Purpose
The purpose of this policy is to describe how SAMSN collects, uses, and
stores information. SAMSN collects information for a variety of purposes including
providing services and maintaining the safety and wellbeing of people who attend or
use SAMSN’s services, programs and/or resources.
The type of information collected depends on the service required. Where services or
advice is provided, such as attendance at a group or accessing individual support,
SAMSN will need to collect with consent, information such as the person’s name and
contact details.
Personal information is stored confidentially in compliance with relevant Commonwealth
and State government legislation.
Information collected
Personal Information
Information of a personal, identifiable nature that may be collected and maintained eg identifier information (including name and date of birth), address, email and contact numbers.
Sensitive Information
SAMSN may also request and keep more sensitive information relevant to the service provided such as attending a group or obtaining individual support. This information may include a person’s requests and needs, disabilities impacting on obtaining a service, and personal disclosures.
Computer Information
As with all websites, SAMSN may also, through the provision of and means of our website, passively collect data. This includes IP address, domain, browser, geographical location, and click stream, search words to access pages.
How information is collected
Personal and sensitive information is collected when it is provided to SAMSN including
information provided by way of telephone, letter or email, and online (Zoom, etc).
A
s with all websites, technical information is collected passively when visiting the
SAMSN website. An example of this is the number of website views. This information is
collected using Google analytics, and cookies. Cookies are small text files that are
placed on a user’s hard disk by SAMSN’s software. They can be deleted manually,
otherwise they remain where they are. The function of the cookie is to collect
information anonymously, and to track user patterns. Users have a choice to reset your
browser to either accept or refuse to accept cookies.
Link to third-party websites
SAMSN’s website may contain links to other sites. By accessing these external
websites users are subject to the third parties’ privacy policies. While SAMSN supports
the protection of everyone’s privacy and abides by security policies, SAMSN is not
responsible for the actions of third parties or their privacy practices. Users are advised
to be aware of the privacy statements of any new website with which they interact.
Usefully, www.esafety.gov.au provides some additional advice regarding device
settings to keep your information safe.
Information storage and protection
The information shared with SAMSN is stored and protected by the following means:
- Written documents are stored in secure and locked cabinets at SAMSN’s head office with restricted staff access.
- Electronic data is stored on databases and computers, which are protected by multi-factor authentication, encrypted and only accessible by limited staff. These protections accord with relevant privacy and archival legislation such as the Privacy Act 1988 (Cth).
- All personal and sensitive information is maintained in accordance with legal requirements to ensure safety and confidentiality of information.
Sharing of information
Confidentiality of those who engage with SAMSN is a high priority. Information shared
with SAMSN is kept confidential within the organisation unless there has been a request
by the person to share specific information with another organisation or agency or as
required by law. Where a request has been made to share information with another
organisation or agency has been made, this will only be done with the person’s consent.
In most cases, written consent to share information with external parties such as an
Authority to Act form, is required.
The only instances when specific information may be divulged without consent are
when disclosure of personal information is required by law, such as by way of subpoena
or police request. In many states including NSW, special legislation exists in criminal
proceedings for sexual assault. This legislation protects the privacy of sexual assault
communications, including counselling notes, when they are subpoenaed.
Mandatory reporting requirements divulging personal information will also need to be
followed if they, a child or adult are at risk of significant harm. Should this occur SAMSN
will endeavour first to inform the person affected of the mandatory disclosure and seek
their consent.
Access to personal information shared with SAMSN
SAMSN supports a person’s right to access information they have shared
with SAMSN.
In accordance with the Australian Privacy Principles, this can be done as
a written request, contacting SAMSN by phone, or in person. SAMSN can also be
contacted to correct or update personal information.
The Australian Privacy Principles and Health Records Information Privacy Act 2002
(NSW) provide that information can be withheld if providing access to that information
will pose a serious threat to life, health or safety of any individual, public health or public
safety.
Data breaches
A data breach happens when personal information held by SAMSN has been lost,
accessed, or disclosed without authorisation such as when:
- A device is lost or stolen;
- A database has experienced a security breach;
- Personal information is mistakenly given to the wrong person.
If SAMSN suspects there has been a data breach, it will:
- Investigate whether a data breach has or is occurring;
- Assess the scope, where this has occurred, including the impact and severity of the breach;
- SAMSN will implement a resolution plan which will include identifying and notifying all affected parties and include the steps to be taken to mitigate the impact of the data breach;
- Notify all parties when the data breach has been resolved.
An example of where a data breach may occur is where an email is sent by mistake to
the wrong person or where an email has been received in error. Where this occurs, all
parties will immediately be notified and requested to delete the email from their system.
Each person involved will be contacted by SAMSN’s Senior Practitioner or their
delegate to confirm the person is satisfied with the steps taken by SAMSN to remedy
the data breach. The Senior Practitioner or their delegate will make an assessment as
to –
- Whether the data breach is likely to result in serious harm to one or more people
- What remedial action SAMSN is required to take to prevent the likely risk of
- serious harm
Where a data breach involving personal information is likely to result in serious harm to
one or more people or where SAMSN has not been able to prevent the likely risk of
serious harm with remedial action, SAMSN will immediately notify the Office of the
Australian Information Commissioner, as required by law.
Complaints and feedback
SAMSN is committed to providing and effective and responsive service. SAMSN
welcomes feedback including compliments and complaints. For more information on
feedback or complaint procedures, go to the Contact Us section on the home page of
the SAMSN website.