QPP Privacy Policy

1. Purpose

The Information Privacy Act 2009 (Qld) (IP Act) and its Queensland Privacy Principles (QPPs) set the rules for how Queensland government agencies – including the Office of the Information Commissioner (OIC) – handle personal information. These rules include a requirement, under QPP 1, that every agency have a QPP privacy policy.
Our QPP privacy policy explains how we manage personal information, including:

1. the kinds of personal information we collect and hold, how we collect and hold that personal information, and the purposes for which we collect, hold, use and disclose personal information
2. how you may complain about our handling of your personal information, and how we will deal with the complaint.

2. Scope

This policy applies to all OIC Commissioners, staff and contractors, and to the personal information we collect, store, manage, use and disclose in discharging most of our statutory functions.

These functions are set out in the IP Act and Right to Information Act 2009 (Qld) (RTI Act). Not all of these functions are subject to the obligations imposed by the QPPs, due to certain exclusions set out in the IP Act. These exclusions include, for example, quasi-judicial functions. OIC’s RTI external review function is quasi-judicial. This means the obligations imposed by the QPPs do not apply to our external review function.

3. Collection of personal information

The definition of ‘personal information’ is set out in the ‘Definitions’ in paragraph 10.

OIC collects personal information required to exercise our statutory functions and meet our legal obligations. We may collect this personal information in writing or by recording information provided verbally.

We collect personal information directly from individuals who access our services and indirectly from third parties as part of carrying out our functions. These functions include:

• Dealing with applications for the external review of agency decisions under the RTI Act.
• Dealing with privacy complaints made under the IP Act.
• Conducting its regulatory functions, for example conducting an audit or review, or assessing an agency’s compliance with the Mandatory Notification of Data Breach (MNDB) Scheme or whether to issue a compliance notice under the IP Act.
• Conducting audits or reviews of agency practices and compliance with the RTI and IP Act.
• Investigating agency compliance with the QPPs and the MNDB scheme
• Responding to enquiries from the public and agencies.

We also collect personal information to carry out our business functions, e.g. human resources management and recruitment processes.

The kind of personal information we collect from individuals directly includes names, contact details, details of individuals’ interactions with other agencies, and details about their concerns or complaints with an agency or a decision or action taken by an agency, and reasonable accommodations required by individuals (i.e. assistance requirements). This information may be collected, for example, when someone:

• applies for external review of an agency decision under the RTI Act
• makes a privacy complaint
• contacts our Enquiries service to request information or assistance; or
• notifies OIC about a data breach.

OIC may also collect personal information directly during, for example, an external review, while dealing with a privacy complaint, or undertaking an audit, review or investigation in accordance with its statutory powers.

Due to the nature of OIC’s statutory functions, we may indirectly collect any kind of personal information which can be recorded in an agency document, for example, when it conducts an audit, carries out an external review, mediates a privacy complaint, assesses a data breach, or undertakes an investigation in accordance with its statutory powers.

OIC may also collect personal information such as individuals’ names and contact details to organise meetings with OIC Commissioners or staff or when offering training and other engagement activities, including via our website and learning management system.

3.1 Sensitive information

We may also collect sensitive information. The definition of ‘sensitive information’ is set out in the ‘Definitions’ in paragraph 10.

We will generally only collect sensitive information directly from the individual it is about or with their consent, or otherwise consistently with our obligations under the IP Act. The kinds of personal information (including sensitive information) we collect and hold are set out in the table below.

4. Use and disclosure of personal information

OIC uses and discloses personal information for the purpose for which the personal information was collected, including:

1. exercising our powers or performing our statutory functions and duties, such as dealing with RTI external review applications, mediating privacy complaints or responding to enquiries
2. managing associated business processes, such as recruitment and human resources administration.

We may also use or disclose personal information for secondary or alternative purposes as permitted under the IP Act. This may include where we are authorised or required under Australian law (including to meet our procedural fairness obligations), with your consent, or where you would reasonably expect us to use or disclose for a related – or in the case of sensitive information, directly related – secondary purpose.

This may include disclosure to a court or tribunal, for example where a privacy complaint is referred to the Queensland Civil and Administrative Tribunal, an external review decision is appealed, or in response to a judicial review application under the Judicial Review Act 1991 (Qld).

5. Access and correction of personal information

Access and correction rights are contained in the RTI Act. With the exception of OIC staff applying to access or correct their own personal information, OIC, its commissioners and staff are not subject to the access and correction obligations under the RTI Act. This means that only OIC staff may apply to access or correct their personal information held by OIC.

6. Disclosure of personal information outside Australia

We would generally disclose personal information overseas only when necessary to address a complaint or application with our statutory functions and obligations. For instance, where a complainant or applicant is overseas.

However, when you communicate with us via a social media platform such as LinkedIn or YouTube, the social media provider and its partners may collect and hold your personal information overseas. We also use Survey Monkey to conduct voluntary surveys from time to time, which may involve the collection and disclosure of participants’ personal information overseas. Data contained within Salesforce remains within Australia.

Where we disclose personal information overseas, this will usually occur with agreement, where we are authorised or required by law, or otherwise consistently with our obligations under the IP Act.

7. Dealing with OIC anonymously or using a pseudonym

People can deal with the OIC’s Enquiries Service, report a data breach or use the enquiry forms on our website anonymously or by using a pseudonym.

Complaints about the OIC can be made anonymously or by using a pseudonym but, depending on nature of the complaint, we may not be able to action a complaint and/or provide a response without a person’s identity (e.g. where a complaint relates to a particular individual’s file).

Anonymous or pseudonymous interaction is not possible for other OIC functions, such as applying for an external review or lodging a privacy complaint. We are required to collect information such as your name, contact details and details of your matter so we can deal with you and your matter effectively and in accordance with our statutory duties.

8. Security of personal information

9. Privacy complaints about OIC

If you believe that OIC has not handled your personal information in accordance with the IP Act, you can make a privacy complaint. You can only make a privacy complaint on behalf of another person if they have authorised you to do so, they are a minor/child and you are their parent or guardian, they lack capacity, and you are their guardian or have other legal authority to act for them.

To make a privacy complaint about OIC, you must send your complaint to the OIC in writing and include:

• an address for us to respond to you (e.g. an email address).
• details about the matter or issues you are complaining about (e.g. what did the OIC do or not do with your personal information that you believe breached the QPPs and the IP Act).

You must send your complaint to us within 12 months of becoming aware of the act or practice you think constitutes a breach by OIC of the IP Act. If you are making a privacy complaint for someone else, please include an authority from them or other evidence.

Contact address for privacy complaints:

Email:

complaints@oic.qld.gov.au

Post:

Office of the Information Commissioner
PO Box 10143 Adelaide Street
Brisbane Qld 4001

9.1 Timeframe for handling a privacy complaint

The response period for a privacy complaint is 45 business days, if OIC requests for a longer period under section 164A(2) of the IP Act, the further specified period until you refuse the request, you further escalate the complaint to the OIC, or the further specified period ends.

If you do not consider OIC’s response to be adequate or if OIC does not respond within the response period, you can escalate your complaint following this procedure. Your complaint will be managed in the same way as complaints about other agencies are managed and will be dealt with by officers who had no involvement in handling the initial complaint or the activities the subject of the initial complaint.

10. Definitions

For the purposes of this policy and related policy documents, the following definitions apply:

11. Related policy documents and supporting documents