Privacy Policy Cancer Council Tasmania

The Privacy Act 1988 (‘the Act’) and the Personal Information Protection Act 2004 (Tas) recognises that people are protective of their personal details and places strict limits on how such information is collected and handled by private sector organisations. The Spam Act 2003 regulates the sending of commercial email and other commercial electronic messages and notes that unsolicited commercial electronic messages must not be sent. Cancer Council Tasmania (CCT) is committed to protecting personal and health information in accordance with these laws.

Any recorded information which can identify a person is subject to this legislation and the National Privacy Principles (‘NPP’s). Under the Act, CCT’s business activities fall under the definition of ‘health service provider’. As a result, there are certain obligations, rights and responsibilities incumbent upon CCT concerning privacy and confidentiality.

PURPOSE

CCT understands that personal information can be used to identify a person and should only be used in limited circumstances. Personal information concerning employees is confidential. CCT will only collect, handle and use this information to provide services to the community, conduct research, advocacy and fundraising activities and evaluate the effectiveness of our services and activities.

This Policy outlines the circumstances surrounding the disclosure of personal information and outlines the policy on all matters of Privacy as it relates to our business. This Policy covers:

• All staff
• Volunteers
• Financial supporters of CCT
• Persons who are the subject of research conducted by and/or for CCT
• Stakeholders involved in the delivery of our services
• Clients whose personal/clinical details are maintained in CCT databases.

This Policy covers authorised uses of (and access to) data owned by CCT and should be read in conjunction with CCT’s Data Access Policy and Data Access Guidelines.

APPLICATION

1. Categories of Information

The categories of information CCT collects are defined in the Act as Personal Information, Sensitive Information and Health Information (“Information”).

1.1 Personal Information

Personal Information is any information or opinion that can be used to identify a person or whose identity is reasonably ascertainable from the information or opinion. This includes any opinions about the person, whether true or not, no matter how the information or opinions are recorded.

1.2 Sensitive Information

Sensitive Information is information about a person’s health, race or ethnic origin, political or religious beliefs or affiliations, membership of a trade union or association, sexual preferences, or criminal record.

1.3 Health Information

Health information is personal information that is also information or an opinion about the physical, mental or psychological health of an individual, a disability of an individual, an individual's expressed wishes for the future provision of their healthcare, or a health service provided to an individual.

2. The information We Collect

We collect Information from individuals both to whom we provide, and who help us provide, our services. This includes persons with cancer and their next of kin, employees, job applicants, donors, research study participants, recipients of support services, participants in advocacy campaigns, participants in education and training programs, health promotion projects or fundraising campaigns, health professionals, suppliers, volunteers, users of our social media pages and applications and our service providers.

The Information we collect will depend on the stakeholder the purpose for which it is collected. We only collect Information that is reasonably necessary to perform our functions or activities.

The kinds of Information CCT collects may include:

• name, date of birth and gender;
• contact information including residential address, email address and telephone number(s);
• details regarding ethnicity e.g. country of birth, Aboriginal or Torres Strait Islander descent or language/s spoken at home;
• payment or billing information including bank account details, credit card details, billing address and invoice details;
• current location, for our mobile applications and where consent is provided for this collection;
• details relating to the services supplied to an individual; and
• username and password for accounts set up on our websites.

We may also collect the following types of information from the following specific stakeholders:

2.1 A person affected by cancer:

• health information and medical history as related to a cancer experience, including the type of cancer diagnosis, treatments, genetic and biometric information.

2.2 A person who connects with Quitline:

• health information and medical history relevant to smoking and/or vaping.

2.3 A job applicant, service provider, employee or volunteer:

• employment history, qualifications, resume and job references;
• fitness for work, including police checks and security information from government agencies or departments (including Working with Vulnerable People registration information), health assessments and other personal information as part of the job application process (only if appropriate and in compliance with the law);
• banking details to process payments such as wages; and
• government related identifiers, such as Tax File Number in compliance with relevant laws.

2.4 A public participant in CCT or National Cancer Council fundraising and support schemes and campaigns:

• opinions via surveys and questionnaires;
• insurance policies and details, which are only collected in limited circumstances such as where qualification for a particular CCT or national Cancer Council program requires certain insurances; and
• details relating to donations made to us.

2.5 A program stakeholder, a person involved in the delivery of CCT services;

• Any opinions/ feedback on Cancer Council Tasmania; and
• Information regarding the delivery of the program, including participant feedback

Where practicable, individuals can deal with us anonymously, by using a pseudonym. They can also choose to not provide us with some or all of their Information, noting this may affect our ability to help or service individuals as fully as we would like.

3. How we Collect Information

Where reasonably practicable, CCT will collect Information directly. This may be in person, on the telephone, by mail or online.

CCT may collect Information from third parties such as contractors (including fundraising service providers) who provide services to us and from health professionals and next of kin (for example when consent has been provided). Information about individuals will not be provided directly to another stakeholder unless a waiver has been granted.

When accessing CCT’s website, CCT or a third-party service providers, may use “Cookies” (small data files placed on an person’s device that do not identify individuals personally but do identify devices).

Software (such as Javascript), or similar technology, which allows us to:

• Maintain the continuity of an individual’s browsing session;
• Remembers the individua’s details and preferences when they return;
• Use Google Analytics to collect information such as demographics and interests, visits to our websites, length of visit and pages viewed; and
• Tailor our advertising through advertising networks on other websites.

Individuals are able to set their browser to notify them when they receive a Cookie and this will provide them with an opportunity to either accept or reject it in each instance. Individuals will be informed that rejecting Cookies may may affect some of the functions on our website.

CCT may also gather individual IP addresses as part of our business activities and to assist with any operational difficulties or support issues with our services. This information does not identify individuals personally.

When individuals use our mobile applications, we may collect Information from them, such as their profile, location and other relevant information, which is used to provide our Services. By providing us with this information, the individual is consenting to our collection and use of this information.

4. How we Use Information

In addition to collecting and using an individual’s information in order to carry out our services, the following statement is provided to explain how we use this information:

“CCT may collect Information to conduct and/or fund research into cancer causes, as well as prevention, diagnosis, treatment and survivorship. We also collect information to ensure we deliver our support services effectively to our clients. Information collected for these purposes is not used for direct marketing unless your consent is obtained.

We may use Information, including your name, contact phone number, address and email address, to send marketing and promotional information by post, email, social media or telephone including SMS. You may opt-out of receiving direct marketing communications from us at any time. If you do not opt-out, we will assume we have your ongoing consent to send information and communications.

Depending on what services we are carrying out, we may collect Information for several purposes, including:

• To manage queries from or about a prospective, current or past employee;
• To provide information and support services, and to evaluate and report on these services;
• To provide information about cancer risk factors, such as UV exposure, tobacco and obesity, and to seek your support for campaigns;
• To facilitate your participation, including through making travel and other logistical arrangements;
• To enable individuals to assist us with volunteering, community fundraising, advocacy and other activities where we seek the community’s assistance; and
• Communicating with individuals in relation to our operations, activities and objectives, to verify their identity, to improve and evaluate our programs and services and to comply with applicable laws.

Whenever practicable, we will provide you with a collection statement setting out the purpose for the collection and how you can contact us regarding your Information.”

5. Use and Disclosure of Information

CCT will always endeavour to:

• Only use or disclose Information about an individual in ways that are consistent with an individual’s reasonable expectations.
• Only use or disclose information about an individual for the purpose it was collected unless the person would reasonably expect such use or disclosure.
• Take reasonable steps to make sure that the information collected, used or disclosed is accurate, complete and up to date.
• Take reasonable steps to protect the information it holds from misuse and loss, and from unauthorised access, modification, or disclosure.
• Take reasonable steps to destroy information if it is no longer needed or permanently de-identify personal information if it is retained for historical or trend purposes.
• Only transfer Information to a recipient in a foreign country in circumstances where the information will have appropriate protection that is consistent with the National Privacy Principles.
• Only release de-identified research information to researchers who have;
  • Complied with the requirements of CCT’s Research Data Access Policy (A06), and
  • Provided evidence that they have obtained Ethics Approval from an appropriate Human Research Ethics Committee (HREC), in accordance with the legally binding guidelines issued by the National Health and Medical Research Council (NHMRC), and
  • If required, have entered into a Memorandum of Understanding with CCT regarding limitations to the use of the requested data.

Other disclosures may include:

• External service providers: to health care professionals, lawyers, counsellors, auditors, financiers, volunteers, agencies and not-for-profits that provide us or the individual with services (only in limited and appropriate circumstances necessary to carrying out our Services);
• Other charities: we may provide de-identified statistical information to other charities for marketing purposes;
• Contractors and service providers who perform services on our behalf, such as mailing houses, printers, information and web-based technology services providers (including interstate or offshore cloud computing service providers), archiving services, database contractors and marketing agencies to perform services on our behalf;
• Partners in our education and training programs who may liaise with our stakeholders to facilitate an individual’s participation and provide post-program support, and
• Cancer Council Australia and other affiliate State and Territory Cancer Councils.

6. Security of Information

CCT stores Information electronically and in hard copy. We will take all reasonable steps to secure Information and protect it from misuse, interference or loss and from unauthorised access, modification or disclosure. Some of the ways we do this include:

• storage of electronic Information using a password protected electronic database;
• storage of hardcopy Information on secure premises only accessible by authorised people;
• using Secure Socket Layer (SSL) certificates for encrypting credit card and debit card numbers;
• encrypting financial information on our servers and restricting access to this information to authorised CCT staff; and
• backing up and archiving Information using secure archiving services.

Where Information is stored with a third party, CCT has arrangements in place which require those third parties to maintain the security of the information. CCT takes reasonable steps to protect the privacy and security of that information. However, if an individual communicates with us via email or over the internet we cannot guarantee its security and we will always ask people to let us know if they believe any of the Information we may hold about them has been compromised in any way, we communicate with them to let us know immediately so that we can investigate.

7. How to Access Information

CCT will give an individual access to Information it holds about that individual on request, and subject to the applicable privacy laws. If CCT holds information and the individual is able to establish that the information is not accurate, complete or up to date reasonable steps will be taken to correct that information.

If for any reason CCT denies access to any part of the Information that is requested, reasons for denial of access or correction will be provided.

8. How Information can be Updated

Individuals can ask CCT to correct or update Information we hold about them at any time. CCT will verify a person’s identity before making any corrections or changes to their information. We also have obligations to take reasonable steps to correct Information we hold once we have been notified that it is inaccurate, out-of-date, incomplete, irrelevant or misleading for the purpose for which it is held.

9. Data Deletion

CCT is committed to protecting personal information. Our data deletion processes are designed to allow individuals to request the removal of their personal data from our systems in accordance with applicable laws and regulations. Upon receiving a valid request to reception@cancertas.org.au, we will take reasonable steps to securely delete or anonymize personal information, except where retention is required by law, for legitimate business purposes, or to complete ongoing transactions.

10. Complaints

If an individual wishes to make a complaint about our handling of their Information, we communicate that they can contact us. CCT will investigate the complaint and endeavour to provide a response within 30 days of receipt of the complaint. If the individual is not satisfied that their complaint has been resolved , they will be advised to make a complaint to the Office of the Australian Information Commissioner (OAIC) which deals with complaints under the Privacy Act 1988 in relation to personal information. The OAIC can be contacted at:

Website: https://www.oaic.gov.au/about-us/contact-us-page

Telephone number: 1300 363 992

In writing: Office of the Australian Information Commissioner

GPO Box 5218, Sydney, NSW, 2001

VARIATION

CCT reserves the right to vary, replace or terminate this Policy from time to time.

ASSOCIATED DOCUMENTS

A06 - CCT Research Data Access Policy

Privacy Act 1998 - www.legislation.gov.au/Details/C2014C00076

Spam Act 2003 - www.legislation.gov.au/Details/C2016C00614

Personal Information Protection Act 2004 - https://www.legislation.tas.gov.au/view/whole/html/inforce/current/act-2004-046

Cancer Council Tasmania aspires to create a culturally safe environment, which is spiritually, socially and emotionally safe for people; where there is no assault, challenge or denial of their identity, of who they are and what they need. It is about shared respect, shared meaning, shared knowledge and experience, of learning together with dignity, and listening and responding to their cultural needs.