PRIVACY POLICY

1 PURPOSE

This policy aims to clearly define what ‘privacy’ and ‘confidential information’ is in relation to IDC, and outline the responsibilities and requirements with respect to handling such information.

In the course of their employment with IDC, staff will receive and acquire information that is confidential and the property of IDC and/or IDC Members, IDC Partners or IDC Stakeholders.  All reasonable care is to be taken, during and after employment, to maintain the confidentiality of the information staff have access to.  Additionally, staff are required to sign and abide by the Confidentiality Clause (Appendix I) contained in this policy.

2 POLICY

2.1 Who is this policy for?

This policy is addressed to all IDC staff, contractors working on an on-going basis, interns, volunteers, consultants and members of the Governance and Finance (G&F) Committee (generally referred to as ‘staff’ in this policy) regardless of location.  All individuals engaged by IDC will be made aware of the Privacy Policy and their responsibilities as stated in the policy during their induction.  It is also applicable to IDC Partners and IDC Stakeholders.

Where there is reference to the Director, it should be noted that he/she is responsible for the coordination, oversight and development of the IDC Secretariat and Coalition, with a focus on strategy, technical advice and institutional and partner development, and working with the G&F Committee on governance and finance issues, and working with the Team Leaders and staff on operational implementation.

Team Leaders constitute ‘senior management’ for the purposes of this policy.

2.2 Legislation and Standards

IDC is compliant will the following state and federal legislation:

  • Information Privacy Act 2000 (VIC);
  • Privacy Act 1988 (Cwlth);
  • Privacy Amendment Act 2012 (Cwlth); and the
  • Australian Privacy Principles.

IDC also recognises that there are various international laws which protect privacy rights too:

  • International Covenant on Civil and Political Rights;
  • International Convention on the Rights of the Child; and the
  • Universal Declaration of Human Rights.

2.3 Private and Confidential Information

Private information relates to personal information.  For the purpose of this policy, the term ‘personal information’ is information or an opinion (whether true or not) that identities or could identify a person, e.g. a person’s name and address.  Within IDC, personal information may be collected from, but is not limited to: job applicants, staff, IDC Members, IDC Partners, and IDC Stakeholders.

Confidential information means information:

  • Which if you shared it outside IDC might put in danger a staff member or other individual e.g. a child or harm the security of an IDC activity;
  • Which IDC is contractually bound to keep confidential or is commercial in nature;
  • About legal or regulatory proceedings relating to IDC which is not publicly known; or
  • In relation to IDC staff which is not publicly available.

2.4 Responsibilities and Requirements

All staff have the responsibility of ensuring privacy and confidentiality.

  • Staff must not during or after their employment with IDC:
  1. Disclose to any person confidential information relating to the business or affairs of IDC and its intellectual property, nor that of its Members, Partners and Stakeholders, unless specifically authorised to do so by IDC;
  2. Other than to the extent that is necessary for them to perform their duties, make extracts, copy or duplicate, make adaptations to, or use any confidential information; make notes, pro-forma documents, working papers or memoranda relating to any matters within the scope of the business of IDC or concerning any of it dealings or affairs;
  • In the case of employment with IDC ceasing, all organisational documents and property must be returned.
  • Staff must ensure that private information is collected and stored in a safe, secure and confidential manner.
  • IDC will ensure access to private and confidential information is limited only to those people who require the information in order to perform their duties.
  • IDC will use or disclose information only for the primary purpose for which the information was collected.  When information is to be used or disclosed for other than the primary purpose for which it was collected, consent will be obtained wherever practicable.
  • It is the responsibility of staff to ensure their personal information held by IDC is accurate, by advising IDC of any changes to their personal information.

2.5 Use of Gathered Information

IDC gathers information that is sometimes private and confidential in nature for both organisational and operational purposes:

  • Internal record keeping for human resources processes and procedures;
  • Payment of salaries;
  • Job and volunteer applications;
  • Emergency situations when a staff member is travelling (require copy of passport);
  • Funding and related banking processes;
  • Activities with IDC Partners;
  • Keep IDC Members and supporters informed; and
  • People’s whose human rights IDC seeks to protect.

2.6 Web Traffic

It is the responsibility of the user to check the privacy policy of third party providers.  IDC is committed to internet privacy and will endeavour to provide information to you in a method that suits a user’s privacy requirements.  If this is not possible, an unsubscribe option is easily available on all of IDC communications materials.

2.6.1 Cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive.  Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.  Cookies allow web applications to respond to you as an individual.  The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

IDC uses traffic log cookies to identify which pages are being used.  This helps to analyse data about webpage traffic and improve the website in order to tailor it to supporter needs.  We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help IDC provide supporters with a better website, by enabling IDC to monitor which pages are found useful and which are not.  A cookie in no way gives IDC access to the computer or any personal information, other than the data you choose to share with IDC.

Individuals can choose to accept or decline cookies.  Most web browsers automatically accept cookies, but can be modified to decline cookies.  This may prevent the individual from taking full advantage of the website.

2.6.2 Links to Other Websites

IDC web content may contain links to other web based content of interest.  However, once the link is housed outside the domain of the IDC, IDC does not have any control over that other web content.  Therefore, IDC cannot be responsible for the protection and privacy of any information which is provided whilst visiting such sites and such sites are not governed by the IDC Privacy and Confidentiality Policy.  Individuals should exercise caution and look at the privacy statement applicable to the web site in question.

2.7 Control of Personal and Confidential Information

There are controls in place for IDC groups to manage their personal and confidential information:

  • Members can choose to remain anonymous on the IDC web site, however, members are named within the password protected members’ area to aid networking and coalition building.
  • IDC will respect and safeguard the privacy and confidentiality of donors.  Donors’ personal information about their identity and information about their donations are protected by law and must not be disclosed to a third party without the consent of the donor.  For more information refer to the IDC Fundraising Policy.  All requests from donors to remain anonymous will be honoured.
  • Campaign supporters can choose to be or not be publicly listed on the communications channels associated with the Global End Immigration Detention of Children Campaign.
  • National campaign organisers can choose to operate entirely anonymously under the umbrella of their national coalition, recognising the sensitive natures in which campaign endorser’s work.
  • Use of photos and images are guided by procedures to ensure the protection and privacy of detainees.
  • There are unsubscribe options available if you wish to cease communications from IDC.

NOTE: National campaign groups are provided with the policies of the IDC as a starting point, however the IDC does not govern these processes and can not ensure that national campaigns will have the same commitment to protection of privacy of personal and confidential information.

2.8 Complaints

The IDC complaints process is also open to members.  For information on how to lodge a complaint please refer to the IDC Complaints Policy which is available here.

3 IMPLEMENTATION

The Director, in conjunction with senior management, is responsible for the administration, revision, interpretation, and application of this policy.  The policy will be reviewed annually and revised as needed.

4 REFERENCES/RELATED DOCUMENTS

IDC Fundraising Policy

IDC Finance Policy

IDC Complaints Policy

IDC Child Protection Policy

IDC Human Rights Policy

IDC Communications Policy

Information Privacy Act 2000 (VIC)

Privacy Act 1988 (Cwlth)

ACFID Code of Conduct

Fundraising Act (VIC) 1998

Fundraising Regulations 2009 (VIC)

 

 

APPENDIX I: CONFIDENTALITY CLAUSE

I…………………….. will not, except where it is mutually agreed upon or is required my role, reveal or divulge to any person or entity any information concerning the organisation, business, finances, transactions or other affairs of IDC or of any of IDC’s Members, IDC Partners or IDC Stakeholders, which may come to my knowledge during the continuance of my employment with IDC, and I will keep in complete secrecy all confidential information entrusted to me and will not use or attempt to use any such information in any manner which may injure or cause loss either directly or indirectly to IDC’s operations.  This restriction will continue to apply after the termination of my employment without limit in point of time but will cease to apply to information or knowledge which may come into the public domain.

 

 

Name:

Signed:

Date:

 

 

 

 

APPENDIX II: PROCEDURES FOR THE PROTECTION OF PRIVATE AND CONFIDENTIAL INFORMATION

Private and confidential information may be paper or computer based, or stored on USB sticks.  Documentation has legal and administrative constraints on their storage and disposal.

Access to Information

Staff do not all require the same level of access to information.  The level of access required is determined by the person’s job role.

Staff members may gain a higher level of access while they are working on a particular project, and then withdrawn if the level of access required changes.

File access is restricted to ensure privacy and confidentiality is maintained.

Files are not to be left where non-staff may access them as the information within them could be taken out of context or made public.

Soft Files

There is information that is of a private and confidential nature stored on Dropbox.

Staff can only access certain folders on Dropbox by invitation.  Private and confidential information is stored in the HR Folder which has limited access.

Staff are to supervise use of their laptops by non-staff as Dropbox is easily accessible via IDC laptops.

Once a staff member concludes their employment with IDC, their personal information is to be deleted from Dropbox.

Hard Files

Hard files that contain private or confidential information must at all times be stored in a securely locked cabinet for access by authorised staff only.

Hard files that contain private or confidential information should only be taken from the IDC offices with the consent of a Team Leader or Director.

Confidentiality Clause

As part of the staff obligations under the Privacy and Confidentiality Policy, staff are required to sign the confidentiality clause at the end of the policy.

Release of Information

Telephone

When answering the phone, staff are to never give out any personal information.

If a staff member is ever in any doubt as to the caller’s identity, or suspect that something is not right, they are to inform a Team Leader immediately and not comply with any requests from the caller.

Press and media requests

Staff are never to give information to the press or media that has not been authorised.

If a staff member is ever unsure, they are to politely decline any requests and refer the person to the Communications Coordinator or Director.

 

 

Storage of records

Records must be correctly stored and eventually destroyed in a secure way by authorised staff to make sure that information of a sensitive nature is not made public.

All records must be stored in a secure, safe area where there is no possibility of damage by pests, vermin or environmental factors.

Records must be transported in a safe and confidential manner ensuring that access is only given to authorised staff.

Destruction of Records

Any documents with private or confidential information are to be placed in locked bins and shredded prior to being sent for recycling.

Records are kept for as long as they have value.

 

 

 

APPENDIX III: IDC WEB SITE PRIVACY STATEMENT

This text is taken directly from www.idcoalition.org.

Disclaimer

The IDC is committed to internet privacy.  We are very much interested in respecting the privacy of our web site visitors’ privacy.  Thus we:

  • Monitor the general web site trends but never track individual visitors;
  • Do not collect information concerning individual visitors unless that information is voluntarily disclosed, such as by filling out our online contact forms; and
  • Do not sell or rent information voluntarily disclosed to us, nor do we share it with third parties.

Individuals who have chosen to sign up to our newsletter or other services can unsubscribe at any time.

The International Detention Coalition is not responsible for content of external internet sites nor responsible for any views, bias or content expressed within any articles listed on this site.

Due to the confidentiality and protection concerns related to the identification of individuals in immigration detention, the images IDC uses either:

  • Stock images that are not of actual detainees; or
  • IDC gathered images of detainees which are guided by the procedures for the use of images and photos.

 

 

 

 

APPENDIX IV: CAMPAIGN WEB SITE PRIVACY STATEMENT

This text is taken directly from www.endchilddetention.org.

This page has been in order to demonstrate our commitment to internet privacy.  We are very much interested in respecting the privacy of our web site visitors’ privacy.  Thus we:

  • Monitor the general web site trends but never track individual visitors;
  • Do not collect information concerning individual visitors unless that information is voluntarily disclosed, such as by filling out our online contact forms;
  • Do not sell or rent information voluntarily disclosed to us, nor do we share it with third parties.

Individuals who have chosen to sign up to our newsletter or other services can unsubscribe at any time.

The names of children featured in our stories have been changed in order to protect their privacy.  Similarly, the faces of the children who have agreed to share their stories of detention have also been blurred for their protection.

Disclaimer

This web site contains links to other internet locations.  The Campaign assumes no responsibility for these web sites, including their respective privacy practices or the content.

The Campaign will not be made responsible for any harm that the web site visitors may suffer as a result of confidentiality breaches in relation to the use of this web site or any information transmitted to the Campaign via this web site.

While the Campaign makes every effort to ensure that any software available to be downloaded from our web site is free of any virus, we cannot fully guarantee this. The Campaign is not responsible for any loss or damage caused by the software or documents downloaded from our web site.