Privacy & Health Information Policy

Introduction

This Privacy & Health Information Policy aligns with the Victorian Privacy and Data Protection Act 2014 and the Health Records Act 2001 and outlines how Council as a Victorian public agency will collect, use, disclose and store personal and health information.

Yarra Ranges Council (YRC) views the protection of an individual’s privacy and the appropriate use of their personal and/or health information as a demonstration of its commitment toward openness, accountability and integrity in all of its activities and programs.

Why have a policy?

In publishing this policy, YRC aims to promote public confidence and transparency by plainly:

  • listing YRC’s reasons and methods for collecting, using or disclosing personal and/or health information;
  • defining how YRC employees must correctly store personal and/or health information;
  • describing the process for individuals to access and correct their personal/health information; and
  • detailing the ways to make a Privacy Complaint or report a Privacy Breach to Council.
  • Further, Council is legally obligated by the Victorian Privacy and Data Protection Act 2014 (PDP Act) and the Health Records Act 2001 (HR Act) to have a written policy about the collection, use, storage or disclosure of personal and health information and to make this available to anyone who asks for it.

    To whom does the policy apply?

    All Councillors, Council officers, contracted service providers, volunteers and those on work experience must adhere to this policy as a condition of their employment/engagement with YRC.

    This policy covers all personal and health information collected, used, stored and disclosed by YRC and includes information gathered:

  • about individuals through any of Council's public access interfaces.
  • from individuals, as well as information about individuals collected from third parties.
  • about individuals regardless of format.  This includes information collected on forms, in person, in correspondence, over the telephone or via our various web forms/sites

    Why does Council collect personal/health information?

    As a local government agency, YRC operates under a legal framework that includes both State and Federal laws. The primary role of YRC within the community is to achieve the objectives and exercise the powers outlined in the Local Government Act 1989 (LGA). In order to achieve these objectives and deliver services, Council often requires the collection and use of personal and/or health information of individuals.

    Therefore, the functions of Council as outlined in the LGA are to:

  • advocate and promote proposals which are in the best interest of the local community;
  • plan for and provide services and facilities for the local community;
  • provide and maintain community infrastructure in the municipal district;
  • undertake strategic and land use planning for the municipal district;
  • raise revenue to enable the Council to perform its functions;
  • make and enforce local laws;
  • exercise, perform and discharge the duties, functions and powers of Councils under the Act and other Acts; and
  • perform any other function relating to the peace, order and good government of the municipal district.


Subject to any limitations or restrictions imposed by or under the LGA or any other Act, Council has the power to do all things necessary or convenient to be done in connection with the achievement of its objectives and the performance of its functions.

In order to meet the functional objectives listed above, the organisational structure of Council has been designed to best deliver a wide variety of efficient and effective community services. The current Council structure focuses on connecting our communities and achieving balanced growth in order to enable the delivery of the Council Plan.               

Yarra Ranges Council stands 900 staff strong and covers over 140 roles across five diverse directorates. The five directorates of Council providing services to the community are as follows:

Office of the CEO
The Office of the CEO includes executive support services and a number of teams whose focus is planning for the future of the community and the agency.

  • Civic Centre Redevelopment
  • Business Transformation
  • Organisation Strategy
  • Corporate Planning & Performance
  • Advocacy and Government Relations

Corporate Services
Our Corporate Services team provides a broad range of support, integral for our internal operations.

  • Financial Services
  • People and Culture
  • Information Services
  • Customer and Communications
Environment & Infrastructure

Our Environment & Engineering team look after a range of areas from roads and waste to maintaining community infrastructure such as parks and sporting facilities.

  • Infrastructure Services
  • Sustainable Environment & Facilities
  • Recreation, Projects and Parks
  • Assets and Capital Programming
  •  

Communities
Our Communities teams look after a range of services provided to all community members from birth to the elderly, including local laws and the arts.

  • Community Services
  • Creative Communities
  • Community Wellbeing

  • Planning, Design and Development
    The Planning, Design and Development teams provide oversight for the strategic planning and economic development of our communities, as well as traditional statutory planning and building services, including compliance.

  • Planning and Building
  • Design and Place
  • Strategic Projects
  • Economic Development and Attraction

  • Key Terms and Definitions

    Personal Information

    Personal information is a record or an opinion, that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion. Personal information may include at a minimum an individual’s:

  • Name
  • Home address
  • Telephone number / email address
  • Date of birth and age
  • Marital status
  • Financial status

    For example, YRC may collect and use relevant personal information like a name and an address to facilitate the lodgement of a customer request, payment of rates, registration of a pet or lodgement of a planning application.

    Health Information

    Health information is a record or an opinion concerning health related activities or services collected by both health service providers and non-health service providers. Health information may include at a minimum details about an individual's:

  • Physical, mental or psychological health
  • Disabilities
  • Use and future use of health services
  • Wishes regarding specific health services or treatments
  • Personal information collected in relation to the provision of health services
  • Genetic information.

    For example, YRC may collect and use relevant health information when providing immunisations, maternal and child health assessments or signing up a client to a home care service.

    Sensitive Information

    Sensitive information is any personal information or an opinion about an individual’s:

  • race or ethnic origin
  • political opinions
  • membership of a political association
  • religious beliefs or affiliations
  • philosophical beliefs
  • membership of a professional trade association
  • membership of a trade union
  • sexual preferences or practice
  • criminal record

    Generally, YRC will not collect or use sensitive information. However, there may be limited circumstances where the collection and use of sensitive information is relevant, for example disclosing ethnicity or a religious affiliation may be relevant to access a specific service.

    Information Privacy Principles

    There are 10 Information Privacy Principles (IPP’s) which are the practical application of privacy law in Victoria, setting out the minimum standards for how Victorian public sector bodies should handle personal information. They are contained in Schedule 1 to the PDP Act

    Health Privacy Principles

    There are also 11 Health Privacy Principles (HPPs), which share the first 10 IPPs, and are designed to protect privacy and promote autonomy, whilst also ensuring safe and effective service delivery, and the continued improvement of health services. They are contained in in Schedule 1 to the HR Act.

    Supporting materials

    There are a range of supporting materials, which are referred to within this policy. These include:

  • Yarra Ranges Council - Records Management - Operational Policy 2020

     

    Data sources used

    This policy was designed using information derived from the following data sources:

  • Office of the Victorian Information Commissioner – web resources - https://ovic.vic.gov.au/
  • Public Records Office Victoria – web resources - https://prov.vic.gov.au/
  •  

    As a Victorian municipal council, YRC is empowered to collect, use, store or disclose personal and/or health information if there is either a legal requirement to do so, or it is essential to effectively deliver a service to the community. YRC will only ever collect personal and/or health information where necessary.

    All Councillors, Council officers, contracted service providers, volunteers and those on work experience must adhere to this policy as a condition of their employment/engagement with YRC.

    YRC holds personal and health information in hard copy and electronic formats. Appropriate security measures are applied to protect the physical and electronic records we store and manage.

    In compliance with the Public Records Act 1973 and the Yarra Ranges Council - Records Management - Operational Policy 2020, Council disposes of hard copy & electronic information when it is no longer required to fulfil the business or legal purposes for which the information was collected.

    This policy is YRC’s global statement outlining Council’s rules and procedures concerning the collection, use, disclosure and storage of personal and/or health information of individuals gathered through all Council communication channels (hard copy forms, electronic forms and our website). 

    All points of collection and all outgoing correspondence that may request personal or health information must include a Collection Statement, advising the customer of the following:

  • Identity of organisation & team collecting information
  • Purposes for which the information is being collected
  • To whom the information will/may be disclosed to
  • Any law that requires the information to be collected
  • Main consequences if (all or some of) the information is not provided
  • Details on how to gain access to the information and how to contact organisation

Where lawful and practicable, Council will offer individuals the option of remaining anonymous when transacting with Council. However, as anonymity may limit Councils ability to process a complaint or another matter, Council reserves the right to take no action on any matter where an individual has chosen not to supply relevant personal information so that Council can adequately perform its functions.

The right to access or correct one’s personal and/or health information held by Council is available at all times. All requests for access or correction should be directed to the relevant area of Council in the first instance. The Freedom of Information/Privacy Officer is also available to assist with any queries of this nature.

Any notification of a suspected privacy breach or privacy complaint is taken seriously and immediately investigated by council’s Privacy Officer within 48 hours of reciept.

Alternatively, complaints can be made directly to the Office of the Victorian Information Commissioner (OVIC) in respect to personal information or to the Health Complaints Commissioner in respect to health information.

Policy Details

A practical description of Councils approach to organisationally relevant Information and Health Privacy Principles is outlined in the following section of this document.

For more information on the full set of  Information Privacy Principles refer to OVIC.

For more information on the full set of Health Privacy Principles refer to the Health Complaints Commissioners.

1.1 Collection, Use and Disclosure

Types of information collected

Depending on the reason, personal and/or health information collected by Council typically includes, but is not limited, to the following:

  • ·name
  • address (residential, postal and/or e-mail)
  • telephone number (work, home or mobile)
  • date of birth
  • signature
  • photography and/or video footage
  • health status or disability information

     

    Reasons for collection

    YRC will only collect personal and/or health information by lawful and fair means if it is necessary to fulfil one or more of its business functions, and where reasonable and practicable, collection will be from an individual directly. By means of demonstration, Council may collect personal and/or health information for the following business purposes:

  • To facilitate the collection of Council fees and charges. For instance, the Rates Team will use name and address details supplied through a letter of Acquisition to connect with owners regarding the payment of rates and waste charges.
  • To resolve service requests. For instance, Council or a contracted service provider may use name and address details supplied through a customer initiated service request to provide updates on the resolution of a request to grade a road or repair a pot hole.
  • To communicate regarding specific localised issues. For example, Development Services will use name & address details to consult with relevant neighbours about a Planning Permit.
  • To aid access and use of health services. For instance, birth notices are supplied by hospitals to Council in order to facilitate access to Maternal and Child health services who provide information and support to new parents and families.
  • To enable Council to undertake its law enforcement functions. For instance, Council collects information about customers from Vic Roads to process parking infringement notices.
  • To communicate and publicise Council initiatives and programs. For example, customers who have opted to be included on a mailing list for a Council publication via our public interfaces.

     

    Methods of collection

    Council will collect information only by lawful and fair means, and not in an unreasonably intrusive way. Council will provide notice of the collection of the information, outlining matters such as the purpose of collection and how individuals can access the information after submission. This will be achieved through the use of a Collection Notice.

    Council may collect personal and/or health information in the following ways:

  • During a conversation with a Council representative at a Service Centre or over the phone
  • From the Council website, social networking sites or sending a messages (SMS/MMS)
  • Council’s online payment portal i.e. rates, permits, animal registrations, fines & infringements
  • The completion of online or hard copy application form or survey.
  • From other third parties i.e. a referral from a community health services

     

    Use of personal and/or health information

    Personal information collected by Council can only be used for the primary purpose for which it was collected, or for a secondary purpose that would be reasonably expected. In accordance with the PDPA, personal information can also be used in other limited circumstances, such as with the individual's consent, for a law enforcement purpose, or to protect the safety of an individual or the public.

    Council may use health information about an individual for the primary purpose for which the information was collected or for a directly related and reasonably expected secondary purpose. Some exceptions exist. In any other circumstance Council will contact the individual in order to obtain consent (unless the use is required by law or permitted by the HRA).

    Where necessary, Council may disclose personal and/or health information to other business units within Council to assist in actioning an enquiry or providing a service.

    Council outsources some of its functions to contractors who perform services for and on behalf of the Council. All third party contracts include provisions to ensuring contractors are bound by the IPP’s & HPP’s in the same way and to the same extent as Council. To assist with compliance the contractor is alerted to our expectations as part of the procurement process and this privacy policy.

    Disclosure of personal and/or health information

    Council will disclose customer’s personal and/or health information with third parties under a limited set of circumstances, and often only in compliance with specific legislation. All disclosures to third parties will be recorded in writing by Council. These circumstances can include, but are not limited to:

  • debt collection agencies (for example, in the recovery of unpaid property rates or fines)
  • government agencies including the Department of Environment, Land, Water and Planning, Department of Human Services, Water Authorities, Victorian Workcover Authority and Vic Roads to enable them to advise you of works which may impact upon you or your property
  • law enforcement agencies, including the courts and the Victoria Police, in circumstances  where Council is required to assist in an emergency, respond to a subpoena or to assist with a police investigation.

1.2 Data – Quality, Security and Transfer

Data quality

In regard to data quality, Council will take all reasonable steps to make sure that the personal and/or health information it collects, uses or discloses is accurate, complete and up to date.

Customers are obligated to inform Council of any relevant changes to their personal and/or health information. Council will only accept advice of changes to personal and/or health information directly from the relevant individual or an appropriately authorised individual (i.e. power of attorney, health advocate). Council reserves the right to request proof of identity to make any changes or amendments to an individuals personal and/or health information.

Data Security & Data Governance

In regards to data security, Council will take all reasonable steps to protect the personal and/or health information it holds from misuse, loss and unauthorised access, modification or disclosure.

Yarra Ranges Council has developed an Information Services Standards and Procedures and Data Governance Framework to practically manage data and information within Council’s digital and non-digital environments.

These framework documents are applied to Council’s operations and outline what good information security and data governance looks like by establishing policies, rules and operational standards across Council.  These frameworks ensures all staff, Councillors, contractors and volunteers understand their roles and responsibilities.

The Information Services Standards and Procedures specifically provides guidance on the following:

  • Acceptable Use Standard
  • Access Control Standard
  • Anti-Virus Standard
  • Business Continuity
  • Cloud Computing Standard
  • Communication and Mobile Devices Standard
  • Computer Systems And Equipment Use Standard
  • Computers for Councillors Standard
  • Cyber Crime and Security Incident Standard
  • Email Standard
  • Encryption Standard
  • Firewall Management Standard
  • Hardware Management Standard
  • Internet Use Standard
  • Laptop And Tablet Security Standard
  • Legal Compliance Standard
  • Network Management Standard
  • Online Services Standard
  • Password And Authentication Standard
  • Personnel Management Standard
  • Physical Access Standard
  • Remote Access Standard
  • Software Management Standard
  • Special Access Standard

Data transfer

In regard to the transfer of personal and/or health information, Council may transfer personal and/or health information about an individual outside Victoria only in limited circumstances (some of which include):

  • if an individual has provided consent
  • if the disclosure is authorised by law
  • if the recipient of the information is subject to a law binding scheme or contract with similar principles as the PDPA.

 

In addition to hosting digital systems and information on in-house servers, Council also employs the use of cloud computing services to provide digital services and store Council information. The use of these external services falls within the PDPA’s definitions of data transfer.

Council will take all reasonable steps to ensure the confidentiality, integrity and availability of Council's information is maintained in accordance with the PDPA when services are delivered through a cloud computing environment. As the cloud can be private or public, local or international Council will ensure that all Cloud arrangements are supported by a Service agreement that will include specific arrangements regarding statutory and legislative obligations for data kept within these types of services.

1.3 Unique Identifiers and Anonymity

Unique Identifiers

A unique identifier is usually a number that is used for the purpose of identifying an individual. Uses of unique identifiers are only allowed where an organisation can demonstrate that the assignment is necessary to carry out its functions efficiently. There are also restrictions on how organisations can adopt unique identifiers assigned to individuals by other organisations. There are very limited uses of unique identifiers at YRC, for example under Local Law provisions unique identification numbers are assigned to registered animals.

In relation to health information, Council may only assign identifiers, such as client identification numbers, to individuals if this step is reasonably necessary for Council to provide health related services efficiently i.e. Maternal & Child Health client identification numbers in the Child Development Information System (CDIS).

Anonymity

As mentioned previously, where lawful and practicable, Council will offer individuals the option of remaining anonymous when transacting with Council. However, as anonymity may limit Councils ability to process a complaint or another matter, Council reserves the right to take no action on any matter where an individual has chosen not to supply relevant personal information so that Council can adequately perform its functions.

1.4 Sensitive Information

The PDPA places special restrictions on the collection of sensitive information. This includes racial or ethnic origin, political opinions or membership of political associations, religious or philosophical beliefs, membership of professional or trade associations or trade unions, sexual preferences or practices, and criminal record. Council can only collect sensitive information under certain circumstances and/or with a customers consent.

1.5 Transfer or closure of the practice of a health service provider

If a health service provided by Council is transferred to another agency or provider or is discontinued, Council must notify its current or former clients via a public notice. A public notice at the place of practice and letters to current clients are also required. Statutory regulations apply.

1.6 Making Information Available to Another Health Service Provider

Where Council acts as a health service provider, it will make health information relating to an individual available to another health service provider if requested to do so by an individual.

2. Storage & management of collected personal and/or health information

2.1. Storage of personal/health information in Corporate Systems

Yarra Ranges Council maintains several Corporate Systems to manage and maintain a wide variety of business activities. Many of these systems contain facilities to store and manage personal and/or health information in electronic formats.

The Public Records Act 1973 requires Victorian public agencies and public officers to 'make and keep full and accurate records' of their decisions & activities. Additionally, all agencies are obligated to ‘establish and maintain a records management program' in conformity with standards and codes of best practice as established by the Public Record Office of Victoria (PROV). These standards apply equally to paper and electronic record keeping environments. YRC operates a records management program based on the PROV standards.

The majority YRC’s corporate records are electronic and are stored within corporate systems which are maintained and managed in accordance with PROV Retention and Disposal authorities.

However, Council also maintains a large hardcopy legacy collection which contains personal and/or health information. Most of these records were created prior to councils amalgamation with Healesville, Upper Yarra, Lilydale and Sherbrooke shires in late 1994.

Some of the hardcopy files that Council holds which may contain personal and/or health information are:

  • Aged & Disability / Youth Files
  • Building Compliance Files
  • Building Permits Files
  • Contract Files – Procurement Files & Contract Administration Files
  • Food & Health Premises Files
  • Historical Property Files
  • Investigation Files
  • Planning Application Files
  • Property Files
  • Road Files
  • Septic Tank Files
  • Subdivision Files
  • Subject Files
  • Valuation & Rate Cards

Many of these hardcopy records are considered to be part of our active corporate information holdings and are regularly used by the organisation to provide ongoing services.

2.2 Retention & Disposal

In accordance with Section 12 of the Public Records Act 1973 and the associated Public Record Office Victoria Standard PROS 10/13, Yarra Ranges Council does carry out a bi-annual programme of archive disposal activity.  Both digital and hard copy records are routinely disposed of in accordance with this legislation and sometimes Council makes the decision to keep records for longer, to assist with business decisions.

As Yarra Ranges was formed in the 1990s from four historical Shires, we have substantial holdings from these former shires, which combined with our own archive, constitute a large slice of municipal history.  Our archive consists of around 22,000 boxes of legacy records and generally, hard copy records that are on permanent retention are routinely transferred to the Public Record Office Victoria in accordance with the legislation.  We also maintain an active electronic document and record management system, as well as use a number of core business system.

2.3 Change Management and Privacy Impact Assessments

When altering corporate systems or transactional processes that collect, use or store personal and/or health information, Council staff will consider and take appropriate action in regard to the implications of the change on Council’s compliance with this policy.

Depending on the extent of the change, staff may consider one or more of the following supporting steps:

  • engaging with relevant internal stakeholders as part of the change management process (e.g. the Privacy Officer for altering processes involving private information or Information Services for existing system changes).
  • ensuring Information Management and Digital & Data Transformation staff are involved in the procurement of new systems or upgrades to existing systems.
  • implementing training and operating procedures to support staff in implementing any changes to processes and procedures.

Where significant changes are being considered, as part of the endorsed Project Management methodology, staff should undertake a formal Privacy Impact Assessment, using the tools produced by OVIC. Their resources include a template for a Privacy Impact Assessment and are available on the OVIC website.

2.4 Training & Awareness

Upon joining YRC, all new staff are required to participate in a series of mandatory presentations and interactive activities designed to introduce new employees to our vision, strategy and organisational policies.  As part of the induction new staff must:

  • agree to abide by the Code of Conduct by completing an online learning module
  • complete an online module specifically focussing on information privacy.

As of January 2020, refresher training in Information Privacy is required for all staff every 2 years.

The Privacy Officers also offer project or work-area specific privacy training and advice to teams within Council, on request.

3. Access and correction of personal and/or health information

3.1 Access

Upon request to the relevant business unit or to the Privacy Officer, Council will take all reasonable steps to let a person know what sort of personal information Council collects, holds, uses and discloses about them. There are a number of exemptions as to why access may be denied and council shall provide reason in writing for the denial. Council has up to 45 days from the date it receives a valid request to provide an individual with a decision regarding access.

3.2 Correction

Individuals wishing to effect simple corrections to a document sourced from council can contact the relevant business unit directly or to speak with the Privacy Officer to resolve their concern informally.

For more complex corrections, Section 39 of the Freedom of Information Act 1982 (FOI Act) allows for an individual to request a correction and/or amendment to a document sourced from council which contains personal information they believe to be inaccurate, incomplete, out of date; or would give a misleading impression.

An amendment cannot have the effect of deleting or expunging the original information recorded in a document. Generally, this means the amendment will be an addition or notation on the document.

Individuals can also make an amendment request if they are the next of kin of a deceased person and they are seeking an amendment to that individual’s information.

There are no fees or charges associated with making a request under section 39 of the FOI Act.

Council has up to 45 days from the date it received a valid request to provide an individual with a decision regarding the amendment request.

Making a correction/amendment request

Section 40 of the FOI Act states a request for an amendment must:

  • be in writing;
  • provide an address where a decision can be sent;
  • specify how the information is inaccurate, incomplete, out of date or misleading; and
  • specify the amendments you are requesting.

Requests for amendment should be addressed to the Privacy Officer:

Mail: Yarra Ranges Council - PO Box 105 LILYDALE VIC 3140

Email: mail@yarraranges.vic.gov.au

Complaints and/or breach notifications may be directed to the Privacy Officer. These will be acknowledged within two business days and will be resolved as soon as practicable.

The complaint must be received within six months from the time the complainant first became aware of the transgression and details of the disclosure will be kept confidential at all times.

Internally, upon becoming aware of a breach or potential breach of the IPPs or HPPs, Council staff are required to notify their direct supervisor without delay. Upon confirming that a breach has occurred, the direct supervisor shall notify both the relevant Director and Council’s Privacy Officer.

Contact details are as follows:

Privacy Officer

Mail: Yarra Ranges Council - PO Box 105 LILYDALE VIC 3140

Email: mail@yarraranges.vic.gov.au

Phone: 1300 368 333

Alternatively, members of the public may wish to report a privacy breach or a privacy complaint to the Office of the Victorian Information Commissioner, the independent regulator with combined oversight of information access, information privacy, and data protection:

Office of the Victorian Information Commissioner

Phone: 1300 006 842

Email: enquiries@ovic.vic.gov.au

Website: https://ovic.vic.gov.au/

The Health Complaints Commissioner is a independent and impartial statutory body that supports safe and ethical healthcare in Victoria, can address complaints about how Council manages access, privacy and confidentiality issues related to personal health information. They can be contacted as follows:

Health Complaints Commissioner

Phone: 1300 582 113

Online form: https://hcc.vic.gov.au/make-complaint

Website: https://hcc.vic.gov.au/

It should be noted that the respective Commissioners may decline to hear the complaint, if you have not first approached Council to discuss and/or resolve the issue.