Amity is committed to the open and transparent management of personal information and to compliance with the Australian Privacy Principles and other legislation. In order to meet this commitment, Amity will educate staff, students and volunteers about information privacy and their legal and ethical obligations when working with sensitive, private, and confidential information.

Amity will respond to any complaints in an efficient and appropriate manner and commit to monitoring privacy compliance.

Definitions

Sensitive Information may include Information or an opinion about an individual’s

• racial or ethnic origin;

• political opinions;

• membership of a political association;

• religious beliefs or affiliations;

• philosophical beliefs;

• membership of a professional or trade association;

• membership of a trade union; sexual orientation, preferences, or practices; or criminal record.

Sensitive information also includes health information and generic information about an individual that is not otherwise health information.

Personal information may include:

• staff and Board member personal information such as home address, telephone numbers and other non-work-related information;

• personal information provided by individuals or about individuals during performance reviews, leave applications, supervision sessions or similar discussions;

• information about an internal dispute or grievance;

• business conducted in Board Meetings, other than identified information as being for public discussion; and any confidential and proprietary information concerning financial transactions, competitive tenders or expressions of interest or any other organisational plans or activities identified by the Board or Chief Executive Officer or other Amity Management Staff.

Personal information- information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

Practices and Procedures

The following practices and procedures apply:

Sensitive information is subject to a higher level of privacy protection than other personal information handled by organisations in the following ways:

• sensitive information may only be collected with consent; and

• sensitive information must not be used or disclosed for a secondary purpose unless the secondary purpose is directly related to the primary purpose of collection and within the reasonable expectations of the individual.

Board Members, Staff and Contractors will:

• be familiar with the Australian Privacy Principles; (https://www.oaic.gov.au/privacy/australian-privacy-principles/read-the-australian-privacy-principles)

• retain all personal, sensitive, and confidential information in the strictest confidence and not disclose any private or confidential information to any person other than for purposes directly related to their position at Amity;

• not use any confidential information which they have acquired in relation to the activities of Amity for their own interests or the interests or purposes of others not associated with Amity;

• not make copies of any confidential information for any reason other than those essential to and directly related to their position and responsibilities with Amity;

• not make public comment on behalf of Amity unless authorised to do so (see media policy);

• in the event of cessation of engagement or employment with Amity, return all materials containing confidential information which are in their possession; and

• not use or divulge, without written consent of the Chief Executive Officer, any information acquired in the course of employment or association with Amity.

These practices will not prevent an individual from:

• making a formal complaint within the organisation;

• disclosing information to proper authorities in relation to concerns about improper conduct,breaches of laws or breaches of duty of care; and/or

• disclosing any information they may be required to disclose by any court or regulatory body or under applicable law. This may include a request to share information under the Protection of Children Act NT (2010).

All paper-based personnel files will be held in a locked cabinet in the office of the Chief Executive Officer. All confidential materials will be shredded and disposed of in the secure confidential bins located onsite.

Additional Privacy and Confidentiality Practices for Amity’s Counselling Service

Further to the details already noted, Amity’s Counselling Service will engage in the following practices and procedures:

• clients are to be made aware of the purpose of gathering statistical data and to whom this information may be given;

• subject to considerations about legal and privacy issues and the safety of other people, clients are to be provided with a process through which they can apply to view records or access copies of records relating to them;

• all client records will be locked in filing cabinets at the end of each day, and only staff requiring regular access to these cabinets will have access;

• all client records will be identified by the relevant file number;

• the online client appointment diary will only contain the information necessary for managing counselling appointments.

Clinical data will be stored in separate systems, accessible by fewer staff members;

• the client database will protect client information through limiting staff access and by only enabling counsellors to view the clinical information relevant to their open cases; and

• staff will not divulge any client information, including appointment details and/or attendance, to any person not employed by Amity without the client’s prior written/signed consent documented in the file. Exceptions to this rule include:

• when issued with a Court Order requiring release of information or a subpoena to attend court to give evidence; and

• where Duty of Care overrides the duty of confidentiality (in circumstances where there is an immediate threat to the life or safety of a person and/or in accordance with mandatory reporting requirements related to child abuse and domestic and family violence)