(v) preparation for, or conduct of, proc(v) preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders

(v) preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders

by or on behalf of an enforcement body; or

(k) an enforcement body performing a lawful security function does not ask the member club not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.

5.3.2 If the member club is not required to provide the member or patron with access to the information because of 5.3.1, the member club must, if reasonable, consider whether the use of mutually agreed intermediaries would allow sufficient access to meet the needs of both parties.

5.3.3 Where providing access would reveal evaluative information generated within the member club in connection with a commercially sensitive decision-making process, the member club may give the member or patron an explanation for the commercially sensitive decision rather than direct access to the information.

5.3.4 The member club will not charge any fees for lodging a request for access to personal information but may charge a reasonable fee for providing access to personal information.

5.3.5 The member club will update the information as soon as reasonably practicable if informed by a member or patron that the information held by the club about the individual is inaccurate, incomplete or not up-to-date.

5.3.6 The member club will take reasonable steps to associate with the requested information a statement claiming that the information is inaccurate, incomplete or not up-to-date if the member or patron and the member club are unable to agree that the information is accurate, complete and up-to-date and the member or patron requests the club to provide the statement.

5.3.7 The member club will a provide reason for any denial of access or refusal to correct personal information.

5.3.8 The member club will put the notice in SCHEDULE 4 in a prominent location in the member club to inform members or patrons about its information management practices, including the type of information it holds, for what purpose, and how it collects, holds, uses and discloses personal information. A member club will take reasonable steps to inform a person of these information management practices on request.

5.4 Security of Personal Information

5.4.1 The member club will take reasonable steps to safeguard the personal information it collects and holds by locating the personal information in a secure place in the club.

5.4.2 The member club will establish guidelines as to which staff members can access personal information and under what circumstances.

5.4.3 The member club will prevent unauthorised access, modification or disclosure and misuse or loss of personal information by putting in place appropriate measures.

5.4.4 The member club that has internet and email facilities will implement an email/internet policy regarding the transmission of personal information through the internet and by email. The member club will provide regular training and awareness sessions to ensure staff understand their privacy obligations in this regard.

5.4.5 The member club will take reasonable steps to destroy or permanently de-identify any personal information that is no longer needed.

5.4.6 The member club will take reasonable steps to instruct staff members not to discuss among themselves personal, health or other sensitive information of members or patrons unless it is necessary for the staff member to perform their duties in relation to the member or patron.

5.4.7 If a member club discloses personal information to a third party contractor for the purpose of performing a function on behalf of the member club, it will require the contractor, as a condition of the contractor’s engagement, to take reasonable steps to protect that information.

5.5 Transborder Flows of Information

5.5.1 The member club, subject to clause 5.5.2, will only transfer personal information of a member or patron to a recipient in a foreign country if:

(a) the member or patron consents to the transfer; or

(b) where the transfer is for the benefit of the member or patron and it is impracticable to obtain the consent of the member or patron to the transfer and if it were practicable to obtain such consent, the member or patron would be likely to give it; or

(c) the transfer is necessary for the performance of a contract between the member or patron and the organisation, or for the implementation of pre-contractual measures taken in response to the member’s or patron’s request; or

(d) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the member or patron between the organisation and a third party; or

(e) the member club has taken reasonable steps to ensure that the information which it has transferred will not be held, used or disclosed by the recipient of the information inconsistently with the APC.

5.5.2 The member club will not transfer information to a recipient in a foreign country in circumstances where the:

(a) recipient of the information is in a jurisdiction not subject to a law substantially similar to the protection accorded under the NPPs in the Privacy Act; or

(b) the member or patron about whom the information relates has not consented to the transfer of information; or

(c) information may be used in ways which are inconsistent with the privacy principles in the APC.

5.5.3 The member club may, when in doubt, ask for a written assurance from the parties involved that the information will remain secure before transferring the information.

6 Application of the Approved Privacy Code

SCHEDULE 5 outlines a possible in-house policy that member clubs can use to meet their privacy obligations under the APC. Member clubs should note that the policy is not an exhaustive list but only outlines the most common examples of the application of the APC in the member club.

7 Breach of the Approved Privacy Code

A member club commits a breach if the member fails to adhere to a provision of the APC.

8 Internal Complaint Resolution Procedures

8.1 The complaint handling procedures established under the APC and the Privacy Act (and accompanying guidelines) will apply to the resolution of a privacy complaint made by a member or patron against a member club.

8.2 If a complaint is instigated or made by a member or patron whilst the member club is (or was) bound by the APC, the member club will be required to resolve the matter to the extent provided in the APC.

8.3 The APC relies on the Privacy Commissioner to deal with all unresolved privacy complaints. The member club is obliged to comply with any declaration made by the Privacy Commissioner and must not repeat or continue the relevant activity or conduct that was the cause of the complaint. In this regard, member clubs must provide all reasonable co-operation, as requested by the Privacy Commissioner.

8.4 The Privacy Act requires all complaints to be resolved at the local level as far as reasonably possible. As such, the complainant in most instances should complain about the alleged breach to the relevant member club (respondent) in the first instance.

8.5 In the event that a member club receives a privacy complaint, the member club will endeavour to respond to the complainant’s concerns as follows:

8.5.1 The member club will designate a staff member as the point of contact in the club regarding privacy issues.

8.5.2 The designated staff member will liaise with the complainant and identify and define the nature and cause of the complaint (and ask, if necessary, for the complaint to be put in writing).

8.5.3 The designated staff member will then inform the complainant of their rights under the APC and Privacy Act, and the timeframe (within 30 days) in which the club will be able to respond to the complaint. The designated staff member, for instance will inform the complainant that they may take their complaint directly to the Privacy Commissioner in the event that the complainant is not satisfied with the outcome after the initial approach and discussion with the member club.

8.5.4 The designated staff member will inform the complainant of the response, if any, by the member club, including the basis (legislation, APC, policies) on which the response was framed.

8.5.5 If the outcome of this liaison between the complainant and the member club is not to the satisfaction of the complainant, the designated staff member will advise the complainant that the complaint is escalated and should be handled in accordance with s.36 of the Privacy Act.

8.5.6 The designated staff member will record details of the complaint and action taken in the Register of Complaints and Actions in SCHEDULE 6.

8.6 The member club must ensure that all complaints are dealt with in a reasonably appropriate timeframe so that any decision (if any decision is required to be made) is made expeditiously and in a manner that does not compromise the integrity or quality of any such decision.

9 Staff Training

9.1 Relevant staff will be provided with appropriate training so that they are aware of the contents, procedures and application of the APC, including referring all privacy complainants to the designated staff member who will be the point of contact for privacy issues in the member club.

9.2 The designated staff member who will be responsible for privacy issues will undergo further training so that he/she is well informed and better positioned to facilitate in instances where the complainant is required to first contact the club (respondent) before approaching the Privacy Commissioner.

9.3 The member club will keep a record of the training in the Register of Training in SCHEDULE 7.

10 Acceptance of and Release from the Approved Privacy Code

10.1 The APC is voluntary and the member club has a choice to either accept or not accept compliance with it. Where a member club does not accept the APC, the NPPs will apply as default privacy principles unless the member club is exempt from the operation of the Privacy Act.

10.2 If the member club decides to accept the APC, the member club will then indicate its formal acceptance by completing the Acceptance of the Queensland Club Industry Privacy Code form in SCHEDULE 8.

10.3 The member club can complete the Release from the Queensland Club Industry Privacy Code form in SCHEDULE 9 at any time after formally accepting the APC, if the member club decides to opt out of the APC. However, if a complaint is instigated or made by a member or patron whilst the member club is (or was) bound by the Privacy Code, the member club will be required to resolve the matter to the extent provided in the APC. To avoid any doubt, a member club will be released from complying with the APC upon the receipt by the Privacy Code Administrator of a completed and executed ‘Release from the Approved Privacy Code’ form.

10.4 The member club can re-join the APC at any time after the date referred to in 10.3, provided it meets the requirements set out in clause 10.2 and makes a written submission for re-subscription and receives written approval for re-subscription from the Privacy Code Administrator.

10.5 Member clubs must return the completed forms/documents referred to in 10.2, 10.3 and 10.4 to the Privacy Code Administrator (in person, by fax or post) to enable the Privacy Code Administrator to maintain accurate, complete and up-to-date electronic and paper records of the Privacy Code members, as required by the Privacy Commissioner.

10.6 Member clubs that cease to be financial members of Clubs Queensland will automatically cease to be bound by the APC.

11 Implementation of the Approved Privacy Code

11.1 Once a member club has accepted the APC, it will have all measures in place within one month of the date of the acceptance.

11.2 The member club will inform members or patrons about the operation of the APC and will prominently display the availability of the Privacy Code in a suitable location in the club.

11.3 The member club will undertake regular audits of the operation of the club privacy procedures to ensure that the procedures comply with the APC.

11.4 The member club will submit information on the operation of the APC to the Privacy Code Administrator, as requested, to enable the Privacy Code Administrator to fulfil its obligations under the APC and the Privacy Act.

12. Administration of the Approved Privacy Code

12.1 Clubs Queensland will perform the role of the Privacy Code Administrator and will be responsible for the administration of the APC, including complying with the reporting and review requirements under the APC and Privacy Act. It will allocate sufficient resources for the administration and on-going monitoring of the APC.

12.2 The Privacy Code Administrator will liaise with member clubs in relation to the implementation and compliance with the APC. Member clubs will direct any questions or feedback in relation to the APC to the Privacy Code Administrator.

12.3 Each member club will nominate a staff member who will be responsible for the general administration of the APC at the member club. The designated staff member must report to the Privacy Code Administrator all information that is relevant to the operation of the APC at the member club.

12.4 The designated staff member of each member club must also advise the Privacy Code Administrator (in writing) of any systemic problems that they discover through their own compliance experiences. If any systemic problems are identified, then the Privacy Code Administrator will endeavour to address them appropriately and in accordance with the Privacy Act.

12.5 The Privacy Code Administrator will maintain an accurate, up-to-date easily accessible on-line record of members of the APC on its website, with a hypertext link to the Privacy Commissioner’s website.

12.6 If any at any stage the Privacy Commissioner revokes the APC (in accordance with its powers under Section 18BE of the Privacy Act), the Privacy Code Administrator will advise the member clubs, public and all other interested parties accordingly.

12.7 All member clubs and individuals are requested to contact Clubs Queensland to obtain any information they require about the Privacy Code Administrator.

13. Review of the Approved Privacy Code

13.1 The Privacy Code Administrator will, in consultation with relevant stakeholders that include member clubs and other interested parties, review the APC at least every three years and is committed to allocating sufficient resources for the review process. The Privacy Code Administrator will provide the review report, with a response to the review report by the Privacy Code Administrator, to the Privacy Commissioner within 30 days of the review being finalised. The Privacy Code Administrator will make available a copy of the above review report to member clubs upon a written request.

13.2 The Privacy Code Administrator will make necessary changes and amendments to the APC from time to time, in consultation with member clubs, and will seek the approval of the changes and amendments from the Privacy Commissioner before incorporating the changes and amendments in the APC.

13.3 Where the Privacy Code Administrator proposes major changes and amendments to the APC, it will undertake adequate consultation with relevant stakeholders, including members clubs, and include a report on the result of the consultation process with the application for approval for the variation of the APC to the Privacy Commissioner.

____________________

Schedule 1 – Approval of the Original Privacy Code

Image unavailable in extracted text

Image unavailable in extracted text

Schedule 2 – Approval of the Privacy Code (Upon Review)

Image unavailable in extracted text

Schedule 3 - Dictionary

contractor means a party that has a contractual relationship with a member club to provide a service or product;

direct marketing means any approaches made or activities undertaken that promote, advertise or market products or services;

health information means:

(a) information or an opinion about:

(i) the health or a disability (at any time) of an individual; or
(ii) an individual’s expressed wishes about the future provision of health services to him or her; or
(iii) a health service provided, or to be provided, to an individual;

that is also personal information; or

(b) other personal information collected to provide, or in providing a health service; or

(c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual or his or her body parts, organs or body substances; or

(d) genetic information about an individual in a form that is, or could be, predictive of the health of the individual or genetic relative of the individual.

health service means:

(a) an activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or the person performing it:

(i) to assess, record, maintain or improve the individual’s health; or

(ii) to diagnose the individual’s illness or disability; or

(iii) to treat the individual’s illness or disability or suspected illness or disability; or

(b) the dispensing on prescription of a drug or medicinal preparation by a pharmacist.

member means any individual who is an on-going financial member of a member club;

member club means a club that is an on-going financial member of Clubs Queensland;

patron means any member of the public who has contacted or been in contact with a member club;

personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

primary purpose means the sole, dominant or fundamental reason or purpose for collecting information;

Privacy Code Administrator means Clubs Queensland located at 55 Holland Street, Northgate Qld 4013. Telephone: (07) 3252 0770, Facsimile: (07) 3252 0971, Website www.clubsqld.com.au and Email clubs@clubsqld.com.au;

Privacy Commissioner means the Privacy Commissioner (Federal);

reciprocal club means a club that has a reciprocal arrangement with another club under Clubs Queensland Reciprocal Arrangement;

related body corporate means:

(a) a holding company of another body corporate;

(b) a subsidiary of another body corporate; or

(c) a subsidiary of a holding company of another body corporate.

Sensitive information means:

(a) information or an opinion about an individual’s

(i) racial or ethnic origin; or

(ii) political opinions; or

(iii) membership of a political association; or

(iv) religious beliefs or affiliations; or

(v) philosophical beliefs; or

(vi) membership of a professional or trade association; or

(vii) membership of a trade union; or

(viii) sexual preferences or practices; or

(ix) criminal record;

that is also personal information; or

(b) health information about an individual; or

(c) genetic information about an individual that is not otherwise health information.

secondary purpose means any reason or purpose other than a primary purpose;

special circumstances means only those circumstances associated with preventing or lessening a serious and imminent threat to the life or health of an individual where the individual to whom the information relates is incapable or unable (either by law, a physical limitation or otherwise) to provide consent to the collection of information.

Schedule 4 – Privacy Notice

Image unavailable in extracted text
Schedule 5 – In-House Privacy Policy