1.1 Melbourne Legacy (‘ML’, ‘we’, ‘our’) is committed to ethical practices and standards. This includes respecting the privacy of all personal information in its possession.
1.2 This policy aims to:
2.1 This policy applies to all employees, Legatees, contractors, volunteers and other authorised personnel required to perform functions on behalf of ML or on ML’s premises.
2.2 This policy is not intended to override or form part of the terms of any award, enterprise agreement or contract that applies to an employee, but should be considered a reasonable direction to staff. As such all employees, volunteers, contractors and other authorised personnel are expected to abide by this policy and report any suspected or known breaches of this policy.
3.1 Relevant legislation which governs how ML handles personal information:
4.1 Access means the ability to view, obtain or retrieve information in any form to any other person.
4.2 Disclosure amounts to making the information accessible or visible to others outside the organisation holding the information.
4.3 Hold means the information in the possession or under the control of ML.
4.4 Loss means that the physical whereabouts of information is unknown (including both hard and/or soft copies) and involves the failure to preserve or maintain the information in a known place. Loss does not include the intentional destruction or de-identification of information.
4.5 Misuse means personal information is misused if it’s used in a way that contravenes any of the information or principles of this policy, which deal with use and disclosure.
4.6 Modification means the changing, removing or adding of components to the original information.
4.7 Personal information means any information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can be reasonably ascertained from the information or opinion.
4.8 Sensitive information means information or an opinion, that is also personal information, about an individual’s:
It also includes health information about an individual, genetic information, or biometric information or templates.
4.9 Unauthorised Access, modification or disclosure means access, modification or disclosure of information that is considered unauthorised where an individual:
4.10 Worker is broadly defined, and for the purposes of this policy means:
5.1 It is necessary for ML to collect personal information in order to deliver certain services and programs. We will always try to collect information directly from the individual or their authorised representative within the requirements of applicable privacy law where it is reasonably necessary and practicable to do so.
5.2 Personal information may be collected when interacting with our staff including when completing physical or online forms, over a telephone call, postal mail, email, in person, via our website (such as our online donation portal and online store), and social media sites.
5.3 In some circumstances, we may collect personal information from a third party where it is unreasonable or impracticable to collect it directly from the individual.
5.4 We may collect personal information about:
5.5 The types of personal information collected and held by Melbourne Legacy will depend on how individuals engage with ML and our services and may include:
5.6 In limited circumstances, Melbourne Legacy is authorised to collect Tax File Numbers (TFNs) for administering paperwork for certain payments. There is no obligation to provide a TFN. However, some payments, such as pensions and allowances, cannot be made without the provision of a TFN. Melbourne Legacy’s handling of TFNs is governed by the Privacy (Tax File Number) Rule 2015, which can be accessed at: www.comlaw.gov.au.
5.7 Where personal information is provided to ML that is unsolicited or not reasonably necessary for one or more of our functions or activities, ML will:
5.8 Sensitive information will only be collected if it is directly related to the primary purpose for which the information will be collected or as required by law or with the individual’s specific and informed consent.
5.9 The sensitive information collected by ML relates mostly to:
5.10 In certain circumstances, personal information may be collected by people or organisations acting and providing services on behalf of ML, such as:
Records collected or created for or on our behalf of are under the control and the same privacy protections apply.
5.11 Melbourne Legacy may also collect personal information from a government agency, such as the Department of Veterans Affairs (DVA) to obtain service history information, support requests and other pertinent information to administer either support or pension claims.
5.12 Individuals can choose to remain anonymous or use a pseudonym where practicable, but this may limit our ability to engage with individuals or provide our services, such as identifying and verifying beneficiaries eligible to receive pensions and allowances.
6.1 ML does not sell, rent or trade personal information to, or with, third parties.
6.2 ML generally uses and discloses personal information for the primary purpose for which it was collected. These primary purposes include but are not limited to:
6.3 In certain circumstances, ML may use or disclose personal information in its possession for a different purpose (the secondary purpose), where the secondary purpose:
6.4 We may disclose personal information to third parties to where it is reasonably necessary for the purpose of collection or a secondary purpose exists. This may include but is not limited to:
6.5 ML may disclose personal information in our promotional material and on social media platforms, for example, when we use photos or recordings from our events in which individuals are reasonably recognisable. Generally, ML will seek consent from the individual where this is reasonably practicable.
6.6 Although the information of a deceased individual is not regulated by privacy law, Melbourne Legacy will continue to respect the sensitivities of family members when using or disclosing such information.
7.1 ML may use or disclose personal information for the purpose of direct marketing where individuals have provided consent or it is reasonably expected and related to the primary purpose of collection. ML may communicate about:
7.2 Individuals can opt-out of receiving direct marketing communications by contacting ML (please see contact details in section 10.1) in writing or, if applicable, by using the unsubscribe link in an email or by accessing Legacy Australia website and unsubscribing.
8.1 Melbourne Legacy will store personal information in a variety of formats, including hard copy and digital (for example, electronic databases). We use a range of IT and physical security systems to protect the personal information we hold and take reasonable steps to ensure that information is protected from misuse, interference, loss, unauthorised access, modification and disclosure. For example, we implement technical measures for data storage and protection, apply access controls to restrict access, use or disclose of personal information, and enter into contractual arrangements with third parties that cover the authorised use and disclosure of personal information, including any cross-border transfer of data outside Victoria or Australia, consistent with applicable privacy law.
8.2 ML may contact individuals to determine whether personal information collected should be retained. If we no longer require the personal information, we will take reasonable steps to destroy or de-identify the personal information, unless it is prohibited by law. For example, if the information is contained within a Commonwealth public record the record can only be destroyed or altered in accordance with the Archives Act 1983 (Cth).
8.3 Melbourne Legacy will take reasonable steps to ensure that personal information we hold is:
8.4 When using contracted service providers we take reasonable steps to ensure they are subject to a law, binding scheme or contract that provides substantially similar protection of personal information.
9.1 Access
9.1.1 Individuals may request access to personal information which ML holds about them by (using the contact details in section 10.1). We cannot provide an individual with the personal information of a partner or family member without consent or other lawful authority, such as to a legal guardian, nominated representative or authorised agent acting on behalf of an individual.
9.1.2 There is no cost associated with requesting access to personal information. ML will respond to most requests for access to personal information within 30 days of the request being received. In some circumstances, a request for personal information can be refused or restricted, including where the release of information may interfere with the privacy of others, or the information is subject to legal professional privilege. If Melbourne Legacy decides to refuse or restrict access to the information a written notice of the reasons for refusal will be provided.
9.2 Correction
9.2.1 Individuals may make a request to ML to update personal information that is out-of-date, incomplete, incorrect or misleading (using the contact details in section 10.1). We will respond to most requests for correction of personal information within 30 days of the request being received. There is no cost associated with requesting correction of personal information.
9.3 We may ask individuals to verify their identity before ML provides access to or corrects personal information.
10.1 Individuals may contact us with their privacy concern or complaints. All privacy directed inquiries and complaints should be directed to:
10.2 We may ask individuals to verify their identity before giving. We encourage individuals to provide a:
10.3 ML aims to acknowledge complaints received by telephone and email within two (2) working days and to resolve the issue within 30 days. For complaints received by mail, Melbourne Legacy aims to provide acknowledgement within fourteen (14) working days and to resolve the issue within 30 days. If the matter is complex, it may take longer. In such cases, we will ensure the individual is given the contact details of the person assigned to managing their complaint and will keep them informed of progress and an expected resolution date.
10.4 Where an individual is dissatisfied with the way ML handles their privacy related complaint, they may contact the Office of the Australian Information Commissioner on 1300 363 992 or via the internet at http://www.oaic.gov.au.
10.5 For more information about our privacy handling practices or this Policy contact the ML Privacy Officer.