Privacy Policy
Karla Kuliny Aboriginal Corporation (Karla Kuliny) is committed to protecting the privacy of personal information of clients, families, carers, staff, volunteers, supporters, and other stakeholders that it collects, holds and administers.
KARLA KULINY collects and administers a range of information for the purposes of providing supports and service delivery to Aboriginal children and young people, families and communities, particularly in the areas of child protection, out of home care and youth justice.
Personal information is collected through conversations with people and from written and electronic communication received. This includes information received from referrals and requests for support, during intake, assessment and service delivery, and from other enquiries, feedback and complaints.
Karla Kuliny also collects personal information through the process of recruiting and managing staff, volunteers, directors and members.
Karla Kuliny recognises the essential right of people to have their information administered well, with respect, integrity, appropriate confidentiality and in a manner that supports good outcomes for those people.
Karla Kuliny recognises the particular importance of collecting, retaining and managing the personal data of children and young people in care, and the fundamental role data security plays in helping to safeguard children and young people. Karla Kuliny has clear processes for managing consent and disclosure for personal information of children and young people.
Karla Kuliny’s approach to privacy are supported through Karla Kuliny’s core values of Caring, Understanding, Leadership, Trust, Unconditional Respect, Empathy and Spirituality.
Karla Kuliny is bound by the Privacy Act 1988 (Commonwealth) which imposes specific obligations when it comes to handling information.
Karla Kuliny’s management of personal information is guided by the following principles:
Privacy Principles
- Karla Kuliny only collects information which the organisation requires for its primary functions, including service delivery, employee management, and management of Directors and Members;
- Karla Kuliny ensures that stakeholders are informed about why we collect information and how we administer this information;
- Karla Kuliny uses and discloses personal information only for our primary functions or another closely related purpose;
- Karla Kuliny stores personal information securely, protecting it from unauthorised access; and
- Karla Kuliny provides stakeholders with access to their information, and provide processes to correct or update the information.
Karla Kuliny will never publish or otherwise publicly disclose any information that identifies or may lead to the identification or a child as being a child in care. Further information on steps to safeguard the wellbeing of children is contained in Karla Kuliny’s Safeguarding Children Policy.
DETAILED POLICY
Type of information collected
Karla Kuliny only collects information that is required and relevant for the purposes of providing support and services to Aboriginal children, young people, families and community.
This information is collected lawfully and fairly.
Most of the time this information is provided directly by the individual. However, sometimes we may need to collect information about an individual from a third party such as a carer, trustee, an authorised representative, another service provider or from a public source.
Confidential information about a client, carer or family
Confidential information about a client, carer, or family, will only be collected when appropriate informed consent has been provided by the individual or their legal guardian. The exception to the requirement for consent is information that Karla Kuliny are required by law to collect or retain or where it is required to ensure the safety and wellbeing of a child.
Confidential information about an individual not receiving care
If, as part of service provision, personal information is shared with Karla Kuliny in confidence about a person who is not receiving services, Karla Kuliny will:
- Take all reasonable steps to confirm with the person that it is to remain confidential
- Record personal information only if it is relevant to the provision of service or support
- Take all reasonable steps to ensure that personal information is accurate and not misleading.
- Take all reasonable steps to ensure that personal information provided to it remains confidential.
Sensitive information
Sensitive information includes information about a person’s culture or ethnic origin, political opinions, or membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices or criminal record that is also personal information.
Karla Kuliny only collects sensitive information when is it required or authorised to do so under law or when necessary to lessen or prevent a serious threat to the life or health of any individual.
Health information
Health information includes any personal information about your health or disability. It includes information or opinion about your illness, injury or disability.
Karla Kuliny only collects health information when it is in the best interests of a client, when it is required or authorised to do so under law or when necessary to lessen or prevent a serious threat to the life or health of any individual.
Health information is collected as required or authorised by under law and in accordance with rules established by competent health or medical bodies that deal with obligations of professional confidentiality which bind the organisation.
Consent
Karla Kuliny provides information about its consent process at the commencement of services, engagement, recruitment of employment process and ensures that people are consulting regarding the use of their personal information.
Consent information is tailored to the audience, and wherever possible discussed with the child as well as an appropriate legal guardian, in language that Karla Kuliny reasonably expects them to understand.
Karla Kuliny understands that there is no exact age at which people can make their own privacy decisions, and that for consent to be valid the person must have the capacity to provide consent, including sufficient maturity and understand of what is being proposed.
Generally speaking, Karla Kuliny assumes that people who are aged over 16 years or over have the capacity to consent to the collection of data, unless it is known that there are factors present that impact the individual’s capacity.
Security of the information held by Karla Kuliny
Karla Kuliny takes all reasonable steps to ensure the protection of personal information that it holds from misuse, loss, interference and unauthorised access, modification or disclosure.
These measures include securing paper files in locked cabinets and physical access restrictions.
Karla Kuliny uses some third-party providers and Australian Childhood Foundation systems to manage and retain its electronic records.
Karla Kuliny works with the these providers and Australian Childhood Foundation to ensure the security of this information, including to ensure that appropriate controls are in place to limit the access of this information to Karla Kuliny employees and nominated delegates. Requirements and protocols for secure data managed are documented in the service agreement.
Use of client data by Karla Kuliny personnel
Client data is used to support effective service delivery and make decisions about the care and support of children and young people.
Therapeutic staff have access to client records in accordance with their duties. This includes the direct case worker and other therapeutic staff who they may consult with about the client. The appropriate purposes for accessing this data include to make assessments about client risk and need, determine appropriate services and supports, prepare reports, ensure appropriate clinical record keeping, monitoring the quality of care and undertaking supervision effectively.
Management also has the right to access client records for legitimate purposes including for example supervision, to review complaints, provide clinical advice or undertake quality assurance.
Administration staff do not have access to client files, however may have access to some form of service user records and reports specifically for the purpose of record keeping, reporting, or other clerical purposes.
From time to time, ACF employees present the work done by the children who have received a service to different audiences to promote the outcomes of ACF. On such occasions, permission will always be sought from children and their parent/carer to use their pictures, drawings, poems, stories, and artwork that has been developed during children’s involvement with the organisation for such purposes. This consent will be asked for in writing and the family will be advised of how this work is going to be used.
Use of staff, director, volunteers or members data
Staff, director, volunteers and members will each have Personnel files that contain personal information required for the purpose of recruiting and managing their association with Karla Kuliny. This typically includes contracts, variations to contracts, qualifications, resumes, recruitment reports, and copies of any outcome of disciplinary actions and other related information about a staff member, student, or volunteer. Personnel files are kept by the CEO in a locked filing cabinet
Personnel files are accessible by the CEO, nominated supervisors, H.R. delegates and the Board Secretariat only.
Specific administrative elements of the Personnel Files such as WWCC, Code of Conduct, salary, leave, and superannuation may be accessed by administrative officers and relevant staff who are authorised by the CEO to have access to information about staff members in order to facilitate the HR, administrative and/or Quality requirements of the organisation.
Staff will each have a Supervision files record outcomes of supervision between the staff member, student or volunteer and their supervisor, performance appraisals, professional development plans, outcomes of disciplinary procedures and any other information associated with work performance.
Supervision files are maintained by the staff member’s line manager. Specific elements of the Supervision Files may be accessed by senior management or relevant staff who are authorised by the CEO to have access to information in order to facilitate the HR, administrative and/or Quality requirements of the organisation.
At the end of a contract, both files are collapsed into one file and stored securely. The collapsed file is then only available to the relevant Senior Manager, the National Corporate Services Manager, HR, the Deputy CEO and CEO.
Collapsed personnel files are retained in secure storage for 25 years and then destroyed using a secure method organised through RECALL storage management.
Disclosure
Karla Kuliny will only disclose data to third parties:
- for the primary purpose for which it was collected;
- Where Karla Kuliny believe that the individual would reasonably expect it to use or disclose the information for another reason closely related to the purpose for which it was collected;
- or where required to under law; or
- or when necessary to lessen or prevent a serious threat to the life or health of any individual.
Karla Kuliny will always seek and obtain your consent for this information to be disclosed to a third party, unless one of the following applies:
- Karla Kuliny is required to do so by law;
- it will prevent or lessen a serious threat to somebody’s life, health or safety or to public health or safety;
- it is reasonably necessary for the enforcement of a law conducted by an enforcement body;
- it is reasonably necessary to assist in locating a missing person; or
- it is reasonably necessary to the conduct of proceedings before a court or tribunal, or for a confidential dispute or resolution process.
This disclosure of data to external organisations (where the requirements for disclosure noted above are met) may include:
- government departments or agencies who provide funding for services
- contractors who support the delivery of some services offered – noting that Karla Kuliny takes all reasonable steps to ensure that contractors comply with the privacy legislation and requirements of this policy when handling personal information
- other information sharing entities prescribed under law
- doctors and healthcare professional who assist us to deliver services
- Police or enforcement agents where legally required/compelled to do so
- other regulatory bodies
In relation to employee, director, members or volunteer information, this may also include disclosure to:
- Referees or former employers or Berry Street employees and volunteers, and candidates for Karla Kuliny employee and volunteer positions
- Professional advisors, including accountants, auditors and lawyers.
Use of Identifiers
Karla Kuliny will not adopt as its own identifier of an individual an identifier that has been assigned by any third party. It may however adopt a prescribed identifier by a prescribed organisation in prescribed circumstances.
Karla Kuliny will not use or disclose the identifier assigned to an individual by a third party unless:
- the use or disclosure is necessary for the organisation to fulfil its obligations to the agency; or
- the use or disclosure is by a prescribed organisation of a prescribed identifier in prescribed circumstances.
Website
When people access Karla Kuliny’s website or connect with Karla Kuliny through social media, Karla Kuliny or their third-party service providers may use ‘Cookies’. These small data files placed on your device do not identify individuals personally but do identify devices. We may also use software such as JavaScript, or similar technology.
- This allows us to:
- remember your details and preferences when you return
- maintain the continuity of your browsing session
- use Google Analytics to collect information such as demographics and interests, visits to our websites, length of visit and pages viewed
- tailor our advertising through networks on other websites.
You can set your browser to notify you when you receive a Cookie, and this will provide you with an opportunity to either accept or reject it in each instance. Please note that if you do this, it may affect some of the functions on our website.
We take great care to protect your personal information on our website and whenever you communicate with us. Once we receive your personal information, we take reasonable steps to protect its security
Disposal of information
Karla Kuliny only keeps personal information for as long as it is required by law. Information that is retained will be archived in such a way that facilitates easy retrieval yet does not compromise security.
If and when personal information is no longer required, the information is destroyed in a secure manner.
Rights, access and corrections
Karla Kuliny takes all reasonable steps to ensure that the personal information that is collected, used or disclosed is relevant, accurate, complete and up to date. If at any time an individual wishes to update their personal information that can do so by contacting Karla Kuliny’s CEO via info@karlakuliny.org.au.
If the individual and Karla Kuliny disagree about whether the information is accurate, complete and up to date, and the individual asks [organisation] to associate with the information a statement claiming that the information is not accurate, complete or up to date, the Karla Kuliny will take reasonable steps to do so.
On request by a person, Karla Kuliny will take reasonable steps to let the person know, generally, what sort of personal information it holds, for what purposes, and how it collects, holds, uses and discloses that information.
Karla Kuliny will provide to the individual its reasons for denial of access or a refusal to correct personal information.
Karla Kuliny can withhold the access of an individual to his/her information if:
- providing access would pose a serious and imminent threat to the life or health of any individual; or
- providing access would have an unreasonable impact upon the privacy of other individuals; or
- the request for access is frivolous or vexatious; or
- the information relates to existing or anticipated legal proceedings between the organisation and the individual, and the information would not be accessible by the process of discovery in those proceedings; or
- providing access would reveal the intentions of the organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
- providing access would be unlawful; or
- providing access would be likely to prejudice an investigation of possible unlawful activity; or
- an enforcement body performing a lawful security function asks Karla Kuliny not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.
If Karla Kuliny decides not to provide the individual with access to the information on the basis of the above-mentioned reasons, Karla Kuliny will consider whether the use of mutually agreed intermediaries would allow sufficient access to meet the needs of both parties.
Complaints
If an individual as a complaint about Karla Kuliny or its personnel in relation to privacy, the individual has the right to make a complaint and have it investigated.
To make a complaint about Karla Kuliny’s privacy practice please contact one of the following:
- Your current or former support worker
- Your current or former manager
- Karla Kuliny’s CEO via info@karlakuliny.org.au
Privacy complaints can also be directed to Karla Kuliny’s general enquiries email via info@karlakuliny.org.au In the event that further resolution is required, the complaint should be brought to the attention of the Office of the Federal Privacy Commissioner.