Privacy

The Barossa Council is committed to maintaining a culture that respects its customers' right to privacy.

Our Privacy Policy (and below) explains how we will collect and manage the personal information of our customers.

If you have any concerns about how your personal information is managed by The Barossa Council, please email our Governance Advisor at barossa@barossa.sa.gov.au or 8563 8444.

Corporate Plan Link

6.2 Ensure that Council's policy and process frameworks are based on principles of sound governance and meet legislative requirements.

1.1 The Barossa Council ("the Council") is committed to maintaining a culture that respects its customers' right to privacy.

1.2 This Policy sets out Council's framework for collecting and managing the Personal Information of its customers.

2.1 The Commonwealth Government's Privacy Act, the Australian Privacy Principles which flow from it, and the South Australian Government's Information Privacy Principles Instruction ("the Principles") do not bind Local Government except when Council contracts with a Commonwealth or State Government agency. However as these Principles set best practice standards for collecting and managing Personal Information, Council's position on privacy will align as is reasonably practicable with them.

2.2 This Policy applies to Council's Elected Members and Workers who, in the course of their official Council duties, collect and manage Personal Information of Council's customers.

2.3 This Policy does not apply where legislation prevails and requires the release of Personal Information in certain circumstances - for example to the Ombudsman, the Independent Commissioner against Corruption, Office of Public Integrity, the Minister, Royal Commissions, courts and tribunals, auditors and other public bodies or prescribed authorities.

2.4 This Policy does not apply to the Personal Information of Council Workers where it is related to their employment with Council as this is managed by Council's Human Resource Framework. It will apply, however, to the Personal Information of Council Workers when they are also Council customers.

2.5 This Policy does not apply to confidential information of organisations and businesses (refer to Council's Procurement Policy).

2.6 In addition to the requirements of this Policy, Workers should be aware of the following:

• 2.6.1 Section 11OA of the Local Government Act - Employees or former Employees must not disclose information that has been determined by Council to be confidential under section 90 of the Act.
• 2.6.2 Council's Human Resource Management Policy- sets out behavioural expectations including, that Employees must not release or divulge information which could be considered private under Council's Privacy Policy, unless the law authorises or requires its release (clause 4.13.2.5 of the Human Resource Management Policy).

4.1 Customer Identification

4.1.1 Council encourages its customers to use their true contact details when dealing with Council so that their requests and complaints may be dealt with as effectively and efficiently as practicable.

4.1.2 However, in some situations a customer may be more comfortable to anonymously make a request or complaint. Council officers will assist a customer in these situations wherever it is practical to do so or where legislation does not require a name and contact to register a complaint or request. Refer to Council's Complaints policies and processes.

4.2 Collection of Personal Information

4.2.1 Council will only collect personal information if it is reasonably necessary for, or directly related to, one or more of Council's functions or activities.

4.2.2 As is appropriate, a higher standard applies to the collection of Personal Information that is deemed to be Sensitive Information and so Council will only collect this kind of Personal Information if:

• (i) the individual consents to data collection; or
• (ii) one or more of the following applies:
  1. the collection is required or authorised by or under an Australian law or a court/tribunal order or as part of or related to Council's enforcement function;
  2. Council requires that this information be collected as part of Council's usual processes, practices or functions, eg Council's Volunteer Registration Form;
  3. Council requires that this information be collected in order to manage risks or assess its ability to provide support, and the information is reasonably necessary for this purpose, eg to submit information regarding nature of a disability or health condition to secure Commonwealth funding.
  4. the collection is required or authorised by or under an Australian law or a court/tribunal order or as part of or related to Council's enforcement function; .
  5. Council requires that this information be collected as part of Council's usual processes, practices or functions, eg Council's Volunteer Registration Form;
  6. Council requires that this information be collected in order to manage risks or assess its ability to provide support, and the information is reasonably necessary for this purpose, eg to submit information regarding nature of a disability or health condition to secure Commonwealth funding.

4.2.3 The type of Personal Information that may be collected by Council includes:

• names and addresses {postal, residential and email addresses)
• photographic identification {eg drivers' licence)
• telephone numbers
• age I date of birth
• property ownership and/or occupier details
• dog ownership
• electoral roll details
• payment history
• financial, rental or income details (eg to support assessment of financial hardship or capability, tenders and contract due diligence, financial guarantees)
• pensioner/concession information
• library membership details
• library borrowing history
• visitor metadata from Visitor Information Centre booking services
• footage from Council's approved Closed Circuit Television monitors
• photographs of individuals taken by Council officers in the course of Council duties.

4.2.4 Proof of Identity

To action particular requests from its customers, Council will require proof of identification, eligibility or entitlement from the customer - for example, for a request to change a name upon marriage or divorce; update an address; or a request for a fee waiver to access a Council record.

To reduce the risk of identity fraud, the attending Worker will not copy the original and retain the copied proof of identity, eligibility or entitlement into Council's record management system, in those circumstances where they can instead reasonably sight the original identification source, note the reference and expiry date and return the original identification immediately to the customer.

Where it is not reasonable to sight the original identification source and return it to the customer, any copies made or received by a Worker will be registered into Council's records managements system with strict access controls.

4.2.5 Council will only collect Personal Information by legal and fair means. This includes collection from a third party such as SA Water, State Electoral Office, Office of the Valuer-General, other Ratepayers and Residents.

4.2.6 Council may determine not to retain Personal Information that is sent to it by an unsolicited or anonymous source where it is deemed to be trivial or unrelated to Council business.

4.2.7 Where practicable, at the time of collection, Council will take reasonable steps to inform its customers:

• of the reasons for the Personal Information collection,
• if such collection is authorised or required by the law, and
• where practicable, of any usual practices with respect to the use and disclosure of such Personal Information.

4.2.8 In collecting Personal Information, Council assumes that:

• The information is free from errors and omissions, is not misleading or deceptive and complies with all relevant laws;
• those who provide the information have the authority to do so;
• Council may not, and is not required to verify the accuracy of the information; and
• it is the responsibility of the individual to provide Council with the details of any changes to their Personal Information as soon as possible.

4.3 Use or Disclosure of Personal Information

4.3.1 Distribution to Third Parties

If Council holds Personal Information of an individual which was collected for a particular purpose ("the primary purpose"), it must not use or disclose the information for another purpose ("the secondary purpose") unless:

• (i) the individual has provided written consent to the use or disclosure of the information for the secondary purpose; or

• (ii) the individual would reasonably expect Council to use or disclose the information for the secondary purpose however:
  • the secondary purpose should be connected to the primary purpose: and
  • if the information is Sensitive Information - then the secondary purpose should be very closely connected to the primary purpose.
    • This requirement for a more direct relationship recognises that the use and disclosure of Sensitive Information can have serious ramifications for the individual and/or their associates; and

for the purpose of this sub-clause (ii), the Worker using or disclosing the information must record a file note explaining the rationale for release. However, a file note is not required if the person providing the personal information has been alerted to the fact that the the information will be used or disclosed for the secondary purpose (eg. as a condition on a form): or

• (iii) the provision of Personal Information is for the purpose of distributing material of and on behalf Of Council and the body which is contracted for this purpose agrees to act in accordance with this Policy (eg for the provision of address data to emailing service provider to post Rates Notices); or

• (iv) the use is by a third party or Worker who provides advice or services to assist Council provide benefits to Ratepayers and/or Residents (eg the Electoral Commission SA, Office of the Valuer-General, insurers, debt collectors); or

• (v) the use or disclosure of the information is required or authorised under an Australian law or a court/tribunal order for example mandated reporting under the Children's Protection Act 1993, or public notifications under the Development Act 1993; or

• (vi) there is a situation where consent cannot be reasonably obtained and the Worker reasonably believes that the disclosure of the information is necessary to prevent or lessen a serious threat to the life, health or safety of a person or group of people, then they may disclose the information necessary to a service provider (eg Department of Communities and Social Inclusion) in order to prevent or lessen such a threat. In such a case, the information must only be shared in accordance with _Council's Information Sharing Process for Promoting Safety and Wellbeing.

4.3.2 Council's Community Engagement

Council will only use or disclose Personal Information for the purpose of Council's own community engagement with an individual, where:

• (i) Council has collected the information from that individual; and
  
• (ii) the individual would reasonably expect Council to use or disclose the information for that community engagement purpose; and
  
• (iii) Council provides a simple means by which the individual may easily request not to receive such community engagement communications; and
• (iv) the individual has not made such a request to Council to cease the communications.

Personal Information provided to Council as part of its community engagement may be used or disclosed publicly for the purposes of reporting to the Elected Body or Council committees and to help inform decision making (eg inclusion in Council agenda reports of names and contact details of individuals who have made public consultation submissions).

4.3.3 Photographs, Used or Published by Council

Council may take photographs of individuals for publication and use in:

• Council publications
• promotional marketing and advertising
• online (i.e. on websites and social media)

Where it is reasonably practical to do so, permission to take and use photographs should be obtained from the individual being photographed or their parent, guardian or an adult accompanying them (as appropriate), prior to taking or using the photograph, either:

• verbally; or
• by completing a Photo Permission and Release Form;

Incidental capturing of images not related to the photograph may occur and every effort will be made to blur or remove such content but cannot always be guaranteed.

When obtaining consent, Council officers must, where reasonably practicable, inform the individual being photographed of the intended use of the photograph.

Once consent is obtained, Council assumes that:

• the person who gave consent has the authority to do so;
• the ownership of the photographs and the copyright therein belong to Council;
  
• the consent is unconditional (unless the individual or person giving the consent expressly states otherwise);
• the consent applies to any and all uses of the photograph, including future use and where the photograph is published multiple times or on multiple platforms, unless the individual or person giving consent expressly states otherwise.

Completed Photo Permission and Release Forms must be stored in accordance with this Policy, Council's Knowledge Management Policy and supporting processes.

4.3.4 Commonwealth and State Contracts

Where Council provides a service funded by a Commonwealth or State government contract, it must disclose to the authorised Commonwealth or State representative any Personal Information it has collected if this meets an obligation under the relevant contract.

Where Council provides Personal Information to another service provider that is subject to the Australian Privacy Principles or Information Privacy Principles, Council will require that provider to sign an undertaking that it will maintain confidentiality when it handles the Personal Information supplied by Council.

4.3.5 Disclaimer

While Council will take all reasonable steps to ensure that the Personal Information disclosed is accurate, current and complete, it cannot accept any responsibility for loss or damage suffered by those who receive such information and rely on it, or as a result of Council's inability to provide the requested information in the first place.

4.4 Security of Personal Information

4.4.1 Council will take all reasonable steps through its secure systems and supporting policies and processes to protect the Personal Information in its possession from misuse, interference, loss, unauthorised access, modification or disclosure.

4.5 Access to Personal Information

4.5.1 Public Access

Council recognises that certain documents containing Personal Information are legislatively required to be made available for public access. These include:

• Property Assessment Records
• Adjoining Property Owner Requests
• All Council Agenda items which have not been subject to a confidentiality order under section 90(3) of the Loco/ Government Act 1999
• Public Consultation documents and information included in public registers under the Development Act 1993
• Public registers required to be kept under the Local Government Act 1999 (eg. Elected Member Register of Interests)
• Voters' Roll
• Petitions to Council (see clause 4.7.2 below for the specific information that will be available from a petition)

4.5.2 Freedom of Information (FOI) Act 1991

To access Personal Information outside those document groups listed in clause 4.5.1 above, a person may apply to Council's Accredited FOI Officer who will process their application in accordance with the governing FOI Act. Application forms are available on Council's website at www.barossa.sa.qov.au.

Personal Information may be released to an applicant, subject to certain legal exemptions, but the subject of that Personal Information:

• must be consulted, as required by the FOI Act, prior to any determination to release that information to the applicant; and
• is entitled to appeal any determination to release the Personal Information, prior to that information being released, in accordance with the FOI Act.

4.5.3 The applicant will be charged in accordance with Council's Fees and Charges Register for any copies of Personal Information which they have been provided.

4.5.4 Refusal to give access

If Council refuses to give access to the Personal Information or to give access in the manner requested by the applicant, it will (subject to any legal requirements) advise the applicant in writing that sets out the:

• (i) reason(s) for the refusal; and
• (ii) complaints mechanisms available through Council's Customer Service Policy, Internal Review of Council Decisions Policy and/or the Ombudsman.

4.6 Correction of Personal Information

4.6.1 Where Council holds Personal Information about an individual; and either:

• (i) is satisfied that, regarding the purpose for which the information is held, the information is inaccurate, out of date, incomplete, irrelevant or misleading; or
• (ii) the individual, with appropriate identification, requests in writing or in person to correct the information; or
• (iii) where the Personal Information is of a nature that requires a written application under the Freedom of Information Act, the individual makes a formal application under that Act for Council to correct the information;

Council will take steps (if any) as are reasonable in the circumstances to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up to date, complete, relevant and not misleading.

4.6.2 If Council refuses to correct the Personal Information as requested by the applicant, it will (subject to any further legal requirements) advise the applicant in writing:

• (i) the reason(s) for the refusal; and
• (ii) the mechanisms available to complain through Council's Complaint Handling Policy, Internal Review of Council Decisions Policy and/or the Ombudsman.

4.7 Suppression of Personal Information

4.7.1 Assessment Record and Voters' Roll

An individual's name or address may be suppressed from the Council's Assessment Record (section 172 of the Local Government Act 1999) and Voters' Roll (section 15 of the Local Government (Elections) Act 1999), where on application by an individual to the Chief Executive Officer is satisfied that the inclusion of such details would place at risk the personal safety of that individual, a member of their family or another individual.

4.7.2 Petitions

Council receives Personal Information in petitions (ie names, signatures and addresses) forwarded to it from those who want Council to undertake a certain action. The Chief Executive Officer is required under the Local Government Procedures at Meetings) Regulations 2013 to place the petition on the public agenda for the next ordinary meeting of Council.

Unless the Chief Executive Officer receives a specific request from a petition co­ signatory to suppress their Personal Information, details will generally not be suppressed by the Chief Executive Officer prior to providing the petition in the public agenda for Elected Body for consideration.

However, upon taking into account any particular sensitivities surrounding the subject of the petition, the Chief Executive Officer, at their discretion, may instead provide a compilation of the petition's co-signatories in a separate paper, and provide this to the public agenda.

4.8 Destruction of Personal Information

4.8.1 Records which contain Personal Information are managed for the life of the record in accordance with the relevant General Disposal Schedule (GOS) and Council's Knowledge Management Policy.

4.8.2 When the information is no longer required by Council and is able to be destroyed in accordance with the GDS.)he information and its meta-data elements within Council's record management system must be de-identified and/or destroyed.

4.9 Data Breach

4.9.1 While Council will always use its best endeavours to protect Personal Information within the parameters of its legal obligations and resources, in the event where a data breach occurs and Council is aware of that breach, Council will notify the affected individual(s) as soon as reasonably practicable so that any consequential damage might be minimised.

• Change of Name and Address in Pathway Process
• Credit Card Payment (Card Not Present) Process
• Critical Client Incident Process
• Information Sharing Process for Promoting Safety and Wellbeing
• Information Sharing Documentation Form
• Information Sharing Guidelines for Promoting Safety and Wellbeing: Ombudsman
• SA Photo Permission and Release Form

• Complaint Handling Policy
• Internal Review of Council Decisions Policy
• Human Resource Management Policy
• Knowledge Management Policy
• Safe Environments for Children and Vulnerable Adults Policy
• Freedom of Information Statement

• Australian Privacy Principles
• Children and Young People (Safety) Act 2017 and Regulations
• Child Safety (Prohibited Persons) Act 2016 and Regulations
• General Disposal Schedules 20, 21 and 32
• Information Privacy Principles Instruction (Department of Premier and Cabinet)
• Local Government Act 1999
• Local Government (Elections) Act 1999
• Local Government (Procedures at Meetings) Regulations 2013
• Privacy Act 1988 (Cth)
  Privacy Amendment Act (Cth) 2012
• Freedom of Information Act 1991

This Policy shall be reviewed by the Document Control Officer in consultation with the relevant stakeholders, within four years or more frequently if legislation or Council needs change.

This Policy is available on Council's website at www.barossa.sa.gov.au. It can also be viewed electronically at Council's principal office at 43-51 Tanunda Road, Nuriootpa and all Council branches, during ordinary business hours. A copy of this Policy can be obtained at those venues upon payment of a fixed fee.

Any person who has a concern about Council's management of their Personal Information or if they require further information should contact the Customer Service Staff on 8563 8444 or attend at Council's Nuriootpa Office in the first instance.

If concerns cannot be satisfied, the person may lodge a complaint in writing to the Chief Executive Officer of Council, PO Box 867, Nuriootpa SA 5355 or barossa@barossa.sa.gov.au

Collection of Personal Information

When you visit our website or ‘Your Barossa’ mobile app, our web measurement tool and internet service providers record anonymous 'metadata' information on website activity for statistical purposes only. This includes the number of users who visit the website, the date and time of the visits, the number of pages viewed and navigational patterns. This information on its own does not identify an individual but it does provide us with statistics that can be used to analyse and improve our website.

Whilst we strive to protect data transmitted over the Internet, we do not warrant and cannot ensure the security of any information which you transmit to us. Accordingly, any information which you transmit to us is transmitted at your own risk.

Any personal information you choose to provide will only be used for the purpose for which it was provided and will not be disclosed to other persons or organisations without your prior consent or if required by law.

You are able to access information held by The Barossa Council about you under the Freedom of Information Act 1991.

If you have any concerns about how your personal information is managed by The Barossa Council, please email our Governance Advisor at barossa@barossa.sa.gov.au or 8563 8444.