Privacy policy

Purpose

The Information Privacy Act 2009 and its Queensland Privacy Principles set the rules for how personal information is to be handled. This Policy relates to the Public Sector Commission (PSC) and sets out how we manage personal information including:

• the kinds of personal information we collect and hold, how we collect and hold that personal information, and the purposes for which we collect, hold, use and disclose personal information
• how you may complain about our handling of your personal information and how we will deal with the complaint.

Scope

This policy applies to the Public Sector Commissioner and staff members, and to the personal information we collect, store, manage, use and disclose in relation to the administration of the ministerial portfolio responsibilities.

The PSC is an independent body; however, it is supported by the Department of the Premier and Cabinet (DPC) through shared resources and infrastructure. Information may be shared between the PSC, DPC and other government agencies to support the implementation of policies and programs, provision of advice, and responding to correspondence and submissions, which may contain personal information.

Personal information we collect and hold

The definition of ‘personal information’ is set out in the Definitions.

The PSC collects, uses, stores and discloses a range of personal information for the purposes of providing services to carry out its services and functions.

This includes personal information about Senior Executives from across the public sector, and relevant executive staff, current members of the public, stakeholders, persons attending functions and events organised by the PSC and nominees being considered for appointment to government bodies and as statutory office holders.

Personal information may include:

• identity and contact details for individuals (e.g. name, phone, email and postal address)
• information relating to individuals’ personal circumstances, including personal interests and conflicts of interest
• information relating to individuals’ financial affairs (e.g. bank account details)
• information about employment (e.g. employment status and work history, education status, referee reports and salary)
• information provided in an application under the Right to Information Act 2009 (RTI Act) or in making a complaint
• feedback on products and services provided by PSC.

We may also receive ‘sensitive information’. The definition of sensitive information is set out in the Definitions. We will generally only collect sensitive information with consent, or otherwise consistent with the obligations under the Act.

How we collect or receive personal information

We collect and receive personal information in a range of ways depending on how you interact with us.

Collecting personal information

We may collect personal information to perform the functions and services of the PSC, for example to arrange a meeting with you or a stakeholder or to respond to a query.

Where possible, we collect the information directly from you or your authorised representative. Sometimes we may collect information about an individual from a third party, or indirectly, including from a Queensland government agency, or other Ministerial Office, but only if: the individual has given consent; if it is otherwise consistent with the obligations under the Act; or it is unreasonable or impracticable for us to collect the information from the individual.

Receiving unsolicited personal information

We receive personal information from individuals without directly asking for it. Personal information may be received when you email us, write to us by mail, contact us by telephone, submit an enquiry through Queensland Government contact centres such as 13 QGOV. We may also receive your personal information when you correspond with DPC or another government agency, another Minister, Member of Parliament, organisation or other third party where your correspondence relates to matters that fall within the Premier, Directors-General of DPC or Public Sector Commissioner’s responsibility.

We take reasonable steps to ensure individuals providing unsolicited personal information to the PSC understand how the information may be used or disclosed, including by publishing this Policy, providing a privacy statement on the PSC webpage and including a privacy statement in automatically generated acknowledgements to emails.

Remaining anonymous

You are able to use a pseudonym and remain anonymous when interacting with us unless:

• we are required or authorised under an Australian law, or a court or tribunal order, to deal with individuals who have identified themselves, or
• it is impracticable to deal with you if you have not identified yourself or are using a pseudonym.

We will inform you if you are not able to remain anonymous or use a pseudonym when dealing with us. However, if you do not provide contact details, we may not be able to respond.

How we hold and protect personal information

We take seriously our obligations to protect the personal information held by the PSC and take reasonable steps to protect your personal information against misuse, interference and loss, and from unauthorised access, modification or disclosure.

These steps include:

• ensuring physical access to the Office is secure
• classifying and storing records securely, including storing physical documents in secure cabinets within the office
• limiting access to information in records systems to appropriate officers
• monitoring system access with controls and authenticated credentials
• regularly updating and auditing our storage and data security systems.
• If personal information that we hold is lost, or subject to unauthorised access or disclosure, we will respond in accordance with the Act and our Data Breach Policy. Our priority is to mitigate harm and to provide timely advice to affected individuals if a data breach is likely to result in serious harm.

Our activities—why we need personal information

The PSC supports the responsibilities of the Public Sector Commissioner and Deputy Commissioners.

Our functions and activities that involve personal information include:

• supporting the Commissioner and Deputy Commissioners in relation to their responsibilities and duties
• supporting the Commissioner and Premier in relation to Cabinet, Executive Council and Parliamentary responsibilities
• supporting the Commissioner and Premier’s attendance at events and official visits
• responding to correspondence
• Government communications and engagement with media
• managing employment and human resource matters within the Commission and across all public sector agencies.

Use and disclosure of personal information

We use and disclose personal information for the purpose for which it was collected and received. We will not use or disclose personal information for another purpose (a secondary purpose) unless: you consent to the use or disclosure of the information, it is otherwise consistent with the obligations under the Act.

The information you provide to the PSC may be disclosed to DPC or another government agency to respond to your matter or resolve the issues you have raised. It may also be disclosed to other Ministerial offices, departmental staff or other government bodies to resolve issues you raise with us.

When you engage with us on social media, your personal information may be stored by those platforms in countries outside Australia and will be subject to the platform’s own privacy arrangements and laws in the platform’s jurisdiction.

Access to and correction of personal information

The Information Privacy Act 2009 provides that you have a right to access, and to request correction of, personal information we hold about you.

We aim to provide individuals with access to their own personal information informally. Where a request is unable to be dealt with informally, you may make a formal application under the Right to Information Act 2009.

Applications must be in writing and submitted by mail, email or in person as follows:

The Right to Information and Privacy Unit in DPC receives applications on behalf of the PSC, and forwards them directly to PSC for processing.

Further information about how to apply can be found on the PSC RTI webpage.

Making a privacy complaint

If you believe we have misused your personal information or did not meet our obligations under the Act to comply with the privacy principles, you can make a privacy complaint to us.

Your complaint must:

• be in writing
• include your contact details so we can contact you about the complaint
• provide a description of your privacy issue or concern
• be made within 12 months of the privacy issue occurring.

Privacy complaints may be sent to the Privacy Offer as follows:

Your complaint will be investigated and a written response advising the outcome of the complaint, including any remedies, will be provided to you within 45 business days. If you are not satisfied with our response, you may make a privacy complaint to the Office of the Information Commissioner (OIC). A guide outlining the OIC’s privacy complaint process is available on the OIC website.

Legislation and related policies

Legislation

• Information Privacy Act 2023
• Right to Information Act 2009

Related policies

• Customer complaint management policy (PDF, 290.8 KB)
• PSC Data Breach Policy

Definitions

Revision history