Privacy and Information Sharing Policy

Last published 24 Mar 2017

1. Privacy notice

This privacy notice applies to the Department of Communities and Justice (DCJ) which consists of the following entities: Housing, the Land and Housing Corporation, the Aboriginal Housing Office, Ageing, Disability and Home Care, Community Services, Strategic Reform and Policy, Programs and Service Design and Corporate Services.

DCJ and its related agencies comply with NSW privacy legislation when collecting and managing personal and health information.

The information we collect from you or from an authorised third party will be held by the entity that collects it, or by the Business Service Centre, the Government owned company that provides corporate support to the Department. It will be used to deliver services and to meet our legal responsibilities.

We may also use your information within DCJ as a whole to plan, coordinate and improve the way we provide services.

DCJ is also legally authorised to disclose information to outside bodies in certain circumstances.

Please read the easy-English version of this privacy notice.

Further information about DCJ privacy policy can be found on the DCJ website:

Privacy notice
the DCJ privacy notice factsheet
or by calling: 9377 6000 or TTY 9377 6167

2. Background

DCJ and all state public sector agencies, statutory bodies, declared authorities and local councils must meet the requirements of the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002 in the collection, use, storage and disclosure of personal and health information.

The Privacy and Personal Information Protection Act 1998 commenced on 1 July 2000. The Act broadly covers the areas of collection, use, storage and disclosure of all personal information except health records.

The Health Records and Information Privacy Act 2002 commenced on 1 September 2004. This Act covers the areas of collection, use, storage and disclosure of health records and applies to organisations that collect, hold or use health information, and makes provision for the protection of that information.

DCJ also complies with the Government Information (Public Access) Act 2009 (GIPA Act). Requests for information will be handled in accordance with the requirements of the Act. For more information refer to the Right to Information policy.

The Spam Act 2003 sets out the legal requirements that DCJ Housing must comply with when sending electronic communications to its clients (this includes Email and SMS). Where a client has provided DCJ Housing with their mobile number and/or email address, DCJ Housing may choose to send them electronic messages where appropriate. Clients will be able to opt out of receiving certain electronic communications, and this will be recorded in DCJ Housing computer records.

The purpose of this policy is to explain the circumstances under which DCJ collects, uses, stores and discloses personal and health information and under which circumstances DCJ will share information with other government and non-government agencies.

3. Scope

This policy applies to all personal and health information collected, used, stored and disclosed by DCJ, including information about DCJ clients, applicants for housing services, or tenants living in dwellings managed by DCJ, including tenants of the Aboriginal Housing Office whose tenancies are also managed by DCJ.

4. Policy statement

DCJ respects the privacy of its clients. DCJ will:

Collect personal and health information for a proper and lawful purpose in order to provide services.
Collect personal and health information directly from the client, unless it is unreasonable or impractical to do so, or the client has consented to it being collected from someone else.
Ensure the information collected is relevant, accurate, up to date, complete and not excessive or misleading.
Inform clients what and why information is collected, how it will be used and who it may be given to.
Not keep personal or health information for longer than necessary.
Ensure the information collected is securely stored and protected.
Do all that is reasonable in the circumstances to prevent loss, unauthorised access, use, modification or disclosure and misuse.

DCJ will only disclose information to other agencies or persons which identifies clients:

If the disclosure is directly related to the purpose for which the information was collected and there is no reason to believe that the person concerned would object.
If the person to whom the information relates was informed when the information was collected that it would be disclosed in this way.
If it is reasonably believed that the disclosure is necessary to prevent or lessen a serious and imminent threat to any person’s health, safety or life.

DCJ will ensure compliance with the privacy principles except:

Where the person to whom the information relates has provided informed consent.
If lawfully authorised or required to do so under the Privacy Act, by legislation, or a Privacy Code of Practice, or DCJ' Privacy code of Practice, and if available, supported by a Service Agreement, Memorandum of Understanding or similar document.

Personal information

Personal information is information, or opinion, about a person that discloses their identity, such as written records or photographs. It can also include information about a person’s ethnic or racial background, political opinion, criminal history, religious belief or sexual preference.

Health information

Health information is personal information that specifically relates to:

a physical or mental health disability that a client has at any time
express wishes about the future provision of health services to a client
a health service provided, or to be provided, to a client.

Collecting personal and health information

DCJ will not collect information unless it is for a proper and lawful purpose. Information is collected so that various housing services can be provided. In most situations, clients will be advised why DCJ is collecting personal information, and who else will receive this information. DCJ may decide not to provide this advice to clients if:

the client does not want DCJ to give them this advice
DCJ is not legally required to provide the advice.

Holding personal and health information

DCJ will keep information in accordance with the State Records Act 1998. While holding information, DCJ will ensure that it is protected and made as secure as possible from loss, unauthorised access, use, modification, disclosure and misuse.

A client who has been given access to a document held by DCJ may apply to make changes to those records if:

the document contains information about the client’s personal affairs;
the information is available for use by DCJ in connection with its administrative functions; and
the information is, in the client’s opinion, incomplete, incorrect, out of date or misleading.

Using or disclosing personal and health information

DCJ will only use or disclose personal and/or health information for the purpose for which it has been collected (or another purpose that is directly related to the purpose for which it was collected), unless:

The client has consented to its use or disclosure for another purpose.

DCJ has reasonable grounds to believe that it is necessary to:

lessen or prevent a serious and imminent threat to the life, health or safety of a client, or of someone else
lessen or prevent a serious threat to public health or safety
meet its legal obligations to protect the public revenue
respond to information requests from the Minister on a matter
meet its obligations in relation to the safety, welfare or wellbeing of a child or young person under the Children and Young Persons (Care and Protection) Act 1998.

DCJ requires the information for reasons such as:

conducting surveys about client satisfaction and issues relating to long term service enhancement
the training of employees or officers of DCJ
where it is reasonably necessary for research or the compilation of statistics in the public interest
where it is reasonably necessary for funding, planning or evaluating the provision of a health service provided in partnership with DCJ.

Exceptions to the privacy principles under the Privacy Act for collecting, using disclosing or exchanging personal and/or health information when other agencies or organisations are involved

DCJ will ensure compliance with the privacy principles and may only otherwise exchange personal and/or health information with other agencies if the exceptions to the privacy principles apply, that is:

where the person to whom the information relates has provided informed consent
where lawfully authorised or required to do so by legislation, or a Privacy Code of Practice, and if available, supported by a Service Agreement, Memorandum of Understanding or similar document in place
for child protection purposes, DCJ may also lawfully exchange certain information under Chapter 16A of the Children and Young Persons (Care and Protection) Act 1998. In this situation, DCJ will only provide as much information about a client as is relevant.

Working with other agencies and inter-agency collaboration

Many DCJ clients have dealings with other agencies, including government and non-government agencies and support groups. DCJ cooperate with these other agencies to seek the best outcomes for the client. We will also make our clients aware of the services provided by these agencies and groups where appropriate.

An interagency approach is often essential when working with clients, particularly when ensuring the safety, welfare or wellbeing of a child or young person. DCJ will work with other agencies to strengthen partnerships recognising the importance of providing appropriate support to families earlier, to prevent children and young people requiring statutory child protection intervention.

Working with the Police

DCJ aims to assist the Police to:

maintain law and order in and around tenancies managed by DCJ
develop and implement crime prevention and community safety strategies.

When appropriate, DCJ will:

Provide information that the Police need in order to carry out their duties, for example, to investigate a criminal activity or to manage a serious incident that threatens life or property.
Provide information to Police when subpoenaed, unless the information is privileged or to which public interest immunity attaches. In these cases, DCJ will lodge an appeal not to provide the information.
Cooperate with the Police to investigate a crime or offence alleged to have occurred within premises/tenancies managed by DCJ.
Seek information from the Police if an offence is related to a tenancy matter in accordance with the Memorandum of Understanding.

Working with the Ministry of Health

The Housing and Mental Health Agreement is a partnership between the Ministry of Health and DCJ. The Agreement is designed to ensure that mutual clients receive appropriate housing that is linked to appropriate mental health support services.

When a client’s application for housing assistance is supported by the Mental Health Service, DCJ must be given sufficient information to accurately assess the person’s housing needs.

If tenancy issues, such as arrears, property damage or antisocial behaviour matters cannot be resolved directly with the client because of their state of mental health, DCJ may ask its partner agencies to provide assistance to resolve the matter. Clients suspected of having a mental illness that is likely to put their tenancy at risk may be referred to the Community Mental Health Service.

Individual cases will be discussed at joint service meetings. Confidentiality will be fully respected in accordance with applicable law and policy. Any exchange of information will be provided in accordance with specified and agreed privacy protocols and, wherever appropriate, based on the client’s written consent.

Working with Community Services

Community Services has the responsibility for the care and protection of children under the Children and Young Persons (Care and Protection) Act 1998. Members of the community and mandatory reporters who suspect that a child or young person is at risk of significant harm (the statutory threshold) are required to report their concerns to the Child Protection Helpline.

DCJ and community housing providers participating in Housing Pathways have a further role in child protection which is to support the safety, welfare or wellbeing of a child or young person whether or not they are known to Community Services. Under Chapter 16A of the Children and Young Persons (Care and Protection) Act 1998 prescribed bodies may exchange information that helps deliver services and supports to assist in the promotion of the safety and wellbeing of children and young people. The exchange of information under Chapter 16A only relates to information already held by the agency and where the information will assist in:

making a decision, assessment or plan,
initiating or conducting an investigation,
providing a service relating to the safety, welfare or wellbeing of the child or young person (or class of children or young persons), and/or
managing a risk to a child or young person.

Requests for information from Community Services

Community Services can request information from Housing and community housing providers participating in Housing Pathways, as a prescribed body under Chapter 16A of the Children and Young Persons (Care and Protection) Act 1998.

Where a request for information under Chapter 16A is received, and Housing is confident the request meets the principles of Chapter 16A, the information must be supplied.

Requests for information under Chapter 16A from a prescribed body may be declined if the request does not meet the principles of Chapter 16A. Community Services however has the power by a notice under Section 248 of the Children and Young Persons (Care and Protection) Act 1998 to compel Housing to disclose existing information relating to the safety, welfare and well-being of a child, an unborn child or a young person. Housing staff are legally obliged to provide this information to Community Services. However, Community Services can only collect information that already exists. It cannot require Housing staff to collect new information or to undertake a separate assessment and report.

Requesting information from Community Services

Housing staff and community housing staff participating in Housing Pathways can request information from Community Services about the safety, welfare and wellbeing of a child or young person under Chapter 16A. DCJ is a prescribed body under Chapter 16A and is legally required to provide this information if the request meets the principles of Chapter 16A.

All information concerning a report will be treated in the strictest confidence.

For more information, see the Children and Young People at Risk policy.

Working with Centrelink

DCJ regularly asks clients to provide information about their household income as part of its process for reviewing eligibility for or entitlement to:

social housing
a Private Rental Subsidy
a rent subsidy
a transfer or mutual exchange
remain living in public housing.

The Income Confirmation Scheme can be used by DCJ applicants, tenants and members of their households who receive Centrelink payments. Participation in the scheme is voluntary and means that clients do not need to provide income statements to DCJ each time an income review is conducted.

Under the Income Confirmation Scheme, DCJ can ask Centrelink to provide up to date information about the income of a client or member of their household, provided the client has given consent and they receive a Centrelink income.

Centrelink does not provide income information unless DCJ has requested it. This means that Centrelink does not automatically tell DCJ each time the income of a client changes. Clients who have joined the Income Confirmation Scheme still need to tell DCJ if their household income changes.

DCJ does not use the information provided through the Income Confirmation Scheme if it is six months, or more than six months, old.

A person can join the Income Confirmation Scheme at any time by providing written consent. A person can leave the scheme at any time by telling their Client Service Officer by phone, in person, or in writing. DCJ will immediately cancel the client’s consent. Consent to participate in the Income Confirmation Scheme cannot be withdrawn through Centrelink.

DCJ will automatically cancel a client’s consent if they no longer have a relationship with it, or with Centrelink.

DCJ stores information provided through the Income Confirmation Scheme:

while the person is a client or a member of a client’s household
and otherwise in accordance with the State Records Act 1998.

Information provided by Centrelink is managed in accordance with the Privacy and Personal Information Protection Act 1998.

Right to Information

Any member of the public may request information held by DCJ under the Government Information (Public Access) Act 2009 (GIPA Act). For more information, see the Right to Information policy. (formerly Freedom of Information).

4. Legislation and compliance

In managing privacy and information sharing, DCJ is required to comply with the following Acts:

The Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002, set out principles that DCJ must apply when it manages personal information.

Both acts provide for DCJ to develop a Code of Practice explaining how it applies these principles and situations where its actions will vary from the principles. DCJ has gazetted a Privacy Code of Practice under the Privacy and Personal Information Protection Act 1998.

The Privacy and Personal Information Protection Act 1998 also requires DCJ to prepare and implement a Privacy Management Plan. This is a separate document that explains how DCJ complies with the specific provisions of the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002.

5. Related documentation

6. Further information

Feedback and complaints

All clients and members of the public have the right to offer feedback about the services that DCJ provides, either because they:

are dissatisfied with the quality of service, or
believe that a policy is wrong, unjust, unlawful, discriminatory or unfair, or
have positive feedback to provide about the service.

Feedback is encouraged and is valued, because it helps to improve DCJ policies, systems and service delivery. For more information on the types of feedback that DCJ would like to receive, please see the Client Feedback Service factsheet.

Feedback can be in the form of a complaint, suggestion, or compliment and can be provided in person, in writing, by email, online or over the telephone. For more information see the Client Feedback Service section of contact us.

For reports of fraud or corruption by staff or clients please see the Reporting Fraud or corruption section of contact us.

Feedback will be dealt with in an equitable, objective and unbiased manner and a client’s privacy will be respected. DCJ provides free, confidential and qualified language services to clients who need the assistance of an interpreter and language services to provide feedback.

Feedback can also be lodged on a client’s behalf by a third party such as a family member, support provider or an advocate. The client’s consent is required before DCJ can provide information about the client to a third party.

Clients may also choose to provide feedback through another source, for example:

their local Member of Parliament
the Minister for Family and Community Services.

If a client or a member of the public is dissatisfied with the way services are delivered this will be managed as a complaint if the matter is not resolved straight away.

Feedback about neighbourhood concerns such as reports of antisocial behaviour, property care issues, unauthorised alterations or illegal activity are also welcome, but will not be managed as a complaint in the first instance. The matter will be managed according to the relevant policy.

Feedback will be acknowledged by DCJ but in most cases a detailed outcome cannot be provided, either because there are ongoing legal proceedings or to protect the privacy of other parties.

If a client believes that DCJ has failed to respond appropriately to this feedback, this will then be managed as a complaint.

Complaints management

Complaints will be acknowledged, reviewed and an outcome provided in general, within 15 working days. However, any complaint that is made about a privacy issue will be completed within 2 months. Clients will be advised if there are any delays in reviewing the complaint and will be provided with an outcome in writing.

Complaints will be directed to the section of DCJ that is responsible for responding to the issue. If the complaint is about a member of staff, it will be reviewed by a more senior officer than the person being complained about and the matter will be discussed with the member of staff who is the subject of the complaint. If a client is concerned about their confidentiality or privacy, they may lodge a complaint anonymously.

DCJ will not treat people differently because they have made a complaint.

If a client is unhappy with the outcome of their complaint or the way their complaint has been handled, they should first discuss it with their local office. They can also discuss it with the NSW Ombudsman, the Tenancy Advocacy Service or Community Justice Centre. If the complaint is about a privacy issue, the client can discuss it with the Information and Privacy Commission NSW.

Appeals and review of decisions

If a client is concerned about the way that DCJ has handled personal information, a client may be entitled to a review of that conduct. The review will be undertaken by a Reviewing Officer appointed by DCJ. Reviews can be requested by contacting the Client Feedback Unit on 1800 422 322.

Applications for further review of the findings of or a response from an Internal Review can be lodged with the NSW Civil and Administrative Tribunal.

Was this content useful?

Your rating will help us improve the website.

Last updated: 10 Jan 2024