Our Privacy Policy

UNSW College operates in complex regulatory and privacy compliance regimes established under both the federal and state legislative frameworks.

As a not-for-profit organisation with an annual turnover exceeding $3 million, UNSW College falls within the definition of an ‘organisation’ in the Privacy Act 1988 (Cth) and is required to comply with that act as an “APP entity”. UNSW College is also:

1. a "related body corporate” of UNSW Sydney as that term is defined by sections 46 and 50 (b) of the Corporations Act 2001 (Cth)); and
2. a “controlled entity” of UNSW Sydney, as that term is defined by section 15A of the University of New South Wales Act 1989 (NSW); and
3. a “public sector agency” as that terms is defined by section 3 (d) of the Privacy and Personal Information Protection Act 1998 (NSW) (PIPPA) and section 4 (d) of the Health Records and Information Privacy Act 2002 (NSW) (HRIPA).

As such, UNSW College may be also required to comply with PIPPA and HRIPA.

UNSW may also collect data on citizens in European Union (EU) countries or process personal data of European residents and as such may need to comply with the General Data Protection Regulation (GDPR).

The purpose of this policy is to outline:

1. the Personal Information handling practices of UNSW College,
2. the way individuals can access their Personal Information to seek the correction of it; and
3. how individuals may make a complaint to UNSW College about the mishandling of their Personal Information.

This Policy applies to:

1. all UNSW College staff working for or on behalf of UNSW College
2. all UNSW College Students
3. parents or guardians of UNSW College Students who are under 18 years of age and School Students
4. third parties, such as customers, Business Partners and Service Providers of UNSW College.

Note: definitions of personal, sensitive and health information in this policy are taken from the Privacy Act 1988 (Cth) unless stated otherwise.

Australian Privacy Principles (APPs) means the 13 Privacy Principles set out in Schedule 1 of the Privacy Act 1988 (Cth) which outline how APP entities must handle, use and manage personal information.

APP entity means an agency or an organisation, including all private sector and not-for-profit organisations with an annual turnover of more than $3 million, all private health service providers and some small businesses.

Business Partner means a person who is part of a business partnership, collaboration or similar arrangement with UNSW College.

Consent means ‘express consent or implied consent’. The four key elements of consent are:

1. the individual is adequately informed before giving consent
2. the individual gives consent voluntarily
3. the consent is current and specific, and
4. the individual has the capacity to understand and communicate their consent.
   

Controller according to the GDPR means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data

CRICOS Code means the Australian Commonwealth Register of Institutions and Courses for Overseas Students.

Direct marketing means the use and/or disclosure of personal information to communicate directly with an individual to promote goods and services. A direct marketer may communicate with an individual through a variety of channels, including telephone, SMS, mail, email and online advertising.

Express consent means consent given explicitly, either orally or in writing. This could include a handwritten signature, an oral statement, or use of an electronic medium or voice signature to signify agreement.

Eligible Data Breach means data breach where:

• both of the following conditions are satisfied:
  • there is unauthorised access to, or unauthorised disclosure of, the information;
  • a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates; or
• the information is lost in circumstances where:
  • unauthorised access to, or unauthorised disclosure of, the information is likely to occur; and
  • assuming that unauthorised access to, or unauthorised disclosure of, the information were to occur, a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates.

GDPR means the General Data Protection Regulation

Health Information as defined by the Privacy Act 1988 (Cth) means:

• information or an opinion about:
  • the health or a disability (at any time) of an individual; or
  • an individual’s expressed wishes about the future provision of health services to him or her; or
  • a health service provided, or to be provided, to an individual; that is also personal information; or
• other personal information collected to provide, or in providing, a health service; or
• other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or
• genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

HRIPA means the Health Records and Information Privacy Act 2002 (NSW)

Information Protection Principles (IPPs) means the 12 Principles set out in Part 2, Division 1 of the PIPPA outlining legal obligations which NSW public sector agencies, statutory bodies, universities and local councils must abide by when they collect, store, use or disclose personal information.

Implied consent arises where consent may reasonably be inferred in the circumstances from the conduct of the individual and the APP entity.

Notifiable Data Breach means a scheme that requires agencies and organisations to notify individuals whose personal information is involved in a data breach that is likely to result in serious harm and to notify Australian Information Commissioner of Eligible Data Breaches.

OAIC means the Office of the Australian Information Commissioner.

Overseas Recipients means a person or entity who is not in Australia or an external Territory, and is not the entity or the individual, and includes UNSW College staff in UNSW College’s subsidiary companies located overseas and education agents.

Permitted General Situation has the meaning in section 16B of the Privacy Act 1988 (Cth).

Personal Information as defined by the Privacy Act 1988 (Cth) means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

1. whether the information or opinion is true or not; and
2. whether the information or opinion is recorded in a material form or not.

Examples of Personal Information include:

1. a record which includes an individual’s name, address, date of birth, mobile phone number, email address;
2. photographs, images, video or audio footage of an individual;
3. the fingerprints, blood or DNA samples of an individual.

PIPPA means the Privacy and Personal Information Protection Act 1998 (NSW).

Privacy Laws means the Privacy Act 1988 (Cth), PIPPA and HRIPA.

Privacy Principles means Australian Privacy Principles and/or Information Protection Principles

Processor according to the GDPR means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

School Student means a person formally engaged in learning, usually one enrolled in a primary or secondary school.

Sensitive Information is defined in s.6 of the Privacy Act 1988 (Cth) to mean:

• information or an opinion about an individual's:
  • racial or ethnic origin; or
  • political opinions; or
  • membership of a political association; or
  • religious beliefs or affiliations; or
  • philosophical beliefs; or
  • membership of a professional or trade association; or 
  • membership of a trade union; or
  • sexual orientation or practices; or
  • criminal record;
  • that is also Personal Information; or
• Health Information about an individual; or
• genetic information about an individual that is not otherwise health information; or
• biometric information that is to be used for the purpose of automated biometric
• verification or biometric identification; or
• biometric templates.

Serious harm means serious physical, psychological, emotional, economic and financial harm, as well as serious harm to reputation and other forms of serious harm that a reasonable person in the entity’s position would identify as a possible outcome of the data breach.

Service Provider means a third party that provides services on behalf of UNSW College to UNSW College Students and/ or staff under a written agreement.

UNSW College Student means a student who is enrolled with UNSW College or a person who has submitted an application for admission to UNSW COllege.

UNSW Sydney means the University of New South Wales (ABN 57 195 873 179).

UNSW Global Pty Ltd is committed to only collect, hold, use and disclose Personal Information that is needed to carry out its functions and activities and to handle the information in accordance with the Privacy Laws and other applicable data protection laws. It is UNSW College policy to:

1. only collect Personal Information for a lawful purpose, which is directly related to UNSW College’s functions and activities;
2. not to collect Health Information or Sensitive Information from an individual unless the individual consents to the collection of the information or unless the collection of the information is required or authorised by or under an Australian law;
3. only collect Personal Information directly from the individual concerned, unless the person has authorised collection from someone else, or where the person is under the age of 16, the information has been provided by a parent or guardian;
4. inform the person concerned that UNSW College collects their Personal Information, the reason for collecting the information, how it is going to be used and disclosed (if applicable) and how the person can access and correct the information;
5. use all reasonable endeavours to ensure the collected information is relevant, accurate, complete, up to date and not excessive;
6. store Personal Information securely and protect it from unauthorised access, use modification or disclosure and destroy or de-activate the information if it is no longer needed;
7. provide access for individuals to their Personal Information and allow to update, correct or amend their Personal Information where necessary; 
8. only use Personal Information for the purpose it was collected unless the person has given their consent or if exemptions apply;
9. only disclose Personal Information with a person’s consent or if exemptions apply.

5.1 UNSW College Functions

UNSW College operates in educational areas that are ancillary to the core business (research and degrees) of UNSW. UNSW College’s core function is education though this is supported by a number of functions including IT, finance, human resources, legal & compliance and sales & marketing

5.2 Collecting Personal Information

5.2.1 UNSW College may collect the following information:

1. Personal Information, such as: the individual’s name, date of birth, contact details, including postal and residential address, email address, phone number and/or mobile number (see Annexure 1 for further examples);
2. Sensitive Information, such as: racial or ethnic origin or criminal record.
3. Health Information, such as: information or opinion about the health or a disability of an individual, e.g. professional medical practitioner certificates.

5.2.2 UNSW College may collect Personal Information, Sensitive Information and Health Information in a number of ways, including the following:

1. Directly from individuals or their authorised representative, for example when the individuals: complete online or hardcopy forms; submit assessment materials, applications, instructions or invoices; speak with UNSW College staff in person or by telephone; correspond with UNSW College by letter or email; use UNSW College websites or social media platforms; or participate in UNSW College’s marketing initiatives.
2. Indirectly from education agents and Service Providers where an individual gave consent for the information to be collected and disclosed to UNSW College, or as otherwise legally permitted by applicable privacy law.
3. Automatically through digital communication information from search engines or UNSW College website hosts (including through the use of cookies and similar technology). This information includes the individual’s Internet Protocol (IP) address and the web pages visited immediately before and after accessing UNSW website.

5.2.4 UNSW COllege informs individuals that it collects their Personal Information, either at or before the time of collection, or as soon as practicable thereafter, either through a form used to collect the information or by giving a notice to individuals or by otherwise ensuring that the individuals are aware of the collection of their Personal Information. The notification will be in writing wherever possible.

5.2.5 Further examples of UNSW College’s functions and activities and the type of Personal Information collected are outlined in Annexure 1.
 

5.3 Consent

Where necessary and as required by law, UNSW College may seek specific consents from an individual to collect, use and disclose the individual’s information.

5.3.1 Consent must be sought when:

• UNSW College collects Sensitive Information about an individual, unless the collection of the information is required or authorised by or under an Australian law or a court/tribunal order;
• The use or disclosure of Personal Information is not directly related to the primary purpose of collection, unless:
  • the individual would reasonably expect UNSW College to use or disclose the information for the secondary purpose or the use; or
  • the disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order;
• UNSW College collects and uses Personal Information, such as testimonials or photos of an individual in marketing or advertising materials. Note, consent is only required where the person's identity is clear or can UNSW Global Pty Limited | ACN 086 418 582 | CRICOS Provider Codes 01020K and 00098G (UNSW) Page 9 of 22 reasonably be ascertained from an image or a video, and in case of testimonials, where the testimonial contains personally identifiable information. UNSW College staff may obtain copies of the Student Consent Form and the Parent/Guardian Consent Form as relevant to their activities by visiting the Forms page on our Intranet website, available here: https://intranet.unswcollege.unsw.edu.au/Policy/SitePages/Home.aspx.
• The use or disclosure of Personal Information is for the purpose of direct marketing, unless certain exceptions under the law apply;
• UNSW College discloses Personal Information about an individual to an Overseas Recipient, unless:
  • the Overseas Recipient of the information is subject to a law that has the effect of protecting the information similar to the Australian Privacy Principles; and
  • there are mechanisms that the individual can access to take action to enforce that protection of the law; or
  • the disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or
  • the disclosure of the information is required or authorised by or under an international agreement relating to information sharing to which Australia is a party; or
  • UNSW College reasonably believes that the disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body, and the Overseas Recipient is a body that performs functions, or exercises powers, that are similar to those performed or exercised by an enforcement body.

5.3.2 Consent is not required if there is a Permitted General situation, for example, UNSW College reasonably believes that the collection, use or disclosure is necessary:

• to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety;
• where UNSW College has reason to suspect that unlawful activity, or misconduct of a serious nature that relates to UNSW College’s functions or activities has been, is being or may be engaged in, the collection, use or disclosure is necessary in order for UNSW College to take appropriate action in relation to the matter; or
• UNSW College reasonably believes that the collection, use or disclosure is reasonably necessary to assist any APP entity, body or person to locate a person who has been reported as missing
  

5.4 Anonymity and Pseudonymity

1. For most of its functions and activities, UNSW College needs Personal Information from identifiable individuals to perform its operations, e.g. to deliver educational services, to conduct educational assessments, or to handle an inquiry or complaint etc. 
2. Where practicable, an individual can choose not to identify themselves or to use a pseudonym. For example, if an individual calls UNSW College to make a simple enquiry, they will not be asked about their name and contact details unless this information is needed to provide a response.

5.5 Storage, Security and Displosal

1. Where practicable, UNSW College will seek to ensure that Personal Information is stored securely within Australia.
2. Where UNSW College engages Service Providers to store Personal Information, UNSW College will seek assurance in its contracts with the Service Providers that they will comply with applicable privacy and data protection law.
3. UNSW College has processes in place to limit access to Personal Information and to prevent unauthorised access, by using measures, such as: user identification, the encryption of data or different level of user access.
4. UNSW College staff are permitted to email or otherwise transfer Personal Information held on UNSW College’s systems to outside systems (such as their personal email accounts or file hosting services) only if it is if absolutely necessary, i.e. for a justified academic, research or business need, and if it is done in accordance with the UNSW College IT Security Policy: 5.13 Bring Your Own Device (BYOD) Policy and relevant procedures.
5. UNSW College will securely destroy or de-identify Personal Information it holds once the Personal Information is no longer needed for any purpose for which the information was collected. This requirement does not apply where the Personal Information is contained in a Commonwealth or state record (for the purposes of records retention laws) or where UNSW College is otherwise required by law to retain the information.

5.6 Direct Marketing

1. UNSW College may use Personal Information collected directly from an individual for the purpose of direct marketing, provided that individual has opted in to receive such communications.
2. An individual can request not to receive direct marketing communications from UNSW College by opting out of receiving future emails or SMSs.
3. UNSW College provides information about how to opt out in each direct marketing communication.

5.7 Disclosing Personal Information

• UNSW College is a related body corporate and a controlled entity of UNSW Sydney. Section 13B of the Privacy Act 1988 (Cth) permits UNSW College to disclose Personal Information to UNSW Sydney as is necessary to carry out its activities and functions, including those set out in paragraphs 5.1 and 5.2 above and in Annexure 1.
• UNSW College may disclose Personal Information to other third parties in the following cases:
  • to UNSW College’s agents, consultants, contractors and Service Providers who assist UNSW College in running its business or provide related services, and who are subject to security and confidentiality obligations;
  • to UNSW College Business Partners, to the extent they are involved in the provision of UNSW College services to customers;
  • where an individual has consented the disclosure to a third party; or
  • if the law allows or requires UNSW College to do so.
• UNSW College will not disclose Sensitive Information without obtaining the consent of the individual unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person or in accordance with section 16A of the Privacy Act (Cth)
• While UNSW College’s main teaching venues are in New South Wales, it operates in more than 20 countries worldwide, predominantly in the Asia-Pacific region. UNSW College may disclose Personal Information, outside New South Wales, to Commonwealth government agencies or to Overseas Recipients where:
  • UNSW College has taken reasonable steps to ensure the Overseas Recipient does not breach the Privacy Principles in relation to the information; or
  • UNSW College reasonably believes that the Overseas Recipient is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the information, and there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme;
  • the individual has expressly consented for UNSW College to do so; or
  • as set out in paragraph 5.3.2 of this Policy.

5.8 Privacy Impact Assessment

When developing or reviewing a project, such as: new or amended programs, activities or databases, UNSW College may consider the need for a Privacy Impact Assessment (PIA). A PIA identifies how a project can have an impact on individuals’ privacy, and makes recommendations for managing, minimising or eliminating privacy impacts.

5.9 Notifiable Data Breach

In the case of an Eligible Data Breach UNSW College will inform the OAIC and affected individuals in the manner required by the Privacy Act 1988 (Cth).

5.10 The General Data Protection Regulations (GDPR)

The GDPR and the Privacy Act 1988 (Cth) share many common requirements, however, there are also some notable differences. Where UNSW College is engaging in business in the European Union that is likely to result in data being collected or processed in relation to European residents, please contact the Legal and Compliance team, who can advise on the nature of responsibilities that UNSW College may have under the GDPR, before you start activities.

5.11 The General Data Protection Regulations (GDPR)

The GDPR and the Privacy Act 1988 (Cth) share many common requirements, however, there are also some notable differences. Where UNSW College is engaging in business in the European Union that is likely to result in data being collected or processed in relation to European residents, please contact the Legal and Compliance team, who can advise on the nature of responsibilities that UNSW College may have under the GDPR, before you start activities. Accessing and correcting Personal Information If an individual believes that the Personal Information which UNSW College holds about them is inaccurate, out-of-date, incomplete, irrelevant or misleading they have the right to request the information to be corrected. To request amendment of his/her Personal Information, the individual should:

1. Provide his/her personal and contact details, and describe the Personal Information about him/her that they would like to amend, providing the reasons that he/she considers the information to be incomplete, incorrect, out-of-date, or misleading;
2. Send the request to the attention of the UNSW College Privacy Officer:
   

   By email:	legalandcompliance@unswcollege.edu.au
   By post:	Legal and Compliance Team UNSW Global Pty Limited 223 Anzac Parade Kensington NSW 2033

3. To prevent adverse consequences of unauthorised disclosure of Personal Information, UNSW College will verify the individual’s identity and authority to request the change prior to processing the request.
4. There is no fee to request correction of Personal Information.
5. UNSW College will aim to respond to the request within 30 days.

5.12 Complaints about handling Personal Information

If an individual believes that UNSW College has misused their Personal Information they can contact the UNSW College Privacy Officer to discuss and try to resolve the issue informally, or lodge an application for a formal review with UNSW College, or complain to the OAIC. UNSW Global Pty Limited | ACN 086 418 582 | CRICOS Provider Codes 01020K and 00098G (UNSW) Page 13 of 22 Please note that the OAIC generally requires individuals to complain directly to the agency or organisation (in this case, UNSW College) and allow 30 days for it to respond before the individual can lodge a complaint with the OAIC. To lodge an application for a formal review with UNSW College, an individual should:

• Complete a Complaint Form in line with the UNSW College Complaints and Appeals Policy within twelve (12) months of the time an individual became aware of the misuse of their personal information. The Complaint Form is available at Annexure 2 of this Policy.
• The complaint can be made about:
  • Collection of Personal Information;
  • Security or storage of Personal Information; 
  • Refusal to access or find out about Personal Information;
  • Accuracy of Personal Information;
  • Use of Personal Information; and
  • Disclosure of Personal Information.
• Email or post the form to the UNSW College Privacy Officer.
• The individual will be informed in writing of the result of the review.
• UNSW College aims to respond to the complaint within 10 working days. If the complaint is complex and requires more extensive investigation, UNSW College will use all reasonable endeavours to complete the review within 30 days.
• If the individual is unhappy with the result of the review he/she can lodge a complaint with the OAIC. Information on how to lodge a complaint can be found on the OAIC website

This Policy sets the foundation for UNSW College compliance with the following legal and regulatory requirements:

1. Health Records and Information Privacy Act 2002 (NSW) (HRIP Act)
2. Privacy Act 1988 (Cth)
3. Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act)
4. Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth)

1. Approver
   The Chief Executive Officer is responsible for the approval of this policy. UNSW Global Pty Limited | ACN 086 418 582 | CRICOS Provider Codes 01020K and 00098G (UNSW) Page 14 of 22
2. Responsible Officer
   The Head of Legal and Compliance is responsible for the implementation, dissemination and review of this policy.
3. Contact Officer (if applicable)
   The Associate Legal Counsel is responsible for the day to day implementation of this policy and is the first point of contact for all enquiries that relate to this policy. (d) Legal and Compliance Team The Legal and Compliance Team is responsible for the administration and publishing of this policy.
4. Staff, Supervisors and Executives
   UNSW College staff, supervisors and executives are responsible for assisting in the implementation of and adherence to this policy. 

This policy is due for review three (3) years from its date of implementation or in case of legislative or regulatory changes.

1. Privacy Impact Assessment Form - available to staff in the Form List section of our Policy Intranet site: https://intranet.unswcollege.unsw.edu.au/Policy/SitePages/Home.aspx.

N/A

Office Use Only