1.1 The Old Bazaar Market ("the OBM") is committed to maintaining a culture that respects each individual’s right to privacy. This Policy sets out the principles of the OBM in relation to its management of personal information.
1.2 The Privacy Act 1988 and the Privacy Amendment (Enhancing Privacy Protection) Act 2012 set out the principles that must be followed by Commonwealth Government agencies and many private organisations in relation to the management, collection, use, storage and disclosure of personal information. The provisions of the Privacy Act do not apply to this OBM or any other South Australian OBM, but it is the intention of the OBM that its policies and practices in relation to privacy should be, so far as is reasonably practicable, consistent with the Privacy Principles set out in the Act.
1.3 The South Australian Government has not implemented a statutory scheme that imposes privacy obligations upon OBMs. This Policy is, therefore, a measure which is intended to promote what the OBM considers to be "best practice".
2. POLICY OBJECTIVES To establish a Policy that forms the basis for the practices and procedures of the OBM in relation to the collection, use, storage and disclosure of personal information by all OBM employees.
3. DEFINITIONS 3.1 Access means providing to an individual, information about himself or herself that is held by the OBM. This may include allowing that individual to inspect personal information or to obtain a copy.
3.2 Collection means gathering, acquiring or obtaining personal information from any source and by any means, including information that the OBM has come across by accident or has not asked for.
3.3 Consent means voluntary agreement to some act, practice or purpose.
3.4 Disclosure means the release of information to persons or organisations outside the OBM. It does not include giving individuals information about themselves.
3.5 Local Government Act means the Local Government Act 1999.
3.6 Personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about a natural living person whose identity is apparent, or can reasonably be ascertained, from the information or opinion, including a photograph or other pictorial representation of a person, but does not include information that is in: • Generally available publications; • Material kept in public records and archives such as the Commonwealth or State archives; or • Anything kept in a library, art gallery or museum for the purpose of reference, study or exhibition.
3.7 Privacy Act refers to the Privacy Act 1988 and the Privacy Amendment (Enhancing Privacy Protection) Act 2012 3.8 Sensitive information means information or an opinion about an individual’s • Racial or ethnic origin; • Political opinions; • Membership of a political association, a professional or trade association or a trade union; • Religious beliefs or affirmations; • Philosophical beliefs; • Sexual preferences or practices; • Criminal record; or • Health.
3.9 The OBM means the Old Bazaar Market.
3.10 Use means the handling of personal information within a OBM including the inclusion of information in a publication.
4. LEGISLATIVE REQUIREMENTS AND CORPORATE POLICY CONTEXT
4.1 In adopting this Policy it is recognised that there are specific legislative requirements to be met as well as other corporate goals. Acts and Regulations have precedence over any OBM Policy and must be considered when interpreting and implementing this policy.
4.2 This Policy is to be implemented in conjunction with other relevant Corporate Policies and Strategies.
5. POLICY STATEMENTS
5.1 Collection of Personal Information
5.1.1 The OBM will not collect personal information unless:
(a) The personal information is collected for a lawful purpose directly related to a legislative function or power of the OBM or OBM business operations;
(b) Collection of the personal information is necessary for or directly related to that purpose; and
(c) Explicit permission has been given by the person whose personal information is being collected.
5.1.2 The personal information that may be collected will depend on the particular purpose for which it is collected, and may include but is not limited to: • Telephone numbers; • Name and addresses (postal, residential and e-mail addresses); • Age and/or date of birth; • Property ownership and/or occupier details; • Details of resident’s/ratepayer’s spouse or partner; • Development applications, including plans or specifications of buildings; • Pet ownership; • Electoral roll details; • Pensioner / concession information; • Payment history; • Financial, rental or income details; • Details of land valuation; • Preferred addresses and methods of contacts; • Details of employment; and • Insurance details.
5.1.3 All personal information that is collected by OBM will be collected in a fair and lawful manner.
5.1.4 All personal information that is collected by OBM for the purposes of research will be treated within the Market and Social Research Privacy Principles (Refer to the Market and Social Research Privacy Code).
5.1.5 The OBM will take reasonable steps to inform the person whose personal information it collects: (a) Of the purpose(s) for which the personal information is being collected;
(b) If the collection of the information is authorised or required by law, that the collection is so authorised or required; and (c) In general terms, of its usual practices with respect to the use and disclosure of personal information of the kind collected.
5.1.6 The OBM will take reasonable steps to ensure that personal information collected by it, is relevant to the purpose(s) of collection and is up to date and complete.
5.1.7 The OBM will take reasonable steps to ensure that the collection of personal information by it does not unreasonably intrude upon an individual’s personal affairs.
5.1.8 The OBM may collect information concerning persons from a number of private and public sector agencies, which may include, but is not limited to Transport SA, the State Electoral Office, Office of the Valuer General, SA Water, Telstra and from individual persons.
5.2 Collection of Sensitive Information
5.2.1 The OBM will not collect sensitive information about an individual unless: (a) The individual has consented; (b) The collection is required by law; (c) The collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any person; or
(d) The collection is necessary for the establishment, exercise or defence of a legal or equitable claim.
5.2.2 If the OBM collects sensitive information about an individual in accordance with the provisions of this Policy, the OBM will take reasonable steps to de-identify the information before the OBM discloses it.
5.3 Maintenance and Storage of Personal information 5.3.1 The OBM may disclose some personal information to an offshore third party cloud computing services provider. In this event, OBM will take adequate and reasonable steps to assure appropriate data security.
5.3.2 The OBM will take reasonable steps to: (a) Protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure; and (b) Maintain its record keeping systems to ensure that all personal information collected is up to date, accurate and complete as far as reasonably practicable; and
(c) Ensure that any person who, on behalf of the OBM, uses or discloses personal information held by the OBM has appropriate authorisation to do so.
5.4 Use of Personal Information
5.4.1 Where the OBM collects personal information for a particular purpose (the primary purpose), it will not use that personal information for any other purpose (secondary purpose), unless:
(a) The OBM first takes reasonable steps to obtain the consent of the individual concerned to use his or her personal information for that secondary purpose; or
(b) The individual would reasonably expect the OBM to use or disclose the information for the secondary purpose and the secondary purpose is directly (for sensitive information) or indirectly related (for any other information) to the primary purpose; or
(b) The OBM believes on reasonable grounds that use of the information for that secondary purpose is necessary to prevent or lessen a serious or imminent threat to the life or health of the individual concerned or another person; or (c) Use of the information for that secondary purpose is required or authorised by law; or (d) Use of the information for that secondary purpose is reasonably necessary for the enforcement of the criminal law or of law imposing a pecuniary penalty.
5.4.2 Direct Marketing: (a) Reasonable expectation to use or disclose: If OBM holds personal non-sensitive information about an individual, it must not use or disclose the information for the purpose of direct marketing except when OBM has collected the information from the individual and the individual would reasonably expect OBM to use or disclose the information for that purpose (except for sensitive information).
(b) No reasonable expectation to use: In the event that the individual would not reasonably expect OBM to use or disclose non-sensitive information for direct marketing, the individual needs to have given consent to the use or disclosure of the information for direct marketing.
(c) OBM must provide a simple means by which the individual may easily request not to receive direct marketing communications from OBM.
(d) OBM will only use or disclose sensitive information about an individual for direct marketing purposes if the individual has consented to the use or disclosure of the information for that purpose.
5.5 Disclosure of Personal Information
5.5.1 The OBM will not disclose personal information it holds about a person to a third party, except where: (a) A reasonable individual is likely to have been aware that his or her personal information would be disclosed in that way;
(b) The resident or ratepayer has consented to or made a written request for personal information to be provided to a third party; (c) The personal information is provided for the purpose of distributing materials of and on behalf of the OBM (for example: the provision of address data for use by a mailing service provider to post Rates Notices or other materials); (d) The third party has been contracted by the OBM to provide advice or services for the purpose of assisting the OBM in providing benefits to persons (for example: State Electoral Office, Office of the Valuer General, insurers, legal service providers); (e) The OBM is required or authorised by law to disclose the personal information to a third party or to the public at large (for example, under the Freedom of Information Act); (f) The resident or ratepayer has been advised of the OBM’s usual practice of disclosing personal information to that third party or a third party of that type for a particular purpose and the disclosure is consistent with that purpose; or (g) A public consultation submission has been received by OBM. To enable transparency in consultation processes to occur, all public consultation submissions received by OBM will become public documents and may be included in a report to OBM which is also available to the public.
5.5.2 Where personal information is provided to the OBM by a person "in confidence", the OBM will not disclose such information to a third party without the person’s consent, unless such disclosure is required or authorised by law (for example, applications made under the Freedom of Information Act).
5.5.3 The OBM will take reasonable steps to: (a) Contract only with third party service providers that are subject to the provisions of the Privacy Act and the Australian Privacy Principles; and (b) Where the third party service provider is not subject to the provisions of the Privacy Act and the Australian Privacy Principles, enter into a Privacy Agreement that requires the third party service provider to comply with the provisions of this Policy relating to the collection, use, storage and disclosure of personal information supplied by the OBM.
5.5.4 The OBM may supply personal information about an individual to that individual as part of a standard communication or pursuant to a request made by the individual.
5.5.5 The OBM does not accept any responsibility for any loss or damage suffered by a person because of their reliance on any personal information provided to them by the OBM or because of the OBM's inability to provide persons with any requested personal information.
5.5.6 The OBM expects that persons will, before relying on any personal information the OBM provides to them, first seek confirmation from the OBM about the accuracy and currency of such personal information.
5.6 Integrity and Alteration of Personal Information 5.6.1 The OBM assumes that personal information provided by persons or other persons is accurate, complete and up-to-date. It is the responsibility of persons to provide the OBM with details of any changes to their personal information as soon as reasonably practicable following such change.
5.6.2 The OBM will take reasonable steps, such as making appropriate deletions, additions and corrections, to ensure that personal information held by it is accurate, relevant, complete, up to date and not misleading.
5.6.3 A person may apply to the OBM, in a form determined by the OBM, to have his or her personal information amended so that it is accurate, relevant, complete, up-to-date and not misleading. Where the OBM, on reasonable grounds, decides not to amend a resident’s or ratepayer’s personal information in the manner requested in the application, the OBM will inform the person of its decision and the reasons for refusing to make the requested amendments. If requested by a resident or ratepayer, the OBM will take reasonable steps to attach to a record containing that person’s personal information a statement provided by that person of the correction, deletion or addition sought.
5.7 Access to Personal Information 5.7.1 A person who wishes to access personal information held by the OBM must make a written application to the Owner of the OBM. An applicant will be required to pay an application fee as determined by the Freedom of Information Act 1991.
5.7.2 Subject to the provisions of this legislation, the OBM may grant or refuse access to personal information as it deems fit.
5.7.3 The OBM recognises that there are certain documents, which may contain personal information, that the OBM is legislatively required to make available for access by members of the public.
5.7.4 An application to access personal information will be dealt with within 30 days of receipt of the request. In certain circumstances, an applicant may be required to satisfy OBM staff as to his or her identity.
5.8 Suppression of Personal Information 5.8.1 A person’s name or address may be suppressed from the OBM’s Assessment Record and Voters Roll where the Chief Executive Officer is satisfied that inclusion of the name or address on the Assessment Record and/or Voters Roll would place at risk the personal safety of that person, a member of that person’s family, or any other person.
5.8.2 Enquiries regarding suppression of personal information should be directed to Customer Services staff at the Customer Service Centre in the first instance.
6. FREEDOM OF INFORMATION Personal information may be released to others if requested under the Freedom Of Information Act, however, in accordance with this Act, a person will be consulted to obtain their opinion on release of the information. Should it be determined the information will be released against the view of the person, they have the right to request a review of the decision, on payment of the prescribed fee, prior to the information being released.
7. COMPLAINTS 7.1 A person who has any concerns regarding how the OBM handles personal information or requires further information can contact the Customer Services staff at the Customer Services in the first instance.
8. REVIEW OF POLICY This policy will be reviewed inline with the OBM’s Policy Framework or earlier in the event of major changes to legislation or related policies, procedures or if deemed necessary by the Executive Manager, Finance & Risk.