Personal information is any recorded information or opinion about an individual where their identity is apparent or reasonably ascertainable from the information or opinion concerned.
We manage personal and health information in accordance with the privacy principles contained in the:
- Privacy and Data Protection Act 2014
- Health Records Act 2001
- other relevant laws.
Sensitive information
Sensitive information is a special category of personal information.
It's defined as information or an opinion about certain sensitive aspects relating to individuals, such as their:
- criminal record
- racial or ethnic origin
- political opinions or membership of political association
- religious or philosophical beliefs or affiliations
- membership of professional or trade associations or unions
- sexual preferences or practices.
Collection, use and disclosure of personal information
Generally, we collect personal information directly from the individual.
Personal or health information may be collected from third parties, such as:
- corporate applicants or authorised representatives with some connection to or association with the individual
- treating doctors / medical professionals.
We take reasonable steps to ensure the individual knows:
- why we collect the personal information
- what is done with it
- to whom it is disclosed.
We may be required to collect some sensitive information. We always obtain the consent of the individual concerned before requesting a police check, unless required under investigation or enforcement action.
Collection
We collect an individual’s personal or health information only where it is necessary for our functions or activities, and only by lawful and fair means that are not unreasonably intrusive.
We may collect personal information for:
- recruitment, employment and human resource management functions
- licensing functions
- compliance and enforcement functions
- analysis, education and reform functions
- reviews and inquiries functions
- reporting functions
- managing complaints
- responding to enquiries and correspondence from members of the public
- fulfilling any other of our purposes, objectives or functions under the law.
The common scenarios in which we may collect personal information include:
- when you establish an account or register to access and use our website / online services
- when we receive application forms and supporting documents
- when we receive information, or invite submissions, from stakeholders or members of the public
- when we receive information from another agency or department under an information sharing arrangement and/or a memorandum of understanding
- when individuals subscribe to our email alerts
- when individuals or stakeholders correspond with us, including by email, mail, telephone or through our website or social media channels.
Use and Disclosure
We use or disclose the personal information we collect only:
- for the purpose for which it was collected
- for a purpose other than the one for which the information was collected, if the information is relevant to the exercise of another function or power (and there is no prohibition on its use for that function or power)
- for a related purpose that an individual would expect their personal information to be used for in the circumstances
- with the consent of the individual concerned, for some other agreed purpose
- for law enforcement purposes
- as otherwise required or authorised by law.
Anonymity
Where lawful and practicable, individuals should have the option of transacting or interacting with us without identifying themselves.
Many of the things we do require you to provide us with your personal information. However, where it doesn't affect the proper performance of our functions, we won't require you to provide it.
Transborder data flows
If an individual’s personal information travels outside Victoria, the privacy protection should travel with it.
We only transfer personal information to someone else outside Victoria in the circumstances permitted by privacy legislation. For example, if the individual consents, or if the recipient of the personal information is subject to a law or binding scheme that is substantially similar to the Victorian privacy protections.
Storing personal information
We take reasonable steps to ensure the personal and health information we collect is:
- accurate
- complete
- up-to-date.
We hold personal and health information in both electronic and paper-based forms. We have various security measures and processes in place to protect the information from:
- misuse
- loss
- unauthorised access
- modification
- disclosure.
Processes include:
- secure computer access levels to ensure only authorised staff have access to certain kinds of computer-stored information
- use of computer passwords to ensure only authorised personnel have access to computer files
- use of virus protection software
- storage of paper-based documents containing personal information in locked cabinets or rooms or other secured areas accessible only by authorised personnel
- providing physical security to limit access to our offices to authorised personnel only.
Your rights to access or correct personal records
You may request a copy of your personal information. You may also request to correct that information if it's found to be inaccurate. You are able to request access to and correct your personal information by contacting us directly at contact@vgccc.vic.gov.au.
Freedom of information requests
However, there are situations where it won't be appropriate to provide direct access to information, and you'll be required to make a Freedom of Information application. A fee may apply for such an application.
If you're an existing or former employee of ours or our predecessors, you may access information relating to your employment by written request without making a formal request.
For more information, refer to Accessing data on the Office of the Victorian Information Commissioner website.
Privacy queries and complaints
You can email privacy@vgccc.vic.gov.au if you have:
- a query about our policies for handling personal information, including any sensitive or health information
- a complaint about how we handle your personal information.
If your complaint isn't resolved to your satisfaction, or within a reasonable time, you can request a review by writing to the Chief Executive Officer at contact@vgccc.vic.gov.au.
Under the Privacy and Data Protection Act 2014, you can complain to the Office of the Victorian Information Commissioner about an act or practice that may be an interference with your privacy. The Commissioner may decline to consider a complaint if you haven't made a complaint to us first.
If your complaint relates to health information held by us, and you feel we haven't adequately dealt with your complaint through our internal procedures, you can contact the Health Complaints Commissioner.
Updated