• Section 1 - Audience
• Section 2 - Introduction
• Section 3 - Public Registers Maintained by the University
• Graduation Book
• Contracts Register
• Section 4 -  Protection and Privacy Principles
• Section 5 -  Information Collection
• Lawful Collection
• Direct Collection
• Open Collection
• Relevance of Collection
• Section 6 - Storage, Protection and Disposal of Personal Information
• Section 7 - Information Access and Accuracy
• Transparency
• Accessibility and Accuracy
• Section 8 - Information Use
• Accuracy
• Limitation
• Section 9 - Information Disclosure
• Restricted and Limited Disclosure
• Safeguarded
• Section 10 - Information Identifiers and Anonymity
• Section 11 - Information Transferrals and Linkages
• Section 12 - Law Enforcement Agencies
• Section 13 - System Design and Review 
• Section 14 - Training and Awareness
• Section 15 - Complaints or Review
• Section 16 - Breach of a Principle
• Section 17 - Controlled Entities
• Section 18 - Administration

Section 1 - Audience

(1) This Privacy Management Plan (Plan) applies to University of Newcastle (University) staff, contractors, controlled entities, volunteers, affiliates and the general public.

Section 2 - Introduction

(2) This Plan details how the University manages personal information of staff, students, and the general public in their dealings with the University, and is a supporting document to the Privacy Policy.  The Privacy Policy establishes the Privacy Officer function within the University.

(3) Section 33 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) requires the University to implement a Privacy Management Plan.

(4) The University is committed to compliance with the PPIP Act and the Health Records and Information Privacy Act 2002 No 71 (the HRIP Act) by:

1. informing individuals how their personal information will be handled by the University;
2. informing individuals of their rights under the legislation;
3. establishing and maintaining a culture of privacy awareness across the University so that staff are aware of their responsibilities under the legislation; and
4. considering the Information Protection Principles and Health Privacy Principles, where relevant, in the design and/or review of processes, systems and projects undertaken or implemented by the University. 

Section 3 - Public Registers Maintained by the University

Graduation Book

(5) The University publishes graduation books which include the name of each graduate and the degree conferred upon them. Students may opt out of inclusion in such graduation books by contacting graduation@newcastle.edu.au

Contracts Register

(6) The University maintains and publishes a Contracts Register as required by the Government Information (Public Access) Act 2009 (NSW) (GIPA Act). It is unlikely the register will include personal or health information. 

(7) The Privacy Officer may be contacted with any concerns about information published as it relates to a person’s personal or health information via email at privacy@newcastle.edu.au

Section 4 -  Protection and Privacy Principles

(8) This Plan is prepared based on the 12 Information Protection Principles (IPPs) and 15 Health Privacy Principles (HPPs) in the PPIP Act and the HRIP Act respectively.

(9) The University is governed by NSW privacy legislation but may have obligations under other legislation such as the Privacy Act 1988 (Cth) and the General Data Protection Regulation (EU 2016/679).

(10) Particular functions or Commonwealth funded research projects may be governed by the Australian Privacy Principles(APPs) which are outlined in the Privacy Act 1988 (Privacy Act). 

Section 5 -  Information Collection

Lawful Collection

(12) The University must only collect personal and health information for a lawful purpose, where it is needed for and directly relates to the University's activities.

(13) Personal or health information may be collected and used by the University for purposes including:

1. providing courses of study (including all associated administrative processes); conferring degrees and other awards;
2. research and administration of higher degree by research candidature;
3. exercising commercial functions;
4. fundraising;
5. promoting events and students;
6. surveys and competitions;
7. news and updates;
8. selection, employment, appraisal, and remuneration of staff and associated administrative processes for the management of staff;
9. providing and administering accommodation for students;
10. providing support services such as counselling, disability services, or advocacy services;
11. managing complaints or disputes;
12. managing or facilitating scholarships; and/or
13. managing requests for academic consideration.

Direct Collection

(14) Personal or health information is collected directly from the individual to whom the information relates, unless:

1. the individual has authorised the collection of the personal information from someone else;
2. the personal information is provided by a parent or guardian of a person who is under the age of 16 years; or
3. for health information, it is unreasonable or impracticable to do so.

(15) Where the University collects personal or health information from another individual, agency or party, consent may be obtained by the individual to whom the information relates:

1. accepting terms and conditions;
2. entering into a contract; or
3. providing valid and express consent.

(16) Another party may manage the consent and authorisation for the provision of personal or health information prior to the information being provided to the University. This may include where a student authorises another tertiary institution to provide information to the University.

(17) The University may collect personal or health information indirectly where:

1. the information is collected in connection with actual or anticipated proceedings before any court or tribunal;
2. the University is investigating a complaint which has or may be referred to, or made to or from an investigative agency;
3. direct collection of the personal or health information would prejudice the interests of the individual to whom the information relates; or
4. indirect collection is otherwise authorised or required.

Open Collection

(18) At the time of collecting personal or health information, or as soon as possible afterwards, the University must inform the individual/s concerned about:

1. why it is collecting the information;
2. the use;
3. who else might see it;
4. how they can view and correct their personal information;
5. whether the information is required by law or is voluntary; and
6. any consequences if they decide not to provide the information.

(19) This advice may be provided by way of:

1. terms and conditions;
2. a collection notice on a form or agreement;
3. a published privacy notice; or
4. correspondence (i.e. email communication or file note).

Relevance of Collection

(20) The University aims to ensure that personal information and health information:

1. is relevant, accurate, complete, up-to-date, not excessive, and that collection does not unreasonably intrude into the personal affairs of the individual;
2. is not collected or unnecessarily duplicated and that databases and systems are maintained and reviewed to ensure the information is accurate;
3. is able to be updated or amended by individuals through processes that are easily identifiable; and
4. is only sought where the information is required  (this will depend on the purpose for which the information is collected).

Section 6 - Storage, Protection and Disposal of Personal Information

(21) The University protects personal information and health information by:

1. identifying and classifying records and handling them accordingly;
2. storing records in University approved systems (appropriate privacy and security measures are incorporated into agreements with external system providers or contractors);
3. ensuring access to systems or databases containing personal information is only granted on a need-to-know basis and that these systems are password protected;
4. ensuring that, wherever available, systems established to collect information are used effectively;
5. ensuring information within systems is only accessed or viewed as required for a University function;
6. ensuring information is only transferred between parties when it is necessary to fulfil a University function and that steps are taken to prevent accidental disclosure;
7. storing paper records securely, for example, in locked offices or cabinets, as appropriate;
8. ensuring information is authorised to be destroyed and destroyed securely, that is, paper records are shredded or placed in a confidential bin, and electronic systems are erased; and
9. ensuring information is not kept for longer than necessary.

(22) The University comprises a number of colleges, schools, divisions, and business units who each may hold information in electronic format, hard copy, or both depending on their individual practices and procedures. These practices and procedures will be subject to the University's overarching policies which determine how the University will use, manage, secure, and dispose of information which may include personal or health information, including but not limited to:

1. this Plan;
2. Records and Information Management Policy;
3. Information Technology Conditions of Use Policy;
4. Information Security Policy; and
5. Research Data and Primary Materials Management Procedure.

Section 7 - Information Access and Accuracy

Transparency

(23) An individual may obtain details on:

1. how their personal or health information is being stored;
2. why it is being used; and
3. any rights they have to access it.

(24) This information will generally be available at the time of collection, via University systems, or upon request as appropriate.

Accessibility and Accuracy

(25) Personal or health information collected by the University may be provided to the person to whom the information relates either informally, via an existing process, or on request. In some cases an administrative fee may apply (for example, student transcripts are available for purchase).

(26) Staff and students may generally correct or amend their personal or health information automatically or routinely. In cases where personal or health information cannot be provided or corrected and amended electronically or by contacting the officer involved, assistance may be sought from:

1. Human Resource Services for requests from staff; or
2. Student Central for requests from students.

(27) In response to a request, the University may amend an individual's personal or health information or make an annotation on the document to detail the request. If the University considers that the personal or health information held is correct and does not require amendment, the individual will be provided with information outlining the reasons for this decision.

1. contains personal or health information about another individual;
2. may require further consideration and advice; or
3. is held across several different units of the University.

Section 8 - Information Use

Accuracy

(29) The University takes reasonable steps to verify the accuracy of personal or health information, especially where the use of the information could lead to negative consequences for the individual.

Limitation

(30) The use of personal or health information primarily refers to its use within the University.

(31) The University must not use information it holds for a purpose other than for which it was collected, unless:

1. the individual to whom the personal information relates has consented to the use of the personal information for another purpose;
2. the other purpose for which the information is to be used is directly related to the purpose for which the personal information was originally collected; or
3. the use of the personal information is necessary to lessen or prevent a serious and imminent threat to the life or health of any individual.

(32) Where personal or health information is to be used for a purpose that is directly related to the original purpose, staff should take reasonable steps to identify and document, as appropriate, why they have considered the use is directly related to the original purpose.

(33) In considering whether a purpose is directly related to the original purpose, staff may consider the reasonable expectations of the individual.

Section 9 - Information Disclosure

Restricted and Limited Disclosure

(34) Disclosure primarily refers to sharing information that is held by the University with another agency or individual outside of the University.

(35) The University and its staff must undertake reasonable actions to ensure that personal or health information is not disclosed, either routinely or on a single occasion, without consent, unless:

1. the individual concerned is reasonably likely to have been aware, or has been made aware at collection, that personal information of that kind is usually disclosed to another person or body;
2. the disclosure is directly related to the purpose for which the personal information was collected and the University has no reason to believe that the individual concerned would object to the disclosure; 
3. the disclosure of the personal information is necessary, on reasonable grounds, to prevent or lessen a serious and imminent threat to the life or health of any individual; or
4. an exemption applies under the Privacy and Personal Information Protection Act 1998 No 133 or Health Records and Information Privacy Act 2002 No 71.

(36) Individuals would likely be considered to have knowledge of a disclosure if:

1. there is documentation to indicate the individual provided valid consent;
2. they were made aware that the information may be disclosed on collection; or
3. there is a clear policy or process indicating that information of that type is usually disclosed.

(37) The University must not use or disclose health information for another purpose (secondary purpose) other than the original purpose for which it was collected unless:

1. an exception at law applies;
2. the individual has provided consent;
3. the secondary purpose is directly related to the original purpose and within the expectations of the individual; or
4. there is reasonable belief that the use or disclosure is necessary to lessen or prevent a serious and imminent threat to the life or health of the individual concerned or another person, or a serious threat to public health and safety.

Safeguarded

(38) University staff must undertake reasonable actions to ensure that any sensitive personal information (such as information about ethnic or racial origin; political opinions; religious or philosophical beliefs; sexual activities or trade union membership) is not disclosed without an individual's consent.

(39) The University may only disclose sensitive information without consent to deal with a serious and imminent threat to any individual's health or safety. 

Section 10 - Information Identifiers and Anonymity

(40) Individuals may be identified by using unique identifiers if it is reasonably necessary to carry out University functions efficiently.

(41) Services may be provided anonymously, where lawful and practicable.

(42) The University will generally require information about an individual to deliver a service, however, anonymity may be allowed wherever possible.

Section 11 - Information Transferrals and Linkages

(43) Health information and personal information (where relevant) may be transferred outside New South Wales if:

1. the University reasonably believes that the recipient is subject to a law, binding scheme, or contract in relation to privacy principles that are substantially similar to those detailed in the PPIPA Act;
2. the individual consents to the transfer;
3. the transfer is necessary for the performance of a contract (either between the individual and the University or in the interests of the individual if the contract is between the University and a third party);
4. the information is required to prevent or lessen a serious or imminent threat;
5. the use is authorised or required by another law;
6. the transfer is for the benefit of the individual and it is impracticable to obtain the consent of the individual to that transfer, and the individual would otherwise be likely to give consent; or
7. the University has taken reasonable steps to ensure that the transferred health or personal information will not be held, used, or disclosed by the recipient inconsistently with the Information Protection Principles or Health Privacy Principles.

(44) Health record linkage systems may only be used if the individual has provided or expressed their consent.

(45) Where the University seeks to use or disclose health or personal information for research purposes without the individual's consent, the research proposal must be submitted and approved by the Human Research Ethics Committee prior to the use or disclosure of information.

Section 12 - Law Enforcement Agencies

(46) The University will only disclose personal information or health information to law enforcement agencies in circumstances where it is required or permitted to do so by law. Examples of circumstances where the University will be required to disclose personal information are where the law enforcement agency issues the University a warrant, notice to produce, or subpoena, or the University is seeking to report a serious indictable offence. The University may, at its discretion, disclose personal information or health information to law enforcement agencies if it is permitted to do so under law, such as where the University has reason to believe that an offence has been committed and the law enforcement agency has requested that the University disclose personal information that is reasonably necessary to investigate that offence.

(47) In accordance with clause 46 above, the discretion to disclose personal or health information to law enforcement agencies as permitted by law may be exercised by:

1. the Vice-Chancellor;
2. the General Counsel;
3. the Deputy Vice-Chancellor (Academic) and Vice President where the information relates to a student or former student; or
4. the Chief People and Culture Officer, where the information relates to a staff member or former staff member.

Section 13 - System Design and Review 

(48) Staff must adopt a privacy by design approach by considering the requirements of the IPPs and HPPs when implementing or reviewing a project, process, or system to identify privacy issues, and implement strategies to address those issues and ensure ongoing compliance.

Section 14 - Training and Awareness

(49) The University offers privacy training sessions for new and continuing staff in the staff learning and development portal ‘Discover’. Privacy training sessions, both general and tailored to a specific area, are available on request to the Privacy Officer.

Section 15 - Complaints or Review

(50) Individuals may raise concerns and complaints about the way in which the University has handled their personal or health information by submitting a complaint to the Privacy Officer at privacy@newcastle.edu.au. Unless the Privacy Officer considers that the complaint constitutes a request for an internal review, a privacy complaint will be considered under the University's complaint handling processes.

(51) A request for an Internal Review can only be made where it is alleged that the University's conduct has:

1. breached any of the IPPs in PPIPA or any of the HPPs in HRIPA;
2. breached a privacy code of practice that applies to the University; or
3. disclosed personal information kept in a public register.

(52) The University will only accept an application for internal review if it meets the thresholds specified in Part 5 of PPIPA. Such an application should:

1. be in writing (or by using the internal review form);
2. be addressed to the University;
3. specify a return address in Australia; and
4. be lodged with the Privacy Officer within 6 months of the date the applicant first became aware of the alleged conduct. The University may exercise its discretion to accept an application which may be received after the end of the 6-month period.

(53) The Internal Review, as far as practicable, will be conducted by the Privacy Officer, or an appropriately qualified employee of the University, who does not have a conflict of interest (Reviewing Officer).

(54) The Reviewing Officer will assess the request for Internal Review in accordance with Part 5 of PPIPA and:

1. will complete the Internal Review within 60 calendar days of the day the application was received; and
2. notify the applicant of the outcome within 14 calendar days of the completion of the Internal Review.

(55) The University may, as result of the outcome of an Internal Review, do any of the following:

1. take no further action on the matter;
2. make a formal apology to the applicant;
3. take such remedial action as it thinks appropriate;
4. provide undertakings that the conduct will not occur again; and/or
5. implement administrative measures to ensure that the conduct will not occur again.

(56) Individuals may lodge a complaint with the Information and Privacy Commission New South Wales or seek an external review with the NSW Civil and Administrative Tribunal at:

Section 16 - Breach of a Principle

(57) Where the University becomes aware of a breach of the IPPs or HPPs, it will take appropriate steps to identify and address the breach. Reports of breaches or potential breaches should be sent to the Privacy Officer at privacy@newcastle.edu.au.

(58) A breach of the Privacy Management Plan, the Privacy Policy, and any associated policy and procedure by a member of University staff may constitute misconduct.

(59) It is an offence under PPIPA and HRIPA for a University staff member, as a part of their employment, to:

1. intentionally disclose or use personal or health information that the staff member has accessed, unless it is for a lawful or authorised purpose; and/or
2. supply, by way of a bribe or other similar corrupt conduct, any personal or health information about an individual to another individual.

Section 17 - Controlled Entities

(60) Controlled entities must manage personal and health information in accordance with this Plan. Controlled entities must determine if they have other requirements under the Australian Privacy Principles and/or other legislation and develop appropriate policies and systems to comply with these requirements.

(61) If a complaint or internal review is received by the University about the conduct of a controlled entity, the University may conduct a review if necessary.

Section 18 - Administration

(62) An issues register is maintained by the Privacy Officer to support the review process. Issues or feedback may be e-mailed to privacy@newcastle.edu.au