Overview

TCCS delivers a wide range of services and amenities to the Canberra community. An overview of these services is available under About us on the Transport Canberra and City Services website. TCCS may collect, hold, use and disclose personal information to effectively perform functions or activities under the Public Sector Management Act 1994, Territory Records Act 2002, Freedom of Information Act 2016, Work Health and Safety Act 2011, and other legislation which confers powers or functions on TCCS under current Administrative Arrangements.

What is personal information?

Personal information is defined by the Act, and for the purpose of this policy:

• means information or an opinion about an identified individual or an individual who is reasonably identifiable –
  • whether the information or opinion is true or not; and
  • whether the information or opinion is recorded in a material form or not.

Sensitive information is a subset of personal information, and includes information on health, racial or ethnic origin, political opinions, association memberships, religious or philosophical beliefs, sexual orientations, criminal history, genetic and biometric information.

Personal health information is not covered by the Act or this policy. All health records handled by TCCS are protected and managed in accordance with the Health Records (Privacy and Access) Act 1997.

Collection of personal information

At all times TCCS will try to only collect information which is reasonably necessary for, or directly related to, the official function or activity being carried out.

TCCS will only collect your personal information by lawful and fair means, and the main way we collect your personal information is when you give it to us. For example, when you:

• apply for an ACT Government concession scheme, or funding or assistance facilitated by us (e.g. free travel on Transport Canberra services).
• participate in community consultations, forums, surveys, meetings or research led be us.
• submit a Freedom of Information (FOI) request.
• are employed by, seeking employment or volunteer with, or are contracted to provide services to us.
• subscribed to a TCCS email distribution list to receive information from us.
• submit a customer form, through Access Canberra form, for one of our services (e.g. register your dog, apply to build a new driveway, or report a damaged tree).
• are a member of one of our boards or committees.

For further detail on how TCCS may collect or use personal information, please refer to Register of Personal Information Collected by TCCS.

Remaining anonymous

Where possible, you will have the option of remaining anonymous or using a pseudonym (a made-up name) when dealing with TCCS. However, you will need to identify yourself in situations where:

• TCCS is authorised or required by law to deal with an identified individual; or
• it is not practicable to deal with you if you have not identified yourself (e.g. we require your name and basic contact information to follow-up with you on an enquiry).

If you need to identify yourself, TCCS will explain why this information is needed and what it would mean for you if the information were not collected.

Collecting sensitive information

TCCS will not collect your sensitive information unless it is reasonably necessary and directly related to the official function being carried out, and you consent to the collection of that information.

TCCS may collect sensitive information without your consent if:

• required or authorised by an Australian law, or a court or tribunal order to do so; or
• it is necessary to lessen or prevent a serious threat to the life, health or safety of one or more persons, or to public health or safety.

Collecting personal information from children and young persons

TCCS will generally require the consent of a parent of legal guardian when collecting the personal or sensitive information of a child or young person under the age of 18.

TCCS may accept the consent of a child or young person under the age 18 to collect their personal information on a case-by-case basis, if we are satisfied with their capacity to consent to the handling or their personal information (e.g. a college student applying for a Student MyWay card).

Indirect collection

TCCS will generally seek to collect your personal information directly from you, unless you consent to us collecting your information from another party, or it is unreasonable or impracticable to do so.

TCCS may obtain personal information collected by another ACT Government directorate or agency, through the ACT Government Data Sharing Memorandum of Understanding, where it is lawful to do so. TCCS may also obtain personal information collected by other Australian federal, state and territory government bodies or organisations in certain circumstances. TCCS may also receive unsolicited personal information (i.e. we did not ask for it) from a third party. If we receive unsolicited information, we must determine if we could have collected it by lawful and fair means. If we decide we could not have, we will destroy the information.

TCCS may also collect personal information from publicly available sources, such as public websites of social networking services (e.g. business websites), to enable us to perform our functions effectively.

Notice of collection

When TCCS needs to collect personal information about you, TCCS will take all reasonable steps to notify you about:

• who we are and how you can contact us.
• the purpose(s) for which we are collecting the personal information.
• the circumstances in which we may have collected it if not collected directly from you, or if you may be unaware that we have collected your personal information.
• any laws requiring us to collect this personal information, or if its collection is authorised or required by a court or tribunal order.
• how you may be affected if we are unable to collect all or some of the requested personal information.
• the details of any agencies, or types of agencies, which we normally disclose the type of personal information to, or if we are likely to disclose it to an overseas recipient.
• our Information Privacy Policy, including information on how you can access or correct your personal information, and how complaints regarding the handling of your personal information can be made and will be managed.

Websites

Information on how TCCS collects information through its websites is available under Website Information Privacy statements , through either the Transport Canberra or City Services websites.

Email lists

TCCS uses subscriber email lists to distribute current information such as newsletters and details of upcoming events open to community members and stakeholders.

These services are voluntary and require your consent to subscribe. If you subscribe, your contact details will be collected for the purpose of that subscription list and will not be collected outside of TCCS without your consent. You will also be provided information on how to unsubscribe at the time of subscription.

Social networking services

TCCS accounts on social networking services, such as Facebook, Twitter and YouTube. If you communicate with us through these, your personal information may be collected by the social network service and will be handled in accordance with their own privacy policies.

TCCS has limited to no control over the way your personal information may be used or disclosed by these services. Therefore, TCCS generally avoids collecting personal information via social media services and will restrict doing so to where necessary.

Disclosure of personal information

TCCS will not disclose or use your personal information for a secondary purpose without your consent unless an exception applies. For example, if its use or disclosure:

• would be reasonably expected from you for us to use the information for a secondary purpose related to the original purpose for which it was collected (e.g. in correspondence to another ACT Government agency if it enabled us to respond to your enquiry more effectively).
• is legally required or authorised by a law, or a court of tribunal order.
• is reasonably necessary for law enforcement related activities, such as the prevention, detection, investigations, prosecution or punishment of criminal offences of breaches of the law, intelligence gathering, surveillance, or conduct of protective or custodial services.
• is authorised by the head of a Commonwealth Intelligence Agency and is certified to be necessary for the performance of that agencies functions.
• is reasonably believed to be necessary to prevent or lessen a serious threat to the life, health of safety of any individual, or to public health or safety.
• is necessary for us to take appropriate action where we have reason to suspect unlawful activity or misconduct of a serious nature which relates to our functions.
• is reasonably believed necessary to help locate a person who has been reported as missing.

For further detail on how TCCS may disclose personal information, please refer to Register of Personal Information Collected by TCCS.

Disclosure of sensitive information

TCCS will only disclose your sensitive information if you agree to us doing so, or you would reasonably expect us to disclose the information for another purpose directly related to the purpose it was collected for.

TCCS may also disclose your biometric information (e.g. fingerprints or photograph) or biometric templates (i.e. digital representations of your distinct characteristics) to an enforcement body (e.g. the Australian Federal Police or Department of Immigration and Border Protection) for secondary purposes. In these instances, TCCS must comply with any directions made by the Australian Information Commissioner (who currently exercises the functions of the ACT Information Privacy Commissioner).

Disclosure to service providers

TCCS contracts service providers to support us in delivering specific functions and services. In some circumstances it may be necessary for us to disclose your personal information to these providers to enable to them to perform their work effectively.

TCCS protects disclosed information by only entering into contracts with service providers who agree to comply with the Territory Privacy Principles, and associated ACT Government and TCCS information policies. All contracted persons who may have access to your personal information are also required to undergo appropriate background checks and will be restricted to the minimum access privileges required to perform their duties.

Disclosure to overseas recipients

TCCS does not disclose personal information to overseas recipients on a regular basis, or under any international agreements for information exchange.

Generally, TCCS will seek your express consent prior if we intend to disclose your personal information to an overseas recipient. However, TCCS may disclose your personal information to an overseas recipient if required or authorised by Australian law, or a court or tribunal order, or if reasonably necessary for law enforcement related activities.

If TCCS were to begin routinely disclosing personal information to an overseas recipient, this policy will be updated, and further detail included in Register of Personal Information Collected by TCCS, in a timely manner.

Storage and security of personal information

TCCS is required to take reasonable steps to ensure personal information we collect is safe and secure, and protected from misuse, interference, loss or unauthorised access, modification or disclosure.

TCCS manages personal information, both as physical files and electronic formats within our data systems, in accordance with the TCCS Records Management Program established under the Territory Records Act 2002. Personal information will also be managed in accordance with any requirements set out by the legislation under which it was collected (e.g. Tax File Numbers).

Systems used to store personal information use comprehensive protections to guard against authorised access, and internal access is limited to necessary persons as part of our general practice; physical records of personal information are stored securely.

TCCS takes reasonable steps to destroy personal information or ensure it is de-identified once it is no longer required.

Storage of personal information overseas

It is TCCS' intent, wherever possible, to store personal information datasets on systems hosted within Australia. However, TCCS does utilise systems that may collect or store personal information, whose data servers are located in the United States.

It should be noted that, if you communicate with a TCCS account through a social networking service (e.g. Facebook or YouTube), the social network provider and its partners may collect and hold your personal information overseas.

If a system is used to collect or store personal information and the dataset is not hosted within Australia, TCCS will take reasonable steps to ensure the law, or binding scheme, of the overseas jurisdiction offers comparable protection of your personal information as is required by the Privacy Act. TCCS will also apply controls to exclude third-party access to your personal information unless specific contractual provisions have been agreed to.

Any personal information collected or stored using a system which may host datasets overseas will be clearly identified, and information on the location and associated privacy policy of the host system included in the Register of Personal Information Collected by TCCS.

Access and correct personal information

Under the Privacy Act, you have the right to ask for access to personal information TCCS holds about you. TCCS is required to take reasonable steps to ensure collected personal information is accurate, up to date and complete, and you have the right to ask we correct your personal information.

Access your personal information

You have the right to request access to your personal information that TCCS holds; you can request access by Contact Us, and we must respond within 30 days.

TCCS must provide you with access to your personal information, as you requested, if it is reasonable and practical to do so.

TCCS will not charge you any fees for making a request to access or providing you with access to your personal information.

You also have the right under the Freedom of Information Act 2016 to request access to documents TCCS holds containing information about you. Further information on Freedom of Information (FOI) access and how to make a request can be found on the TCCS website under Freedom of Information.

Correct your personal information

You have the right to request we correct any of your personal information that TCCS might hold if you believe it is incomplete, incorrect, out-of-date or misleading. You can ask we correct personal information we hold about you by Contacting Us, and we must respond within 30 days.

TCCS must take then take reasonable steps to correct and satisfy ourselves the information is up-to-date, accurate, complete and not misleading in relation to the purpose it is held for. If we make a correction and the incorrect information was previously disclosed to others, you can ask we notify them about the correction.

There may be reasons why we refuse to correct your personal information. For example, we may be required or authorised by law to not correct the information. If we refuse to correct your personal information, you can ask us to associate with that information a statement that you believe it is incorrect and why.

TCCS will not charge you any fees for making a request for correction, correcting or associating a statement to the personal information.

Make a complaint

You can submit Transport Canberra and MyWay feedback, enquiries and complaints through the Access Canberra portal, or Contact Usfor any other complaints about how TCCS has handled your personal information. Complaints should be made in writing, and we are able to assist you in lodging your complaint if required.

TCS will acknowledge receipt of your complaint within five working days and consider how we can resolve the issue satisfactorily, with an aim to respond to your complaint within 21 working days. Information about TCCS’ complaints management process is available under Feedback and Complaints on our website.

If you are not satisfied with our response to the complaint, you can ask for a review by a more senior officer within TCCS, or you also have the right to submit a formal privacy complaint to the Information Privacy Commissioner through the Office of the Australian Information Commissioner (OAIC).

The OAIC is an independent body and will assess your complaint to determine whether our actions interfered with your privacy. If your complaint is upheld by the Information Commissioner, you may be able to seek remedy through the ACT Magistrate’s Court.

Information on submitting a complaint to the Information Commissioner is available on the OAIC website under Lodge a privacy complaint with us or through their enquiries line at 1300 363 992.

Contact us

For more information on the collection, use, security, access or disclosure of your personal information held by TCCS, please contact us by:

Email: TCCS.GBSGovernance@act.gov.au

Phone: +61 2 6205 5187

TCCS is committed to making its information accessible to as many people as possible. This policy is available as a printed document, an accessible PDF and in Word by contacting us on the above email address or phone number.

If you require an alternative format of this document, if you are deaf or hearing impaired, or if English is not your first language, you can get assistance through calling the following services:

Canberra Blind Society: +61 2 6247 4580

National Relay Service: 13 36 77

Translating and Interpreting Service: 0423 677 767