Purpose
Cornerstone Housing Ltd (Cornerstone) is required to comply with the Privacy Act 1988 (Cth) (the Act) and the Australia Privacy Principles (APP).
The purpose of this Privacy Policy is to explain;
- The kinds of personal information that Cornerstone collects and holds;
- How Cornerstone collects and holds personal information;
- The purposes for which Cornerstone collects, holds, uses and discloses personal information;
- How an individual may access their personal information that is held by Cornerstone and seek the correction of such information;
- How an individual may complain about a breach of privacy and how Cornerstone will deal with such a complaint; and
- Whether Cornerstone is likely to disclose personal information to overseas recipients.
Definitions
| Term | Definition |
|---|---|
| ‘Personal information‘ | means information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not. |
| ‘Sensitive information‘ | means: information or an opinion about an individual’s: racial or ethnic origin; or political opinions; or membership of a political association; or religious beliefs or affiliations; or philosophical beliefs; or membership of a professional or trade association; or membership of a trade union; or sexual orientation or practices; or criminal record; that is also personal information; or health information about an individual; or genetic information about an individual that is not otherwise health information; or biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or biometric templates. |
Policy Statement
Collection and Retention of Personal Information
Tenants and Applicants
Cornerstone collects information from individuals which is necessary to check suitability and provide social or affordable housing and support services. This includes collecting personal information such as an individual’s name, address, contact number, email, Centrelink reference number, bank account details, income details, ethnicity, date of birth, gender, disability status, health history, family history and lifestyle factors.
Job applicants, employees, and volunteers
Cornerstone collects information from individuals which is necessary to assess and engage applicants for employment or volunteering with Cornerstone. This includes collecting personal information such as an individual’s name, address, contact number, email, professional experience, qualifications, references with past employers, bank account details, criminal history, and any other information which is necessary to assess your suitability for employment.
Board Members and Committee Members
Cornerstone collects information from individuals for the purposes of individuals becoming or being a board or committee member, and to enable Cornerstone to appropriately manage its governance obligations. This includes collecting personal information such as an individual’s name, address, contact number, email, professional experience, qualifications and past appointments, bank account details, criminal history, memberships, financial standing, and any other information which is necessary for Cornerstone to collect to properly discharge its governance obligations.
Landlords
Cornerstone collects information from individual landlords for the purposes of managing properties under a property management agreement. This includes collecting personal information such as an individual’s name, address, contact number, email, and bank account details.
Carers, Guardians, Attorneys, and Next-of-Kin
Cornerstone collects information about our tenants’ carers, guardians, attorneys, and next-of-kin for the purposes of contacting those individuals as needed to appropriately support the relevant tenant. This includes collecting personal information such an individual’s name, address, contact number, and email.
Donors
Cornerstone collects information from individuals for the purposes of fundraising and managing donations. This includes collecting personal information such as an individual’s name, address, contact number, email, credit card details, and bank account details.
Contractors
Cornerstone collects information from individual contractors for the purposes of managing and maintaining properties used to provide accommodation services, or to provide other negotiated services to Cornerstone. This includes collecting personal information such as an individual’s name, address, contact number, email, professional experience, license and insurance detail, qualifications, references with past employers, bank account details, and criminal history.
Collection of Personal Information
Cornerstone will only collect personal information that is necessary for it to carry out its business activities.
Where possible personal information will be collected directly from individuals, however, information may also be collected from multiple sources including directly from an individual, via a government agency, police records, landlords (past and present), recruiters, employers (past and present), support partners, and external referees.
Use of Personal Information
Cornerstone only uses personal information for the purpose for which it was collected by Cornerstone (primary purpose), unless:
- there is another purpose (secondary purpose) which is related to the primary purpose, and the individual would reasonably expect, or Cornerstone has informed the individual that said information will be used for that secondary purpose; or
- an individual has given consent for their personal information to be used for a secondary purpose; or
- Cornerstone is required or authorised by law to use an individual’s personal information for a secondary purpose (including for research and quality improvements within Cornerstone).
For example, Cornerstone may use an individual’s personal information to:
- provide accommodation services and support services to an individual, or assess an individual’s suitability to receive such accommodation and support services;
- notify individuals of services which Cornerstone reasonably considers may be suitable to an individual’s needs;
- for the purposes of managing and maintaining properties;
- invite individuals to events which Cornerstone facilitates or organises, where Cornerstone reasonably considers those events to be relevant to the services they provide to the individual;
- appropriately manage their business, such as reporting to any third parties to which Cornerstone has contractual obligations, assessing insurance requirements, conducting audits and maintaining our registration as a community housing provider;
- assist it in running its accommodation business, including quality assurance programs, billing, improving services, implementing appropriate security measures, conducting research, and training personnel; and
- effectively communicate with third parties, including Services Australia (e.g., Centrelink) and the Department of Human Services.
Security of Personal Information
Cornerstone will take all reasonable steps to protect any personal information collected to ensure protection from unauthorised access, misuse, loss, theft, modification, or unauthorised disclosure.
Reasonable steps include:
- Verifying the identity of any individual wishing to access their personal information;
- Implementing computer system safeguards including password protection, multifactor authentication, and rules of user access;
- Monitoring computer information systems to test and evaluate data security in line with the appropriate industry standards;
- Provision of lockable physical security for paper records;
- Ensuring that information is transferred securely;
- Archiving information in a secure and accessible manner;
- Storing material for a legal period and then disposing of it securely; and
- Ensuring there is reasonable physical security in Cornerstone’s offices.
Disclosure to Overseas Recipients
As of the date of approval on this policy, Cornerstone does not disclose personal information to overseas recipients.
We may engage services providers based overseas to host data storage for personal information. Cornerstone will take reasonable steps to ensure that overseas service providers do not breach Australian privacy laws in relation to the storage of an individual’s personal information.
The reasonable steps may not apply if Cornerstone reasonably believes that:
- The recipient is subject to laws that has the effect of protecting information in a similar way to the Australian Privacy Principals; and
- There are mechanisms that an individual can access in that overseas country to enforce their rights for any breaches or privacy of their personal information.
Accessing and Amending Personal Information
Individuals can request a copy of their personal information held by Cornerstone by contacting the Privacy officer at [email protected] or by post PO Box 100 Marden SA 5070. If an individual makes a request to access their personal information, Cornerstone will ask for verification of identity and request that the information sought be specified.
An individual can also request an amendment to any of their personal information if they consider that it contains inaccurate information.
While Cornerstone aims to meet all requests to access and amendments to personal information, if there is an instance where they are unable to do this, Cornerstone will provide a reason.
Complaints Handling
Complaints can be made by emailing [email protected] or by post PO Box 100 Marden SA 5070.
If the complaint is not rectified, it can be escalated to the Office of the Australian Information Commissioner – GPO Box 5218 Sydney NSW 2001, Phone: 1300 363 992 or Email: [email protected]
Openness
Cornerstone’s Privacy Policy is available publicly on its website (cornerstonehousing.com.au/privacy) and can also be obtained upon request.
Anonymity
Where feasible, an individual will have the option to deal with Cornerstone anonymously, however, if the personal information provided to Cornerstone is incomplete or inaccurate, or any personal information is withheld, Cornerstone may not be able to provide the services or support being sought, or deal with an individual effectively.
Responsibilities
The Board, through the CEO or delegate, will be responsible for maintaining the Privacy Policy
The Board, through the CEO or delegate, will be responsible for the day to day management of personal information collection, access, correction, storage, use, and disclosure.
Managers, including the CEO, will be responsible to consult and communicate with relevant staff on issues relating to privacy.
All employees will be responsible and accountable for their role in compliance with the Australian Privacy Principles.