POLICY: 6. PRIVACY 

1. Introduction 

Ceduna Aboriginal Corporation, its affiliates, and agents (CAC, we, us, our) is committed to protecting your privacy. CAC takes the responsibility of protecting and managing your personal information very seriously. 

CAC is bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth) (Privacy Act). The Privacy Act regulates how CAC collects, uses, discloses, and handles personal information. In some circumstances, CAC may undertake contractual obligations to observe additional privacy obligations. 

This Privacy Policy sets out how we manage your personal information, including sensitive information, and protect your privacy. From time to time, it may be necessary for us to review and revise this policy. We reserve the right to change this policy at any time. When we do so, we will post our updated Privacy Policy on our website, accessible at www.cac.asn.au (Website). We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy. 

Please note that this policy should be read together with any other privacy statement, including our Privacy Collection Notices, that we may provide to you when we collect your personal information. By providing personal information to us, you consent to our collection, use and disclosure of your personal information in accordance with this Privacy Policy and any other arrangements that apply between us. 

2. What is personal information? 

References to the terms personal information and sensitive information have the meaning used in the Privacy Act. 

Broadly, personal information is any information or an opinion about an individual who is identified or whose identity is reasonably ascertainable, for example, your name, age, gender, postcode or contact details. It includes sensitive information, which is information about, for example, an individual’s racial or ethnic origin, political opinions, and criminal record. 

3. What personal information does CAC collect? 

CAC will only collect personal information if it is relevant and reasonably necessary for us to carry out our work. Our work is primarily focused on delivering services, programs, activities, events and other initiatives to the Aboriginal people and communities in the Ceduna and surrounding regions (CAC Programs). 

The personal information which we may collect about you includes, but is not limited to, the following types of information: 

  • your personal details, including your full name, age, gender, date of birth, racial or ethnic identification or nationality; 
  • your contact details, including home address, email address and telephone number (and in the case of children attending Youth Hub or CAC’s homework centre, the contact details of their parent(s) or guardian(s)); 
  • monitoring and security data in relation to employee and other activity or movements in CAC premises; and 
  • other information from which you are identifiable or reasonably identifiable. 

CAC may take photographs as part of its regular activities, including at community engagement events. You will be notified at the commencement of an event if photos will be taken and will be able to request to not have your photo taken. 

3.1 Sensitive Information 

CAC may collect your sensitive information, which is a subset of personal information. For example, we collect sensitive information through paper-based or electronic application and sign-up forms for CAC Programs. 

Examples of the kinds of sensitive information we may collect (with your consent) include information about your racial or ethnic background, or nationality. In the case of CAC employees, we may also collect biometric information (such as facial recognition data) to monitor attendance, and maintain security, at CAC premises. 

Your sensitive information will assist CAC to determine whether you are eligible to participate in particular CAC Programs. We will obtain your consent when collecting sensitive information from you, except where otherwise provided by Privacy Law. 

3.2 Anonymity 

CAC will take all reasonable steps to comply with a request to communicate with us and engage in our activities on an anonymous basis. However, we may not be able to fully communicate with you or enable you to engage in all our activities if you do not provide us with the personal information requested. For example, you may not be eligible to register for, and participate in, our CAC Programs unless you provide us with the required information. 

4. How does CAC collect your personal information? 

We collect personal information in a number of ways, including: 

  • when you contact us via telephone, email, websites or other avenues; 
  • through the completion of online and paper-based forms (for example, as part of the process for signing up for or participating in CAC Programs); 
  • as part of CAC’s community activities and consultations; 
  • for entrants to CAC’s premises, through the use of CCTV cameras; and 
  • for CAC staff, through automatic time recording devices (including through facial recognition or pin access). 

CAC will usually collect personal information directly from you. However, we sometimes need to collect information from a third party, such as government departments or agencies, communication organisations, community organisations with which CAC coordinates community services, or from your guardians or other advocates. 

Where CAC collects personal information from a third party we will take such steps as are reasonable in the circumstances to notify you, or ensure you are aware, of that collection and the circumstances of collection. 

5. Why do we collect personal information? 

CAC collects and handles personal information for the purposes of carrying out our work. The purposes for which we may collect personal information include, but are not limited to: 

  • managing your involvement in CAC Programs, including measuring attendance and engagement of community members, including members of the Aboriginal community, at various CAC Programs; 
  • improving the way CAC Programs are administered and delivered to the community, and increasing community engagement in such programs; 
  • meeting CAC’s reporting requirements to external stakeholders, including government organisations, individuals, bodies, agencies or other entities which provide funding to CAC to support CAC Programs and other business functions; 
  • organising and communicating with you about CAC’s community events, including sending news and information about our services, programs and activities; 
  • for entrants to CAC’s office building, monitoring for safety and security purposes; and 
  • for CAC staff, time recording to monitor office attendance. 
6. Use and disclosure 

We will normally use or disclose your personal information only for the purposes it was given to us and for a reasonably related secondary purpose, which CAC believes you should reasonably expect or to which you have consented, including to be contacted in relation to CAC Programs. 

As part of carrying out our functions and delivering CAC Programs, we may need to disclose your personal information to other organisations, which include: 

  • agencies that provide services or support to you and fund the service provided to you, such as:

– state and federal government departments; 

– emergency services (in the event of an emergency); 

– coroner; 

– service providers; and 

– your social worker or case manager; 

  • employers; 
  • schools; and 
  • family and/or significant individuals in your life. 

We may also be required to disclose your personal information where required by law, for example, in response to a subpoena. 

We will ordinarily notify you to whom we will disclose your personal information at the time we collect the relevant information from you, subject to the exclusions set out in Privacy Law. We do not supply our database information to marketing organisations not acting on our behalf. We will take reasonable steps to ensure that the persons and organisations to whom we disclose personal information are bound to protect the privacy of that personal information. 

We do not disclose your personal information to entities located overseas or otherwise store such information outside of Australia. 

7. Storage and security of the information we hold 

We will take reasonable steps to protect the personal information that we hold from misuse, interference and loss, and from unauthorised access, modification and disclosure. We hold personal information in both hard copy and electronic formats.

The steps taken by CAC to ensure security include: 

  • storage of physical paper records in locked storage units; 
  • access rights to computerised records are password-protected and unauthorised attempts to access such records are continuously monitored; 
  • limiting the number of authorised people who have access to your information, such that only those with a need-to-know are permitted access to your data (including for the purpose of carrying out internal security audits); and 
  • maintaining and periodically reviewing your policies and procedures for the secure access and use of CAC’s IT systems, and appropriate use of data stored on CAC premises and systems. 

We will only keep your personal information for as long we need it for the purposes described in this policy. Your personal information will be destroyed or de-identified when it is no longer required by us or our agents. 

In the event that a data breach considered ‘notifiable’ under the Privacy Act occurs, CAC will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC). A breach is defined as a data breach that is likely to result in serious harm to any of the individuals to whom the information relates. Serious harm could include serious physical, psychological, emotional, and financial harm, as well as serious harm to reputation. 

8. Access to and correction of personal information 

We take reasonable steps to ensure that the personal information we hold is accurate and complete. If at any time you wish to access or update your personal information, you can do so by contacting our Privacy Officer (details set out below). We will allow access or make changes to your personal information unless we consider that there is a sound reason under the Privacy Act to withhold the information or not to make changes. 

For security reasons you will be asked to put your request in writing. CAC may require you to verify your identity and specify what information you require. CAC may charge a fee to cover the cost of accessing and/or updating your personal information. 

If we cannot provide you with access to your personal information, we will provide you with a written notice to explain the reasons for refusal. 

9. Links to third party websites and services 

Our website includes links to pages and services provided by third parties. Where you access links to web pages or services that are outside our web domain you will be leaving our Website and going to a web page controlled by a third party. When you access such links, CAC’s privacy practices, and this policy, no longer apply to you or your personal information. Information collected on those third party websites will be managed in accordance with the third party’s own privacy policies. 

Unless otherwise indicated, we: 

  • do not endorse or authorise the content of any third party website; 
  • are not affiliated or associated with the owner or operator of any third party website; and 
  • assume no responsibility or liability for the condition or content of any third party website or for the operation or function of any service or facility offered on any third party website. 
10. Google Analytics 

Our Website may use Google Analytics to track certain activities by, and collect information about, visitors. Google Analytics anonymously tracks how visitors interact with the Website, including which websites they visited immediately prior to the Website, what they did on the Website and whether they completed any transactions on the Website, such as registering to receive our newsletter. 

Our Website may collect technical data, which may include your IP address, the type of device you are using to access the Website, device attributes, browser type, language and operating system and other information such as the location from which you have come to the Website and the pages you visited prior to the Website. Our Website may use cookies. Such data may qualify as personal information under Privacy Law, however it is not used to identify individual users of our Website. 

For more information on how Google Analytics collects and processes data, see www.google.com/policies/privacy/partners. 

11. How to make a Complaint 

If we collect and hold your personal information, you have a right to make complaint and have it investigated and dealt with in accordance with the complaints procedure set out below. 

The procedure to make a complaint is: 

  • the complaint is to be in writing and must be sent to the Privacy Officer; 
  • the complaint must specify the details of the alleged breach; 
  • the Privacy Officer will consider the complaint and make a determination within 45 days and will inform the complainant of the outcome in writing; 
  • if the Privacy Officer determines that there has been a breach of the Privacy Act by CAC, they will advise the relevant persons in writing of any action required to remedy the breach and if the breach is not remedied within 30 days, the Privacy Officer is to be informed; and 
  • CAC will maintain a record of all complaints and determinations and of the action taken to remedy any breach. 

If you are unhappy with our response, you can refer your complaint to the OAIC. CAC will provide its full cooperation if this occurs. 

Anyone who wishes to obtain more information about privacy can visit the OAIC website: www.oaic.gov.au. 

12. Privacy Officer contact details 

Gavin Haynes 

Privacy Officer 

Ceduna Aboriginal Corporation 

Email: gavin@cac.asn.au 

Telephone: (08) 8625 3210 

Address: 39 McKenzie St, Ceduna, SA 5690 

You may request a hard copy of this Privacy Policy by contacting the Privacy Officer.