Meaning of acronyms used in this document:
ACECQA: Australian Children’s Education & Care Quality Authority
APPs: Australian Privacy Principles
ECS Agencies: ACECQA and each of the State and Territory Education and Care Regulatory Authorities
ECS Commissioner(s): Either one, or all, of the Education and Care Services Ombudsman, the National Education and Care Freedom of Information Commissionerand the National Education and Care Privacy Commissioner.
FOI: Freedom of Information
This policy outlines the personal information handling practices of the office of the National Education and Care Services Ombudsman, Privacy, and Freedom of Information Commissioners – the ECS Commissioners. The ECS Commissioners are independent statutory officers appointed collectively by all Commonwealth, State and Territory education minsters.
We collect, hold, use and disclose personal information to carry out our work under the Education and Care Services National Law (the National Law) and associated Education and Care Services National Regulations, the Ombudsman Act 1976 (Cth), the Privacy Act 1988 (Cth) and the Freedom of Information Act 1982 (Cth). In handling personal information, we choose to act consistently with the requirements of the Australian Privacy Principles (found at Schedule 1 of the Privacy Act 1988).
Our role is to provide ombudsman, privacy, and freedom of information oversight of the national early childhood education and care regulation scheme – the National Quality Framework – in relation to the actions of the Australian Children’s Education and Care Quality Authority (ACECQA) and the state and territory early childhood education and care Regulatory Authorities – the ECS agencies.
Our services are free and independent. We investigate complaints about how the ECS agencies have handled your personal information or how they have executed their freedom of information or privacyresponsibilities. We conduct reviews of freedom of information decisions made by the ECS agencies and we investigate complaints about the administrative actions of ACECQA.
What is personal information?
Personal information is broadly defined under the Privacy Act 1988. It is information or an opinion about you that identifies you or would enable your identity to be reasonably discovered. The information does not have to be true or recorded in a material form to be classified as personal information.
Some examples of personal information we collect about you as we carry out our functions may include, but are not limited to, your name, email and postal addresses, telephone numbers, employment details, and commentary or opinion about you – even if that commentary or opinion is not correct.
Collection of your personal information
We try to only collect personal information about you if we need it to carry out our functions. Personal information may be collected by us through electronic enquiry and complaint forms on our website, in writing by mail or email, through telephone and teleconferencing conversations, and in face-to-face meetings. Personal information that we collect is used by us only for the purposes for which it was provided and for directly related purposes (unless otherwise required by or authorized under law).
Direct collection – information you give to us
The main way we collect your personal information is when you give it to us. For example, we collect initial personal information such as your name and contact details, when you:
- contact us for information – but only if we need it to assist you
- make a complaint about the way an ECS agency has handled your FOI request or when you seek a review of an FOI decision made by an ECS agency
- make a complaint about how an ECS agency has handled your personal information
- notify us of a privacy data breach by an ECS agency
- make a complaint about how ACECQA has carried out its functions
- report a matter for investigation.
We may also collect personal information from you or others when we initiate an investigation or review a privacy or FOI matter.
When we handle a complaint or undertake a review or an investigation, we may also receive or collect personal information about you from publicly available sources – such as social or other media – or from third parties such as applicants, complainants, respondents or witnesses in a complaint or investigation, or an authorised representative you may have.
We have broad discretion and powers about how we conduct investigations or reviews including powers to require others to provide information to us.
Unsolicited personal information
At times we may receive unsolicited personal information about you as we carry out our functions. Such information may be related to a matter we are investigating or reviewing, or it may be irrelevant to it. If the information is irrelevant, we will destroy it. If it is relevant to the matter we are dealing with, we willassess whether we would be permitted under the APPs to collect this same information about you andwhether we could have collected it when carrying out our functions. If we determine we could have collected the information we will retain it; otherwise, if it is lawful and reasonable to do so, we will destroy the information or ensure that it is de-identified.
If we receive unsolicited personal information about you, we will endeavor to tell you if it is reasonable to do so.
Information collected through email and our website
Your email address may be recorded on our servers if you send a message to us. Our electronic forms on our website enable you to lodge an enquiry, make a complaint about how an ECS agency undertakes its privacy and FOI responsibilities, notify a privacy data breach, or request a review of an FOI decision made by an ECS agency.
When you complete an electronic form on our website it is emailed directly to the ECS Commissioners. The emailed form does not include your email address unless you have included it within the form itself. The forms are also stored securely in an encrypted database on the website for a short period of time.
In very limited circumstances our IT technicians may be able to view your personal information where there is a technical issue that requires investigation. In these cases, our IT supplier must ask our permission.
Our public website ‘necsopic.edu.au’ is hosted in Australia. Google Analytics is used on thewebsite to collect and store data about your interaction with the site anonymously for statistical purposesand to help us to improve our services. The type of data collected may include your device’s IP addressand type, the date and time of your visit, your broad geographic location, and the pages visited. This data does not identify you.
No attempt will be made to identify users of the website except where a law enforcement agency exercises a legal authority to inspect Internet Service Provider logs.
Our website may also contain links to other websites of relevance to our users. While we take reasonable care when deciding to provide a link to another site, we are not responsible for the privacy compliance or the content of these other websites.
Anonymity and Confidentiality
You may seek to engage with us anonymously or use a pseudonym, or you may request that your complaint remains confidential. If you do want to make an anonymous or confidential complaint, we ask that you contact us by phone to discuss the matter. This will enable us to discuss with you any limitations there may be in dealing with your complaint in this way.
For most of our functions we usually need your name and contact details and sufficient information about the matter you are raising to enable us to deal with it effectively and fairly. We may be able to ensure that only limited information is disclosed to the ECS agency that is the subject of your complaint. However, in some circumstances it is possible we could be compelled by law to share information about a confidential complaint – for example if the matter is the subject of a legal proceeding.
Where appropriate and practicable we will de-identify your information. However, in some instances this will not be possible. For example, if you have requested a review of a FOI decision made by an ECS agency, requested a review of ACECQA’s decision on the assessment of your qualifications, or made a complaint about an agency’s disclosure of your personal information, your identity will need to be revealed to the relevant agency.
Use of your personal information
Consistent with the APP 6 we use and disclose your personal information for the reasons it was collected (the primary purpose). We cannot use or disclose your personal information for another reason (a secondary purpose) unless an exemption applies. Exemptions include:
- you consent to the use or disclosure of your personal information for a secondary purpose, or
- the use or disclosure of the information is required or authorised by, or under, an Australian law or a court/tribunal order, or
- we reasonably believe it is necessary for enforcement-related activities carried out by or on behalf of an enforcement body.
Disclosure of your personal information
Unless prevented by law, and it is reasonable and practicable to do so, we will discuss how and why we may need to disclose your personal information with you before we do so. If you do not want your information to be disclosed, you will need to tell us as this may affect how we handle your matter.
We will likely need to disclose at least some of your personal information when assessing your complaint or conducting a review or investigation. We will usually disclose the information you give us, including details of your complaint, to the ECS agency you have complained about. We may also need to disclose your information to others who have information relevant to your complaint.
We may need to disclose the information you give us to third parties involved in your matter, for example an affected third party in an FOI Review. In these instances, we will discuss the disclosure of the information first and where appropriate and practicable we can remove your identifying details.
Review of ECS Commissioners’ decisions
We may disclose personal information to another review body such as a court or administrative tribunal if a complainant, applicant, or respondent seeks a review of our decision.
Publication and reports
If you are a party to a matter considered by the ECS Commissioners we generally do not disclose your personal information when we publish decisions, determinations, or reports unless you request it be disclosed or it is fair and reasonable in the circumstances to do so. FOI Commissioner Review Decisions are published on our website.
We do not disclose personal information to the media.
Disclosure of personal information to overseas recipients
It is possible that your personal information may need to be disclosed to overseas recipients when the ECS Commissioners are undertaking a review or investigation. For example, a review by the ECS Ombudsman of ACECQA’s handling of an assessment of your early childhood education qualifications might result in questions being raised with offshore education institutions. Any such disclosure would be discussed with you first.
Storage and disposal of personal information
Personal information is stored electronically by our office whenever possible. Electronic information is stored in a secure case management database. Most paper records that are received by the office are converted to digital copies and either returned to the sender or securely destroyed. Any paper records remaining are stored in locked, secure cabinets.
Details of general enquiries to the ECS Commissioners – including enquiries that do not fall within the jurisdiction of the Commissioners – for the immediate past and current reporting years are electronically stored for statistical purposes, and then securely destroyed. Information collected in relation to reviews of FOI decisions and any of the ECS Commissioners’ investigations and determinations, are currently retained indefinitely.
Access to, and alteration of, records containing your personal information
When you provide personal information in relation to our services, you may ask for access to the personal information that we hold about you and you may ask us to correct that information. We will ask you to verify your identity before we either give you access to the information or correct it. We will take steps to correct the information if we consider it is reasonable in the circumstances.
If we refuse to correct your personal information you can request us to attach a statement from you to the information indicating that you believe the information is incorrect and the reasons why.
Complaints about the way we collect, hold, use or disclose personal information
If you have concerns about how we have handled your personal information you may raise them with us in writing. We will assess whether our practices have been consistent with the APPs and attempt to resolve your concerns with you. Where appropriate, we will modify our practices or advise you about any further options open to you if you are dissatisfied with our response.
Phone: 1300 081 533
PO Box 283
Curtin ACT 2605