Privacy & Health Information Policy

• Introduction
• Policy Statement
• Policy Detail
• Storage & management of collected personal and/or health information
• Access and correction of personal and/or health information
• Report a Data Breach or make a Privacy Complaint to Council

Introduction

This Privacy & Health Information Policy aligns with the Victorian Privacy and Data Protection Act 2014 and the Health Records Act 2001 and outlines how Council as a Victorian public agency will collect, use, disclose and store personal and health information.

Yarra Ranges Council (YRC) views the protection of an individual’s privacy and the appropriate use of their personal and/or health information as a demonstration of its commitment toward openness, accountability and integrity in all of its activities and programs.

Why have a policy?

In publishing this policy, YRC aims to promote public confidence and transparency by plainly:

• listing YRC’s reasons and methods for collecting, using or disclosing personal and/or health information;
• defining how YRC employees must correctly store personal and/or health information;
• describing the process for individuals to access and correct their personal/health information; and
• detailing the ways to make a Privacy Complaint or report a Privacy Breach to Council.

• Further, Council is legally obligated by the Victorian Privacy and Data Protection Act 2014 (PDP Act) and the Health Records Act 2001 (HR Act) to have a written policy about the collection, use, storage or disclosure of personal and health information and to make this available to anyone who asks for it.

  To whom does the policy apply?

  All Councillors, Council officers, contracted service providers, volunteers and those on work experience must adhere to this policy as a condition of their employment/engagement with YRC.

  This policy covers all personal and health information collected, used, stored and disclosed by YRC and includes information gathered:

• about individuals through any of Council's public access interfaces.
• from individuals, as well as information about individuals collected from third parties.
• about individuals regardless of format.  This includes information collected on forms, in person, in correspondence, over the telephone or via our various web forms/sites

  Why does Council collect personal/health information?

  As a local government agency, YRC operates under a legal framework that includes both State and Federal laws. The primary role of YRC within the community is to achieve the objectives and exercise the powers outlined in the Local Government Act 1989 (LGA). In order to achieve these objectives and deliver services, Council often requires the collection and use of personal and/or health information of individuals.

  Therefore, the functions of Council as outlined in the LGA are to:

• advocate and promote proposals which are in the best interest of the local community;
• plan for and provide services and facilities for the local community;
• provide and maintain community infrastructure in the municipal district;
• undertake strategic and land use planning for the municipal district;
• raise revenue to enable the Council to perform its functions;
• make and enforce local laws;
• exercise, perform and discharge the duties, functions and powers of Councils under the Act and other Acts; and
• perform any other function relating to the peace, order and good government of the municipal district.

• Financial Services
• People and Culture
• Information Services
• Customer and Communications

• Community Services
• Creative Communities
• Community Wellbeing

• Planning, Design and Development
  The Planning, Design and Development teams provide oversight for the strategic planning and economic development of our communities, as well as traditional statutory planning and building services, including compliance.

• Planning and Building
• Design and Place
• Strategic Projects
• Economic Development and Attraction

• Key Terms and Definitions

  Personal Information

  Personal information is a record or an opinion, that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion. Personal information may include at a minimum an individual’s:

• Name
• Home address
• Telephone number / email address
• Date of birth and age
• Marital status
• Financial status

  For example, YRC may collect and use relevant personal information like a name and an address to facilitate the lodgement of a customer request, payment of rates, registration of a pet or lodgement of a planning application.

  Health Information

  Health information is a record or an opinion concerning health related activities or services collected by both health service providers and non-health service providers. Health information may include at a minimum details about an individual's:

• Physical, mental or psychological health
• Disabilities
• Use and future use of health services
• Wishes regarding specific health services or treatments
• Personal information collected in relation to the provision of health services
• Genetic information.

  For example, YRC may collect and use relevant health information when providing immunisations, maternal and child health assessments or signing up a client to a home care service.

  Sensitive Information

  Sensitive information is any personal information or an opinion about an individual’s:

• race or ethnic origin
• political opinions
• membership of a political association
• religious beliefs or affiliations
• philosophical beliefs
• membership of a professional trade association
• membership of a trade union
• sexual preferences or practice
• criminal record

  Generally, YRC will not collect or use sensitive information. However, there may be limited circumstances where the collection and use of sensitive information is relevant, for example disclosing ethnicity or a religious affiliation may be relevant to access a specific service.

  Information Privacy Principles

  There are 10 Information Privacy Principles (IPP’s) which are the practical application of privacy law in Victoria, setting out the minimum standards for how Victorian public sector bodies should handle personal information. They are contained in Schedule 1 to the PDP Act

  Health Privacy Principles

  There are also 11 Health Privacy Principles (HPPs), which share the first 10 IPPs, and are designed to protect privacy and promote autonomy, whilst also ensuring safe and effective service delivery, and the continued improvement of health services. They are contained in in Schedule 1 to the HR Act.

  Supporting materials

  There are a range of supporting materials, which are referred to within this policy. These include:

• Yarra Ranges Council - Records Management - Operational Policy 2020

   

  Data sources used

  This policy was designed using information derived from the following data sources:

• Office of the Victorian Information Commissioner – web resources - https://ovic.vic.gov.au/
• Public Records Office Victoria – web resources - https://prov.vic.gov.au/

•  

  Policy Statement

  As a Victorian municipal council, YRC is empowered to collect, use, store or disclose personal and/or health information if there is either a legal requirement to do so, or it is essential to effectively deliver a service to the community. YRC will only ever collect personal and/or health information where necessary.

  All Councillors, Council officers, contracted service providers, volunteers and those on work experience must adhere to this policy as a condition of their employment/engagement with YRC.

  YRC holds personal and health information in hard copy and electronic formats. Appropriate security measures are applied to protect the physical and electronic records we store and manage.

  In compliance with the Public Records Act 1973 and the Yarra Ranges Council - Records Management - Operational Policy 2020, Council disposes of hard copy & electronic information when it is no longer required to fulfil the business or legal purposes for which the information was collected.

  This policy is YRC’s global statement outlining Council’s rules and procedures concerning the collection, use, disclosure and storage of personal and/or health information of individuals gathered through all Council communication channels (hard copy forms, electronic forms and our website). 

  All points of collection and all outgoing correspondence that may request personal or health information must include a Collection Statement, advising the customer of the following:

• Identity of organisation & team collecting information
• Purposes for which the information is being collected
• To whom the information will/may be disclosed to
• Any law that requires the information to be collected
• Main consequences if (all or some of) the information is not provided
• Details on how to gain access to the information and how to contact organisation

• ·name
• address (residential, postal and/or e-mail)
• telephone number (work, home or mobile)
• date of birth
• signature
• photography and/or video footage
• health status or disability information

   

  Reasons for collection

  YRC will only collect personal and/or health information by lawful and fair means if it is necessary to fulfil one or more of its business functions, and where reasonable and practicable, collection will be from an individual directly. By means of demonstration, Council may collect personal and/or health information for the following business purposes:

• To facilitate the collection of Council fees and charges. For instance, the Rates Team will use name and address details supplied through a letter of Acquisition to connect with owners regarding the payment of rates and waste charges.
• To resolve service requests. For instance, Council or a contracted service provider may use name and address details supplied through a customer initiated service request to provide updates on the resolution of a request to grade a road or repair a pot hole.
• To communicate regarding specific localised issues. For example, Development Services will use name & address details to consult with relevant neighbours about a Planning Permit.
• To aid access and use of health services. For instance, birth notices are supplied by hospitals to Council in order to facilitate access to Maternal and Child health services who provide information and support to new parents and families.
• To enable Council to undertake its law enforcement functions. For instance, Council collects information about customers from Vic Roads to process parking infringement notices.
• To communicate and publicise Council initiatives and programs. For example, customers who have opted to be included on a mailing list for a Council publication via our public interfaces.

   

  Methods of collection

  Council will collect information only by lawful and fair means, and not in an unreasonably intrusive way. Council will provide notice of the collection of the information, outlining matters such as the purpose of collection and how individuals can access the information after submission. This will be achieved through the use of a Collection Notice.

  Council may collect personal and/or health information in the following ways:

• During a conversation with a Council representative at a Service Centre or over the phone
• From the Council website, social networking sites or sending a messages (SMS/MMS)
• Council’s online payment portal i.e. rates, permits, animal registrations, fines & infringements
• The completion of online or hard copy application form or survey.
• From other third parties i.e. a referral from a community health services

   

  Use of personal and/or health information

  Personal information collected by Council can only be used for the primary purpose for which it was collected, or for a secondary purpose that would be reasonably expected. In accordance with the PDPA, personal information can also be used in other limited circumstances, such as with the individual's consent, for a law enforcement purpose, or to protect the safety of an individual or the public.

  Council may use health information about an individual for the primary purpose for which the information was collected or for a directly related and reasonably expected secondary purpose. Some exceptions exist. In any other circumstance Council will contact the individual in order to obtain consent (unless the use is required by law or permitted by the HRA).

  Where necessary, Council may disclose personal and/or health information to other business units within Council to assist in actioning an enquiry or providing a service.

  Council outsources some of its functions to contractors who perform services for and on behalf of the Council. All third party contracts include provisions to ensuring contractors are bound by the IPP’s & HPP’s in the same way and to the same extent as Council. To assist with compliance the contractor is alerted to our expectations as part of the procurement process and this privacy policy.

  Disclosure of personal and/or health information

  Council will disclose customer’s personal and/or health information with third parties under a limited set of circumstances, and often only in compliance with specific legislation. All disclosures to third parties will be recorded in writing by Council. These circumstances can include, but are not limited to:

• debt collection agencies (for example, in the recovery of unpaid property rates or fines)
• government agencies including the Department of Environment, Land, Water and Planning, Department of Human Services, Water Authorities, Victorian Workcover Authority and Vic Roads to enable them to advise you of works which may impact upon you or your property
• law enforcement agencies, including the courts and the Victoria Police, in circumstances  where Council is required to assist in an emergency, respond to a subpoena or to assist with a police investigation.
  
  

1.2 Data – Quality, Security and Transfer

Data quality

In regard to data quality, Council will take all reasonable steps to make sure that the personal and/or health information it collects, uses or discloses is accurate, complete and up to date.

Customers are obligated to inform Council of any relevant changes to their personal and/or health information. Council will only accept advice of changes to personal and/or health information directly from the relevant individual or an appropriately authorised individual (i.e. power of attorney, health advocate). Council reserves the right to request proof of identity to make any changes or amendments to an individuals personal and/or health information.

Data Security & Data Governance

In regards to data security, Council will take all reasonable steps to protect the personal and/or health information it holds from misuse, loss and unauthorised access, modification or disclosure.

Yarra Ranges Council has developed an Information Services Standards and Procedures and Data Governance Framework to practically manage data and information within Council’s digital and non-digital environments.

These framework documents are applied to Council’s operations and outline what good information security and data governance looks like by establishing policies, rules and operational standards across Council.  These frameworks ensures all staff, Councillors, contractors and volunteers understand their roles and responsibilities.

The Information Services Standards and Procedures specifically provides guidance on the following:

• Acceptable Use Standard
• Access Control Standard
• Anti-Virus Standard
• Business Continuity
• Cloud Computing Standard
• Communication and Mobile Devices Standard
• Computer Systems And Equipment Use Standard
• Computers for Councillors Standard
• Cyber Crime and Security Incident Standard
• Email Standard
• Encryption Standard
• Firewall Management Standard
• Hardware Management Standard
• Internet Use Standard
• Laptop And Tablet Security Standard
• Legal Compliance Standard
• Network Management Standard
• Online Services Standard
• Password And Authentication Standard
• Personnel Management Standard
• Physical Access Standard
• Remote Access Standard
• Software Management Standard
• Special Access Standard

4. Report a Data Breach or make a Privacy Complaint to Council