Published: 17 November 2022

This Privacy policy covers personal information collected on Dataplace, how it is secured and kept safe, and what we do with the information we collect.

Dataplace also publishes a Data transparency statement, which is not a legal requirement, but it is provided so that users of the platform can understand more broadly the data collected and why, who the data might be shared with and how it is managed. It is provided to users of the platform to be transparent about the data management practices employed for Dataplace.

About this Policy

Dataplace is a whole of government platform, managed by the Office of the National Data Commissioner (ONDC) on behalf of the Australian Government. The ONDC is a part of the Department of Finance.

The Department of the Prime Minister and Cabinet (PM&C) assists the ONDC in hosting the Dataplace platform.

Dataplace facilitates access between organisations that want to use government data and government agencies that hold data.

Dataplace supports making a request for data from any Australian Government agency, this includes requesting data under the Data Availability and Transparency Act 2022 data sharing scheme (DATA Scheme). Dataplace also allows organisations to apply to be an accredited user or an accredited data service provider (ADSP) under the DATA Scheme.

This Privacy Policy applies specifically to the handling of personal information by the Office of the National Data Commissioner (within the Department of Finance) and the National Data Commissioner (referred to together as 'we', 'us' 'our') in connection with Dataplace. It outlines the kinds of personal information we collect, why we collect it, and how we handle it for the purposes of providing Dataplace services.

In the Privacy policy:

• personal information is defined in the Privacy Act 1988 as being 'Information or an opinion about an identified individual, or an individual who is reasonably identifiable;

1. whether the information or opinion is true or not; and
2. whether the information or opinion is recorded in a material form or not.’

It may include information about you such as your name and contact information.

• sensitive information is a subset of personal information. It includes information such as your racial or ethnic origin, political opinions, religious beliefs or affiliations, philosophical beliefs, sexual orientation or practices, criminal record, and health information.

You should read the Privacy policy if you are:

• applying on behalf of an organisation to become an accredited user or an accredited data service provider under the Data Availability and Transparency Act 2022
• using Dataplace to make, contribute to or assess data requests
• using Dataplace to make, contribute to and/or manage data sharing agreements
• if you are an individual person named in a data sharing agreement.

How we collect personal information

We collect personal information (including some sensitive information) in different ways including:

• from the Dataplace online portal (such as when you make an application or register to use Dataplace)
• through forms and documents that have been provided to us
• through correspondence with you (e.g. emails or phone calls)
• from an organisation that you work for. 

What we collect

We may collect different kinds of information about you. This can include:

• personal information about you such as your name, position title and email address
• further specific personal information about you if you are the person responsible for data management and data governance for your organisation that is seeking to be an accredited user under the DATA Scheme such as information about your type of employment (full time, part time, etc), details about your delegation to act for your organisation, details about your qualifications, skills and experience)
• sensitive information about you if you will have access to data shared under the DATA Scheme in your organisation such as information about your citizenship.

When you access and use Dataplace the website server logs the following information:

• the type of browser and operating system you are using
• the address of the referring site (for example, the Google search page)
• your IP address (a number which is unique to the modem, router or gateway that connects you to the internet)
• the date, time and address of each page you visit
• how long you visited each page
• the date, time and address of each document you upload to or download to Dataplace.

Why we collect information and how we use it

We collect and use personal information (including sensitive information) in accordance with the *Privacy Act 1988 (Cth) *and the Australian Privacy Principles, for the purpose of enabling you to have access to Dataplace, to administer the Dataplace platform with IT support provided by PM&C, and to undertake functions and activities under the DATA Scheme.

This includes:

• providing access to Dataplace - we collect and use personal information to onboard users to Dataplace and manage access so you can use the services of Dataplace

• processing applications for organisations to become an accredited user or data service provider under the DATA Scheme - we collect and use personal information as part of these applications, including to:

• - assess against the accreditation criteria under the DATA Scheme

  • obtain information about, and to verify, information provided in applications
  • communicate with you.

• *managing data requests and data sharing agreements *- we collect and use personal information to help government agencies manage data sharing requests and data sharing agreements, including so they can communicate with you about your data sharing request. In circumstances where sensitive data (which may not be sensitive personal information) is being shared, we may collect information to identify individuals who will have access to that sensitive data

• maintaining registers under the DATA Scheme - we will use personal information to maintain the accredited user and data sharing registers that we are required to do under the DATA Scheme

• operating Dataplace - we use information collected by Dataplace to ensure that Dataplace is operating effectively and efficiently and to respond to enquiries you may make to us about Dataplace.

• manage and respond to requests for information or support (including requests made under freedom of information legislation)

• conduct statistical reporting and research, including to de-identify personal information so that any statistical reporting or research outcomes do not identify you or any other individuals

• undertake statistical analysisand system administration using information collected from our website. No attempt is made to identify users or their browsing activities, except where a law enforcement agency or the Commissioner is undertaking an investigation and has legal authority to identify users and/or their browsing activities.

• seek legal advice if required.

We may engage contractors to assist us undertake any of the above functions and activities. We ensure that all contractors are subject to the same legal requirements as our staff, including strict confidentiality, privacy and security obligations.

Who we disclose your information to

We may need to disclose your personal information to others. We will protect your information by taking steps to ensure that any disclosure is done in accordance with the *Privacy Act 1988 *(Cth).

We may disclose your personal information (including sensitive information) to:

• enable us to undertake our functions under the DATA Scheme, which includes disclosure to the Minister or other relevant authorities or third parties where authorised or required by law, including as required for national security purposes
• to other users of Dataplace where you and that user interact**, **such as when you send a request for data and a data custodian considers that request
• to our IT service providers if they need access to provide IT support services, which is currently provided by PM&C.

Disclosure of information overseas

We will not disclose information outside Australia for any other reason, unless authorised by law.

How we store personal information

We take reasonable steps to protect your personal information against misuse, interference and loss, and from unauthorised access, modification or disclosure. These include:

• any documents you provide us are stored securely and in accordance with Australian Government security guidelines
• personal information you provide to us is only accessed by personnel on a ‘need-to-know’ basis and by personnel who have authorisation
• we monitor access to our digital systems with access only permitted with authenticated credentials
• we ensure our buildings are secure
• we regularly update and audit our data storage and data security requirements
• access to your information from overseas is prohibited, as is storage of your information overseas. All electronic data is stored in PM&C’s data centres
• we ensure that we destroy or archive personal information we hold when it is no longer required, in accordance with the Archives Act 1983 (Cth).

How to access and correct your personal information

Accessing your personal information

You have the right to ask for access to the personal information that we hold about you. You can do this using our contact details below.

If you ask us for access to the information we must give you access, unless there is a law that restricts us from giving you access.

If we refuse to give you access to your personal information, we will let you know in writing and will provide reasons for our refusal.

Updating your personal information

You have the right to ask that we correct personal information that we hold about you. You can do this using our contact details below. If you have a personal profile on Dataplace, you may update the personal information present in that profile.

If you ask us to correct your personal information, we must take reasonable steps to correct your information if we consider that it is incorrect.

If we refuse to correct your personal information, we will let you know in writing and will provide reasons for our refusal.

Privacy impact assessments

The Privacy Code requires agencies, including the Department, to conduct a Privacy Impact Assessment (PIA) for all high privacy risk projects. It is also open to the Department to undertake PIAs as best practice and to exercise due diligence where a project is below this threshold.

PIAs completed by the Department, since the Privacy Code commenced on 1 July 2018, are listed in the table below.

| |
| |
| |
| |

How to make a complaint

How to complain to us

If you think we may have breached your privacy rights, you may contact us using the contact details set out below.

We will respond to your complaint promptly if you provide your contact details. You do not need to provide your name, or can use a pseudonym, but we may not be able to fully investigate and resolve your complaint if you do not provide all relevant details.

We are committed to quick and fair resolution of any complaints, and will ensure your complaint is taken seriously. You will not be victimised or suffer negative treatment by us if you make a complaint.

How to complain to the Office of the Australian Information Commissioner (OAIC)

You also have the option of contacting the OAIC, if you wish to make a privacy complaint against us.

The OAIC website contains information on how to make a privacy complaint to the OAIC.

If you make a complaint directly to the OAIC, the OAIC may recommend you try to resolve the complaint directly with us in the first instance.

How to contact us

If you wish to ask questions about this Privacy policy, or how your personal information is collected, held, used or disclosed please contact us.

Please also contactus if you wish to obtain access to or seek correction of your personal information or make a complaint about a breach of your privacy.

Please contact the Department of Finance Privacy Officer, using the following contact details:

Email: privacy@finance.gov.au

Post: Privacy Contact Officer, Department of Finance, 1 Canberra Avenue, FORREST ACT 2600

Fax: +61 2 6283 7999

Availability of this Privacy policy

If you wish to access this Privacy policy in an alternative format (e.g. hard copy) please contact us using the contact details above. This Privacy policy is available free of charge.