Privacy statement

Privacy statement

This privacy statement details how the Parliamentary Workplace Standards and Integrity Commission (the commission) collects, manages, uses and discloses personal, sensitive, and health information.

Our function and why we collect information

We are an independent body responsible for managing reports of parliamentary misconduct, including inappropriate parliamentary workplace behaviour, by members of parliament, ministers and parliamentary secretaries.

We will also deal with certain public interest complaints referred to us by the Independent Broad-based Anti-corruption Commission (IBAC).

For us to carry out our functions, we may collect, use, disclose and handle personal information, including sensitive and health information. We take protecting your personal information seriously. We will manage your personal information carefully, respectfully, and in accordance with relevant Victorian legislation, including the:

• Parliamentary Workplace Standards and Integrity Act 2024 (Vic) (PWSI Act).
• Privacy and Data Protection Act 2014 (Vic) (PDP Act)
• Health Records Act 2001(Vic) (HR Act).

In compliance with the principles in these acts, we have measures in place to ensure information is not misused, lost or unlawfully disclosed.

We will provide a person reasonable access to their personal information and will correct details in order to ensure that records are accurate.

Definitions

The commission may, depending on the circumstances, collect personal information including health or sensitive information.

Personal information

Any information that can identify a person like a name, contact details or photos, or an opinion that is recorded.

Health information

Information about an identifiable person regarding their physical, mental or psychological health or disability or how they want health services to be provided, which is subject to the Health Records Act 2001(Vic).

Sensitive information

Information regarding a person’s ethnicity or race, political or religious beliefs or memberships, philosophical beliefs, sexual preferences or practices, criminal record or trade union membership.

What information we collect

We collect personal information in a number of ways including through written documents, audio and video recordings.

Personal information may be collected if an individual makes an enquiry, a report, or a public interest disclosure using our online form. Our online report form is owned, managed and developed by Elker as a cloud-based platform.

Elker is subject to many of the same obligations as the Commission with regards to protecting personal information. Elker cannot access any personal or identifying information, though they may use de-identified data to assist with diagnostic tasks and quality improvement. Elker, and their cloud storage provider Amazon Web Services (AWS), are subject to industry standard encryption and security measures and are regularly audited for data security. All data on the Elker platform is stored within Australia.

We collect information to perform our functions under legislation. We may get information from a person directly when they provide us with information via our website or reporting form, via email, mail and in person.

We may also collect information about a person from:

• an authority or entity (for example, while conducting an investigation or receiving a report of misconduct)
• a third party
• other publicly available sources.

As far as is practical, we will inform a person of how we intend to use their information and to whom their information may be disclosed.

How we use collected information

We use personal, sensitive and health information to carry out our functions under the PWSI Act (in most cases, to manage reports of misconduct that have been provided to us). In some cases, we may be authorised by law to use or provide personal or health information to others for other purposes (for example, to provide information to another integrity body such as the Victorian Inspectorate or IBAC). In some situations, an individual’s consent may be sought to use or provide personal information to others.

We will only use or disclose personal information for the primary purpose for which the information was collected, for a secondary purpose that a person or body may reasonably expect us to perform (for example, de-identified systemic issues and reporting), as required or authorised by law, or any other purpose permitted under the PWSI Act, PDP Act and HR Act.

When we disclose or transfer information to another person or body, we will take reasonable steps to preserve the privacy of the person to whom the information relates (for example, by only providing information relevant to a matter or de-identifying information prior to its disclosure).

How we keep information secure

All areas of the commission must comply with privacy legislation at all times, except in certain situations. These situations include where:

• the provisions of another governing Act are more specific about how information should be managed
• information relates to a generally available publication, for example, websites, or publicly accessible directories.
  

Specific areas of the commission may have additional privacy policies that explain in more detail their information management practices and how records are managed in accordance with privacy legislation.

What information we collect

The commission collects personal and health information for statutory and administrative reasons. Typical collections include:

• solicited and unsolicited correspondence from the public
• applications, enquiries, submissions, surveys and reports
• details of staff, volunteers, visitors, committee members and statutory office holders
• research data.

Where lawful and practicable an individual may be anonymous when interacting with the commission, no identifying details will be collected. In some cases, however, we will be unable to assist a person without collecting some personal information. For example, a complainant needs to identify themselves and a person or organisation they believe is responsible if they wish to have their report assessed by the commission.

How we use collected information

The commission uses and provides to other people or organisations, personal or health information for the purposes it collected it.

Occasionally, the commission may be authorised by law to use or provide personal or health information to others for other purposes. In other situations, an individual’s consent may be sought to use or provide personal information to others.

The commission only assigns or adopts a unique identifier (e.g. employee number) for an individual if it is necessary, authorised by law or with consent. The commission ensures any transfer of personal or health information outside Victoria is in accordance with privacy legislation.

The commission takes reasonable steps to ensure that personal and health information held is accurate, complete and up to date. Usually, the commission relies on individuals to provide accurate and current information to the commission in the first instance, and to notify when circumstances or details change.

How we keep information secure

All areas of the commission have security measures aimed at protecting personal and health information from misuse, loss, unauthorised access or disclosure.

The stored information is also archived in accordance with the Public Records Act 1973, which determines when it is appropriate to retain or dispose of it.

The commission periodically reviews its ongoing need to collect and keep personal information.

Accessing or correcting information held by us

Where appropriate a person may ask for access to their personal or health information, without having to make a formal request under the Freedom of Information Act 1982 (Vic) (FOI Act).

In some situations, such access outside the FOI Act will not be appropriate, and they will have to make a formal FOI request (for example, if a third party’s privacy is involved).

People can access information held about them by the Commission by:

• directly contacting us
• under the FOI Act where appropriate.

Please note, the PWSI Act section 85 contains an exemption from the FOI Act to which the document discloses information that relates to— (a) a referral (a report on misconduct); or (b) a public interest complaint referred to the Commission by the IBAC; or (c) an investigation by the Commission; or (d) a recommendation made by the Commission under this Act.

Breaches of this policy

Information privacy complaints can be made verbally or in writing to the Commission. If the complaint is complex, the complainant will be invited to submit their complaint in writing.

Following receipt of a privacy complaint, the below actions will occur simultaneously or in quick succession:

• breach containment and preliminary assessment/investigation
• evaluation of the risks associated with the breach
• notification to appropriate delegates and authorities.

The commission will aim to make a decision on all verbal complaints quickly, and written complaints as soon as possible. The commission will confirm the assessment and outcome to the complainant in writing. This may include accepting the complaint in full or part, declining to allow the complaint or referring the complaint to the Office of the Victorian Information Commissioner.

Information privacy complaints are recorded in a Privacy Complaints Register, maintained by commission staff.

Any breach of the policy by commission employees may result in disciplinary action being taken by the commission. In addition, a breach of this policy may constitute a breach of the VPS Code of Conduct.

To find out more or make a complaint

We will investigate and resolve privacy complaints with fairness, integrity and respect for the rights of the individual. If you have a privacy complaint or wish to discuss our information handling practices, please contact us via the details below.

Parliamentary Workplace Standards and Integrity Commission
Postal: 1 Macarthur Street, East Melbourne, Victoria, 3001.
Email: enquiries@pwsic.vic.gov.au

Detailed information and resources, including how to make a complaint about an Act or practice regarding interference with information privacy, are available from:

Office of the Victorian Information Commissioner – Privacy and Data Protection
Postal: PO Box 24274, Melbourne, Victoria 3001
Telephone: 1300 006 842
Email: enquiries@ovic.vic.gov.au
Website: www.ovic.vic.gov.au

If your complaint relates to health information:
Health Complaints Commissioner
Postal: Level 26, 570 Bourke Street, Melbourne, Victoria, 3000
Telephone: 1300 582 113
Website: hcc.vic.gov.au(opens in a new window)

This statement is reviewed and updated every 5 years or earlier if required. It was last reviewed in December 2024.