(b) Where access to personal information would reveal evaluative information generated within the member club in connection with a commercially sensitive decision-making process, the member club will not provide direct access but will give an explanation for the decision not to allow access to that information.
(c) Where appropriate, the member club may facilitate mutually agreed intermediaries from both parties (member club and member or patron) in regard to information that cannot be made available to the member or patron.
(d) The member club will not charge any fees for lodging a request for access to personal information but may charge a reasonable fee for providing access to personal information.
(e) If a member or patron informs the member club in writing that the information held by the club about himself or herself is not accurate, complete or up-to-date, the member club will (if the assertion by the member or patron is correct) endeavour to update the information as soon as reasonably practical.
(f) The member club will take reasonable steps to include with the requested information a statement claiming that the information is not accurate, complete or up-to-date if the member or patron and the member club are unable to agree that the information is accurate, complete and up-to-date and the member or patron requests the club to provide the statement.
(g) The member club will a provide reason for any denial of access or refusal to correct personal information.
(h) The member club will put the signage in Appendix C in a prominent location in the member club to inform members and patrons about its information management practices, including the type of information it holds, for what purpose, and how it collects, holds, uses and disclosures information.
Scenario
The following scenario explains a practical application of Privacy Principle 3. The scenario is not definitive and member clubs should take into consideration their own circumstances when dealing with privacy issues at their venues.
John had been a regular member of the Yellow Hill Club for many years. As a result, he was well known to the club staff and management. He decided to use his contacts at the club to help the local gambling support group better target people who may have a problem with gambling in the area. John asked the club to release relevant details, including the number of people regularly playing the pokies at the club and contact details of those seeking self-exclusion from the club.
Individuals can only access their own personal information and not the personal information of others. Accordingly, the Yellow Club declined to release the information, citing that it would unreasonably impact on the privacy of its members and patrons. Also the information was commercially-sensitive and the release would commercially disadvantage the club, as the area had three hotels competing in the same market as the club. However, to meet its privacy obligations, the club arranged a meeting with John and the local support group and provided them with general statistical information.
On a separate occasion, John received a letter from the Yellow Hill Club requesting renewal of his membership. He noticed that his phone number was incorrect and wondered what other information held by the club was also incorrect. He contacted the Club Manager and requested access to his personal information held by the club. After completing the relevant form, John was provided with his personal information held by the club. He noticed that his phone number, e-mail address and date of birth were all incorrect. John requested that these details be corrected. Once the Club Manager had verified the new details, John’s record was updated.
6.4 Privacy Principle 4 - Security of Information
(a) The member club will take reasonable steps to safeguard the information it collects and holds by locating the information in a secure place in the club (eg: a lockable filing cabinet in the Club Manager’s office etc.).
(b) The member club will establish clear guidelines as to which staff members can access personal information and under what circumstances (eg: when the Club Manager is on annual/sick leave).
(c) The member club will prevent unauthorised access, modification or disclosure and misuse or loss of personal information by putting in place appropriate measures, such as, installing lock and key, designating some areas as “For Staff Only” etc. In the case of computer records, the member club will put in place appropriate protection mechanisms such as use of a password, virus protection software and firewall.
(d) In respect of those member clubs that have internet and email facilities, the member club will implement an email/internet policy/statement regarding the transmission of personal information through the internet and by email. The member club will provide regular training and education sessions to ensure staff understand their privacy obligations relating to the use of the email and internet facilities provided by the member club.
(e) The member club will take reasonable steps to destroy or de-identify any information that is no longer needed (such as, shredding or pulping paper records, and deleting or erasing information stored electronically).
(f) The member club, as far as practicable, will not permit staff members to discuss personal, health and sensitive information of members and patrons in front of other members and patrons or members of the community.
Scenario
The following scenario explains a practical application of Privacy Principle 4. The scenario is not definitive and member clubs should take into consideration their own circumstances when dealing with privacy issues at their venues.
The Blissvale Club, being a small club with only a few staff, welcomed all offers of assistance when it organised major functions at the club. The Club Manager would ask the volunteers to help in various ways, including taking turns to telephone members and patrons to confirm their attendance at the functions at the club. After receiving three separate calls, only one of which related to the functions at the club, Alice, who was a regular member of the club, lodged a complaint with the Club Manager that her personal information was being passed around. She explained that of the three calls she received, two were unrelated to the functions at the club. In fact, both were attempts to sell her some products that she had not solicited.
The Blissvale Club had clearly failed to take reasonable steps to safeguard the personal information of its members and patrons by allowing access to the information to unauthorised persons, in this case volunteers, working at the club. In addition, the volunteers misused the information by passing it to third parties. The Blissvale Club should locate the information in a secure place in the club and also establish clear guidelines and a privacy policy as to who can access personal information. The club should also take reasonable steps to prevent any misuse of the information, as it happened in this case.
6.5 Privacy Principle 5 - Transborder Flows of Information
(a) Subject to clause 6.5(b), the member club will only transfer personal information of a member or patron to a recipient in a foreign country if:
the member or patron consents to the transfer; or
where the transfer is for the benefit of the member or patron and it is impracticable to obtain the consent of the member or patron to the transfer and if it were practicable to obtain such consent, the member or patron would be likely to give it; or
the transfer is necessary for the conclusion or performance of a contract between the member or patron and the organisation, or for the implementation of pre-contractual measures taken in response to the member’s or patron’s request, or
the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the member or patron between the organisation and a third party.
(b) The member club will not transfer information to a recipient in a foreign country in circumstances where the:
recipient of the information is in a jurisdiction that does not have adequate protection similar to the protection accorded under the Privacy Code and Privacy Act; or
the member or patron about whom the information relates has not consented to the transfer of information; or
information may be used in ways which are inconsistent with the Privacy Code.
(c) In some instances, the member club may ask for a written assurance from the parties involved that the information will remain secure before transferring the information.
Scenario
The following scenario explains a practical application of Privacy Principle 5. The scenario is not definitive and member clubs should take into consideration their own circumstances when dealing with privacy issues at their venues.
The Long Road Club, situated in Brisbane, received a request from a hotel in Germany for contact details of its members so that it may offer discounts to those members travelling to Germany. Although the club was satisfied that the hotel adhered to the stringent privacy obligations imposed on organisations within the European Community, it was not satisfied that its members would consent to the disclosure of their personal details. The club also felt the disclosure would be inconsistent with its privacy statement.
Rather than disclose the information, the Long Road Club requested the hotel to send its brochures and any discount offers to the club. The Long Road Club then displayed the brochures and offers in the club for the information of its members and patrons. Members and patrons could then contact the hotel personally for further information. The Long Road Club also mentioned the offer in its newsletter.
Application of the Privacy Code
7.1 General Administration and Operation
(a) Membership Application Form
eg: The member club should, in addition to providing its proper trading name and contact details, include a privacy statement explaining why the personal information is being collected, details of individuals and organisations likely to receive the information, how the member or patron can access, update and amend the personal information held by the club, any consequences that may result if the requested information is not provided by the member or patron and how the member or patron can request the member club to cease sending direct marketing materials to them.
(b) Membership Database
eg: The member club should keep accurate, complete and up-to-date records and also ensure that both physical and electronic databases are secure.
(c) Members’/Reciprocal Members’ and Visitors’/Guests’ Sign-in Registers
eg: For Members’/Reciprocal and Visitors’/Guests’ Sign-in Registers (“Registers”) that were printed prior to 21 December 2001 and do not facilitate the prevention of unauthorised access to the Registers, member clubs will ensure that:
Registers are placed in appropriate locations to prevent them from being stolen; and
an appropriate sign is displayed within close proximity of the Registers, notifying patrons, visitors and members that they are to complete and sign the Sign‑in Register (as required under the Liquor Act (Qld) 1992) and that their personal information (name, address and membership number) recorded in the Sign-in Register may be able to be seen by other members of the public who read or sign the Sign-in Register.
In respect of the Visitors’/Guests’ Sign in Register (“Visitor Register”) and to assist member clubs with new obligations under this Privacy Code in respect of direct marketing, member clubs must include on each of the tear off slips of the Visitor Register a statement such as “Please tick here (insert box) if you do not wish to receive any direct marketing materials”.
(d) Internet and E-mail
eg: The member club should circulate an appropriate email/internet policy/statement outlining (among other things) how email correspondence is to be internally and externally handled, and other internet usage restrictions to be imposed upon staff.
(e) Club Website
eg: If the member club uses cookies, web bugs or other means in respect of their website, they need to advise the public accordingly, and may include in a relevant policy the following statement: “This website uses cookies. A cookie can record your name and address and other personal details such as your credit card number. You can turn off cookies in your browser. However, this may result in some parts of the website not being accessible to you.”
(f) Loyalty Programs
eg: The member club should inform members and patrons that their personal information may be used by loyalty programs operated by the member club and can include a statement in its promotional brochures as follows: “The club will not send you direct marketing materials, if you have indicated that you do not wish to receive them.”
(g) Advertising and Promotions
eg: The member club should not associate members’ or patrons’ names with prize winnings. When contacted by members and/or patrons (either by email, post, telephone or otherwise) to request the member club to cease sending further direct marketing material, the member club must ensure that no further direct marketing material is sent, unless otherwise notified.
(h) Correspondence
eg: The member club should put in place procedures that ensure all letters, emails or other correspondence are only able to be accessed by the intended recipients. This means that only those to whom correspondence is addressed should have access to the information, unless another person has the appropriate authority to access the information.
(i) Exclusions
The member club should follow the procedures in relation to self-exclusion and exclusions requested by a third party as set out in the Queensland Responsible Gambling Resource Manual to assure members’/patrons’ information remain confidential.
(j) Video Surveillance
eg: The member club should ensure that access, storage and security of video tapes are by authorised staff only. In instances where the member club maintains video surveillance, in accordance with relevant industry legislation (such as, the Liquor Act (Qld) 1992), appropriate signage notifying the public that they are under surveillance will be displayed.
7.2 Information Collected Under Other Legislation Applicable to Clubs
(a) Gaming Machine Act (Qld) 1991
eg: The member club should ensure that all personal information relating to the Self-exclusion Deed remains confidential.
(b) Liquor Act (Qld) 1992
eg: The member club should ensure that personal information requested by staff when checking proof of age remains confidential.
(c) Keno Act (Qld) 1996
eg: The member club should ensure that personal information requested by staff when checking proof of age remains confidential.
(d) TAB Act (Qld) 1999
eg: The member club should ensure that personal information requested by staff when checking proof of age remains confidential.
(e) Workplace Health and Safety Act (Qld) 1995
eg: The member club should ensure that records held by the designated Workplace Health and Safety Officer remain confidential.
(f) Anti-Discrimination (Qld) Act 1991
eg: The member club should ensure that records held by the designated Officer remain confidential.
7.3 Reciprocal Members
The member club will treat the privacy concerns of reciprocal club members in the same way as it would deal with the privacy concerns of its members.
7.4 Contractors
In respect of contractors, the member club will make the contractor aware of the privacy principles in the club’s advertisement for provision of contractual services and also during the negotiation process. Where there is a dispute in respect of whether the contractor is bound by obligations under this Privacy Code or another code, the matter will be dealt with in accordance with the Privacy Act.
7.5 Appendix D outlines some best practices that member clubs will adhere to when dealing with the above issues. Member clubs should note that the above is not an exhaustive list but only the most common examples of the application of the Privacy Code.
Breach of the Privacy Code
8.1 The following constitutes a breach of the Privacy Code:
(a) The member club does not fully comply with its obligations under the Privacy Code.
(b) The member club acts or engages or repeats a practice that is contrary to or inconsistent with the Privacy Code.
(c) The member club fails to respond to a complaint by a member or patron.
(d) The member club fails to act on a directive by the Privacy Commissioner or the Privacy Code Administrator.
(e) The member club fails to rectify any action or practice that is contrary to or inconsistent with the Privacy Code.
Complaint Facilitation Procedures
9.1 The Privacy Code relies on the Privacy Commissioner to deal with all unresolved privacy related complaints. Accordingly, the complaint handling procedures established under the Privacy Code and the Privacy Act (and accompanying guidelines) will apply to the resolution of a privacy complaint made against a member club under the Privacy Code. To avoid any doubt, member clubs must not deal with any privacy complaint other than in accordance with the Privacy Act. If a complaint is instigated or made by a member or patron whilst the member club is (or was) bound by the Privacy Code, the member club will be required to resolve the matter to the extent provided in the Privacy Code.
9.2 However, as the Privacy Act requires a complainant in most instances to complain about the alleged breach to the relevant member club (respondent) in the first instance, the member club will in these cases endeavour to respond to the complainant’s concerns as follows:
(a) The member club will designate a staff member as the point of contact in the club regarding privacy issues.
(b) The designated staff member will liaise with the complainant and identify and define the nature and cause of the complaint (and ask, if necessary, for the complaint to be put in writing).
(c) The designated staff member will then inform the complainant of their rights under the Privacy Code and Privacy Act, and the timeframe (within 30 days) in which the club will be able to respond to the complaint. For example, the designated staff member will inform the complainant that they may take their complaint directly to the Privacy Commissioner in the event that the complainant is not satisfied with the outcome after the initial approach and discussion with the member club.
(d) The designated staff member will inform the complainant of the response, if any, by the member club, including the basis (legislation, Privacy Code, policies) on which the response was framed.
(e) If the outcome of this liaison between the complainant and the member club is not to the satisfaction of the complainant, the designated staff member will advise the complainant that the complaint is escalated and should be handled in accordance with the procedures under the Privacy Act (see: Section 36 of the Privacy Act).
9.3 The designated staff member will record details of the complaint and action taken in the Register of Complaints and Actions in Appendix E.
9.4 The member club is obliged to comply with any declaration made by the Privacy Commissioner (for example, if the Privacy Commissioner declares that a certain activity of a member club is contrary to the Privacy Code and/or Privacy Act (see: Sections 52, 55(2) and 55A of the Privacy Act), that member club must not repeat or continue the relevant activity or conduct). In this regard, member clubs must provide all reasonable co-operation as requested by the Privacy Commissioner.
9.5 The member club must ensure that each of the above steps are undertaken within a reasonably appropriate timeframe so that any decision (if any decision is required to be made) is made expeditiously and in a manner that does not compromise the integrity or quality of any such decision.
Staff Training
10.1 All staff will be provided with appropriate training regarding the Privacy Code so that they are aware of the content, procedures and application of the Privacy Code, including referring all privacy complainants to the designated staff member who would be the point of contact for privacy issues in the member club.
10.2 In addition, the designated staff member who will be responsible for privacy issues will undergo further training so that he/she is well informed and better positioned to facilitate in instances where the complainant is required to first contact the club (respondent) before approaching the Privacy Commissioner.
10.3 The member club will keep a record of all training in the Register of Training in Appendix F.
Acceptance of and Release from the Privacy Code
11.1 The Privacy Code is voluntary and the member club has a choice to either accept or not accept compliance with the Privacy Code.
11.2 If the member club decides to accept the Privacy Code, the member club will then indicate its formal acceptance by completing the Acceptance of the Queensland Club Industry Privacy Code form in Appendix G.
11.3 The member club can complete the Release from the Queensland Club Industry Privacy Code form in Appendix H at any time after formally accepting the Privacy Code, if the member club decides to opt out of the Privacy Code. However, if a complaint is instigated or made by a member or patron whilst the member club is (or was) bound by the Privacy Code, the member club will be required to resolve the matter to the extent provided in the Privacy Code.
11.4 The member club can re-subscribe to the Privacy Code at any time after the date referred to in clause 11.3, provided it meets the requirements set out in clause 11.2 and makes a written application for re-subscription and receives written approval for re-subscription from the Code Administrator.
11.5 Member clubs must return the completed forms/documents referred to in clauses 11.2, 11.3 and 11.4 to the Privacy Code Administrator (in person, by fax or post) to enable the Privacy Code Administrator to maintain accurate, complete and up-to-date electronic and paper records of the Privacy Code members, as required by the Privacy Commissioner.
11.6 Member clubs that cease to be financial members of Clubs Queensland will automatically cease to be bound by the Privacy Code.
11.7 Where a member club does not accept the Privacy Code, the NPPs will apply unless the member club is exempt from the operation of the Privacy Act
Implementation of the Privacy Code
12.1 Once the member club has accepted the Privacy Code, it will have all measures in place within one month of the date of the acceptance.
12.2 The member club will inform members and patrons about the various aspects of the Privacy Code and will prominently display the availability of the Privacy Code in a suitable location in the club.
12.3 The member club will undertake regular audits of the operation of the club privacy procedures to ensure that the procedures fully comply with the Privacy Code.
12.4 The member club will lodge a report with the Privacy Commissioner on the operation of the Privacy Code and other matters as specified by the Privacy Commissioner within two months after the end of the financial year of the club. Specifically, this report will outline the number and nature of privacy complaints made against the member club and the amount of time spent dealing with privacy complaints. The report will be in an electronic form using the template issued by the Privacy Commissioner.
Administration of the Privacy Code
13.1 Clubs Queensland will adopt the role of the Privacy Code Administrator and will be responsible for the administration of the Privacy Code. It will allocate sufficient resources for the administration and continuity of the Privacy Code.
13.2 The Privacy Code Administrator will liase with member clubs in relation to the implementation and compliance with the Privacy Code. Member clubs will direct any questions or feedback in relation to the Privacy Code to the Privacy Code Administrator.
13.3 The Privacy Code Administrator will be responsible for (amongst other things) complying with the reporting and review requirements under the Privacy Code and Privacy Act.
13.4 Each individual club will nominate a staff member who (amongst other things) will be responsible for the general administration of the Privacy Code at club level. The designated staff member, in addition to facilitating complaints as discussed above, must (amongst other things) report to the Privacy Code Administrator the number and nature of all complaints received and the amount of time spent dealing with each complaint.
13.5 The nominated staff member of each member club must also advise the Privacy Code Administrator (in writing) of any systemic problems that they discover through their own complaint experiences. If any systemic problems are identified, then the Privacy Code Administrator will endeavour to address them appropriately and in accordance with the Privacy Act.
13.6 The Privacy Code Administrator will also maintain an accurate, up to date easily accessible on-line record of Privacy Code members on its website, with a hypertext link to the Privacy Commissioner’s website.
13.7 If any at any stage the Privacy Commissioner revokes the Privacy Code (in accordance with its powers under Section 18BE of the Privacy Act), the Privacy Code Administrator will advise the member clubs, public and all other interested parties accordingly.
13.8 All member clubs and individuals are requested to contact Clubs Queensland to obtain any information they require about the Privacy Code Administrator.
Review of the Privacy Code
14.1 As the Privacy Code Administrator, Clubs Queensland will, in consultation with the public, its member clubs and other interested parties, review the Privacy Code at least every three years and is committed to allocating sufficient resources for the review process. The Privacy Code Administrator will provide the review report, with a response to the review report by the Privacy Code Administrator, to the Privacy Commissioner within 30 days of the review being finalised. The Privacy Code Administrator will make available a copy of the above review report to member clubs upon a written request.
14.2 The Privacy Code Administrator will make necessary changes and amendments to the Privacy Code from time to time, in consultation with its member clubs, and will seek the approval of the changes and amendments from the Privacy Commissioner before incorporating the changes and amendments in the Privacy Code.
14.3 Where the Privacy Code Administrator proposes major changes and amendments to the Privacy Code, it will (among other things) undertake adequate consultation with the public, its members clubs and other interested parties and include a report on the result of the consultation process with the application for approval for the variation of the Privacy Code to the Privacy Commissioner.
____________________
Appendix A
[Insert Approval Letter from the Privacy Commissioner]
Appendix B
SUMMARY OF NPPs
Member clubs should note that this following summary of the NPPs (and any reference to the NPPs) is for information purposes only and member clubs and their members and/or patrons should refer to and comply with the Privacy Code’s Privacy Principles (as set out in Section 6 of this Privacy Code)
National Privacy Principles (NPPs)
Application
NPP 1 – CollectionCollection of personal information must (among other things) be fair, lawful and not intrusive. A person, from whom information is being collected, must be told the organisation’s name, the purpose of collection, that the person can get access to their personal information and what happens if the organisation does not give the information.
Only applies to information collected after 21 December 2001(or for small businesses (not health services) applies to information collected after 21 December 2002).
NPP 2 - Use and DisclosureAn organisation should only use or disclose information for the purpose it was collected unless the person has consented, or the secondary purpose is related to the primary purpose and a person would reasonably expect such use or disclosure, or the use is for direct marketing in specified circumstances, or in circumstances related to public interest such as law enforcement and public or individual health and safety.
Only applies to information collected after 21 December 2001(or for small businesses (not health services) applies to information collected after 21 December 2002).
NPP 3 - Data QualityAn organisation must (among other things) take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to date.
In respect of collection, it only applies to information collected after 21 December 2001(or for small businesses (not health services) applies to information collected after 21 December 2002).In respect of use and disclosure, it applies regardless of when it was collected.(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 4 - Data securityAn organisation must (among other things) take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.
Applies regardless of when information was collected(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 5 – OpennessAn organisation must have a policy document or Privacy Code outlining its information handling practices and make this available to anyone who asks.
Applies regardless of when information was collected(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 6 - Access and correctionGenerally speaking, an organisation must give an individual access to personal information it holds about that individual on request.
If information already held is not used or disclosed, it only applies to information collected after 21 December 2001.But if information already held is used or disclosed after commencement of the Privacy Act, then rights of access and correction apply unless unreasonable administrative burden or cause the organisation unreasonable expense.(or for small businesses (not health services), applies to information collected after 21 December 2002, no exception like the above).
NPP 7 - IdentifiersGenerally speaking, an organisation must not adopt, use or disclose, an identifier that has been assigned by a Commonwealth government agency (such as a Tax File Number).
Applies regardless of when information collected(for small business (not health services), delay in application until 21 December 2002, then applies regardless of when collected).
NPP 8 – AnonymityOrganisations must give people the option to interact anonymously whenever it is lawful and practicable to do.
Only applies to information collected after 21 December 2001(for small businesses, only applies to transactions entered into with an organisation after 21 December 2002).
NPP 9 - Transborder Data FlowAn organisation can only (among other things) transfer personal information to a recipient in a foreign country where the foreign recipient has similar privacy restrictions imposed and in circumstances where the information will have appropriate protection.
Applies regardless of when information collected(for small business, delay in application until 21 December 2002, then applies regardless of when collected).
NPP 10 - Sensitive InformationAn organisation must not collect sensitive information unless the individual about whom the information relates has consented, it is required by law, or in other specified circumstances, for example, relating to health services provision and individual or public health or safety.
Only applies to information collected after 21 December 2001(or for small businesses (not health services), applies to information collected after 21 December 2002).