Description

DELETE BEFORE USE

Purpose: This is a legally drafted document that sets out a company’s privacy policy.

 

When to use this template: When implementing the policy into a company policy handbook or as a standalone or an amended policy which can be provided to a person being employed/contracted by the company or an existing employee or contractor.

 

How to use the template: Review the document and if applicable confirm or complete any information highlighted in yellow. Once completed and the contents are accurate and suitable for your business and scenario, the agreement can be issued to a person being employed. Both parties will need to sign the agreement.

 

Disclaimer: This document does not constitute legal advice. This is a generic template and the individual circumstances of your business have not been considered. The author(s) of this template will not be liable for any issues arising from the use of this template or reliance on the data contained within. If you require advice on, or amendments to this document, we encourage you to seek independent legal or other professional advice. If you are a NECA member, this document may be available to you on the Member Knowledge Base (MKB) free of charge. Please check MKB prior to purchasing, as no refund will be available once the item has been purchased.

 

DELETE BEFORE USE

Purpose: This is a legally drafted document that sets out a company’s privacy policy.

 

When to use this template: When implementing the policy into a company policy handbook or as a standalone or an amended policy which can be provided to a person being employed/contracted by the company or an existing employee or contractor.

 

How to use the template: Review the document and if applicable confirm or complete any information highlighted in yellow. Once completed and the contents are accurate and suitable for your business and scenario, the agreement can be issued to a person being employed. Both parties will need to sign the agreement.

 

Disclaimer: This document does not constitute legal advice. This is a generic template and the individual circumstances of your business have not been considered. The author(s) of this template will not be liable for any issues arising from the use of this template or reliance on the data contained within. If you require advice on, or amendments to this document, we encourage you to seek independent legal or other professional advice. If you are a NECA member, this document may be available to you on the Member Knowledge Base (MKB) free of charge. Please check MKB prior to purchasing, as no refund will be available once the item has been purchased.

 

 

 

 

 

PRIVACY POLICY

 

Purpose

This Policy explains the Company’s obligations in relation to information management, including security of information and privacy, and how the Company expects its Workers to treat private information.

Scope

This Policy applies to all Workers employed by the Company or working for or on behalf of the Company.

Workers means all directors, managers, employees, apprentices, and trainees of the Company, all labour hire workers, contractors, work experience students, volunteers working for or on behalf of the Company, and any other workers as defined in the relevant workplace health and safety legislation working for or on behalf of the Company. In this Policy, these categories and positions are referred to collectively as Workers.

In addition, the Company has a responsibility to maintain appropriate workplace policies and this Policy forms part of the Company’s compliance with relevant legislation, regulations, standards and codes.

 

[NB: Under the Privacy Act 1988 (Cth) a business is only required to have a privacy policy (and be subject to the Privacy Act) where your business:

 

  • generates more than $3 million in turnover annually; or

 

  • provides a health service and holds health information other than in an employee record; or

 

  • buys or sells personal information; or

 

  • are a contracted service provider for a Commonwealth contact, or a subcontractor for a government contactor (noting that compliance in this instance is only required for the activities relating to the Commonwealth contract).

 

If your business does not meet this criteria, you can choose to include or exclude this policy.]

Policy Statement

The Company is committed to protecting the privacy of people whose personal information has been collected, used and/or stored by a Worker or the Company during the course of running its business.

 

This Policy:

  • has been developed in accordance with the Australian Privacy Principles (APPs) contained within the Privacy Act 1988 (Cth) (Privacy Act);
  • explains how the Company collects, uses, discloses and otherwise handles personal information relating to Individuals; and
  • may be varied from time to time in accordance with any changes to the Company’s practices and/or the law.

Company Obligations

For the purpose of this Policy:

 

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

  • whether the information or opinion is true or not; and
  • whether the information or opinion is recorded in a material form or not.

 

Personal Information may include information such as an individual’s name (including alias and previous names), signature, address, telephone number and email address, date of birth, sex and bank account details.

 

Sensitive Information is a type of Personal Information which may include information about an Individual’s racial or ethnic origin, health information, political opinions, membership of a political association, professional or trade association or trade associations or unions, religious beliefs or affiliations, philosophical beliefs, sexual orientation or practices, criminal record, genetic information and biometric information that is to be used for certain purposes.

Collection, use and disclosure of personal information

The Company is required to collect and use personal information only by lawful and fair means. Purposes may include:

  • to administer payroll, compensation and benefits;
  • to comply with requirements imposed by law (including but not limited to taxation, superannuation and workers compensation);
  • to arrange for the leasing of vehicles and other equipment;
  • to nominate Workers for committees, boards and panels, and to attend any functions as a representative of the Company;
  • to provide services;
  • to engage with clients, contractors and potential clients;
  • for record keeping purposes;
  • to correspond with the relevant Individual;
  • provide employment; and
  • any other lawful reason relevant to employment and/or provision of service.

 

If an individual chooses not to provide their personal information, the Company may not be able to provide employment or engagement in services.

 

Where it is practical and lawful for the Company to do so, the Company will enable the individual to access the Company’s website and make general telephone enquiries, or via social media, without having to identify themselves, or by using a pseudonym.

Consent

By submitting personal sensitive information to the Company, the individual agrees that the Company may collect, use and disclose such personal information as permitted or required by the Privacy Act, other laws or by a court or tribunal.

Unsolicited information

If the information received by the Company is not required by the Company to perform one or more of its services or activities, the Company will destroy or de-identify the information as soon as practicable.

Quality of personal information

The Company takes reasonable steps to make sure that personal information is accurate, complete and up to date. The Company recommends individuals advise the Company if there are any errors in personal information and/or if there are any changes to the information.

Security, retention and storage of personal information

The Company takes reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or disclosure. The Company has physical, electronic and procedural safeguards to protect personal information it holds. For example, personal information is stored in secured office premises and in electronic databases requiring logins and passwords for access. Access to information stored electronically is restricted to authorised staff.

 

There are circumstances where collection, use or disclosure may be justified or permitted, or where the Company is obliged to disclose Personal Information without the individual’s consent. These circumstances could include:

  • where the information is publicly available;
  • where required by law or by order of a court or tribunal;
  • where the Company believes, upon reasonable grounds, that there is an imminent risk to an identifiable person or group, death or serious bodily harm;
  • where it is alleged that an Individual is guilty of a criminal offence, or is civilly liable in a legal action or guilty of certain misconduct; and
  • for Workers Compensation and Australian Taxation Office requirements.

Access and correction of personal information

Individuals can access personal information held by the Company, with some exceptions as allowed by law.

.

Upon receiving a written request and subject to any applicable exemptions, the Company will inform the individual of the current version of Personal Information and may provide access and the opportunity to correct any errors. Access requests should be sent to HR.

 

The Company may refuse a request if:

  • giving access would threaten the health and safety of the Individual or any other individual;
  • giving access would unreasonably impact the privacy of other individuals;
  • the request is frivolous or vexatious;
  • the information relates to existing or anticipated legal proceedings between the Company and the Individual and is not otherwise discoverable in those proceedings;
  • giving access would prejudice negotiations;
  • giving access would be unlawful;
  • denying access is authorised under an Australian law or court or tribunal order; and
  • denying the request is permitted by any other reason by the Privacy Act.

Complaints

If there are complaints about how the Company has collected, stored or used an Individual’s personal information, individuals may contact Human Resources. The Company will endeavour to deal with the complaint and take any steps necessary to resolve the matter promptly, but usually within 10 business days. If the complaint is unable to be resolved within 10 business days, the Company will advise in writing, including an expected response date.

 

If the Individual is unsatisfied with the Company’s response, they may refer the complaint to the Office of the Australian Information Commissioner (OAIC). The OAIC can be contacted on 1300 363 992.

Worker Obligations

Workers will unavoidably receive and handle personal and private information about clients, Workers, or have access to other confidential information pertaining to the Company. The Company must protect this information as it may be legally binding on the Company to do so, or the information is competitive in nature.

 

When a Worker is dealing with confidential information, they should:

  • lock or secure confidential information at all times;
  • shred confidential documents when they’re no longer needed;
  • make sure they only view confidential information on secure devices;
  • only disclose information to other Workers when it’s necessary and authorised; and
  • keep confidential documents inside our company’s premises unless it’s absolutely necessary to move them.

 

Workers should not:

  • use Personal or Sensitive Information for any personal benefit or profit;
  • disclose Personal or Sensitive Information to anyone outside of the Company; or
  • replicate confidential, personal or sensitive documents and file and store them on insecure devices.

 

When Workers stop working for the Company, they’re obliged to return any confidential files containing Personal Sensitive Information and delete them from their personal devices.

 

Personal or Sensitive Information may occasionally have to be disclosed for legitimate reasons such as:

  • when a regulatory body or Government agency requests it as part of an investigation or audit; or
  • if our Company examines a venture or partnership that requires disclosing some information (within legal boundaries).

 

In such cases, Workers involved should document their disclosure procedure and collect all needed authorisations. The Company is bound to avoid disclosing more information than needed.

 

Workers should notify the Company where there is an actual or suspected breach of this Policy.

 

Employee Records

 

Employee records are exempt from the APPs and rules set out in the Privacy Act.

 

Employee Record is defined in the Privacy Act as ‘a record of personal information relating to the employment of the employee. Examples of personal information relating to the employment of the employee are health information about the employee and personal information about all or any of the following:’

  • the engagement, training, disciplining or resignation of the employee;
  • the termination of the employment of the employee;
  • the terms and conditions of employment of the employee;
  • the employee’s personal and emergency contact details;
  • the employee’s performance or conduct;
  • the employee’s hours of employment;
  • the employee’s salary or wages;
  • the employee’s membership of a professional or trade association;
  • the employee’s trade union membership;
  • the employee’s recreation, long service, sick, personal, maternity, paternity or other leave;
  • the employee’s taxation, banking or superannuation affairs.

 

Accordingly, any action or practice by the Company in relation to the employment relationship between the Company and a current or former employee, where the Company held or holds an employee record relating to that individual is not subject to the APPs and the obligations in the Privacy Act.

 

Medical information in relation to a current or former employee will be held as confidential and will only be disclosed when directly relevant to the employment relationship, as required by law, or with the consent of the employee to which the information relates (or the guardian of such a person).

 

Breach of Policy

 

This Policy is a lawful and reasonable direction to Workers.

 

Failure to comply with this Policy may result in disciplinary action up to including termination, in accordance with the Disciplinary Action Policy.