Privacy
Quality and Risk
Version Control
Version
1
(supersedes policy 1.02)
Date Approved
17/08/2022
Date for Review
30/09/2025
Purpose
As an Australian Privacy Principles (APP) entity, Mpower has a legal obligation to clients, employees, contractors and the public to abide by the Australian Privacy Principles the Privacy Act 1988 and state based legislation to protect the rights of individuals to privacy and confidentiality.
Mpower must responsibly manage the collection, use and disclosure of personal information, the integrity and correction of personal information, the rights of individuals to access their personal information and ensure the confidentiality of any procedure, form or collateral that uses personal, health or sensitive information.
Scope
This policy applies to all Mpower employees, students, contractors and volunteers, children and young persons and adults receiving Mpower services and supports.
Policy Context
Standards
- Australian Human Rights Commission Act 1986
Guidelines
- Australian Privacy Principles 2019
Acts, Federal and Victorian
- Child Information Sharing Scheme
- Child Safe Standards 2022
- Crimes Act 1958
- Enhancing Online Safety Act 2015
- Family Violence Information Sharing Scheme
- Freedom of Information Act 1982
- Health Records Act 2001 (Vic)
- Human Services Standards 2015
- ISO 9001:2015 Standards
- NDIS Practice Standards and Quality Indicators 2019
- Part 5A of the Family Violence Protection Act 2008
- Privacy Act 1988
- Privacy and Data Protection Act 2014 (Vic)
- Victorian Charter of Human Rights and Responsibilities Act 2006
Organisation policies
2.02 Complaints
2.03 Incident Response and Reporting
4.03 ICT Security and Usage
5.02 Recruitment, Selection and Appointment
6.03 Information Sharing and MARAM
6.04 Client Service Charter
6.05 Client Records
Forms, record keeping, other documents
2.02.01 Complaints Handling Procedure
2.04.01 Privacy Procedures
2.04.02 Privacy Collection Statement
6.05.01 Client Records, Health and Personal
Child Link
Incident Management System
Mpower Rights and Responsibilities Brochure
Mpower Service Agreements
MYP System
Risk Register
Xero Accounting System
Policy Statement
Mpower only collects personal, health or sensitive information within Australian borders.
Mpower will be responsible for the fair and responsible handling of personal, health or sensitive information by protecting the privacy of an individual's information that is held, providing individuals with a right of access to their information and providing an accessible framework for the resolution of complaints regarding the handling of that information.
Mpower must take reasonable steps to protect personal, health or sensitive information it holds from misuse, interference, loss, unauthorised access, modification or disclosure.
Where Mpower no longer needs personal information that it holds, it must take reasonable steps to destroy that information or ensure that it is de-identified.
Mpower must set out in documents clearly expressed procedures on its management of personal, health or sensitive information and the steps that an individual must take in order to obtain access to, or correction of their information.
Mpower must not delete information relating to an individual, even if it is later found or claimed to be inaccurate, unless the deletion is permitted, authorised, or required by law.
Mpower uses the personal and sensitive information that it collects about its employees, students, contractors and volunteers, children and young person’s to provide administration services, to contact them with Mpower information as part of their supports and services, to investigate complaints and conduct disciplinary investigations and proceedings, to conduct internal audits and as otherwise needed for its functions and activities.
Personal information that Mpower collects may be used to market the services of Mpower.
Mpower collects and holds health information to provide health services, supports or activities performed in relation to an individual that is intended to assess, record, maintain or improve the individual's health, to treat the individual's illness or disability or suspected illness or disability.
Mpower may disclose, or provide access to, your personal information to third parties in connection with the purposes described in this Privacy Policy and Policy Procedures such as in its CRM provider, for the maintenance and security of that information. Third parties may be located anywhere within Australia from time to time.
Mpower’s nominated Privacy Officer is the Chief Executive Officer.
All privacy breaches must be reported in the Incident Management System.
Responsibilities and Delegations
This policy applies to
All personal, sensitive and health information collected and held in any format for the purpose that it has been collected.
Specific Responsibilities
The Chief Executive Officer is the Privacy Officer
Policy approval
Executive
Definitions
Child Link
A web-based platform that displays information about a child to authorised key professionals who have responsibility for child wellbeing and safety. Child Link shows limited but critical information, such as a child’s participation in key early childhood and education services.
Health Information
Information or an opinion, that is also personal information about the health or disability of any individual.
Health Service
An activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or the person performing it to assess, record, maintain or improve the individual's health, to treat the individual's illness or disability or suspected illness or disability.
CRM
The Client Relations Management (CRM) system is a software program where all participants, clients, providers and suppliers details are kept.