Â鶹´å

This Privacy Policy (Policy) outlines the personal information handling practices of the Â鶹´å of Canberra and describes the framework to protect the privacy of all personal information or other data collected by the Â鶹´å in compliance with relevant privacy laws.

This Policy applies to all members of the Â鶹´å, including its staff and controlled entities, unless otherwise agreed by Council and the Vice-Chancellor of the Â鶹´å. A reference to the Â鶹´å in this Policy is a reference to all such entities of the Â鶹´å.

This Policy incorporates and is to be read in conjunction with the Â鶹´å’s Privacy Management and Data Breach Plan (Appendix 2) as well as the Data Classification Schedule (Appendix 3).

Definitions
Highly Sensitive means data subject to regulatory control, Â鶹´å Legal Advice, Personal Information about persons under age of 18, Tax File Numbers, Credit card details, campus safety data, personnel and/or payroll records, student records, commercial data belonging to a third party (contracts and commercial in confidence), patent information, personal health information and clinical trial data. It also includes data identified under the Australian government security classification system as confidential or higher (refer to www.protectivesecurity.gov.au).

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not. It does not include personal health information.

Personal health information is highly sensitive and means any Personal Information, whether or not recorded in a health record relating to the health, an illness or a disability of the individual; or collected by a health service provider in relation to the health, an illness or a disability of an individual.

Private information includes but is not limited to business unit process and procedure, unpublished intellectual property, ITC system design and configuration information, a limited range of Personal Information such as student numbers.

Sensitive information means in relation to an individual, information or an opinion about an individual’s racial or ethnic origin, immigration status, political opinions, memberships of political, professional and trade associations and unions, religious and philosophical beliefs, sexual orientation or practices, criminal history, health information, and genetic and biometric information. In relation to the Â鶹´å, it means organisational financial data, exam material and results, internal directories and organisational charts, internal planning documents, research data (containing Personal Information), and data considered commercial in confidence.

The Â鶹´å will strive to create, promote and maintain a culture of respect for the privacy of all individuals.
Through the management of privacy and incorporating privacy requirements into processes, procedures and information systems, the Â鶹´å aims to foster and support a relationship of trust between the Â鶹´å and its staff, students and members of the community.

The Â鶹´å’s Approach
The Â鶹´å will only collect, hold, use and disclose Personal Information to enable the Â鶹´å to meet legal obligations and where it is reasonably necessary or related to one or more of the Â鶹´å’s functions or activities.

These include:

• for students (includes past, current and future): to administer enquiries, admission, enrolment, academic progress, academic integrity, discipline, graduation, accommodation, access to Â鶹´å facilities and services, library loans, fees, visa, immigration, taxation and financial support purposes, and in relation to graduates, for alumni activities; and
• for employees, affiliates, visitors and sub-contractors: to administer pay, entitlements, performance, teaching, research, access to Â鶹´å facilities and services, visa, immigration and taxation purposes, and in relation to work health and safety, or rehabilitation and compensation matters.

How the Â鶹´å collects and holds Personal Information
Personal Information is considered to be ‘held’ by the Â鶹´å if the Â鶹´å is in possession or control of the information, or the information is in the possession or control of a person employed or engaged by the Â鶹´å in the course of that employment or engagement.

The Â鶹´å collects and holds information in a number of ways including:

• because it is required to provide a service which has been requested – for example, to implement a reasonable adjustment plan or if an individual becomes a client of the Medical and Counselling Centre or Faculty of Health Clinic;
• because it has been provided to the Â鶹´å – for example, by applying for admission or employment, participating in mobility or exchange programs, participating in or commenting on online forums, registering to attend an event, asking the Â鶹´å a question or making a complaint or;
• because of an individual’s previous or current relationship with the Â鶹´å – through the Â鶹´å’s advancement, alumni relations and philanthropy activities; and
• because the Â鶹´å is required by law to collect it – for example, because of higher education and immigration laws or monitoring and logging of metadata from an individual’s use of IT and online services and facilities provided by the Â鶹´å.

Sometimes the Â鶹´å may use or disclose Personal Information in circumstances where it would be reasonably expected to use or disclose it.

The Â鶹´å will not collect, hold, use or disclose sensitive information or personal health information, unless with the individual’s consent or if an exemption exists or is authorised by law. However, the Â鶹´å may collect, use or disclose personal, health or sensitive information in situations where it may be impracticable to obtain an individual’s consent or give prior notice, if the Â鶹´å reasonably believes it is necessary to do so, such as:

• to lessen or prevent a serious threat to life, health or safety;
• to review CCTV cameras on Â鶹´å premises;
• to take appropriate action in relation to suspected unlawful activity or misconduct;
• for enforcement related activities conducted by, or on behalf of, an enforcement body; for example, to assist authorities to locate a person reported as missing; or
• when establishing or defending a legal or equitable claim, or participating in a confidential dispute resolution process.

How the Â鶹´å discloses Personal Information
Common situations in which the Â鶹´å discloses Personal Information include, but are not limited to:

• other higher education institutions, if a student is involved in a student mobility, exchange, cross-institutional or joint program, or if a student is transferring to another institution;
• certain student administration matters;
• the Â鶹´å of Canberra College;
• accommodation service providers; for example, a Lodge, College or Hall of Residence; if a student’s accommodation is dependent on academic progress or affected by any Statutes, Rules, or policies of the Â鶹´å;
• a returning officer or other appointed electoral body for conducting elections of representatives to official Â鶹´å panels, committees, boards and associations;
• publications about some examination results and the award of some prizes and scholarships;
• when requested, for example, when a person graduates from the Â鶹´å (the record of a person’s graduation from the Â鶹´å is a public document);
• releasing information pursuant to the Â鶹´å’s Statutes, Rules, policies and procedures, or pursuant to a contractual obligation to which an individual has agreed to, such as Work Integrated Learning placements;
• publications about research activities at or involving the Â鶹´å in which an individual has elected to be involved;
• releasing statistical information to Australian Government Departments who are authorised to require it, the Tertiary Education Quality and Standards Agency (TEQSA), state and territory governments, Tertiary Admissions Centres (TACs), Higher Education providers for the purposes of the (‘HESA’) or the (‘ESOS’), and Universities Australia;
• reporting to the Australian Tax Office about Commonwealth-supported fee liabilities or to facilitate income tax assessment;
• reporting to Australian Government Departments with portfolio responsibility for social security and/or veterans’ entitlement matters about an individual’s income or a student’s attendance if the Â鶹´å is legally required to do so;
• reporting to Australian Government Departments with portfolio responsibility for child support matters about an individual’s income if the Â鶹´å is legally required to do so;
• if an individual is not an Australian citizen, reporting to Australian Government Departments with portfolio responsibility for migration and immigration, employment, higher education, research and technology, and related matters;
• the Australian National Audit Office for auditing purposes; and
• if the Â鶹´å is required by law to disclose the information.

The Â鶹´å may disclose Personal Information to an external review body if an individual seeks an external review of a Â鶹´å decision or makes a complaint to an external complaint handling body such as the ACT Ombudsman.
If an individual makes a complaint or report an incident to the Â鶹´å about another individual at the Â鶹´å, in some circumstances; the Â鶹´å may be required to disclose some Personal Information to the individual about whom a complaint has been made. It may be that sometimes the Â鶹´å is unable to act on a complaint or allegation unless consent is given to this kind of disclosure.

Engagement with Third Parties
The Â鶹´å does not disclose Personal Information about students to a student’s relatives or other relevant party without the student's consent. Students under 18 years of age and/or students who are registered with Inclusion and Engagement may consent to such disclosures of Personal Information in writing.

When the Â鶹´å engages third parties to perform services that involve handling any of the Personal Information held by the Â鶹´å, the Â鶹´å engages the third-party service provider in accordance with the obligations that apply to the Â鶹´å under the Privacy laws.

Social Media
If an individual chooses to communicate with the Â鶹´å or access information about the Â鶹´å through a social network service or app, the social network or app provider and its partners may collect, hold, use or disclose Personal Information, in Australia or overseas, for their own purposes and according to their own policies. This policy does not apply to those services.

Collecting through websites
Entry to some Â鶹´å web services is restricted by user log-in protocols. The Â鶹´å requires individuals to use their Â鶹´å ID to access these sites to help the Â鶹´å keep the information accessible through these sites secure from unauthorised alteration, use or disclosure, to resolve problems with the Â鶹´å’s IT systems, and to keep an auditable record of who has accessed this information.

The Â鶹´å has a public website. When the website is viewed, the server makes a record of the visit and logs some or all of the following information:

• the viewer’s browser’s internet IP address;
• the date and time of the visit to the site;
• the pages accessed and documents downloaded;
• the previous site visited;
• the type of browser the viewer is using; and
• the username entered if accessing a restricted site.

The Â鶹´å uses this information for statistical purposes, for system administration tasks to maintain this service and to personalise the user’s experience in future visits to the site. The Â鶹´å may use that information to identify and resolve problems with the Â鶹´å’s IT systems, and to keep an auditable record of who has accessed the Â鶹´å’s IT systems for security purposes. The Â鶹´å does not attempt to identify individuals unless prior consent is given. However, in the unlikely event of an investigation, the Â鶹´å, a law enforcement agency or other government agency may exercise its legal authority to inspect the Â鶹´å’s server’s logs or require reporting by the Â鶹´å.

Building access
If an individual enters any Â鶹´å building or room that requires the individual to swipe their Â鶹´å ID card to gain entry, the Â鶹´å may collect and use that information to keep an auditable record for safety and security purposes.

Library loans
If an individual borrows material from the Â鶹´å library, the Â鶹´å collects and uses Personal Information to manage priority course-based access to materials and to communicate with individual’s about their library loans. The Â鶹´å does not keep this information after borrowed library material is returned.

Email lists
The Â鶹´å collects individuals’ non-Â鶹´å of Canberra email address (and other contact details) when these are provided to the Â鶹´å. The Â鶹´å will only use this information to contact individuals for administrative purposes related to their engagement with the Â鶹´å. The Â鶹´å will use graduates email addresses to send information about Â鶹´å of Canberra alumni and philanthropy activities. Graduates can opt out of alumni related activities at any time by clicking on the unsubscribe link included in all such emails.

If an individual registers to attend an event, the Â鶹´å usually collects the contact details provided at registration to communicate with individuals about the event registered for. The Â鶹´å may also communicate with individuals about other events the Â鶹´å thinks individuals might be interested in. Individuals can opt out of receiving further emails at the time of registering for an event, by telling the sender by return email that they do not want to receive further emails, or the individual can unsubscribe from further events emails using the link in the email, according to how the event registration process is administered.

The Â鶹´å also collects individuals’ non-Â鶹´å of Canberra email address for purposes of sending student notifications and issuing passwords.

Anonymity
Where practicable and lawful, the Â鶹´å will allow individuals to interact with the Â鶹´å anonymously or using a pseudonym. However, for most of the Â鶹´å’s functions and activities the Â鶹´å usually needs an individual’s name and contact information or Â鶹´å ID number, and enough information about the particular matter to enable the Â鶹´å to respond to the inquiry, request, application, donation or complaint.

The Â鶹´å will also allow individuals to request the destruction of the Personal Information the Â鶹´å holds where practicable and lawful in line with the lawful principle of the ‘right to be forgotten’ under the European Union (EU) (GDPR). The GDPR, which took effect on 25 May 2018, replaces the previous European data protection legislation.

Collection from other people
In the course of the Â鶹´å’s day to day activities as an employer and a higher education provider, the Â鶹´å may collect Personal Information about individuals indirectly from publicly available sources, or from third parties. The Â鶹´å also collects Personal Information from publicly available sources to enable the Â鶹´å to identify and contact stakeholders who may be interested in the Â鶹´å’s endowment and philanthropy programs.

Overseas disclosure
In performing and managing its functions and activities, the Â鶹´å may need to make personal information available to third party services providers, including providers of cloud services and website hosts. These third parties may be located overseas. The Â鶹´å will take reasonable steps to ensure that any third parties located overseas whom the Â鶹´å engages to handle Personal Information are bound by substantially similar privacy standards and obligations as the Â鶹´å. Appendix 1 lists the overseas locations of providers where Â鶹´å data is held.
If a student is involved in a mobility, exchange, cross-institutional or joint program with an institution in another country, or if a student is transferring to another institution overseas, the Â鶹´å will disclose Personal Information to the student’s home or host institution overseas, including matters which impact on the student’s ability to participate in the program, such as misconduct.

Storage and security of Personal Information
Most of the information the Â鶹´å creates or handles is contained in, or forms part of, an Australian Capital Territory Record. The Â鶹´å takes reasonable steps to destroy or de-identify Personal Information in a secure manner when the Â鶹´å no longer needs it. The Â鶹´å is required to deal with most of its records in accordance with the and Disposal Authorities issued pursuant to that Act.

Access and correction of Personal Information
The Â鶹´å will make its best effort to ensure the Personal Information it holds is accurate and complete when collected and kept up to date for the period in which it is used.

An individual has a right to know what Personal Information is held about them and a right to access that information for review or correction where appropriate.

If requested, the Â鶹´å will give individuals access to their Personal Information, unless there is a law that allows or requires the Â鶹´å not to.

If the Â鶹´å makes a correction to the information it holds and discloses the incorrect information to others, an individual can request that the Â鶹´å informs the individual about the correction. The Â鶹´å will do so unless there is a valid reason not to. If the Â鶹´å refuses to correct Personal Information, an individual can ask the Â鶹´å to attach a statement to it stating that the individual believes the information is incorrect and why.

Privacy complaints
If an individual wishes to make a complaint about how the Â鶹´å has handled their Personal Information, this should be done in writing. For assistance in lodging a complaint, please contact: privacy@canberra.edu.au.
If the Â鶹´å receives a complaint about how Personal Information has been handled, the Â鶹´å will determine what (if any) action should be taken to resolve the complaint.

Privacy complaints will be referred for resolution to the relevant data and/or information system stewards in the first instance. The Â鶹´å will promptly indicate that the complaint has been received and will endeavor to respond to the complaint within 30 days.

If an individual is not satisfied with the Â鶹´å’s response, a review by a more senior officer within the Â鶹´å can be requested, or a complaint can be lodged at the .

Contacts
Telephone:  +61 2 6201 5569
TTY:  +61 2 6251 4601 (for hearing impaired callers)
Email:  privacy@canberra.edu.au 
Mail: Privacy Contact Officer
         Â鶹´å of Canberra
         BRUCE ACT 2601
         Australia

Related Documents
Charter of Conduct and Values
Â鶹´å of Canberra Compliance Register
Data Governance Framework
Delegations Policy Framework
Enterprise Agreement
Fraud and Corruption Control Plan

DITM and Records Management Policy Manual
 

 

APPENDIX 1
Locations of overseas recipients of Personal Information

United States of America
Canada
United Kingdom
European Union
Japan
Singapore
Hong Kong
India
Vietnam
China
 

• collection is relevant and necessary in accordance with the Principles of this policy; and
• a privacy notice and/or consent as relevant to the situation is included as part of the collection process.

1. Serious Breach includes where:
   1. multiple individuals are affected by the breach or suspected breach;
   2. there are, or there may be, a Real Risk of Serious Harm to the affected individual(s);
   3. the breach or suspected breach indicates a systemic problem in the Â鶹´å’s processes or procedures;
   4. there could be media or stakeholder attention as a result of the breach or suspected breach; or
   5. the risk rating is “Medium”, “High” or “Extreme” as identified in Annexure 3: Data Classification Assessment of this Response Plan;
2. Data Breach means, for the purpose of this Plan, when Information is lost, stolen or subjected to unauthorised access, modification, disclosure, or other misuse or interference, whether accidentally or intentionally;
3. Direct marketing means issuing marketing or promotional materials about the Â鶹´å or other parties directly to an individual (e.g. by post, email, SMS);
4. Real Risk of Serious Harm includes risk of physical, psychological, emotional, reputational, economic or financial harm to an affected individual, for the avoidance of doubt this includes, but is not limited to, risk of identity theft, financial fraud, health fraud, embarrassment, discrimination or disadvantage and blackmail;
5. Notifiable data breach means a data breach that is likely to result in serious harm, which must be notified to affected individuals and the Office of the Australian Information Commissioner (OAIC).

• all privacy impacts are assessed and addressed, including the disclosure, transfer or storage of Personal Information outside Australia or to a Commonwealth agency, and
• all contractual obligations with relevant third parties are imposed through an enforceable contract, appropriately managed and monitored.

1. Privacy Management

The Â鶹´å is subject to the (the Privacy Act) and the . Through its Privacy Policy and this Plan the Â鶹´å describes how it will keep its practices consistent with the Australian Privacy Principles (the Principles), as well as providing guidance to Â鶹´å staff on the application of the Principles. This Plan also describes the application of the Principles and the Â鶹´å’s own policy to everyday decision making by Â鶹´å staff.

1.  Collection of Personal Information - [Privacy Policy principle 1.1, 1.3]

1. that the Â鶹´å has collected the information and the circumstances of the collection; and
2. of the Â鶹´å’s Privacy Statement.

• the individual would reasonably expect the Â鶹´å to use or disclose the Personal Information for the Secondary purpose;
• the Secondary purpose is related to the Primary purpose (or in the case of Sensitive Information, directly related to the Primary purpose); or
• another exemption exists at law.

• A student applies to enrol in a program that is clearly advertised as being jointly delivered by the Â鶹´å with other universities and that applications will be considered by all collaborating universities.
• An individual submits an entry to a Â鶹´å-run competition. The competition rules clearly state that entries will be judged by an independent panel.
• The Â鶹´å is served with a subpoena to produce personnel records of a staff member or a student who is involved in a motor vehicle accident case.
• The Vice-Chancellor’s office receives an email from Centrelink, acting under the , requesting that the Â鶹´å provides enrolment information about a student.
• The Â鶹´å’s Student Life (pastoral care) team forms a reasonable belief that a student is at risk of self-harming. The Â鶹´å can notify the ACT Mental Health Crisis Team triage service and provide location and other sensitive information so that it can determine whether to take action to locate the student and provide intervention.

7.  Permitted disclosure to third parties [Privacy Policy principle 2.4] including Overseas recipients – [Privacy Policy principle 2.5, 2.6]

• Providing government departments and agencies with Personal Information to satisfy reporting requirements.
• Sharing date of birth, course information and reasonable adjustment plans with the Â鶹´å’s controlled entities or the Â鶹´å of Canberra College so that services can be provided to a student.
• Sharing student names and email addresses with a Canadian software provider in order to establish user accounts to enable students to have access to the Â鶹´å’s internet-based education resources and assessment tools.
• The Faculty of Health organises clinical placements for students and the placement provider requires police checks, names and emergency contact details of the attending students.
• Sharing research data containing Personal Information with an overseas collaborating institution.

• storing electronic files with Personal Information on a server located overseas where the Â鶹´å does not have a contract with this organisation; eg
  • downloading information to ‘Dropbox’,
  • storing research data on Google Drive
• disclosing a student’s grades to a prospective employer
• informing a parent about student class attendance or welfare

• consent has been obtained from the individual via an opt in process;
• the marketing is directly related to the purpose it was collected for; or
• the individual would reasonably expect us to use or disclose the Personal Information for that purpose.

• The Â鶹´å sends an email to all enrolled students to advertise a public event being held by the Â鶹´å of Canberra Union.
• The Marketing team sends a tweet about new course offerings in the upcoming semester to all students.

9.  ACCURACY OF INFORMATION - [Privacy Policy principle 3.1, 4.4, 4.5, 4.6] 10.  SECURITY OF PERSONAL INFORMATION - [Privacy Policy principle 3.1] 11.  DEALING WITH REQUESTS FOR ACCESS TO PERSONAL INFORMATION -  [Privacy Policy principle 4.1, 4.3]
Requests from Individuals
Individuals are entitled to request access to their own Personal Information in writing or email without the need for a formal application under the .

Requests from lawyers (other than the Â鶹´å’s lawyers)
Lawyers do not have a special right to access information held by the Â鶹´å. Personal Information must not be disclosed in response to a lawyer’s request unless it is accompanied by written consent of the person to whom the information relates, or if required by law or a court/tribunal order.

An example where records should not be released:
The Faculty of Arts and Design receives a letter from a law firm requesting attendance and academic records pertaining to a former student. The letter states the documents are urgently required for a hearing in the ACT Supreme Court.

A letter of this nature should be accompanied by a subpoena from the court or written consent from the student concerned. All Such Requests Should Be Forwarded to the Â鶹´å’s Legal Office.

The Â鶹´å may limit access
Documentation produced to third parties or individuals may be withheld or redacted if the Â鶹´å determines that access would not be appropriate. Permitted reasons include:

• unreasonable impact on the privacy of other individuals (e.g. personally identifying information of referees on a staff appointment file)
• the request for access is frivolous or vexatious
• documents are subject to confidentiality obligations or legal professional privilege, granting access would compromise the Â鶹´å in anticipated legal proceedings or commercially sensitive decision-making processes
• the release of the information may create serious risk of harm ().

12.  Responding to a data breach - [Privacy Policy principle 5.1]

• mistakenly emailing Personal Information to the wrong person
• loss or theft of laptops, removable storage devices or physical files
• hacking of the Â鶹´å’s DITM systems
• staff accessing Personal Information outside the requirements of their employment.

1.  Identification of a breach 2.  Assessment of a breach

1. an evaluation of the scope and possible impact of the breach;
2. determination if the breach is likely to be notifiable; and
3. a plan of action to minimise harm including, if required, notification to the OAIC.

3.  A notifiable breach 5.  Breaches that are not serious 6.  Records
3.     Alignment with Government Security Classification
The Â鶹´å of Canberra does not use dissemination limiting markers (DLMs) in its Data Classification. Alignment to the Australian Government and ACT Government security classification systems as follows:

Â鶹´å of Canberra	Commonwealth	ACT
Public	Information not requiring additional protection	Unclassified
		FOR OFFICIAL USE ONLY (OR FOUO)
Sensitive/Private	CONFIDENTIAL	SENSITIVE
		SENSITIVE:LEGAL
		SENSITIVE: PERSONAL
Highly Sensitive	SECRET	SENSITIVE: AUDITOR-GENERAL
NA	TOP SECRET	SENSITIVE: CABINET

 

Terms	Definitions
Data Breach	means, for the purpose of this Plan, when Information is lost, stolen or subjected to unauthorised access, modification, disclosure, or other misuse or interference, whether accidentally or intentionally.
Direct marketing	means issuing marketing or promotional materials about the Â鶹´å or other parties directly to an individual (e.g. by post, email, SMS).
Highly Sensitive	means data subject to regulatory control, Â鶹´å Legal Advice, Personal Information about persons under age of 18, Tax File Numbers, Credit card details, campus safety data, personnel and/or payroll records, student records, commercial data belonging to a third party (contracts and commercial in confidence), patent information, personal health information and clinical trial data. It also includes data identified under the Australian government security classification system as confidential or higher (refer to www.protectivesecurity.gov.au).
Notifiable data breach	means a data breach that is likely to result in serious harm, which must be notified to affected individuals and the Office of the Australian Information Commissioner (OAIC).
Personal health information	is highly sensitive and means any Personal Information, whether or not recorded in a health record relating to the health, an illness or a disability of the individual; or collected by a health service provider in relation to the health, an illness or a disability of an individual.
Personal Information	means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not. It does not include personal health information.
Private information	includes but is not limited to business unit process and procedure, unpublished intellectual property, ITC system design and configuration information, a limited range of Personal Information such as student numbers.
Real Risk of Serious Harm	includes risk of physical, psychological, emotional, reputational, economic or financial harm to an affected individual, for the avoidance of doubt this includes, but is not limited to, risk of identity theft, financial fraud, health fraud, embarrassment, discrimination or disadvantage and blackmail.
Sensitive information	means in relation to an individual, information or an opinion about an individual’s racial or ethnic origin, immigration status, political opinions, memberships of political, professional and trade associations and unions, religious and philosophical beliefs, sexual orientation or practices, criminal history, health information, and genetic and biometric information. In relation to the Â鶹´å, it means organisational financial data, exam material and results, internal directories and organisational charts, internal planning documents, research data (containing Personal Information), and data considered commercial in confidence.
Serious Breach	includes where: (i) multiple individuals are affected by the breach or suspected breach; (ii) there are, or there may be, a Real Risk of Serious Harm to the affected individual(s); (iii) the breach or suspected breach indicates a systemic problem in the Â鶹´å’s processes or procedures; (iv) there could be media or stakeholder attention as a result of the breach or suspected breach; or (v) the risk rating is “Medium”, “High” or “Extreme” as identified in Annexure 3: Data Classification Assessment of this Response Plan.