General

This policy outlines Luminary Supports’ expectations regarding the protection and management of personal information collected, used, stored and disclosed in the course of conducting its business and providing supports and services.

Luminary Supports is committed to ensuring that the collection and management of personal information is transparent, accountable and compliant with relevant legislative requirements, including the Australian Privacy Principles contained within the Privacy Act 1988 (Cth).

Scope

Luminary Supports requires all staff, including employees, casual staff, contractors and volunteers, to comply with this policy at all times when collecting, accessing, using, storing or handling personal information in the course of their employment or engagement.

Personal information may include information relating to staff, including personnel records and files, as well as participant information.

Collection of Personal Information

Luminary Supports will only collect personal information that is reasonably necessary to facilitate administrative processes, meet legal or regulatory requirements, or provide supports and services to a participant.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not.

It may also be necessary for Luminary Supports to collect sensitive information in order to provide certain supports and services.

Sensitive information may include information about an individual’s:

• Racial or ethnic origin

• Political opinions

• Membership of a political association

• Religious beliefs or affiliations

• Philosophical beliefs

• Membership of a professional or trade association

• Membership of a trade union

• Sexual orientation or practices

• Criminal record

• Health or genetic information

• Biometric information or biometric templates

Personal and/or sensitive information collected by Luminary Supports may include:

• Name

• Date of birth and age

• Gender

• Nationality

• Personal and emergency contact details

• Taxation, banking and superannuation details

• Driver licence details

• Education history and qualifications

• Previous or current employment information

• Reference checks

• Police checks

• Working with Children Check details

• NDIS Worker Screening Check details

• Health and medical information

• Support needs and relevant care information

• Forensic orders, where applicable

• Financial management information, including information provided by the Public Trustee or another authorised financial administrator

Where practicable, information will be collected directly from the individual concerned. Where information is collected from another person or organisation, Luminary Supports will take reasonable steps to ensure the individual is aware that the information has been collected and understands the purpose for which it will be used.

Information may be collected by telephone, electronically, in person, through Luminary Supports services or activities, and through interviews, assessments, forms and questionnaires.

Any unsolicited information received that is not reasonably necessary for Luminary Supports’ functions or activities will be destroyed or de-identified where appropriate and lawful to do so.

Individuals may have the option of remaining anonymous or using a pseudonym when interacting with Luminary Supports where practicable, unless there is a legal requirement for the individual to identify themselves or Luminary Supports is unable to provide the required service without knowing their identity.

For participant services, information collected and recorded will, as far as reasonably possible, be accurate, factual and relevant to enabling Luminary Supports to effectively plan, deliver, monitor and evaluate supports.

The collection of information will not unreasonably intrude upon a participant’s personal affairs.

Participants and/or their representatives or advocates will be informed, where appropriate, about why information is being collected and the circumstances in which it may be used or disclosed.

Use and Disclosure of Personal Information

Personal information will not generally be disclosed without the prior consent of the participant or staff member unless disclosure is required or authorised by law.

Luminary Supports will only use or disclose personal information for the purpose for which it was collected, for a related purpose that the individual would reasonably expect, with the individual’s consent, or where otherwise permitted or required by law.

Photographs, videos, testimonials, news stories or other content identifying an individual will not be publicly released or used for marketing purposes without appropriate prior consent from the individual or their authorised representative.

Decisions regarding the collection, use and disclosure of participant information will take into account the participant’s rights, privacy, safety and best interests.

Staff must recognise and respect each participant’s role in controlling their personal information. Only information that is relevant to providing appropriate supports, meeting legal obligations or administering services will be collected and maintained.

Where a participant requires assistance to make an informed decision regarding the use or disclosure of their information, they will be given the opportunity to involve a family member, nominee, guardian, advocate or other appropriate support person.

Access to personal information contained within participant records is restricted to people who have a legitimate and authorised reason to access that information. This may include:

• The participant

• A participant’s guardian, nominee, administrator or authorised representative, within the scope of their authority

• Luminary Supports staff, contractors or casual staff who require the information to provide or administer supports

• Health professionals or other professionals engaged in providing services to the participant who require relevant information to perform their role

• Government agencies, regulators or other persons with lawful authority to access the information

Luminary Supports will take reasonable steps to inform individuals of circumstances where information may be required to be disclosed to another person, organisation or authority.

Consent may not be required where the use or disclosure of information is authorised or required by law, including where it is:

• Necessary to prevent or lessen a serious threat to the life, health or safety of an individual or the public

• Required under a subpoena, court order or other lawful requirement

• Reasonably necessary for law enforcement activities

• Required to protect public funds

• Required to report an incident, allegation or concern to an authorised regulatory or government body

• Necessary for the primary purpose for which the information was collected or for a directly related purpose the participant would reasonably expect

For example, relevant health information may need to be provided to a treating health professional where it is necessary for the participant’s treatment, care or safety.

Maintaining the Quality of Personal Information

Luminary Supports will take reasonable steps to ensure that personal information it collects, uses and stores is accurate, complete, current, relevant and not misleading.

Participants, their representatives and staff are encouraged to advise Luminary Supports as soon as practicable of any significant changes to their personal information so that records can be updated.

Where information has previously been disclosed to a third party and Luminary Supports subsequently becomes aware that the information was inaccurate or has changed, reasonable steps may be taken to notify the relevant third party where appropriate, practicable and lawful.

Staff who become aware of a significant change in a participant’s circumstances should ensure the relevant information is appropriately documented and communicated to authorised personnel in accordance with Luminary Supports’ procedures.

Confidentiality

All staff, contractors and volunteers must maintain the confidentiality of personal, sensitive and organisational information obtained through their role with Luminary Supports.

Confidential information must only be accessed, discussed, shared or used where it is necessary to perform authorised duties or where disclosure is otherwise permitted or required by law.

Staff must not discuss participant information with unauthorised persons, including family members, friends or other participants, and must take reasonable care when discussing confidential matters in workplaces, vehicles, public areas or other environments where conversations may be overheard.

Confidentiality obligations continue after a staff member, contractor or volunteer ceases working with or providing services to Luminary Supports.

Storage and Security of Personal Information

Luminary Supports will take reasonable steps to protect personal and sensitive information from misuse, interference, loss, unauthorised access, modification or disclosure.

This may include the use of secure electronic systems, password protection, appropriate access permissions, secure physical storage and processes for safely disposing of records when they are no longer required.

Access to participant and staff records will be limited to authorised persons who require access as part of their role.

Personal information will be retained and disposed of in accordance with applicable legal, regulatory and record-keeping requirements.

Access and Correction

Individuals may request access to personal information Luminary Supports holds about them and may request that inaccurate, incomplete, out-of-date, irrelevant or misleading information be corrected.

Luminary Supports will respond to requests for access or correction within a reasonable timeframe and in accordance with applicable privacy legislation.

Access may be refused or limited where permitted or required by law. Where appropriate, Luminary Supports will provide an explanation for the decision.

Breaches of Privacy and Confidentiality

Any actual or suspected breach of privacy, confidentiality or information security must be reported to Luminary Supports as soon as practicable.

Luminary Supports may take disciplinary and/or legal action where a staff member, contractor, volunteer or other person breaches this policy or their confidentiality obligations.

Participants or other individuals who believe their privacy has been breached may make a complaint through Luminary Supports’ complaints management process.

Luminary Supports is committed to responding to privacy complaints fairly and within a reasonable timeframe.

Luminary Supports will respond to eligible data breaches in accordance with the Notifiable Data Breaches Scheme under Part IIIC of the Privacy Act 1988 (Cth).

Where a data breach is likely to result in serious harm to one or more individuals, Luminary Supports will assess the breach and undertake any notification or other action required by law.