Policy Standard
- Collection of personal information by Prisons Services is managed in accordance with the Privacy Act 1993.
Performance Standards
- Personal information can only be collected if it is for a lawful and necessary purpose connected with a function of the Department.
- Under Information Privacy Principle 2 (IPP2), personal information can only be collected directly from the prisoner unless it is reasonably believed:
- that the information is publicly available information; or
- that the prisoner authorised collection of the information from someone else; or
- that non-compliance would not prejudice the interests of the prisoner; or
- that non-compliance is necessary to avoid prejudice to the maintenance of the law, including the prevention, detection, prosecution and punishment of offences, or for the enforcement of a law imposing a pecuniary penalty, or for the protection of the public revenue, or for the conduct of proceedings before any court or tribunal; or
- that compliance would prejudice the purposes of the collection; or
- that compliance is not reasonably practicable in the circumstances of the particular case;
- that the information will not be used in a form in which the prisoner is identified; or
- that the collection of the information is in accordance with an authority granted by the Privacy Commissioner under section 54 of the Privacy Act.
- Under Information Privacy Principle 3 (IPP3), the prisoner must be informed before the collection (if practicable, otherwise as soon as possible after) of:
- the fact that the information is being collected; and
- the purpose for which the information is being collected; and
- the intended recipients of the information; and
- the name and address of the Department of Corrections and the agency that will hold the information; and
- if the collection of the information is authorised or required by or under law, the particular law by or under which the collection of the information is so authorised or required and whether or not the supply of the information by that prisoner is voluntary or mandatory; and
- the consequences (if any) for that prisoner if all or any part of the requested information is not provided; and
- the rights of access to, and correction of, personal information provided by these principles.
These requirements do not have to be met if:
- these steps have been taken in relation to the collection, from that prisoner, of the same information or information of the same kind, on a recent previous occasion; or
- If it is believed, on reasonable grounds:
- that non-compliance is authorised by the prisoner; or
- that non-compliance would not prejudice the interests of the prisoner; or
- that non-compliance is necessary to avoid prejudice to the maintenance of the law including the prevention, detection, prosecution and punishment of offences, or for the enforcement of a law imposing a pecuniary penalty, or for the protection of the public revenue, or for the conduct of proceedings before any court or tribunal; or
- that compliance would prejudice the purposes of the collection; or
- that compliance is not reasonably practicable in the circumstances of the particular case; or
- that the information will not be used in a form in which the prisoner is identified.
- Under Information Privacy Principle 4 (IPP4), personal information shall not be collected by unlawful means, or by means that, in the circumstances of the case, are unfair, or intrude to an unreasonable extent upon the personal affairs of the prisoner.
- Under Information Privacy Principle 5 (IPP5), any information collected is to be protected, by such security safeguards as are reasonable in the circumstances, against loss, access, use, modification, disclosure and any other misuse except as authorised by the Privacy Act.
- When taking documents off-site, the documents are to be held in a covered folder, satchel or box within the possession or control of staff.
