Purpose

This policy is specifically targeted at the personal information collected, stored and disclosed about employees, contractors, volunteers, participants and members of the public during the daily operation of Ability Links.

Ability Links collects, holds, uses and discloses personal information for during operation only with the expressed permission of the confidential information’s owner. Ability Links will only disclose confidential information if:

·         It is a mandated legal obligation to disclose to a government agency

·         It is court ordered.

·         A mandatory reportable disclosure or

·         places someone at risk of harm

In dealing with personal information, Ability Links abide by the obligations imposed on us under federal law, the Privacy Act 1988 and the Privacy Amendment (Notifiable Data Breaches) Act 2017.

Scope

This policy applies to all employees, contractors, sub-contractors and work experience personal.

Policy

Our policy is to respect and protect the privacy of all people connected with Ability Links, including participants, providers, employees, contractors and community partners.

Ability Links collect and hold information which is reasonably necessary for us to carry out our role. The kinds of information Ability Links collect, and hold includes (but is not limited to) personal information about participants and other users of our services, and about our employees, contractors and providers.

Collection of Personal Information

Ability Links generally use forms, online portals and other electronic or paper correspondence to collect this information. Ability Links Employees or people acting on its behalf (e.g. contracted service providers) may collect information directly.  Ability Links may also obtain personal information collected by other Commonwealth agencies, State or Territory government bodies, or other organisations.

Ability Links collects personal information through a variety of different methods, including:

·         paper-based forms

·         electronic forms (including online forms)

·         face to face meetings

·         telephone communications

·         email communications

·         communications by fax

·         the NDIS, Providers & Ability Links website; and

·         social media websites.

Ability Links holds personal information in a range of paper-based and electronic records. Storage of personal information (and the disposal of information when no longer required) is managed following AL-IM-05 Records Management.

Ability Links collects and holds a broad range of personal information in records relating to:

·         employment and personnel matters for Ability Links staff and contractors (including Worker Screenings Assessments)

·         the performance of Ability Links legislative and administrative functions

·         individuals participating in the National Disability Insurance Scheme (NDIS) assigned to Ability Links

·         registered NDIS providers

·         the staff of NDIS providers

·         the management of contracts and funding agreements

·         the management of fraud and compliance investigations

·         the management of audits (both internal and external)

·         correspondence from members of the public to the NDIS Commission, Minister of the Department of Social Services and other Advocacy services when required.

·         complaints (including privacy complaints) made and feedback provided to Ability Links.

·         the provision of legal advice by internal and external lawyers.

Ability Links will not collect any personal information which it does not need. The Privacy Act requires that Ability Links collect information for a purpose that is reasonably necessary for, or directly related to, a function or activity of providing a provision of support.

When Ability Links collects personal information, Ability Links is required by the Privacy Act to notify the Participant or employee of a number of matters. These include the purposes for which Ability Links collects the information, whether the collection is required or authorised by law and any person or body to whom we usually disclose the information.

Examples of personal information that Ability Links may collect includes:

·         name, address and contact details (e.g. phone, email and fax)

·         photographs, video recordings and audio recordings

·         information about personal circumstances (e.g. marital status, age, gender, occupation, accommodation and relevant information about carers, partners or children)

·         information about financial affairs (e.g. payment details, bank account details and information about business and financial interests)

·         information about identity (e.g. date of birth, country of birth, passport details, visa details, drivers’ licence, birth certificates, ATM cards)

·         information about employment (e.g. work history, referee comments, remuneration)

·         information about background (e.g. educational qualifications, the languages you speak and your English proficiency)

·         government identifiers (e.g. Centrelink Reference Number or Tax File Number) and

·         information about assistance provided under the NDIS.

·         health information as defined under the Privacy Act.

On occasions, Ability Links may collect or hold sensitive information such as:

·         racial or ethnic origin;

·         health (including information about medical history and any disability or injury);

·         Information about the supports or services receive, including supports or services received or have received under the NDIS and information about the people who provide those supports.

Purposes for which personal information is collected, held, used and disclosed:

Ability Links collects and holds personal information for a variety of different purposes relating to its functions and activities including:

·         performing Coordination or Supports

·         arranging Service Agreements

·         arranging Provision of Support

·         performing Plan Management

·         performing its employment and personnel functions in relation to its staff and contractors

·         performing its legislative and administrative functions

·         policy development, research and evaluation

·         complaints handling

·         contract management and

·         management of correspondence with the NDIS.

Ability Links uses and discloses personal information for the primary purposes for which it is collected. Ability Links will only use your personal information where it is able to do so in accordance with the Privacy Act.

Disclosed to An External Third Party

Individual personal and sensitive information will not be disclosed to an external third party without written permission from the individual unless in the following circumstances:

·         Emergency services personnel (e.g. Police, Fire Services, Ambulance) in an emergency where the health or safety of the individual is at risk.

·         It is de-identified first and required for lawful statistical purposes.

·         Required or authorised to do so under Australian law or a court/tribunal order.

Participants personal and sensitive information shall be lawfully and fairly collected:

·         By consent, directly from participants or their lawfully authorised representative; and/or

·         By lawful referrals from other service providers, brokers, Government agencies and allied health professionals.

Storage of personal and sensitive information:

• Digital information is stored in a management system, password protected and only accessible by authorised staff.
• Hard copy files of a personal or sensitive nature are stored in lockable filing cabinets and only accessible by authorised staff.
• Ability Links will retain all personal and sensitive records for a period of 7 years, or in the case of children, until the Participant attains 25 years of age.
• Tax File Number (TFN), Ability Links always keep this information secure. Due to legal restraints on the disclosure of TFNs, if a person asks us for their TFN, we will not be able to provide it to them. If a person wants to obtain their TFN, they will need to obtain this from the Australian Taxation Office directly.
• Ability Links does not send personal information out of Australia. If we are legally required to do so, we will take all reasonable steps to protect your personal information within the boundaries of the Australian Privacy Principles.

Participant access to and the correction of personal information

The Participant has the right under the Privacy Act to access personal information held about them. The Participant also has the right under the Privacy Act to request corrections to any personal information that Ability Links holds that the Participant believes to be inaccurate, out-of-date, incomplete, irrelevant, or misleading. However, the Privacy Act sets out circumstances in which the Ability Links may decline access to or correction of personal information (e.g. where access is unlawful under a secrecy provision in portfolio legislation, or where the personal information held is an opinion and not an objective fact).

The Participant can simply contact Ability Links to seek correction of personal information at any time.

Information held by contractors:

Under the Privacy Act, Ability Links is required to take contractual measures to ensure contracted service providers (including sub-contractors) comply with the same privacy requirements applicable to Ability Links.

Employee Personal information both personal and sensitive shall all be lawfully and fairly collected:

·         By consent, directly from employee.

·         By authorised referees provided by the employee.

·         By lawful referrals from employment agencies and training institutions.

·         By lawful referrals from employment agencies and training institutions.

·         By legally required background probity checks, authorised by the employee.

Personal  information for participants, employees or other organisations will be held by Ability Links. Ability Links will not disclose personal information for another purpose unless the individual has consented to the use or disclosure of the information, or unless required or authorised under Australian law or a court/tribunal order.

Accidental or unauthorised disclosure of personal information:

Ability Links deals promptly with any accidental or unauthorised disclosure of personal information. Ability Links follows AL-IM-06 Data Breach Protection and Response Plan and the OAIC’s Data breach notification  when handling accidental or unauthorised disclosures of personal information. Legislative or administrative sanctions, including criminal sanctions, may apply to unauthorised disclosures of personal information.