• Section 1 - Purpose and Scope
• Purpose
• Scope
• Legal Context
• Section 2 - Principles and Key Requirements
• Information Privacy Principles
• Access and Amendment of Personal Information
• Privacy Complaints
• Privacy Breaches
• Section 3 - Roles, Responsibilities and Accountabilities
• UQ Staff
• Managers of Organisational Units
• Right to Information and Privacy Office
• Section 4 - Monitoring, Review and Assurance
• Section 5 - Recording and Reporting
• Section 6 - Appendix
• Definitions

Section 1 - Purpose and Scope

Purpose

(1) As a statutory body established by the University of Queensland Act 1998 (Qld) (UQ Act), The University of Queensland (UQ) is subject to various State, Commonwealth and international legislative requirements (relevant privacy laws) in relation to how it collects, stores, provides access to, uses and discloses personal information. 

(2) This Policy outlines UQ’s obligations and expectations regarding the management of personal information in accordance with relevant privacy laws.

Scope

(3) This Policy applies to all staff.

Legal Context

(4) As a public university established under Queensland law, UQ’s privacy obligations are primarily governed by Queensland’s Information Privacy Act 2009 (IP Act) and its eleven Information Privacy Principles (IPPs). At various times, and with respect to certain information, UQ may also have privacy obligations under other jurisdictions as outlined below.

Commonwealth Privacy Act 1988 and the Australian Privacy Principles

(5) UQ is generally not an “agency” nor an “organisation” for the purposes of the Privacy Act 1988 (Cth) (Privacy Act), and is generally not subject to the Privacy Act, the Australian Privacy Principles (APPs) or the requirements of the Notifiable Data Breach Scheme (NDB Scheme).

(6) However, limited circumstances in which UQ is subject to the NDB Scheme include:

1. the handling of Tax File Numbers;
2. the handling of information (metadata) retained under section 187A of the Telecommunications (Interception and Access) Act 1979 (Cth) (TIA Act); and
3. where UQ has contractual obligations to comply with the NDB Scheme (e.g. funding agreements which require compliance with the APPs and the NDB Scheme).

(7) In relation to metadata retained under the TIA Act, UQ is an “organisation” for the purposes of the Privacy Act and is subject to the Privacy Act and its APPs in relation to that metadata.

(8) In relation to personal information collected under the Higher Education Support Act 2003 (Cth) and the VET Student Loans Act 2016 (Cth), UQ must comply with the APPs but is not subject to other Privacy Act obligations (such as the NDB Scheme) in relation to the personal information collected under these Acts.

(9) The APPs are similar in operation to Queensland’s IPPs.

General Data Protection Regulation (EU)

(10) UQ may at times be a “data controller”, “joint controller” or “data processor” for the purposes of the European Union’s General Data Protection Regulation (GDPR).

(11) In limited circumstances UQ may have obligations under the GDPR to the extent that it processes personal data in relation to various “GDPR activities”. “Personal data” as defined under the GDPR may include a broader range of information than “personal information” as defined under the IP Act and the Privacy Act (refer to section 6).

(12) UQ is not subject to the GDPR in circumstances where the processing of personal data is not related to a “GDPR activity”, or where UQ does not otherwise have contractual obligations to a data controller with respect to compliance with the GDPR.

Section 2 - Principles and Key Requirements

Information Privacy Principles

(13) UQ is committed to managing personal information it holds in an open and transparent manner, and in accordance with the Information Privacy Principles. To achieve this, UQ will:

1. Only collect personal information that is necessary to fulfil, or directly related to fulfilling, a lawful purpose directly related to a function or activity of UQ.
2. Ensure appropriate notification is provided to (or, where applicable, consent obtained from) an individual when collecting personal information directly from that individual.
3. Take all reasonable steps to ensure that personal information in its control is protected against:
   1. Loss;
   2. Unauthorised access, use, modification or disclosure; or
   3. Any other misuse.
4. As appropriate, provide information about the types of documents that contain personal information in the form of a personal information register.
5. Use and disclose personal information in accordance with the requirements of the IP Act.
6. Adopt privacy-by-design, and manage privacy risks proactively, by undertaking early assessment of privacy impacts and embedding good privacy practices into UQ’s business systems development processes and project management processes.

Access and Amendment of Personal Information

(14) The IP Act provides individuals with the right (subject to certain exemptions and exclusions) to access documents held by UQ that contain the individual’s personal information. The IP Act also provides a right for an individual to request an amendment to UQ documents containing their personal information which the individual considers to be inaccurate, incomplete, out-of-date or misleading.

(15) UQ also maintains a number of administrative access schemes to facilitate individuals’ access to their personal information outside of the IP Act.

(16) The Access to and Amendment of UQ Documents Procedure outline the processes for accessing and/or amending personal information under the IP Act and UQ’s administrative access schemes.

Privacy Complaints

(17) An individual that has concerns about how their personal information is being collected, stored, used or disclosed may make a complaint to UQ’s Right to Information and Privacy Office. The Privacy Management Procedure includes further information about how an individual can make a privacy complaint to UQ and how privacy complaints will be managed.

Privacy Breaches

(18) UQ takes its privacy and cyber-security obligations very seriously.

(19) Upon becoming aware of an actual or suspected privacy breach, UQ staff must report it as soon as possible to UQ’s Right to Information and Privacy Office or Information Technology Services (ITS). UQ will respond to actual or suspected privacy breaches in a timely fashion in accordance with its policies, procedures and processes.

(20) UQ will notify privacy regulators and affected individuals of privacy breaches in accordance with its legislative obligations, and with due regard to applicable guidelines published by the relevant regulators.

Section 3 - Roles, Responsibilities and Accountabilities

UQ Staff

(21) All UQ staff are responsible for:

1. handling personal information in accordance with this Policy; and
2. notifying UQ’s Right to Information and Privacy Office or ITS of actual or suspected privacy breaches as soon as possible.

Managers of Organisational Units

(22) In addition to the responsibilities set out in clause 21, Managers of UQ Organisational Units are responsible for:

1. reviewing the Unit’s personal information holdings and taking steps to ensure that any personal information held within the Organisational Unit is protected from unauthorised access, modification, use or disclosure; and
2. assisting and supporting the investigation of any privacy complaints and/or breaches of this Policy.

Right to Information and Privacy Office

(23) UQ’s Right to Information and Privacy Office is responsible for:

1. providing advice and leadership in relation to privacy compliance across UQ;
2. receiving, processing and responding to privacy complaints and requests to access or amend UQ documents containing an individual’s personal information;
3. where applicable, reporting privacy breaches to the relevant Information Commissioner or privacy regulator, and providing advice to business units on notifying individuals affected by privacy breaches; and
4. providing sufficient training opportunities and awareness-raising materials to enable UQ staff to meet their obligations under this Policy.

Section 4 - Monitoring, Review and Assurance

(24) UQ’s Right to Information and Privacy Office will monitor, review and provide assurance on the effectiveness of this Policy and the operational procedures in place to implement its principles.

Section 5 - Recording and Reporting

(25) UQ’s Right to Information and Privacy Office will oversee UQ’s reporting obligations to management and government authorities as required under the IP Act and other relevant privacy laws.

Section 6 - Appendix

Definitions