1988.
3.8 Sensitive information means information or an opinion about an individual’s • Racial or ethnic origin;
• Political opinions;
• Membership of a political association, a professional or trade association or a trade union;
• Religious beliefs or affirmations;
• Philosophical beliefs;
• Sexual preferences or practices;
• Criminal record; or
3.9 The Council means the City of Adelaide.
3.10 Use means the handling of personal information within a Council including the inclusion of information in a publication.
4. LEGISLATIVE REQUIREMENTS AND CORPORATE POLICY CONTEXT
4.1 In adopting this Policy it is recognised that there are specific legislative requirements to be met as well as other corporate goals. The following Acts and Regulations have precedence over any Council Policy (addressed below) and must be considered when interpreting and implementing this policy:
• City of Adelaide Act 1998 and Regulations;
• Development Act 1993 and Regulations;
• Dog and Cat Management Act 1995 and Regulations;
• Expiations of Offences Act 1996;
• Food Act 2001 and Regulations;
• Freedom of Information Act 1991 and Regulations;
• Local Government Act 1999 and Regulations;
• Local Government (Elections) Act 1999 and Regulations;
• Rates and Land Tax Remission Act 1986 and Regulations;
• Recreation Grounds Rates and Taxes Exemption Act 1981;
• Road Traffic Act 1961;
• Public and Environmental Health Act 1987 and Regulations;
• State Records Act 1997 and Regulations;
• Valuation of Land Act 1971 and Regulations; and
• The Market & Social Research Privacy Principles (2003).
4.2 This Policy is to be implemented in conjunction with other relevant Corporate Policies and Strategies, including:
• Strategic Management Plan;
• Freedom of Information Statement;
• Corporate Complaints Handling Policy;
• Grievance Policy & Procedure;
• Employee Code of Conduct;
• Code of Conduct for the Lord Mayor and Councillors of the City of Adelaide; and
• Public Communication and Consultation Policy.
5. POLICY STATEMENTS
5.1 Collection of Personal Information
5.1.1 The Council will not collect personal information unless:
(a) The personal information is collected for a lawful purpose directly related to a legislative function or power of the Council;
(b) Collection of the personal information is necessary for or directly related to that purpose; and
(c) Explicit permission has been given by the person whose personal information is being collected.
5.1.2 The personal information that may be collected will depend on the particular purpose for which it is collected, and may include but is not limited to:
• Telephone numbers;
• Name and addresses (postal, residential and e-mail addresses);
• Age and/or date of birth;
• Property ownership and/or occupier details;
• Details of resident’s/ratepayer’s spouse or partner;
• Development applications, including plans or specifications of buildings;
• Pet ownership;
• Electoral roll details;
• Pensioner / concession information;
• Payment history;
• Financial, rental or income details;
• Details of land valuation;
• Preferred addresses and methods of contacts;
• Details of employment; and
• Insurance details.
5.1.3 All personal information that the Council is legislatively required or permitted to collect will be collected in a fair and lawful manner.
5.1.4 All personal information that is collected by Council for the purposes of research will be treated within the Market and Social Research Privacy Principles (Appendix A).
5.1.5 The Council will take reasonable steps to inform the person whose personal information it collects:
(a) Of the purpose(s) for which the personal information is being collected;
(b) If the collection of the information is authorised or required by law, that the collection is so authorised or required; and
(c) In general terms, of its usual practices with respect to the use and disclosure of personal information of the kind collected.
5.1.6 The Council will take reasonable steps to ensure that personal information collected by it, is relevant to the purpose(s) of collection and is up to date and complete.
5.1.7 The Council will take reasonable steps to ensure that the collection of personal information by it does not unreasonably intrude upon an individuals personal affairs.
5.1.8 The Council may collect information concerning persons from a number of private and public sector agencies, which may include, but is not limited to Transport SA, the State Electoral Office, Office of the Valuer General, SA Water, Telstra and from individual persons.
5.2 Maintenance and Storage of Personal information
5.2.1 The Council will take reasonable steps to:
(a) Protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure; and
(b) Maintain its record keeping systems to ensure that all personal information collected is up to date, accurate and complete; and
(c) Ensure that any person who, on behalf of the Council, uses or discloses personal information held by the Council has appropriate authorisation to do so.
5.3 Use of Personal Information
5.3.1 Where the Council collects personal information for a particular purpose, it will not use that personal information for any other purpose, unless:
(a) The Council first takes reasonable steps to obtain the consent of the individual concerned to use his or her personal information for that other purpose; or
(b) The Council believes on reasonable grounds that use of the information for that other purpose is necessary to prevent or lessen a serious or imminent threat to the life or health of the individual concerned or another person; or
(c) Use of the information for that other purpose is required or authorised by law; or
(d) Use of the information for that other purpose is reasonably necessary for the enforcement of the criminal law or of law imposing a pecuniary penalty; or
(e) The purpose for which the personal information is used is directly related to the purpose for which it was collected.
5.4 Disclosure of Personal Information
5.4.1 The Council will not disclose personal information it holds about a person to a third party, except where:
(a) A reasonable individual is likely to have been aware that his or her personal information would be disclosed in that way;
(b) The resident or ratepayer has consented to or made a written request for personal information to be provided to a third party;
(c) The personal information is provided for the purpose of distributing materials of and on behalf of the Council (for example: the provision of address data for use by a mailing service provider to post Rates Notices or other materials);
(d) The third party has been contracted by the Council to provide advice or services for the purpose of assisting the Council in providing benefits to persons (for example: State Electoral Office, Office of the Valuer General, insurers, legal service providers);
(e) The Council is required or authorised by law to disclose the personal information to a third party or to the public at large (for example, under the Freedom of Information Act);
(f) The resident or ratepayer has been advised of the Council’s usual practice of disclosing personal information to that third party or a third party of that type for a particular purpose and the disclosure is consistent with that purpose; or
(g) A public consultation submission has been received by Council. To enable transparency in consultation processes to occur, all public consultation submissions received by Council will become public documents and may be included in a report to Council which is also available to the public.
5.4.2 Where personal information is provided to the Council by a person “in confidence”, the Council will not disclose such information to a third party without the person’s consent, unless such disclosure is required or authorised by law (for example, applications made under the Freedom of Information Act).
5.4.3 The Council will take reasonable steps to:
(a) Contract only with third party service providers that are subject to the provisions of the Privacy Act and the National Privacy Principles; and
(b) Where the third party service provider is not subject to the provisions of the Privacy Act and the National Privacy Principles, enter into a Privacy Agreement that requires the third party service provider to comply with the provisions of this Policy relating to the collection, use, storage and disclosure of personal information supplied by the Council.
5.4.4 The Council may supply personal information about an individual to that individual as part of a standard communication or pursuant to a request made by the individual.
5.4.5 The Council does not accept any responsibility for any loss or damage suffered by a person because of their reliance on any personal information provided to them by the Council or because of the Council’s inability to provide persons with any requested personal information.
5.4.6 The Council expects that persons will, before relying on any personal information the Council provides to them, first seek confirmation from the Council about the accuracy and currency of such personal information.
5.5 Alteration of Personal Information
5.5.1 The Council assumes that personal information provided by persons or other persons is accurate, complete and up-to-date. It is the responsibility of persons to provide the Council with details of any changes to their personal information as soon as reasonably practicable following such change.
5.5.2 The Council will take reasonable steps, such as making appropriate deletions, additions and corrections, to ensure that personal information held by it is accurate, relevant, complete, up to date and not misleading.
5.5.3 A person may apply to the Council, in a form determined by the Council, to have his or her personal information amended so that it is accurate, relevant, complete, up-to-date and not misleading. Where the Council, on reasonable grounds, decides not to amend a resident’s or ratepayer’s personal information in the manner requested in the application, the Council will inform the person of its decision and the reasons for refusing to make the requested amendments. If requested by a resident or ratepayer, the Council will take reasonable steps to attach to a record containing that person’s personal information a statement provided by that person of the correction, deletion or addition sought.
5.6 Access to Personal Information
5.6.1 A person who wishes to access personal information held by the Council must make a written application to the Freedom of Information Officer. An applicant will be required to pay an application fee as determined by the Freedom of Information Act 1991.
5.6.2 Subject to the provisions of this legislation, the Council may grant or refuse access to personal information at its discretion.
5.6.3 The Council recognises that there are certain documents, which may contain personal information, that the Council is legislatively required to make available for access by members of the public.
5.6.4 An application to access personal information will be dealt with within 30 days of receipt of the request. In certain circumstances, an applicant may be required to satisfy Council staff as to his or her identity.
5.7 Suppression of Personal Information
5.7.1 A person’s name or address may be suppressed from the Council’s Assessment Record and Voters Roll where the Chief Executive Officer is satisfied that inclusion of the name or address on the Assessment Record and/or Voters Roll would place at risk the personal safety of that person, a member of that person’s family, or any other person.
5.7.2 Enquiries regarding suppression of personal information should be directed to Customer Services staff at the Customer Service Centre in the first instance.
5.8 Sensitive Information
5.8.1 The Council will not collect sensitive information about an individual unless:
(a) The individual has consented;
(b) The collection is required by law;
(c) The collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any person; or
(d) The collection is necessary for the establishment, exercise or defence of a legal or equitable claim.
5.8.2 If the Council collects sensitive information about an individual in accordance with the provisions of this Policy, the Council will take reasonable steps to de-identify the information before the Council discloses it.
6. FREEDOM OF INFORMATION
Personal information may be released to others if requested under the Freedom Of Information Act, however, in accordance with this Act, a person will be consulted to obtain their opinion on release of the information. Should it be determined the information will be released against the view of the person, they have the right to request a review of the decision, on payment of the prescribed fee, prior to the information being released.
7.1 A person who has any concerns regarding how the Council handles personal information or requires further information should contact the Customer Services staff at the Customer Service Centre in the first instance.
7.2 If the person’s concerns can not be satisfied, the person may lodge a formal complaint, under the Corporate Complaint Handling Policy & Procedures or the Grievance Policy & Procedure
8. REVIEW OF POLICY
This policy will be reviewed bi-annually or earlier in the event of major changes to legislation or related policies, procedures or if deemed necessary by the Team Leader Risk & Planning.
10. FURTHER INFORMATION
Customer Service Centre
25 Pirie Street
Adelaide SA 5000
Telephone: (08) 8203 7203
Team Leader Risk & Planning
25 Pirie Street
Adelaide SA 5000
Telephone: (08) 8203 7274
Freedom of Information Officer
25 Pirie Street
Adelaide SA 5000
Telephone: (08) 8203 7459
APPENDIX A – Market & Social Research Privacy Principles
• Personal information should not be collected unless necessary to the project.
• At the time of data collection, the responding individual should be informed of:
o the purpose(s) for collecting retaining identification details;
o the period for which the information will remain identified;
o whether they are likely to be re-contacted based on the information collected;
o their right to access and/or delete, destroy or de-identify part of all of the information they provide (while it remains identifiable)
o the organisation collecting the information and/or list source
o contact details for further information
• If personal information is collected for a specific purpose (i.e. validation of interview data), once the personal information has been used for the specific reason any remaining information should be de-identified and the personal information destroyed.
• Identified information may only be retained while details are required for the primary collecting purpose – after this time information should be de-identified. Identifying information should be stored separately from other information and linked with an ID number.
• Steps should be taken to ensure that personal information is securely stored and not misused.
• Personal information should not be used except for the purpose to which it is relevant. It can be used for another purpose with the consent of the individual – this consent can be explicit or implied, and includes providing personal details to a third party.