YMCA SOUTH AUSTRALIA Privacy Policy

Transcription

1 Policy Title: Author: YMCA SOUTH AUSTRALIA Created by: 1 P a g e

2 Policy Title: Author: 1. Introduction considers the privacy of individuals, staff, volunteers, clients, Member Associations and associated companies to be of highest importance, and is committed to handling all personal information with honesty and transparency. is committed to ensuring openness and transparency of governance to stakeholders while protecting the privacy of individuals. This policy outlines how the YMCA South Australia will approach the collection, storage, disclosure and use of personal information. This policy has been prepared in accordance with current legislation. 2. Scope reserves the right to make changes or amendments to the as required by law, technologies and relevant changes in s operational practices. This policy applies to all people with access to Inc., its entities and YMCA South Australia Youth and Family Services Inc. For the purpose of this document we refer to these entities as. All policies and procedures that apply to YMCA activities at an Association / Entity level must conform to this Policy. This policy applies to the whole of (staff, Board Directors, volunteers and independent contractors and consultants) with access to information systems and storage (computer based or otherwise). 3. Policy Statement adheres to the Australian Privacy Principles under the Commonwealth Privacy Act 1988; and as amended, the Commonwealth Amendment (Private Sector) Act 2000; and the Privacy Amendment (Enhancing Privacy Protection) Act For more information on the Act and the Australian Privacy Principles, please refer to the Office of the Australian Information Commissioner Collection of Personal Information If requires the collection of any personal information, the purpose for which the information is to be collected and the consequences of providing it will be made clear at the time of the collection. Personal information may be collected for the following purposes: Programs and Service Provision Administration Created by: 2 P a g e

3 Policy Title: Author: Training Employment (payroll, taxation, superannuation) Work Health & Safety Research, Development and Quality Assurance Donations also collects sensitive health information such as: Blood Pressure Body-Mass Index Personal Medical Plans Public Incident Injury and Claims Records Medical Conditions and/or Disability Personal information may be collected from various sources including: Client membership application forms Training application forms Website inquiry and website feedback sections Website donation form , e-card, mail and facsimile Responses to employment advertisements Employees and contractors Voting member registers Registration for events and programs All information is collected in a fair and lawful manner and as required / permitted by law. YMCA South Australia is committed to ensuring that all individuals are aware of the purpose of collection of the information. 4.1 Collection of Personal / Health information relating to children will not collect, use or disclose personal information about anyone under the age of sixteen (16) years of age unless the consent of a parent or legal guardian has been obtained. 4.2 Website Accessing the website at will not require any identification or any other personal information to enable access, and therefore users retain anonymity. Created by: 3 P a g e

4 Policy Title: Author: does however collect personal information, suggestions and feedback provided by visitors through the following sections on the website: Contact us Provide Feedback enewsletter Distribution Donation Form This information, and the ideas provided, may be used to assist in making improvements to the website or to operations. On no occasion will a person s name or personal details be published without permission. Where s or e-cards are forwarded to an address or contact person listed on this website, the sender s address will not be added to a mailing list and will be only used by to contact the sender. Once the office has responded to any feedback or complaint, the sender s contact information will be deleted in a secure manner. will provide advice on its website regarding the accessing of other links provided on the site, and include a disclaimer regarding perceived ownership of said sites. 4.3 Maintenance and Storage of Personal Information will take reasonable steps and use appropriate security mechanisms to ensure that the personal information held is protected from misuse and loss, and from unauthorised access, modification or disclosure. will maintain its record keeping system to ensure that all personal information collected is up to date and complete as is reasonably practical. Any person who on behalf of, uses or discloses personal information held by YMCA South Australia must have appropriate authorisation to do so. 5 Use & Disclosure will not use personal information for any purpose other than for which it is intended without first seeking the individual s consent or unless authorised or requested by law. The organisation will take reasonable steps to protect personal information from loss, misuse, unauthorised access, disclosure or inappropriate or accidental destruction. Disclosure of personal and health information will be in accordance with the Australian Privacy Principles. Created by: 4 P a g e

5 Policy Title: Author: 6. Data Quality Where requires personal information to be collected, every effort will be made to ensure the information is accurate, complete and up to date. 7. Data Security Information collected on individuals, including staff, volunteers, clients, member associations and associated companies will be stored in a secure environment at all times. Where information is stored off site, will ensure confidentiality agreements with the archival suppliers are in place and maintained. All such suppliers are to be screened to ensure that they maintain security and confidentiality requirements. Consumer health information is to be retained for a minimum of seven (7) years following the last occasion on which a service is provided. Where information was first collected while the individual was a child, it is to be retained until he/she is twenty five (25) years of age or for seven (7) years, whichever is the greater. Accredited training qualifications and related records are retained for twenty seven (27) years. Employment documents and records, including payroll records, are to be retained for periods of time as prescribed by the relevant legislation both during and post-employment. Employees may request access to their personal file. However, files are not to be removed from the office location in which they are stored and access is to be supervised. At the discretion of the Manager - People and Culture, documents may be copied or printed and provided to the employee original copies are not to be removed from files other than for copying purposes. All credit card and personal financial data collected by is handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS). 8. Openness will be open about the type of personal information collected and stored and the ways in which it is used. The is available to the community, members and clients upon request and website. 9. Access and Correction Where personal information is obtained and retained, the individual it relates to is entitled to access that record. may be required to deny access only in circumstances where it would be unlawful or not within the jurisdiction of relevant legislation. must take reasonable steps to confirm the identity of any individual seeking access to their own information. Unless required by law no person or persons may have access to any personal information pertaining to any other person. Created by: 5 P a g e

6 Policy Title: Author: will respond to processing, access, and correction requests promptly upon request. Any health information collected by will not be deleted during the period of time it is required to be held (refer above). Amendments or alterations to health information are to be recorded on a separate form and attached to the original file. 10. Identifiers may be required to collect an individual s identifiers such as a Tax File Number, Medicare Number or Social Security Number for the provision of services. Where collected, these identifiers will only be disclosed to agencies as required by law. 11. Transfer/Closure of Health Services In the event of local YMCA Association managed health services (i.e. medical suite, massage service, physiotherapy service, sports medicine service, health and fitness club) being transferred, sold, leased, or ceasing operation, the Association is required to enact notification and transfer procedures as directed by the appropriate State/Territory legislation. 12. Sensitive Information If or when is required to collect sensitive information about an individual, it will only be collected and transferred to other parties as outlined at the time of collection with the individual s consent. Collection of sensitive information such as religious affiliation, gender, disability, NDIS status, languages spoken other than English and criminal records will only occur when the individual has consented or where the law requires such collection. 13. Contact and Complaints Formal complaints regarding the manner in which personal information is collected, used or disclosed are to be handled in accordance with the YMCA Complaints and Handling Procedure. If any person has concerns, complaints or thinks there has been a breach of privacy regarding information collected about you, please either submit via the website or contact the or the person nominated by the. If you are not satisfied with the response to your complaint, or at any time, you may refer your complaint to the Office of the Australia Information Commissioner ( Created by: 6 P a g e

7 Policy Title: Author: 14. Roles and Responsibilities Department / Area Board Directors Senior Management Role / Responsibility Oversee the development, monitoring and review of the Policy and related systems. Review and approve as appropriate Ensure appropriate training is provided to all staff and volunteers to foster a responsible working environment Ensure clear guidelines that delineates inappropriate behavior that is acceptable and reinforce the potential ramifications for Responsible for the promotion of a culture that encourages respect and consideration for the privacy and use of people s private information is lawful Adhering to the requirements of the All employees (including Managers, Directors, Coordinators, Team Leaders), Volunteers and Contractors Responsible for adhering to the requirements of the Privacy Policy and ensuring they understand their responsibilities Created by: 7 P a g e

8 Policy Title: Author: 15. Supporting Documents Privacy rights in South Australia are established in accordance with the privacy related legislation: The Commonwealth Privacy Act 1988 Criminal Law Consolidation Act 1935 Listening and Surveillance Devices Act 1972 Summary Offences Act 1953 Electronic Transactions Act 2000 (South Australia) Disability Services Act 1993 (South Australia) Equal Employment Opportunity Act 1987 (Commonwealth) Payment Card Industry (PCI) Security Standards Council - Complaints and Grievance Policy - Code of Conduct Policy Membership Terms and Conditions Fact Sheet in relation to YMCA Website and Privacy Monitoring and Evaluation The will monitor and evaluate the every two (2) years to ensure the systems and process remains relevant and consistent with best practise business management principles. 17. Version History Version Date Description of changes Effective Date Review Date May May 2014 Updated June 2014 June March 2017 Review and Update June 2017 June 2019 Created by: 8 P a g e