Sharing information with third parties
ANU recognises that your privacy is very important. The way we collect, use, disclose, secure and dispose of your personal information is governed by our compliance with, and obligations as an 'agency' under the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs).
We collect, hold, use and disclose your personal information to enable us to meet legal obligations and for a range of internal University purposes. These include:
for students:
to administer your admission, enrolment, academic progress, academic integrity, discipline, graduation, accommodation, access to University facilities and services, library loans, fees, visa, immigration, taxation and financial support purposes, and in relation to graduates, for alumni activities;
for employees, visitors and sub-contractors:
to administer pay, entitlements, performance, research funding applications, access to University facilities and services, visa, immigration and taxation purposes, and in relation to work health and safety, or rehabilitation and compensation matters.
Governance
You can find detailed Information on the university's approach to privacy on the ANU website. ANU policies and procedures are available in the University Policy Library, including the ANU Privacy Policy.
Disclosing personal information to third parties
It is vital that personal information is only provided to and used by third parties if it is permitted by the Privacy Policy and Privacy Act 1988. All staff are responsible for ensuring this information is only provided to third parties if there is a reason to supply that information that is consistent with the policy. For example, if you are asked to supply names and emails of individuals to an external group, you should check the request with the Senior Privacy Officer (privacy@anu.edu.au), if it is not a circumstance covered by the policy.
Receiving appropriate approvals
Remember, privacy obligations can change, so you should always seek delegate approval to disclose personal information, even if a request has been approved in the past. Local areas who disclose personal information to third parties are encouraged to implement a documented approval process, so that delegate approval can be captured and recorded in the ERMS.
Misuse of your personal information
If you are contacted by an organisation that you have not given consent to have and use your personal information, you should ask that they delete your personal information and consider reporting the matter to the OAIC. If you need assistance, please contact the Senior Privacy Officer (privacy@anu.edu.au).
Resources and training
It is recommended that all staff undertake the ANU Privacy Awareness Training module, if you have not already done so - it can be found on Pulse. Training material from information sessions and more can be found on the ANU website. The Senior Privacy Officer is also available to provide local area training, addressing privacy issues for your business processes and activities.
Scenario questions
Have a read of the following scenarios and think about what you would do if you were faced with them. Check your answer against the guidance provided.
Scenario 1:
You are contacted by your trade union. The union wants to ensure their mailing lists are up-to-date and ask for a list of the names and ANU email addresses of all current staff in your local area. Do you:
A. Provide the information - the union will probably be contacting staff about working at ANU, so it is ok
B. Only provide the names and emails of staff on the ANU directory - that is public information anyway
C. Advise the caller you are unable to provide the requested information - the union is a third-party, so express consent is required from individuals to disclose personal information
Answer: If you selected option C, that is correct! ANU staff must not provide any personal information to third parties without the express consent of the individuals.
You can thank the caller for contacting you, but advise that you are not able to disclose personal information to third parties. You refer any further privacy questions to the ANU Privacy Officer.
Option A is not correct, as providing information to the union is not permitted by the ANU Privacy Policy, regardless of how the union will use the information.
Option B is not correct, as it does not matter if the information may be publicly available elsewhere, ANU must not disclose the information without consent.
Do not hesitate to contact the Privacy Officer for any additional Information or clarification.
Scenario 2:
You receive an email from a new textbook supplier, who is offering ANU students 15% off all textbooks and laptop purchases, if they can verify their enrolment. They ask for a list of all currently enrolled students at ANU, including names, email and mailing addresses, phone numbers and program details. Do you:
A. Send the list straight away - what a great opportunity for the students to save some money on their study supplies
B. Advise the sender you are unable to provide the requested information - the supplier is a third-party, so express consent is required from individuals to disclose personal information
C. Only provide a list of students enrolled in courses with really expensive textbooks - the discount will help them the most
Answer: If you selected option B, that is correct! ANU staff must not provide any personal information to third parties without the express consent of the individuals.
Contact your Associate Dean Education to discuss the offer and consider whether any action would be appropriate. Then the sender can be thanked for contacting you, and advised that you are not able to disclose personal information to third parties. Any appropriate actions can then be discussed with the sender. You can refer further privacy questions to the ANU Privacy Officer.
Option A and C are not correct, as providing information to a third-party business is not permitted by the ANU Privacy Policy, even if they provide services that may be useful to students or staff.
Scenario 3:
You receive an email from an organisation who would like to award a grant to a researcher at ANU. They ask for the names, email addresses and phone numbers of all current research fellows, so they can contact them about their organisation and services offered for researchers. Do you:
A. Provide all the information requested - a grant is a grant after all and protecting personal information comes second to possible income
B. Only provide the names and email addresses - the organisation does not need to call the researchers, but there is no harm in receiving a few emails
C. Advise the sender you are unable to provide the requested information - the organisation is a third-party, so express consent is required from individuals to disclose personal information. You pass the sender's details to the contact in your College responsible for grants, to follow up with the organisation
Answer: If you selected option C, that is correct! ANU staff must not provide any personal information to third parties without the express consent of the individuals.
ANU welcomes the opportunity to consider awards and scholarships for students and research. There are established processes and guidelines for these. Contact the relevant staff in your college or school or the Admissions Office and Coursework Scholarships Office to determine the next steps.
The sender can be thanked for contacting you, advised of the process for consideration of their offer without disclosure of personal information to third parties. You refer any further privacy questions to the ANU Privacy Officer.
Option A is not correct, as providing information to a third-party organisation is not permitted by the ANU Privacy Policy, even if they provide services that may be useful to students or staff.
Option B is not correct, as email addresses are personal information, and must be handled in the same way as any other personal information.
Further support
For any questions or concerns, please contact the Senior Privacy Officer on (02) 6125 4679 or privacy@anu.edu.au.