1. Introduction

1.1. Purpose

This purpose of this policy is to outline how the National Archives of Australia will manage personal information collected in the course of carrying out its business. Personal information is managed in accordance with the Australian Privacy Principles (APPs) as specified in the Privacy Act 1988 (Cth) (Privacy Act).

Definition

In accordance with the Privacy Act personal information is 'information or an opinion about an identified individual, or an individual who is reasonably identifiable:

1. whether the information or opinion is true or not; and
2. whether the information or opinion is recorded in a material form or not'¹.

Scope

This Policy applies to information in all formats created or received by the National Archives in the performance of its business.

Out of Scope

The Policy does not apply to Commonwealth records held in the National Archives' collection. These are administered in accordance with provisions in the Archives Act 1983 (Cth) (Archives Act).

1.2. Objectives

This policy supports the principles outlined in the Privacy Act by promoting and facilitating an understanding of and compliance with the APPs and how they apply in the Archives context. This includes:

• outlining how the National Archives manages the personal information it collects, holds, uses and discloses
• providing guidance for individuals accessing records containing their personal information and seeking correction of such information
• outlining how an individual can complain about a breach of the APPs and how the National Archives will deal with such a complaint

1.3. Legislative Framework

• Privacy Act 1988 (Cth);
• Archives Act 1983 (Cth);
• Public Service Act 1999 (Cth);
• Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth);
• Criminal Code Act 1995 (Cth);
• Freedom of Information Act 1982 (Cth);
• Human Rights and Equal Opportunity Commission Act 1986 (Cth);
• Merit Protection (Australian Government Employees) Act 1984 (Cth);
• Australian Information Commissioners Act 2010 (Cth); and
• Ombudsman Act 1976 (Cth).

2. Personal information and the National Archives

2.1 Personal information the National Archives collects and holds

The National Archives will only collect personal information when it is reasonably necessary for, or directly related to, the National Archives' business.

Personal information may be collected by the National Archives in the performance of its business, including:

• personnel and employment records
• access case files
• advice to agencies
• personnel security records
• Advisory Council records
• financial management records
• Freedom of Information records
• tender records
• personal records depositor’s files
• correspondence with public and official researchers
• applications for fellowships and scholarships
• community consultation and oral histories
• files.

The National Archives may also collect or hold a range of sensitive information which is a type of personal information. This includes information or opinion about an individual's:

• health (including predictive genetic information)
• racial or ethnic origin
• political opinions and association
• religious beliefs or affiliations
• philosophical beliefs
• sexual orientation or practices
• trade or professional associations and memberships
• union membership
• criminal record.

The National Archives collects sensitive personal information about an individual only with the individual’s consent or if authorised by or under law to do so. The National Archives ensures that any information it collects is relevant for the purpose for which it is collected and is used only for that purpose. Personal information will only be collected by lawful and 'fair' means.

The National Archives uses forms, online systems and other electronic or paper documentation and will usually collect the information from the individual personally.

Personal information is held in the following ways:

• Electronic Document & Records Management system e.g. HP Records Manager
• Client Relationship Management System e.g. Maximiser
• E-Recruitment System
• Human Resources System
• Research Management Systems e.g. RefTracker, E-Commerce and RecordSearch
• Electronic and paper files.

2.2 Storage and data security

The National Archives will take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Digital information is protected in systems that comply with the Australian Government Protective Security Policy Framework. Information held in a physical format is secured in locked cabinets and access is restricted to those with a 'need to know'.

If a data breach occurs the National Archives will respond as required by the Office of the Australian Information Commissioner's Data breach notification – A guide to handling personal information security breaches.

2.3 Records management

Personal information held by the National Archives is managed in accordance with the relevant records and information management policies and guidelines and disposed of in accordance with section 24 of the Archives Act.

2.4 Access to and correction of personal information

The National Archives is required under APP 12 to provide access on request of the individual to their personal information created or maintained by the National Archives. Where access is requested the National Archives must respond within 30 days. The National Archives must take reasonable steps to provide access in a way that meets the National Archives' needs and the needs of the individual.

If the National Archives makes a decision not to grant access to an individual, a written response will be provided listing reasons for the refusal and mechanisms available to complain about the refusal.

Under APP 13, the National Archives will take reasonable steps to correct personal information that it collects and holds to ensure that it is accurate, up-to-date, complete, relevant and not misleading. An individual may seek correction of their personal information through a request for amendment to the area of the National Archives responsible for the information (e.g. People Management and Development (PMD) for personnel and employment records). The National Archives will notify the individual of the decision within 30 days and provide written reasons if the request to amend personal information is refused.

2.5 Use and disclosure of personal information

In accordance with APP 6, the National Archives uses and discloses the personal information it collects for the primary purpose for which it was collected. An example of this is where personal information gathered from a client who approaches the National Archives with a reference inquiry seeking access to records in the National Archives' collection, is used to respond to the reference inquiry.

The National Archives may also use or disclose personal information for reasonably expected secondary purposes permitted under the Privacy Act, including in accordance with requirements or authorisation by or under law, or with the individual's consent.

The National Archives will notify the individual at the point of collection or as soon as practicable afterwards about types of disclosures that apply to particular collections of personal information.

The National Archives will not usually disclose personal information overseas but, in the event it does, the National Archives will comply with APP 8 which outlines how to appropriately deal with cross-border disclosures of personal information. Where necessary, the National Archives may also enter into a contractual arrangement that requires the overseas recipient to handle the personal information in accordance with the APPs.

2.6 Accidental or unauthorised disclosure of personal information

The National Archives protects personal information that it holds and will take seriously and promptly deal with any accidental or unauthorised disclosure of personal information, including by taking action under its Notifiable Data Breach (NDB) Scheme obligations.

External service providers who handle personal information about the National Archives' staff, users or other individuals are ordinarily bound contractually to comply with the Privacy Act and may themselves have statutory obligations as APP entities in their own right.

It is also ordinarily a requirement for staff and contractors and service providers to comply with the Privacy Act in fulfilment of their obligations under:

• Public Service Act 1999
• Public Service Regulations 1999
• Australian Public Service (APS) Values
• APS Code of Conduct
• the terms of their engagement.

If employees disclose official information without authority they may face disciplinary sanctions including, in the most serious cases, termination of employment.

3. Visiting the National Archives’ website

Protecting privacy online

The National Archives is committed to protecting privacy online in accordance with the Office of the Australian Information Commissioner's Guide to securing personal information.

While the National Archives makes every effort to secure information transmitted to the website over the internet, there is a possibility that this information could be accessed by a third party while in transit.

3.1 Email Communication

There are inherent risks associated with the transmission of information over the internet, including via email. The National Archives will record an individual's email address when in correspondence with them. All correspondence and comments supplied to the National Archives will be stored for a period of time as set down in the Administrative Functions Disposal Authority. The National Archives will use an individual's email address only for the purpose for which it was provided. If this is of concern to any individual, they should use other methods of communication with the National Archives, such as post or phone.

3.2 Visiting the Website

The National Archives makes a record of an individual's visit to this site, including through the use of cookies, and logs the following information for statistical purposes:

• server address
• top-level domain name (e.g. .gov, .com, .edu, .org, .au, .nz, etc.)
• which pages are accessed and which documents are downloaded
• the date and time of an individual’s visit
• the previous site they visited
• operating system (e.g. Windows, Mac)
• which browser was used (e.g. Internet Explorer)
• the age group the individual falls into
• the individual's gender
• the individual's topics of interest.

The National Archives will not attempt to identify an individual's browsing activities except, in the unlikely event of an investigation, where a law enforcement agency may exercise its authority to inspect the service provider's logs. For information on use and disclosure of personal information please see the text in this policy about APP 6.

The National Archives' website uses the Department of Finance's GovCMS Content management platform and web hosting service. The Department of Finance may, in its role as a service provider of GovCMS, collect and use Website Analytics data collected from the website for the purpose of providing services to the National Archives. For further information, please refer to the Department of Finance's GovCMS Privacy Policy.

The National Archives' online shop

The National Archives' online shop provides a secure connection to customer browsers, providing surety that personal details and credit card numbers are safe when shopping online.

The following link provides more information about safe shopping online with the National Archives.

3.3 Social Networking Services

The National Archives uses social networking services and entities including: Brolly, Facebook, Twitter, Instagram and Youtube to engage with the public. When communicating with the National Archives using these services the National Archives may collect personal information through third parties to help us engage with the public. The social networking service will also handle individuals' personal information for its own purposes. Brolly, Facebook, Twitter, Instagram and Youtube each have their own privacy policies.

3.4 Data Breaches

In accordance with the Office of the Australian Information Commissioner's Notifiable Data Breach (NDB) Scheme, the National Archives must notify individuals if a suspected data breach is likely to cause them serious harm.

Examples of serious harm include:

• identity theft, which can affect an individual’s finances and credit report
• financial loss through fraud
• a likely risk of physical harm
• serious psychological harm
• serious harm to an individual’s reputation.

For more information, please refer to the Office of the Australian Information Commissioner's Data breach notification - A guide to handling personal information security breaches.

The National Archives will provide timely advice to any individual’s impacted to ensure they are able to manage any loss that may result from the breach.

4. Complaints

4.1 National Archives complaint-handling commitment

The National Archives is committed to timely and fair resolution of complaints including those relating to compliance with the APPs.

General enquiries about the National Archives' compliance with the APPs can be made to the National Archives' Privacy Contact Officer who can be contacted at privacy@naa.gov.au.

Complaints about the National Archives' personal information handling practices can also be made directly to the Office of the Australian Information Commissioner (OAIC).

If a complaint is received by the National Archives about a breach to the APPs or any registered binding APP code, the National Archives' will investigate the complaint.

The result of the investigation will be documented and communicated to the appropriate parties, including the complainant and/or the individual who is the subject of the personal information. The National Archives will examine the processes around the collection, use and disclosure of personal information to ensure issues or gaps are identified and rectified to avoid future breaches.

4.2 How to make a complaint

Individuals can make complaints about how the National Archives handles personal information. Complaints should be made in writing to the National Archives' Privacy Officer (details below).

If National Archives receives a complaint about how we have handled personal information, we will determine what (if any) action should be taken to resolve the issue.

If the complaint is about misconduct of a National Archives’ employee, we will assess and handle the complaint using the APS Values and Code of Conduct and the guidelines issued by the Australian Public Service Commission.

The National Archives will respond to complaints within 30 days. If individuals are not satisfied with the National Archives’ response, they may escalate their complaint to OAIC.

5. Contacting the National Archives' Privacy Officer

In accordance with APP 1, an individual may contact the Privacy Contact Officer to:

• obtain access to their personal information
• make a complaint about a breach of their privacy
• query how their personal information is collected, used or disclosed
• request a free copy of this APP Privacy Policy
• ask questions about this APP Privacy Policy.

The National Archives' Privacy Officer may be contacted by any of these contact points:

Privacy Officer

National Archives of Australia

Post: PO Box 4924, Kingston ACT 2604

Email: privacy@naa.gov.au

Telephone: 02 6212 3600

6. Authorisation

This policy has been approved by:

David Fricker

Director-General

1 March 2021