Privacy

The Rundle Mall team is a semi-autonomous body of the City of Adelaide.

The City of Adelaide (“the Council”) is committed to maintaining a culture that respects each individual’s right to privacy.

The Council will not collect personal information unless:

• The personal information is collected for a lawful purpose directly related to a legislative function or power of the Council or Council business operations;
• Collection of the personal information is necessary for or directly related to that purpose; and
• Explicit permission has been given by the person whose personal information is being collected.

The personal information that may be collected will depend on the particular purpose for which it is collected, and may include but is not limited to:

• Telephone numbers;
• Name and addresses (postal, residential and e-mail addresses);
• Age and/or date of birth;
• Property ownership and/or occupier details;
• Details of resident’s/ratepayer’s spouse or partner;
• Development applications, including plans or specifications of buildings;
• Pet ownership;
• Electoral roll details;
• Pensioner / concession information;
• Payment history;
• Financial, rental or income details;
• Details of land valuation;
• Preferred addresses and methods of contacts;
• Details of employment; and
• Insurance details.

All personal information that is collected by Council will be collected in a fair and lawful manner.

The Council will take reasonable steps to inform the person whose personal information it collects:

• Of the purpose(s) for which the personal information is being collected;
• If the collection of the information is authorised or required by law, that the collection is so authorised or required; and
• In general terms, of its usual practices with respect to the use and disclosure of personal information of the kind collected.

The Council will take reasonable steps to ensure that personal information collected by it is relevant to the purpose(s) of collection and is up to date and complete.

The Council will take reasonable steps to ensure that the collection of personal information by it does not unreasonably intrude upon an individual’s personal affairs.

The Council may collect information concerning persons from a number of private and public sector agencies, which may include, but is not limited to Transport SA, the State Electoral Office, Office of the Valuer General, SA Water, Telstra and from individual persons.

The Council will not collect sensitive information about an individual unless:

• The individual has consented;
• The collection is required by law;
• The collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any person; or
• The collection is necessary for the establishment, exercise or defence of a legal or equitable claim.

If the Council collects sensitive information about an individual in accordance with the provisions of this Policy, the Council will take reasonable steps to de-identify the information before the Council discloses it.

The Council may disclose some personal information to an offshore third party cloud computing services provider. In this event, Council will take adequate and reasonable steps to assure appropriate data security.

The Council will take reasonable steps to:

• Protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure; and
• Maintain its record keeping systems to ensure that all personal information collected is up to date, accurate and complete as far as reasonably practicable; and
• Ensure that any person who, on behalf of the Council, uses or discloses personal information held by the Council has appropriate authorisation to do so.

In the event of a data breach involving Tax File Number (TFN) information, Council will take the following steps:

• Contain the data breach;
• Within 30 days of the event, assess if the data breach is an eligible data breach;
• Take remedial action to prevent the unauthorised access or disclose of TFN information;
• Notify the Australian Information Commissioner and affected individuals where there is an eligible data breach; and
• Review the incident, report to other relevant bodies and take preventative action to ensure that a similar incident does not occur again.

Where the Council collects personal information for a particular purpose (the primary purpose), it will not use that personal information for any other purpose (secondary purpose), unless:

• The Council first takes reasonable steps to obtain the consent of the individual concerned to use his or her personal information for that secondary purpose; or
• The individual would reasonably expect the Council to use or disclose the information for the secondary purpose and the secondary purpose is directly (for sensitive information) or indirectly related (for any other information) to the primary purpose; or
• The Council believes on reasonable grounds that use of the information for that secondary purpose is necessary to prevent or lessen a serious or imminent threat to the life or health of the individual concerned or another person; or
• Use of the information for that secondary purpose is required or authorised by law; or
• Use of the information for that secondary purpose is reasonably necessary for the enforcement of the criminal law or of law imposing a pecuniary penalty.

Direct Marketing:

• Reasonable expectation to use or disclose: If Council holds personal non-sensitive information about an individual, it must not use or disclose the information for the purpose of direct marketing except when Council has collected the information from the individual and the individual would reasonably expect Council to use or disclose the information for that purpose (except for sensitive information)

• No reasonable expectation to use: In the event that the individual would not reasonably expect Council to use or disclose non-sensitive information for direct marketing, the individual needs to have given consent to the use or disclosure of the information for direct marketing
• Council must provide a simple means by which the individual may easily request not to receive direct marketing communications from Council
• Council will only use or disclose sensitive information about an individual for direct marketing purposes if the individual has consented to the use or disclosure of the information for that purpose

The Council will not disclose personal information it holds about a person to a third party, except where:

• A reasonable individual is likely to have been aware that his or her personal information would be disclosed in that way;
• The resident or ratepayer has consented to or made a written request for personal information to be provided to a third party;
• The personal information is provided for the purpose of distributing materials of and on behalf of the Council (for example: the provision of address data for use by a mailing service provider to post Rates Notices or other materials);
• The third party has been contracted by the Council to provide advice or services for the purpose of assisting the Council in providing benefits to persons (for example: State Electoral Office, Office of the Valuer General, insurers, legal service providers);
• The Council is required or authorised by law to disclose the personal information to a third party or to the public at large (for example, under the Freedom of Information Act);
• The resident or ratepayer has been advised of the Council’s usual practice of disclosing personal information to that third party or a third party of that type for a particular purpose and the disclosure is consistent with that purpose; or
• A public consultation submission has been received by Council. To enable transparency in consultation processes to occur, all public consultation submissions received by Council will become public documents and may be included in a report to Council which is also available to the public.

Where personal information is provided to the Council by a person “in confidence”, the Council will not disclose such information to a third party without the person’s consent, unless such disclosure is required or authorised by law (for example, applications made under the Freedom of Information Act).

The Council will take reasonable steps to:

• Contract only with third party service providers that are subject to the provisions of the Privacy Act and the Australian Privacy Principles; and
• Where the third party service provider is not subject to the provisions of the Privacy Act and the Australian Privacy Principles, enter into a Privacy Agreement that requires the third party service provider to comply with the provisions of this Policy relating to the collection, use, storage and disclosure of personal information supplied by the Council.

The Council may supply personal information about an individual to that individual as part of a standard communication or pursuant to a request made by the individual.

The Council does not accept any responsibility for any loss or damage suffered by a person because of their reliance on any personal information provided to them by the Council or because of the Council's inability to provide persons with any requested personal information.

The Council expects that persons will, before relying on any personal information the Council provides to them, first seek confirmation from the Council about the accuracy and currency of such personal information.

The Council assumes that personal information provided by persons or other persons is accurate, complete and up-to-date. It is the responsibility of persons to provide the Council with details of any changes to their personal information as soon as reasonably practicable following such change.

The Council will take reasonable steps, such as making appropriate deletions, additions and corrections, to ensure that personal information held by it is accurate, relevant, complete, up to date and not misleading.

A person may apply to the Council, in a form determined by the Council, to have his or her personal information amended so that it is accurate, relevant, complete, up-to-date and not misleading. Where the Council, on reasonable grounds, decides not to amend a resident’s or ratepayer’s personal information in the manner requested in the application, the Council will inform the person of its decision and the reasons for refusing to make the requested amendments. If requested by a resident or ratepayer, the Council will take reasonable steps to attach to a record containing that person’s personal information a statement provided by that person of the correction, deletion or addition sought.

A person who wishes to access personal information held by the Council must make a written application to the Freedom of Information Officer. An applicant will be required to pay an application fee as determined by the Freedom of Information Act 1991.

Subject to the provisions of this legislation, the Council may grant or refuse access to personal information as it deems fit.

The Council recognises that there are certain documents, which may contain personal information, that the Council is legislatively required to make available for access by members of the public.

An application to access personal information will be dealt with within 30 days of receipt of the request. In certain circumstances, an applicant may be required to satisfy Council staff as to his or her identity.

A person’s name or address may be suppressed from the Council’s Assessment Record and Voters Roll where the Chief Executive Officer is satisfied that inclusion of the name or address on the Assessment Record and/or Voters Roll would place at risk the personal safety of that person, a member of that person’s family, or any other person.

Enquiries regarding suppression of personal information should be directed to Customer Services staff at the Customer Service Centre in the first instance.

Personal information may be released to others if requested under the Freedom of Information Act, however, in accordance with this Act, a person will be consulted to obtain their opinion on release of the information. Should it be determined the information will be released against the view of the person, they have the right to request a review of the decision, on payment of the prescribed fee, prior to the information being released.

A person who has any concerns regarding how the Council handles personal information or requires further information can contact the Customer Services staff at the Customer Service Centre in the first instance.

If the person’s concerns cannot be satisfied, the person may lodge a formal complaint, under the Corporate Complaint Handling Guideline.

Throughout this information, the below terms have been used and are defined as:

Access means providing to an individual, information about himself or herself that is held by the Council. This may include allowing that individual to inspect personal information or to obtain a copy.

Collection means gathering, acquiring or obtaining personal information from any source and by any means, including information that the Council has come across by accident or has not asked for.

Consent means voluntary agreement to some act, practice or purpose.

Disclosure means the release of information to persons or organisations outside the Council. It does not include giving individuals information about themselves.

Eligible Data Breach An eligible data breach for Council is when the unauthorised access, disclosure or loss of TFN information is likely to result in serious harm to one or more individuals.

Notifiable Data Breach Scheme (NDB) Councils are subject to the NDB Scheme under the Privacy Act 1988 to the extent that TFN information is involved in an eligible data breach.

Personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about a natural living person whose identity is apparent, or can reasonably be ascertained, from the information or opinion, including a photograph or other pictorial representation of a person, but does not include information that is in:

• Generally available publications;
• Material kept in public records and archives such as the Commonwealth or State archives; or
• Anything kept in a library, art gallery or museum for the purpose of reference, study or exhibition.

Sensitive information means information or an opinion about an individual’s:

• Racial or ethnic origin;
• Political opinions;
• Membership of a political association, a professional or trade association or a trade union;
• Religious beliefs or affirmations;
• Philosophical beliefs;
• Sexual preferences or practices;
• Criminal record; or
• Health.

(a) The personal information is collected for a lawful purpose directly related to a legislative function or power of the Council;

(b) Collection of the personal information is necessary for or directly related to that purpose; and

(c) Explicit permission has been given by the person whose personal information is being collected.

The personal information that may be collected will depend on the particular purpose for which it is collected, and may include but is not limited to:

• Telephone numbers;
• Name and addresses (postal, residential and e-mail addresses);
• Age and/or date of birth;
• Property ownership and/or occupier details;
• Details of resident’s/ratepayer’s spouse or partner;
• Development applications, including plans or specifications of buildings;
• Pet ownership;
• Electoral roll details;
• Pensioner / concession information;
• Payment history;
• Financial, rental or income details;
• Details of land valuation;
• Preferred addresses and methods of contact(s);
• Details of employment; and
• Insurance details.

All personal information that the Council is legislatively required or permitted to collect will be collected in a fair and lawful manner.

All personal information that is collected by Council for the purposes of research will be treated according to the Market and Social Research Privacy Principles.

The Council will take reasonable steps to inform persons whose personal information it collects:

(a) Of the purpose(s) for which the personal information is being collected;

(b) If the collection of the information is authorised or required by law, that the collection is so authorised or required; and

(c) In general terms, of its usual practices with respect to the use and disclosure of personal information of the kind collected.

The Council will take reasonable steps to ensure that personal information collected by it, is relevant to the purpose(s) of collection and is up to date and complete.

The Council will take reasonable steps to ensure that the collection of personal information by it does not unreasonably intrude upon an individual’s personal affairs.

The Council may collect information concerning persons from a number of private and public sector agencies, which may include, but is not limited to Transport SA, the State Electoral Office, Office of the Valuer General, SA Water, Telstra and from individual persons.

Maintenance and Storage of Personal information

The Council will take reasonable steps to:

(a) Protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure; and

(b) Maintain its record keeping systems to ensure that all personal information collected is up to date, accurate and complete; and

(c) Ensure that any person who, on behalf of the Council, uses or discloses personal information held by the Council has appropriate authorisation to do so.

Use of Personal Information

Where the Council collects personal information for a particular purpose, it will not use that personal information for any other purpose, unless:

(a) The Council first takes reasonable steps to obtain the consent of the individual concerned to use his or her personal information for that other purpose; or

(b) The Council believes on reasonable grounds that use of the information for that other purpose is necessary to prevent or lessen a serious or imminent threat to the life or health of the individual concerned or another person; or

(c) Use of the information for that other purpose is required or authorised by law; or

(d) Use of the information for that other purpose is reasonably necessary for the enforcement of the criminal law or of law imposing a pecuniary penalty; or

(e) The purpose for which the personal information is used is directly related to the purpose for which it was collected.

Disclosure of Personal Information

The Council will not disclose personal information it holds about a person to a third party, except where:

(a) A reasonable individual is likely to have been aware that his or her personal information would be disclosed in that way;

(b) The resident or ratepayer has consented to or made a written request for personal information to be provided to a third party;

(c) The personal information is provided for the purpose of distributing materials of and on behalf of the Council (for example: the provision of address data for use by a mailing service provider to post Rates Notices or other materials);

(d) The third party has been contracted by the Council to provide advice or services for the purpose of assisting the Council in providing benefits to persons (for example: State Electoral Office, Office of the Valuer General, insurers, legal service providers);

(e) The Council is required or authorised by law to disclose the personal information to a third party or to the public at large (for example, under the Freedom of Information Act);

(f) The resident or ratepayer has been advised of the Council’s usual practice of disclosing personal information to that third party or a third party of that type for a particular purpose and the disclosure is consistent with that purpose; or

(g) A public consultation submission has been received by Council. To enable transparency in consultation processes to occur, all public consultation submissions received by Council will become public documents and may be included in a report to Council which is also available to the public.

Where personal information is provided to the Council by a person “in confidence”, the Council will not disclose such information to a third party without the person’s consent, unless such disclosure is required or authorised by law (for example, applications made under the Freedom of Information Act).

The Council will take reasonable steps to:

(a) Contract only with third party service providers that are subject to the provisions of the Privacy Act and the National Privacy Principles; and

(b) Where the third party service provider is not subject to the provisions of the Privacy Act and the National Privacy Principles, enter into a Privacy Agreement that requires the third party service provider to comply with the provisions of this Policy relating to the collection, use, storage and disclosure of personal information supplied by the Council.

The Council may supply personal information about an individual to that individual as part of a standard communication or pursuant to a request made by the individual.

The Council does not accept any responsibility for any loss or damage suffered by a person because of their reliance on any personal information provided to them by the Council or because of the Council's inability to provide persons with any requested personal information.

The Council expects that persons will, before relying on any personal information the Council provides to them, first seek confirmation from the Council about the accuracy and currency of such personal information.

Alteration of Personal Information

The Council assumes that personal information provided by persons or other persons is accurate, complete and up-to-date. It is the responsibility of persons to provide the Council with details of any changes to their personal information as soon as reasonably practicable following such change.

The Council will take reasonable steps, such as making appropriate deletions, additions and corrections, to ensure that personal information held by it is accurate, relevant, complete, up to date and not misleading.

A person may apply to the Council, in a form determined by the Council, to have his or her personal information amended so that it is accurate, relevant, complete, up-to-date and not misleading. Where the Council, on reasonable grounds, decides not to amend a resident’s or ratepayer’s personal information in the manner requested in the application, the Council will inform the person of its decision and the reasons for refusing to make the requested amendments. If requested by a resident or ratepayer, the Council will take reasonable steps to attach to a record containing that person’s personal information a statement provided by that person of the correction, deletion or addition sought.

Access to Personal Information

A person who wishes to access personal information held by the Council must make a written application to the Freedom of Information Officer. An applicant will be required to pay an application fee as determined by the Freedom of Information Act 1991.

Subject to the provisions of this legislation, the Council may grant or refuse access to personal information at its discretion.

The Council recognises that there are certain documents, which may contain personal information, that the Council is legislatively required to make available for access by members of the public.

An application to access personal information will be dealt with within 30 days of receipt of the request. In certain circumstances, an applicant may be required to satisfy Council staff as to his or her identity.

Suppression of Personal Information

A person’s name or address may be suppressed from the Council’s Assessment Record and Voters Roll where the Chief Executive Officer is satisfied that inclusion of the name or address on the Assessment Record and/or Voters Roll would place at risk the personal safety of that person, a member of that person’s family, or any other person.

Enquiries regarding suppression of personal information should be directed to Customer Service staff at the Customer Service Centre in the first instance.

Sensitive Information

The Council will not collect sensitive information about an individual unless:

(a) The individual has consented;

(b) The collection is required by law;

(c) The collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any person; or

(d) The collection is necessary for the establishment, exercise or defence of a legal or equitable claim.

If the Council collects sensitive information about an individual in accordance with the provisions of this Policy, the Council will take reasonable steps to de-identify the information before the Council discloses it.

Complaints

A person who has any concerns regarding how the Council handles personal information or requires further information should contact the Customer Services staff at the Customer Service Centre in the first instance.

If the person’s concerns can not be satisfied, the person may lodge a formal complaint, under the Corporate Complaint Handling Policy & Procedures or the Grievance Policy & Procedure

Further Information

For further information on the Adelaide City Council Privacy Policy, please contact the Manager, Corporate Governance via the following contact details:

Customer Service Centre
25 Pirie Street
Adelaide SA 5000
Telephone: (08) 8203 7203

Freedom of Information requests should be addressed to:

Freedom of Information Officer
City of Adelaide
GPO Box 2252
ADELAIDE SA 5001