PRIVACY STATEMENTS - This guide will be hidden but feel free to delete once completed.
This information was provided by our legal services officer Sep 2023.
Information Privacy Principle 3 of the Privacy Act says that when an organisation, business or agency collects information from an individual, it should ensure that the individual is informed about what information is being collected and the purpose it is to be used for.
A privacy statement is provided to an individual at or before the time an organisation collects personal information from them (or if that is not practical, as soon as possible after the information is collected). It explains to individuals the purpose for which the information is collected, and how the organisation will use and handle the information.
In addition to being a requirement under the Privacy Act, privacy statements are important because they promote transparency about the collection and handling of personal information, and ensure individuals are aware of their rights and obligations in relation to giving up (and later accessing) their information.
Privacy policies v privacy statements
Although they both inform individuals about how we will manage their personal information, privacy policies and privacy statements are different.
A privacy policy speaks about our information management practices in a broad sense, whereas a privacy statement outlines our information handling practices for a specific purpose or activity.
A privacy statement should include:
that we’re collecting information about them (if it's not obvious)
the purpose of collection
who we’re going to give it to (if anyone);
whether the person has to give us the information and what will happen if they don't;
that they can access the information we hold about them and correct it if it's wrong.
The purpose of collection
The purposes of collecting the information should be clearly stated and be specific, rather than explained in a general reference to a broad power such as ‘licensing’ or ‘for the performance of our functions’. In some situations, there may be several purposes of collection. We should try to list all the known purposes for which we are collecting that personal information from individuals to ensure that we are able to use the information as intended.
Individuals are more likely to accept related uses or disclosures of their personal information when we are upfront about how we will use the information we are collecting.
Who we’re going to give it to (if anyone)
We are required to ensure that individuals are made aware of who their information is likely to be shared with. Where the information is usually shared for specific purposes, the statement should refer to these. If personal information is collected with the intention of publication or dissemination (such as online or in a publicly available document), this should also be made explicitly clear at the time of collection.
Whether the person has to give us the information
Where we have the power to compulsorily obtain information, this should be made clear. The privacy statement should state which law is being relied upon as the basis for collection, as this makes our authority clear and allows an individual to verify the legal basis for collection.
What will happen if they don't…
We are required to provide notice of the consequences for individuals if they choose not to provide all or part of the personal information requested. For instance, we may not be able to provide a full range of services if certain information is not provided.
Where an individual has the option to not give certain details (such as an email address, phone number or even name), this should be made clear. There may be instances where an individual does not wish to participate or take advantage of all of our activities, and so may prefer to withhold certain information.
When should we provide a privacy statement?
A privacy statement should be provided to an individual each time we collect personal information from them. When collecting personal information in connection with different functions or activities, we need to provide more than one privacy statement. This is because the purposes for collection, the type of information collected, and the way in which the information is used and disclosed may differ with each activity. For example, information collected when receiving a complaint will be handled differently from information collected as part of a recruitment process.
Layering privacy statements
Information required under IPP 3 can be provided in layers, from a full explanation to a brief notice. Brief privacy statements on forms or signs can be supplemented by longer statements made available online or in brochures. For example, where CCTV surveillance is being conducted, the sign might identify that we are conducting surveillance, briefly explain why there is surveillance and provide a website where individuals can find more complete details about IPP 3 matters.
The template below is NOT HIDDEN! Please update with relevant information for your form.