Objective:
Purpose
This policy affirms Workforce Plus and its partner Management Governance Australia
(MGA） commitment to privacy and its approach to the responsible handling of personal，
sensitive and health information in all its forms，consistent with relevant legislation.
Overview
Workforce Plus is a not-for-profit organisation under Victorian law and operates on Aboriginal
Country of the Gunai Kurnai Nation. Workforce Plus expects all staff to respectfully work，live
and study on Aboriginal Country.

Workforce Plus and MGA is required to comply with the Privacy and Data Protection Act 2014
（Vic) and Health Records Act 2001 （Vic） in respect to the handling of personal sensitive and
health information. Workforce Plus and MGA controlled entities are also required to comply
with the Privacy Act 1988 （Cth） and will comply with the Victorian laws when handing
personal， sensitive and health information. This policy is modelled on Australian privacy
requirements，this now includes the Australian Privacy Principles (APP） privacy obligations as
at March2014.

 

·The principles that direct privacy management at Workforce Plus and MGA.
·The responsibilities of Workforce Plus and MGA its staff， students and affiliates when
handling personal， sensitive and health information (collectively referred to as personal
information） across all locations.
Scope:
This policy applies to all staff， students， Board Directors and affiliates of Workforce Plus and
MGA including contractors and partners providing services on behalf of Workforce Plus and
MGA.
Information referred to in this policy includes student records (including personal information
and training results） staff records (including personnel and payment records) and all other
business data relating to clients of all types.
This policy does not replace or alter Workforce Plus/MGA’s obligations under other laws such
as providing formal access to records under the Freedom of Information Act 1982 and the
（APP） privacy obligations.

Policy Statement:
Principles

1.1.Workforce Plus and MGA values the privacy of individuals and will foster a positive and
respectful privacy culture which supports a relationship of trust between Workforce Plus and
staff，students and third parties
1.2.Workforce Plus and MGA will apply and adhere to the Victorian Information Privacy
Principles (IPP），the Victorian Health Privacy Principles (HPP)，the Australian Privacy Principles
（APP)，and any other relevant laws as they apply to the entities，functions and activities
of Workforce Plus and MGA. To the extent that inconsistencies or differences might exist in
the global context best practice privacy management will guide Workforce Plus and MGA in
its actions to achieve compliance.
1.3.Workforce Plus and MGA adopts a privacy by design approach proactively incorporating
privacy requirements， ensuring compliance with law and enabling continuous improvement.
of privacy practices.
1.4.Workforce Plus and MGA will prescribe its approach to responsible and transparent
handling of personal information across the Workforce Plus and MGA in an
accessible Workforce Plus and MGA Privacy Statement.
1.5.Workforce Plus and MGA will ensure those covered by the scope of this policy are made
aware of their responsibilities and will provide appropriate information and compliance
training opportunities，
2.Responsibilities
2.1.Privacy is everyone’s responsibility and all staff，students and affiliates have an
obligation to manage personal information collected accessed usedre-used or disclosed
during their engagement with Workforce Plus and MGA in accordance with this policy
the Workforce Plus and MGA Privacy Statement，and associated information security，
information management policies.
2.2.Managers are required to ensure that privacy principles and practices are implemented
locally，and suspected or actual breaches of this policy are reported in accordance with the
Compliance Breach Management Procedure.
2.3.The Workforce Plus and MGA Chief Executive Officer（CEO) is responsible for:
a） Establishing the privacy management framework to enable communication and
implementation of applicable privacy requirements.
C）
b）Reviewing privacy impact assessments.
c Providing privacy training other education programs and advice
d） Monitoring compliance with this policy and reporting on complaints and
breaches of this policy to internal governance bodies and external agencies as
a
required.
e） Investigating privacy breaches，incidents or complaints.
2.4.The CEO oversees information security controls and responses to enable Workforce Plus
and MGA to deliver effective protection of personal data held by Workforce Plus and
MGA consistent with privacy management obligations across all its operations.
2.5.The CEO is responsible for making determinations on external reporting on the
recommendation in the event of a privacy breach.
2.6.The CEO monitors compliance with this policy and reports on complaints and breaches

3.Review
3.1.The CEO will review this policy at least every three(3）years in accordance with the
Policy Governance Framework and review and update the Workforce Plus and MGA Privacy
Statement annually.
4.Type of information collected
4.1.Workforce Plus and MGA usually collect personal information about individuals directly
from those individuals or their authorised representative
Workforce Plus and MGA sometimes collect personal information from a third party or from a
publicly available source，but only if:
the individual has consented to such collection or would reasonably expect us to collect their
personal information in this way or
if it is necessary for a specific purpose such as the investigation of a privacy complaint.

4.2.Workforce Plus and MGA only collect personal information for purposes which are
directly related to our functions or activities under the Privacy Act 1988 （Privacy Act），
Freedom of Information Act 1982 （FOI Act） or the Australian Information Commissioner Act
2010 （AIC Act） and only when it is necessary for or directly related to such purposes.
Workforce Plus and MGA will collect and securely store personal information including but
not limited to， postal addresses email addresses and telephone numbers， where it has been
provided for a specific purpose， for example feedback on-going contact or subscription to a
blog or newsletter.

With consent Workforce Plus and MGA will also collect sensitive information relating to client
health when itis necessary.

5.Using our computers and data collection
5.1.Google Analytics uses cookies to collect information about which pages have been
visited length of time spent on the site，and navigation pathways (for example from a search
engine，a link，an advertisement etc.) and screens selected. Information collected by cookies
（including IP addresses） is transmitted to and stored by Google on servers in the USA.

6.Method of collection of other data
6.1. Personal and sensitive information is collected in a number of ways，including from
business cards，direct email，online data entry，verbally，by fax and by mail.
7.Identifiers
7.1.Workforce Plus and MGA will assign unique identifiers to individuals where it is
necessary in order to carry out one or more of its functions or activities. Workforce Plus and
MGA will not make this unique identifier available to others and will not adopt as its own a
unique identifier that has been assigned by another agency: The exception to this is the
Unique Student Identifier (USI） which has been assigned by ASQA to students to track
people through the education system. Workforce Plus is required to report on Unidentified
students. This reporting relates to participation only not academic results or health or welfare
information.

8.Anonymity
8.1.Workforce Plus and MGA will give people the option to interact anonymously whenever
it is lawful and practicable to do so.Where an individual opts for anonymity，staff will ensure
the individual is aware that thiswill impact on the provision of training and other services
9.Storage of information
9.1.Workforce Plus and MGA take steps to protect the personal information we hold against
loss unauthorised access，use， modification or disclosure， and against other misuse，
9.2.When the personal information that we collect is no longer required，we destroy or
delete it in a secure manner， in accordance with the OAICS Records Disposal Authority.
9.3.Personal information relating to day-to-day activity is maintained in an online database
（Job Ready）， which is password protected. In addition，individual staff members may
maintain personal contacts lists’ containing personal information required for them to perform
their daily duties，which is also password protected.
9.4.Hardcopy information is held in secure locked cabinets.

10.Use and disclosure of information
10.1.Workforce Plus and MGA only use personal information for the purposes for which we
collected it- purposes which are directly related to one of our functions or activities.
10.2. Workforce Plus and MGA do not give personal information about an individual to other
Government agencies private sector organisations or anyone else unless one of the following
applies:

·the individual has consented
·the individual would reasonably expect，or has been told，that information of that kind is
usually passed to those individuals bodies or agencies
·it is otherwise required or authorised by law
· it will prevent or lessen a serious and imminent threat to somebody’s life or health or
·It is reasonably necessary for the enforcement of the criminal law or of a law imposing a
pecuniary penalty， or for the protection of public revenue.
·Personal information relating to day-to-day business is used primarily for liaising about
current and future business. When personal information has been provided for a specific
reason for instance to receive blog updates it is used for this purpose. Personal
information relating to current and prospective clients is also used for direct marketing
purposes. As per APP 7，cause 7.2 (b） these clients would reasonably expect to receive
occasional marketing from Workforce Plus/MGA.
·Workforce Plus/MGA will not share personal information with any other parties without
permission unless it:
·is required or authorised by law
·will prevent or lessen a serious and imminent threat to someone’s health
ois basic contact information required for direct marketing activities.
·Other than information collected by Google Analytics from our websites (see above）. no
personal or sensitive information is disclosed to overseas recipients
11.Accessing your information
11.1 clients can access the personal information that Workforce Plus and MGA hold about
their person and can ask Workforce Plus and MGA to correct the personal information held
about them

11.2.The client may request access to or correction of personal information about them that
Workforce Plus and MGA holds at any time， The client may opt out of any further contact
from Workforce Plus and MGA.To protect individuals privacy and the privacy of others，
Workforce Plus/MGA will need evidence of identity before information about a individual can
be accessed or changed. Please contact Reception for further advice.
12.If you wish to make a complaint
12.1. Workforce Plus and MGA are bound by the Privacy Act 1988 （Cth），and the Privacy
Amendment （Enhancing Privacy Protection） Act 2012. If you feel we have breached one or
more of the APPs you complain directly to Workforce Plus/MGA in writing. If you have not
received a response within 30 days， or are dissatisfied with the response you can contact the
Office of the Australian Information Commissioner （OAIC).

13.Definitions
Health information
Information or an opinion about an individual’s physical， mental or psychological healthy
disability； health services provided or future provision of health services and a variety of
other health matters (including information about organ or body substance donation and
genetic information)

Personal data
Refers to any information relating to an identified or identifiable natural person/ directly or
indirectly，by reference to an identifier such as a name an identification number location
data，an online identifier or to one or more factors specific to the physical， physiological
genetic mental， economic，cultural or social identity of that natural person.
Personal information
Information or an opinion that is recorded in any form about an individual whose identity is
apparent or can reasonably be ascertained from the information or opinion. Typically this
includes information like name，date of birth address，phone number etc. Personal
information includes personal data.
Privacy by design
The means for ensuring privacy protections are integrated in process and technology design.
Sensitive information
A special category of personal information that requires more protection. It includes the
following information about an individual: racial or ethnic origin； political opinion；
membership of a political association； religious beliefs or affiliations； philosophical beliefs；
membership of a professional or trade association； membership of a trade union; sexual
preference or practices； criminal record.