Policy: Privacy

The ANU’s Privacy Policy page can be viewed in full here.

Purpose

This privacy policy outlines the personal information handling practices of The Australian National University.

Overview

The Privacy Act 1988 (Cth) (‘Privacy Act’) requires The Australian National University (‘ANU’) to have a privacy policy. We will update this privacy policy if our personal information handling practices change. The specific legal obligations of the ANU when collecting and handling your personal information are outlined in the Privacy Act and in particular in the Australian Privacy Principles in Schedule 1 of that Act.

Scope

This Privacy Policy only applies to ANU. It does not apply to any other company or organisation we may associate with, including organisations whose services are in some way linked to ANU through online content or services (such as apps, social media platforms). If you choose to communicate with us or access information about ANU through a social network service or app, the social network or app provider and its partners may collect, hold, use or disclose your personal information, in Australia or overseas, for its own purposes and according to its own policies. This policy does not apply to those services.

When we engage third parties to perform services for us that involve handling any of the personal information we hold, we engage the third party service provider in accordance with the obligations that apply to ANU under the Privacy Act.

Definitions

Personal information means information or an opinion about an individual who is identified, or who can reasonably be identified, from the information, whether or not the information or opinion is true or recorded in a material form, and includes sensitive information; and

Sensitive information means information or an opinion, that is also personal information, about a person’s racial or ethnic origin, political opinions, memberships of political, professional and trade associations and unions, religious and philosophical beliefs, sexual orientation or practices, criminal history, health information, and genetic and biometric information.

Policy statement

Overview

1. We collect, hold, use and disclose your personal information to enable us to meet legal obligations and for a range of internal University purposes. These include:

1. for students, to administer your admission, enrolment, academic progress, academic integrity, discipline, graduation, accommodation, access to University facilities and services, library loans, fees, visa, immigration, taxation and financial support purposes, and in relation to graduates, for alumni activities;
2. for employees, visitors and sub-contractors, to administer pay, entitlements, performance, research funding applications, access to University facilities and services, visa, immigration and taxation purposes, and in relation to work health and safety, or rehabilitation and compensation matters.

2. Sometimes material that contains your personal information is created by us when we perform some of our internal processes, such as academic assessment or performance evaluation processes. This material is also protected and handled in accordance with this privacy policy.
3. We may also collect, use or disclose personal information in situations where it may be impracticable to obtain your consent or give you prior notice, if we reasonably believe it is necessary to do so, such as:

• to lessen or prevent a serious threat to life, health or safety;
• when we are required or authorised to do so by or under a law;
• to take appropriate action in relation to suspected unlawful activity or serious misconduct;
• to assist authorities to locate a person reported as missing;
• establishing or defending a legal or equitable claim, or participating in a confidential dispute resolution process; or
• for enforcement related activities conducted by, or on behalf of, an enforcement body.

Collection of personal information

4. ANU collects a wide range of personal information in the course of its operations, for purposes that are directly related to its core functions or activities. ANU may collect personal information about you:

1. because we need it to provide a service you have requested – such as providing you with information about applying to the University for education or employment purposes;
2. because you have provided it to us – by applying for admission, enrolling in courses, participating in mobility or exchange programs, applying for a position as an employee, participating in or commenting on online forums, registering to attend an event, asking us a question or making a complaint;
3. because of your previous relationship with ANU – through our alumni relations and philanthropy activities;
4. because we are required by law to collect it – for example because of higher education and immigration laws.

5. At all times we aim to collect only the information we need for the particular function or activity we are carrying out. We may not be able to provide the assistance or services you seek if you do not provide us with personal information when we request it.

Collecting sensitive information

6. Sometimes we may need to collect sensitive information about you, for example, if you become a client of the counselling services provided by the ANU, attend the Medical Centre as a patient, request assistance from the Disability Support Centre, if you make a complaint to or about ANU, if you apply for employment at ANU, or to facilitate activities in relation to employment law or the Safety, Rehabilitation and Compensation Act 1988 (Cth) (‘SRC Act’).

Collection from people other than you

7. In the course of our day to day activities as an employer and a higher education provider, we may collect personal information about you indirectly from publicly available sources, or from third parties you have authorised to disclose your information. We also collect personal information from publicly available sources to enable us to identify and contact stakeholders who may be interested in our endowment and philanthropy programs.

Anonymity

8. Where practicable and lawful, we will allow you to interact with us anonymously or using a pseudonym. However, for most of our functions and activities we usually need your name and contact information or your University ID number, and enough information about the particular matter to enable us to respond to your inquiry, request, application, donation or complaint.
9. We may host or manage some publicly accessible blogs and other interactive media. If you choose to interact with these media, you can do so anonymously or using a pseudonym.

Collecting through websites

10. The ANU has its own public website at http://www.anu.edu.au. When you look at the ANU web site our server makes a record of your visit and logs some or all of the following information:

• your browser’s internet address;
• the date and time of your visit to the site;
• the pages you accessed and documents downloaded;
• the previous site visited;
• the type of browser you are using; and
• the username entered if accessing a restricted site.

ANU uses this information for statistical purposes and for system administration tasks to maintain this service. We do not attempt to identify individuals however in the unlikely event of an investigation, the University, a law enforcement agency or other government agency may exercise its legal authority to inspect our server’s logs.

11. Entry to some ANU web services is restricted by user log-in protocols. We require you to use your University ID to access these sites to help us keep the information accessible through these sites secure from unauthorised alteration, use or disclosure, to resolve problems with our IT systems, and to keep an auditable record of who has accessed this information.

On-campus IT infrastructure, and remote IT access

12. If you use any ANU IT infrastructure that requires you to log-in using your University ID, we may use that information to identify and resolve problems with our IT systems, and to keep an auditable record of who has accessed our IT systems for security purposes.

Building access

13. If you enter any ANU building or room that requires you to swipe your University ID card to gain entry, we may collect and use that information to keep an auditable record of who has had access to campus locations for safety and security purposes.

Library loans

14. If you borrow material from any ANU library, we collect and use your personal information to manage priority course-based access to materials and to communicate with you about your library loans. We do not keep this information after you have returned the library material you borrowed.

Social Networking Services

15. We sometimes use social networking services such as Twitter, Facebook and YouTube to communicate with the public about our activities or achievements. If you choose to communicate with us using these services we may collect your personal information, but we will only use it to communicate with you. The social networking service may also collect or handle your personal information and use it for its own purposes. These services have their own privacy practices and policies. ANU is unable to regulate the actions of those services. This policy does not apply to the acts or practices of those services.

Email lists

16. We collect your non-ANU email address (and other contact details) when you enrol as a student or apply for employment. We only use this information to contact you for administrative purposes related to your engagement with us.
17. If you are a graduate, we use your email address to send you information about ANU alumni and philanthropy activities. You can opt out of alumni related activities at any time by clicking on the unsubscribe link included in all such emails.
18. If you register to attend an event, we usually collect the contact details you provide at registration to communicate with you about the event you registered for. We may also communicate with you about other events we think you might be interested in. You can opt out of receiving further emails at the time you register for an event, by telling the sender by return email that you do not want to receive further emails, or you can unsubscribe from further events emails using the link in the email, according to how the event registration process is administered.

Use and disclosure

19. We generally use or disclose personal information only with your consent and for the purpose we collected it, unless you consent to us using or disclosing it for a different purpose. We generally do not disclose personal information about students to a student’s relatives without the student’s consent. Students may consent to such disclosures of personal information using this form: http://www.anu.edu.au/files/resource/Consent-form.pdf
20. Sometimes we may use or disclose your personal information in circumstances where you would reasonably expect us to use or disclose it, the Privacy Act permits the disclosure, and it is impracticable to obtain your consent.
21. We will take reasonable steps to ensure that any third parties who receive your personal information from ANU are bound by substantially similar privacy standards and obligations as ANU.
22. Common situations in which we disclose personal information include:

• to other higher education institutions, if you are involved in a student mobility, exchange, cross-institutional or joint program, or if you are transferring to another institution,
• in relation to certain student administration matters, to the entity trading as ANU College;
• to accommodation service providers, an Affiliated Lodge, College or Hall of Residence, if your accommodation is dependent on your academic progress or affected by any Statutes, Rules, Orders or policies of the University;
• to a returning officer or other appointed electoral body for conducting elections of representatives to official University panels, committees, boards and associations;
• in publications about some examination results and the award of some prizes and scholarships;
• when requested, the fact of a person’s graduation from the University (the record of a person’s graduation from the University is a public document);
• releasing information pursuant to University Statutes, Rules, Orders, policies and procedures, or pursuant to a contractual obligation to which you have agreed;
• in publications about research activities at or involving ANU in which you have elected to be involved;
• releasing statistical information to Australian Government Departments who are authorised to require it, the Tertiary Education Quality and Standards Agency (TEQSA), state and territory governments, Tertiary Admissions Centres (TACs), Higher Education providers for the purposes of the Higher Education Support Act 2003 (Cth) (‘HESA’) or the Education Services for Overseas Students Act 2000 (Cth) (‘ESOS’), and Universities Australia;
• reporting to the Australian Tax Office about Commonwealth supported fee liabilities or to facilitate income tax assessment;
• reporting to Australian Government Departments with portfolio responsibility for social security and/or veterans’ entitlement matters about a person’s income or a student’s attendance if we are legally required to do so;
• reporting to Australian Government Departments with portfolio responsibility for child support matters about a person’s income if we are legally required to do so;
• if you are not an Australian citizen, reporting to Australian Government Departments with portfolio responsibility for migration and immigration, employment, higher education, research and technology, and related matters;

• to the Australian National Audit Office for auditing purposes;
• if we are required by law to disclose the information.

23. We may disclose personal information to an external review body if you seek an external review of an ANU decision or make a complaint to an external complaint handling body such as the Commonwealth Ombudsman.
24. If you make a complaint or report an incident to us about another person at ANU, in some circumstances we may be required to disclose some of your personal information to the person about whom you have made a complaint. It may be that sometimes we are unable to act on your complaint or allegation unless you consent to this kind of disclosure. We will assess and handle complaints about the conduct of ANU members in accordance with ANU Legislation, Policies and Procedures, and applicable laws.

Overseas disclosure

25. If you are involved in a mobility, exchange, cross-institutional or joint program with an institution in another country, or if you are transferring to another institution overseas, we will disclose personal information about you to your home or host institution overseas.
26. In performing and managing our functions and activities, we may need to make your personal information available to third party services providers, including providers of cloud services and website hosts. These third parties may be located overseas. We will take reasonable steps to ensure that any third parties located overseas whom we engage to handle your personal information are bound by substantially similar privacy standards and obligations as ANU.

Disclosure of sensitive information

27. We only disclose your sensitive information for the purposes for which you gave it to us, or for directly related purposes you would reasonably expect, or if the Privacy Act allows us to disclose it, or if you agree.

Quality of personal information

28. We take reasonable steps to ensure that the personal information we hold is accurate, up to date and complete by:

• asking you to update or confirm that your details are correct when you use our human resources or student information systems;
• recording information in a consistent format;
• where necessary, confirming the accuracy of information we collect from a third party or a public source;
• adding updated or new personal information to existing records.

Storage and security of personal information

29. We take reasonable steps to protect the security of the personal information we hold from both internal and external threats by regularly assessing the risk of misuse, interference, loss, and unauthorised access, modification or disclosure. Measures taken may be physical, electronic, or procedural. ANU staff are advised to treat personal information with care, and in accordance with this Privacy Policy and other applicable laws.
30. A lot of the information ANU creates or handles is contained in or forms part of a Commonwealth Record. We take reasonable steps to destroy or de-identify personal information in a secure manner when we no longer need it. We are required to deal with most of our records in accordance with the Archives Act 1983 (Cth), and Disposal Authorities issued pursuant to that Act.

Access and correction of your personal information

31. You have the right under the Privacy Act to ask for access to your personal information that we hold, and ask that we correct that personal information. You can ask for access or correction by contacting us and we will respond within 30 days.
32. If you ask, we will give you access to your personal information unless there is a law that allows or requires us not to. We will take reasonable steps to correct your personal information if we consider it is incorrect, unless there is a law that allows or requires us not to. We will ask you to verify your identity before we give you access to your information or correct it, and we will try to make the process as simple as possible. If we refuse to give you access to, or correct, your personal information, we will notify you in writing setting out the reasons for refusal.
33. If we make a correction and we have disclosed the incorrect information to others, you can ask us to tell them about the correction. We will do so unless there is a valid reason not to. If we refuse to correct your personal information, you can ask us to attach a statement to it stating that you believe the information is incorrect and why.
34. You also have the right under the Freedom Of Information Act 1982 (Cth) (FOI Act) to request access to documents that we hold and to ask for information that we hold about you to be changed or annotated if it is incomplete, incorrect, out-of-date or misleading. For further information about access to your personal information held by ANU, see requests for personal information under the FOI Act at http://foi.anu.edu.au/personal_information/personal_information.php.

How to make a complaint

35. If you wish to complain to us about how we have handled your personal information you should complain in writing. If you need help lodging a complaint, you can contact us for information. If we receive a complaint from you about how we have handled your personal information we will determine what (if any) action we should take to resolve the complaint.

We will tell you promptly that we have received your complaint and then respond to the complaint within 30 days. If you are not satisfied with our response you may ask for a review by a more senior officer within ANU (if that has not already happened) or you can complain to the Privacy Commissioner. For further information see our internal complaint handling policies and procedures.

How to contact us about privacy matters:

You can contact us by:

• Email: privacy@anu.edu.au
• Phone: +61 2 6125 5111

(Mon-Fri: 8am-6pm)
• Post: Attention:
• Privacy Officer
• The Australian National University
• Canberra ACT 2601 Australia