Military services records

Understanding and Maintaining your information;

Confidentiality and Privacy 

​

Privacy Act

The Privacy Act 1988 (Privacy Act) is the principal piece of Australian legislation protecting the handling of personal information about individuals. This includes the collection, use, storage and disclosure of personal information in the federal public sector and in the private sector.  Other statutory provisions also affect privacy and separate privacy regimes apply to state and territory public sectors. 

​

Governance

The Privacy Act provides 13 Australian Privacy Principles (APPs). The APPs apply to government agencies and private sector organisations with an annual turnover of $3 million or more. The APPs are principles-based—protecting privacy while not burdening agencies and organisations with inflexible prescriptive rules.. 

​

The Office of the Australian Information Commissioner (OAIC) is responsible for investigating breaches of the APPs and credit reporting provisions.

​

Freedom of Information

Freedom of information (FOI) means the right of the public to access information Australian Government ministers and Australian Government agencies hold.  This right is promoted and enforced in the Freedom of Information Act 1982 (FOI Act).

 

Identifiable Information

It is important that you know how to keep your personal identifiable information private and secure.  Identifiable information is any piece of information, or ‘data’, that can confirm who you are or how to find you. It’s important to make sure it’s only used with your knowledge and consent and for the purpose it should be used.  You are in control of making sure that you are clearly informed by anyone that collects your personal information of how it will be collected, stored and used. 

​

Health Information

Health information includes information or opinions about the health or disability of an individual and future health information for health services.  Health information is regarded as one of the most sensitive types of personal information. For this reason, the Privacy Act provides extra protections for the way health information is handled.

​

Personal Information

The Privacy Act defines personal information as ‘information or opinion, whether true or not, and whether recorded
in a material form or not, about an identified individual, or an individual who is reasonably identifiable’.  Personal
information includes an individual’s name and address, signature, contact details, birth date, medical records and
bank account details.  It does not matter whether the information is true. Personal information can be held in any media. Information does not have to be explicitly recognised as personal information to constitute personal information under the Privacy Act. The types of information that are personal information are unlimited and can vary widely.

 

Medical Information
Your doctors may record personal information on paper and in electronic records, and this may also include; X-rays, CT scans, videos, photos and audio recordings. Information held by doctors may include not only medical opinions and diagnosis directly, it also includes data and information from a third party in the course of providing your healthcare service.

​

Defence Information

The Defence records may include your service report, personal and health documents.  Prior to 2013 mental health documentation was retained in psychology documents, whereas after 2013 mental health is within health documents.  

 

DVA Information

DVA collects personal details such as name, date of birth, occupation, marital status, residential details, contact details, government identifiers, and date of death, Information about a person’s circumstances and background such as employment history, military service history, marital status, financial affairs and remuneration, medical, and lifestyle. Information about dependants, family members and authorised representatives, Tax File Numbers (TFNs), when required for certain payments and details that may relate to a program.

​

Use & Disclosure

Generally, the distinction between use and disclosure refers to whether third parties are involved.  For example, a doctor will ‘use’ health information when it holds and manages that information within the medical practice, such as for clinical or consultation.  Whereas, the doctor ‘discloses’ health information if it makes it accessible to persons, agencies or companies ‘outside the practice and releases the handling of the personal information from its own control.

​

An organisation or agency can’t use or disclose your personal information for another reason (a secondary purpose) unless an exception applies. Exceptions include: you’ve consented to an organisation or agency using or disclosing your personal information for a secondary purpose, an organisation or agency uses or discloses your personal information because they think it’s reasonably necessary for enforcement-related activities carried out by, or on behalf of, an enforcement body, a secondary purpose is required or authorised under an Australian law, or court or tribunal order.

​

Consent to the handling of personal information

Your consent is only valid if you’re aware of the consequences of giving or not giving your consent at the time you make the decision. An organisation or agency should:

​

• clearly explain how they want to handle your personal information

• communicate their request in plain English, without legal or industry jargon.

​

Consent must be voluntary

You give voluntary consent if you’re not forced or pressured to give your consent. Some factors that decide if consent is voluntary are:

• the options available to you if you choose not to consent

• the seriousness of any consequences to you, your family or associates if you refuse to consent.

​

Consent must be current and specific

When you give consent at a particular time and for specific circumstances, an organisation or agency can’t assume your consent continues indefinitely.

​

Express consent
You give express consent if you give it openly and obviously, either verbally or in writing. For example, when you sign your name (by hand, or by an electronic or voice signature). An organisation or agency must get your express consent before handling your sensitive information.

​

Implied consent
An organisation or agency doesn’t need your express consent to handle your non-sensitive personal information; but they need to reasonably believe that they have your implied consent.  It’s not sufficient for an organisation or agency simply to tell you of their collection, use or disclosure of your personal information. Unless they presented you with an opt-out option they cannot assume your implied consent.

​

Bundled consent
A bundled consent is a single request for consent from an organisation or agency that contains several requests to collect, use and disclose your personal information, and does not let you choose which ones you consent to and which you don’t.

​

You can withdraw your consent at any time.