Privacy policy

Introduction

Playgroup Tasmania acknowledges and respects the privacy of individuals. This statement outlines Playgroup Tasmania's policy on the collection, use and management of personal information.

Playgroup Tasmania will make every effort to protect the privacy and confidentiality of all individuals associated with Playgroup Tasmania by ensuring that all records and information about children, families, playgroup participants, staff, volunteers and management are kept in a safe and secure place and are not divulged or communicated, directly or indirectly, unless strict criteria are met.

Playgroup Tasmania is bound by the Australian Privacy Principles contained in the Commonwealth Privacy Act and is compliant with the Privacy Amendment (Enhancing Privacy Protection) Act 2012.

Purpose

The purpose of this document is to set out:

• the standards by which we handle personal information;

• the rights of individuals to access their personal information or to make a complaint about how we have handled their information; and

• who to contact if you would like to know more about our approach to privacy.

If you would like to know more about the Privacy Act you can visit the website of the Federal Privacy Commissioner.

http://www.privacy.gov.au/

Who does this Policy apply to?

This privacy policy assumes that you are resident in Australia and an individual. The Privacy Act does not apply to the collection of information about business.

This policy applies to the following members of the Playgroup Tasmania community.This policy applies to all activities run by Playgroup Tasmania Inc. This includes all activities in the organisation which involve, result in or relate to contact with children.

Policy

This policy ensures that we comply with the National Privacy Principles and other related legislation. This policy ensures access to, and the collection and use of, personal information provided by individuals to Playgroup Tasmania is managed responsibly through a system of control.

The following guides the professional practice framework for all areas of activity within our organisation:

• having the confidence of individuals is a privilege;
• individual’s access to information about them is a right;
• the privacy of individuals is invaded through the collection and storage of unnecessary information;
• the formation of, or expression of, a professional assessment must be recorded with care.

All individuals have the right to be informed on who has access to their information. Individuals have a right to challenge the accuracy of personal information recorded about them. At, or before, the time (or, if that is not practicable, as soon as practicable after) that we collect personal information about an individual, we must take reasonable steps to ensure that the individual is aware of:

• the content of the information;
• the identity of the program/unit and how to contact it;
• their right to make reasonable requests to access that information;
• the purpose for which the information is collected;
• the period of time for which the information is kept;
• the organisations (or types of organisations) to which the service/unit usually discloses information of that kind;
• any law that requires the particular information to be collected; and
• the main consequences (if any) for the individual if all or part of the information is not provided.

What kind of personal information does Playgroup Tasmania collect?

The type of information Playgroup Tasmania collects and holds includes (but is not limited to) personal information, including sensitive information, about:

• children, families and/or care givers before, during and after membership at Playgroup Tasmania;

• job applicants, staff members, volunteers and contractors; and

• other people who come into contact with Playgroup Tasmania.

In general Playgroup Tasmania only collects information required to provide and facilitate playgroups and related programs, and the safety of the children in our care. The aim is to use fair and lawful ways of collection.

When you use our website, having your cookies enabled will allow us to maintain the continuity of your browsing session and remember your details when you return. We may also use web beacons, Flash local stored objects and JavaScript. If you adjust your browser settings to block, reject or delete these functions, the webpage may not function in an optimal manner. We may also collect information about your IP address, although this may not identify you.

Personal Information you provide: Playgroup Tasmania will generally collect personal information held about an individual using forms filled out by families/care givers, face-to-face meetings and interviews and telephone calls. Occasionally people other than families and children will provide personal information. In these circumstances Playgroup Tasmania will use best endeavours to confirm the information is correct by contacting the individual concerned. We aim to ensure you know why we are collecting the information, to whom the information will be given and how we will use it or disclose it.

Exception in relation to employee records: Under the Privacy Act the National Privacy Principles do not apply to an employee record. As a result, this Privacy Policy does not apply to Playgroup Tasmania treatment of an employee record, where the treatment is directly related to a current or former employment relationship between Playgroup Tasmania and employee.

How will Playgroup Tasmania use the personal information you provide?

Playgroup Tasmania will use personal information it collects from you for the primary purpose for which it was collected, and for such other secondary purposes as are reasonably expected, or to which you have consented.

In relation to direct marketing, Playgroup Tasmania will use your personal information for direct marketing where you have provided that information, and you are likely to expect direct marketing: only then will you be sent direct marketing containing an opt out. If we use your personal information obtained from elsewhere, we will still send you direct marketing information where you have consented and which will also contain an opt out. We will always obtain your consent to use sensitive information as the basis for any of our direct marketing.

We may use video surveillance for security purposes and the footage will be used only by Playgroup Tasmania and by the providers of our security services for security purposes. Surveillance videos are not used for other purposes and the footage is not publicly available. Surveillance cameras are not located in any bathrooms or change room facilities.

Children & Families: In relation to personal information of children and families, Playgroup Tasmania’s primary purpose for collection is to enable Playgroup Tasmania to facilitate playgroups and provide families with information relevant to their needs. This includes satisfying both the needs of families and the safety and needs of the children throughout the period the family is a Playgroup Tasmania member.

The purposes for which Playgroup Tasmania uses personal information of children and families include:

• to keep families informed about matters that may be of interest to their needs and development, through correspondence, newsletters and magazines;

• day-to-day administration and reporting requirements, including government funding bodies;

• looking after children and family safety and wellbeing;

• meeting Playgroup Tasmania’s legal obligations and allowing Playgroup Tasmania to discharge its duty of care.

Job applicants, staff members and contractors: In relation to personal information of job applicants, board members, staff members and contractors, Playgroup Tasmania’s primary purpose of collection is to assess and (if successful) to engage the applicant, staff member or contractor, as the case may be.

The purposes for which Playgroup Tasmania uses this personal information include:

• in administering the individual’s employment or contract, as the case may be;
• for insurance purposes;
• to satisfy Playgroup Tasmania’s legal obligations, for example, in relation to child protection legislation.

Volunteers: Playgroup Tasmania also obtains personal information about volunteers who assist Playgroup Tasmania in its functions or associated activities to enable Playgroup Tasmania and the volunteers to work together in the best interests of children and families.

The purposes for which Playgroup Tasmania uses this personal information include to satisfy Playgroup Tasmania’s legal obligations, for example, in relation to child protection legislation.

Marketing and fundraising: Playgroup Tasmania marketing and fundraising is important for future growth and development to ensure that Playgroup Tasmania continues to be a quality environment in which children, families, staff and volunteers thrive.

All members of the wider Playgroup Tasmanian community may from time to time receive fundraising information. Playgroup Tasmania publications, like newsletters and magazines, which include personal information, may be used for marketing purposes.

Written consent will be obtained from families for the use of images, craft samples or information relating to themselves or their children in promotional material or on the Playgroup Tasmania website.

There are situations in which we may use or disclose information without an individual’s consent. These include where:

• we reasonably believe that use or disclosure is necessary to reduce or prevent a threat to a person’s life or health or safety or a serious threat to public health or safety;

• we are investigating or reporting on suspected unlawful activity;

• the use or disclosure is required or authorised by law; or

• we reasonably believe that the use is necessary for child safety, law enforcement, public revenue protection, prevention and remedying of seriously improper conduct, or preparation or conduct of court or tribunal proceedings, either by or on behalf of an enforcement body.

If we use or disclose information on these grounds we will make a written note of such disclosure.

It is expected that employees will exercise professional judgment in relation to how and when to explain the limits of privacy and confidentiality. Where confidential information is to be provided to other agencies, the preferred option is via written consent of the client using a consent form. However, it is also acknowledged that the nature of work may result in situations where it is not always possible to use a consent form. When such situations arise, verbal consent must be given by the individual and the employee is required to make a record indicating that verbal consent was provided.

Who might Playgroup Tasmania disclose personal information to?

Playgroup Tasmania may disclose personal information, including sensitive information when appropriate, held about an individual to:

• government departments;
• child safety authorities;
• medical practitioners;
• people providing services to Playgroup Tasmania,
• recipients of Playgroup Tasmania publications, like newsletters and magazines; and
• anyone you authorise Playgroup Tasmania to disclose information to.

Personal information regarding staff, volunteers or Board members will not be given to anyone without written permission, except in a medical emergency.

Lists of children's or families names, emails and phone numbers are deemed confidential and are not for public viewing and will not be issued to any other person or organisation without written consent.

Sending information overseas: Playgroup Tasmania will not send personal information about an individual outside Australia without obtaining the consent of the individual (in some cases this consent will be implied) or otherwise complying with the National Privacy Principles.

We do not use overseas providers of IT services including servers and cloud services.

How does Playgroup Tasmania treat sensitive information?

Sensitive information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless you agree otherwise, or the use or disclosure of the sensitive information is allowed by law.

Sensitive information can only be recorded with the individual’s consent unless:

• the collection is required by law; or
• the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual, where the individual whom the information concerns:
• is physically or legally incapable of giving consent to the collection; or
• physically cannot communicate consent to the collection; or
• the collection is necessary for the establishment, exercise or defence of a legal or equitable claim.

Management and security of personal information

Playgroup Tasmania’s staff are required to respect the confidentiality of children’ and families’ personal information and the privacy of individuals.

Playgroup Tasmania has in place steps to protect the personal information it holds from misuse, loss, unauthorised access, modification or disclosure. This requires a range of processes such as:

• locked storage of paper records
• locking up procedures and alarms on facilities
• password protected access rights to computerised records
• use of cloud based professional software with inbuilt high levels of security
• staff policy and training in regard to security and password integrity

Personal conversations with families about their children, or other matters that may be sensitive in nature, will take place in an area that affords them privacy.

Personal conversations with volunteers and staff about matters relating to their performance will take place in an area that affords them privacy.

Updating personal information

Playgroup Tasmania endeavours to ensure that the personal information it holds is accurate, complete and up-to-date. A person may seek to update their personal information held by Playgroup Tasmania by contacting the administration team. We will take reasonable steps to destroy or remove identifying features from personal information when it is no longer needed for any purpose including any requirement of law.

The National Privacy Principles require Playgroup Tasmania not to store personal information longer than necessary.

Checking about what personal information Playgroup Tasmania holds

Under the Commonwealth Privacy Act, an individual has the right to obtain access to any personal information which Playgroup Tasmania holds about them and to advise Playgroup Tasmania of any perceived inaccuracy. There are some exceptions to this right set out in the Act. Children will generally have access to their information through their families.

To make a request to access any information Playgroup Tasmania holds about you or your family, please contact the administration team. In routine requests for access to personal information, the administration team will verify your identity and that you have the right to access that information.

In the event of a non-routine request for access to personal information, especially where the issues relating to the request are of a sensitive nature, the administration team will consult the CEO. Where there is uncertainty about the request, the CEO and Board can seek legal advice on behalf of Playgroup Tasmania.

Playgroup Tasmania may charge a fee to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, Playgroup Tasmania will advise the likely cost in advance.

Rights of access to the personal information of children

Playgroup Tasmania respects every parent or care givers right to make decisions concerning their child/ren.

Families may seek access to personal information held by Playgroup Tasmania about them or their child by contacting the administration team. However, there will be occasions when access is denied. Such occasions would include where release of the information would have an unreasonable impact on the privacy of others, where the release of the information would be against the law (i.e. care and protection orders; parenting orders; family violence orders) or where the release may result in a breach of Playgroup Tasmania's duty of care to the families or children.

Playgroup Tasmania may, at its discretion, on the request of a child, grant that child access to information about them held by Playgroup Tasmania, or allow to give or withhold consent to the use of their personal information, independently of their families. This would normally be done only when the maturity of the child and/or child’s personal circumstances so warranted.

Anonymity

Where it is lawful and practicable, we will allow individuals to enter into transactions with us on an anonymous basis.

Notifiable Data Breaches (NDB)

The Notifiable Data Breach Scheme prevents the concealment of breaches if the breach is considered to result in serious harm to the affected person(s). Pursuant to section 26WE of the Act, an eligible data breach which would require notification, occurs in circumstances where:

• there is an unauthorised access or unauthorised disclosure of information and a reasonable person would conclude that access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates, or
• information is lost in circumstances where such unauthorised access or disclosure is likely to occur and a reasonable person would conclude that, assuming such access or disclosure did occur, it would be likely to result in serious harm to any individuals to whom that information relates.

Examples of circumstances which may meet the criteria of a Notifiable Data Breach, include when:

• disclosing personal information about children, families or staff for purposes other than what it was collected for and without consent
• a device containing a member of the community’s personal information is lost or stolen (e.g a laptop)
• a database containing personal information is hacked
• personal information about children, families or staff is mistakenly provided to the wrong person, or
• records containing personal information are stolen from unsecured recycling bins.

Notification to the Office of the Australian Information Commissioner (OAIC)

Once Playgroup Tasmania forms the view, based on reasonable grounds, that there has been a Notifiable Data Breach, it will:

• prepare a statement in accordance with the Act, and
• give a copy of the statement to the OAIC as soon as practicable after becoming aware of the breach.

The statement will set out:

• the identity and contact details of Playgroup Tasmania
• a description of the breach that Playgroup Tasmania has reasonable grounds to believe has happened
• the kind/s of information concerned, and
• recommendations about the steps that individuals should take in response to the breach.

Playgroup Tasmania will notify the contents of that statement to the affected individuals (children, families, staff etc.) as soon as practicable.

How long will the Playgroup Tasmania keep my information?

When your personal information that is no longer required (including as required under law), it will be de-identified or destroyed. If you have provided consent in writing to us then your information may be retained indefinitely for marketing purposes. The release of non-identifying information must be checked prior to release to ensure the information is truly non-identifying. Wherever it is lawful and practicable, individuals must have the option of not identifying themselves.

Enquiries and privacy complaints

If you would like further information about the way Playgroup Tasmania manages personal information, please contact the Privacy Officer. If you have any feedback, concerns, complaints or you think there has been a breach of privacy, then also please contact the Privacy Officer. If we do not deal satisfactorily with your concerns, we will meet with you to discuss further. If you are not satisfied with our response to your complaint within 30 days from this meeting, then you can refer your complaint to the Office of the Australian Information Commissioner via:

• email: enquiries@oaic.gov.au
• tel: 1300 363 992
• fax: +61 2 9284 9666

Privacy Officer contact phone: 03 6331 6599

Privacy Office contact email: jacinda.armstrong@playgrouptas.org.au

This policy replaces and overrides all previous Privacy policies of Playgroup Tasmania.

Definitions

For definitions of the terminology used in this policy please refer to the separate document – Playgroup Tasmania Data Dictionary.

Relevant legislation and standards

National Privacy Principles contained in Privacy Amendment (Private Sector) Act 2000

Commonwealth Privacy Act 1988

Work, Health and Safety Act 2011

Personal Information Protection Act 2004 (Tas)

Privacy Amendment (Enhancing Privacy Protection) Act 2012

Responsibilities

The Playgroup Tasmania Board has responsibility and oversight of all policies and will review this policy in line with the Policy Review Schedule and any relevant change in legislation or standard practice.

The CEO of Playgroup Tasmania has ultimate responsibility for ensuring that appropriate and effective internal control systems are in place. The CEO will:

• Ensure that the induction process includes training in this policy.
• Where appropriate, delegate responsibility for compliance to other officers and oversee their performance.
• Review and report to the Board, as appropriate, on the effectiveness of the management systems.
• Analyse material breaches and identified compliance system weaknesses for systematic trends and ensure that any adverse trends are addressed.
• Promote a culture of effective policy compliance across the organisation.

All staff, volunteers and board members at all levels will ensure that they are aware of the organisation’s policy, undertake actions consistent with it and where appropriate, suggest ways in which practices, systems, procedures and policy could be improved.