Introduction

The Australian National University is subject to the provisions of the Privacy Act 1988 (Cth).  This Act embodies 11 Information Privacy Principles which apply to collectors of personal information.  The University is one such collector and it must therefore comply with the Information Privacy Principles.

The Privacy Act was passed by Federal Parliament at the end of 1988.  The Act aims to protect personal information in the possession of federal government departments and agencies and safeguards the collection and use of tax file numbers.  It therefore gives individuals rights in relation to how their personal information is handled by:

• Commonwealth and ACT agencies;
• credit providers and credit reporting agencies;
• all who hold and use tax file numbers; and
• any organisation which requests old minor conviction information.

Definition

Under the Privacy Act 1988 personal information is defined as: 
 "information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion".

Within this definition there is no distinction as to the source of the information or the forms in which it is held. It is personal information whether it is provided by an individual or generated by the University.

University's Policy

The University's policy on the collection, use and control of personal information by the University is as follows:

(a)   personal information collected or generated by the University will be directly related to the functions and activities of the University and will be collected in a lawful and fair manner;

(b)   the University will use reasonable endeavours to ensure that individuals from whom it collects personal information understand what is being collected, how it is to be used and by whom;

(c)   the University will use reasonable endeavours to ensure that personal information it holds is of good quality and not unnecessarily intrusive upon an individual's personal affairs;

(d)   the University will take every reasonable step to ensure the security of personal information;

(e)   subject to its obligations under the Freedom of Information Act and any other law relating to privacy the University will permit individuals to have access to personal information it holds about them;

(f)    the University will use reasonable endeavours to ensure that the personal information it stores and uses is kept up to date in terms of relevance, accuracy and completeness;

(g)   the University will use personal information only for purposes which are relevant;

(h)   the University will not release outside the University the personal information it holds unless provided for by law or with the consent of the individual to whom the information relates.

Application of Policy

In the application of the policy, the University acknowledges the obligations it has as an institution toward the personal information it holds on individuals. It also recognises that staff of the University, both academic and administrative, require access to personal information consistent with their professional responsibilities to other staff and to students and that this requirement brings with it an obligation for staff to understand and acknowledge the nature and limits of their access to and use of personal information.

Just as the University and the staff of the University have obligations toward personal information so too do individuals who are required to provide that information. If the University is to ensure the quality and accuracy of the personal information it collects then this places an obligation upon an individual to provide relevant and accurate information to the University.

To assist the proper and fair application of the policy the University will nominate an appropriate officer, or officers, to handle issues relating to privacy and confidentiality, and to serve as a contact point for staff and students seeking advice on policy and procedures.

The University will nominate an officer as the official contact with the Privacy Commissioner.

The University recognises and accepts its obligation to ensure that staff are fully aware of their responsibilities under the Act and will accordingly provide appropriate training opportunities.