The planning and delivery of the Metro Tunnel Project (Project) is being overseen by the Melbourne Metro Rail Authority (MMRA).
The Legal Framework
As a public organisation delivering a project on behalf of the Victorian Government, MMRA must comply with the Privacy and Data Protection Act 2014 (Vic) which contains a set of Information Privacy Principles (IPPs). MMRA must also comply with other laws which protect your privacy, including the Health Records Act2001 (Vic). The Health Records Act contains a set of Health Privacy Principles (HPPs) and applies to MMRA's handling of health information, which is not subject to the IPPs.
Types of information
In providing a query or feedback to MMRA, some of your personal information may come into MMRA's possession and when that occurs it is known as a collection under the Privacy and Data Protection Act 2014 (Vic). The different types of information that are governed by privacy laws are set out below.
Personal information is information or an opinion that is recorded in any form, whether true or not, about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
Sensitive information is also personal information, specifically personal information about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliation, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, or criminal record.
What personal information does MMRA collect?
MMRA has a number of interactions with the public during which the public may provide MMRA with personal information. For example, on its online "contact us" form MMRA collects individual's names and contact details. In other instances, MMRA may collect personal information such as proof of identity, work details or information about your interactions with MMRA including enquiries and complaints. In relation to owners and occupiers of properties affected by the Project, MMRA may collect additional information such as information about buildings on the properties and planning permits. MMRA may collect your image (e.g. by photograph) if you attend any MMRA premises, information sessions or Project construction sites. For job applicants, MMRA collects information about qualifications, skills, experience, character and screening checks. In addition for staff who join MMRA, MMRA collects information about their employment arrangements and conduct and payment/financial details.
How will MMRA handle the personal information that it collects about you?
In performing its functions and in complying with the IPPs and HPPs, MMRA:
- will only collect personal information about you that is necessary for MMRA to fulfil its functions. A core function of MMRA is to engage and consult with stakeholders and the public about the Project. In some circumstances MMRA may collect personal information from third parties. For example, MMRA may collect personal information from other government bodies and ministers that redirect your queries and issues to MMRA. MMRA may also collect personal information from other third parties including public sources, local councils, rail operators, contractors engaged to help deliver the Project and organisations/groups with which you are associated or involved (e.g. your employer or a community group).
- will, when collecting your personal information, take reasonable steps to notify you or ensure that you are aware of the purpose for which your personal information is being collected and how your personal information is used and disclosed.
- may use the information you provide to communicate with you about the Project, consider and respond to enquiries, requests, applications or complaints, plan and manage the design and delivery of the Project, gain a better understanding of MMRA's stakeholders' questions or concerns about the Project to allow our team to respond to enquiries more efficiently, and to inform future public information and engagement activities.
- may disclose your contact details to a third party, such as a rail operator or authority, Public Transport Victoria, the Department of Economic Development, Jobs, Transport and Resources or a contractor engaged to help deliver the Project, an external company that delivers mail on behalf of MMRA, technology service providers, to respond to your enquiry or concerns, or at handover of the completed Project to the authority responsible for the rail network. MMRA may publish images, e.g. in MMRA's reports, website and social media pages. MMRA is subject to additional privacy requirements under the IPPs and HPPs when transferring personal information to third parties outside Victoria. This may occur in some cases including in relation to some technology providers.
- will obtain your consent to collect your sensitive information (unless MMRA is otherwise required or authorised to collect it), and to use or disclose your personal information if required.
- will take reasonable precautions to protect the security of your personal information from loss, misuse, unauthorised access, modifications or disclosures, including measures relating to secure premises, data access restrictions and user authentication.
In relation to job applicants and staff, MMRA uses also personal information for recruiting, training and managing staff. Personal information (including payroll/financial details where appropriate) may also be disclosed to academic institutions, recruiters, payroll service providers, screening check providers, health service providers, professional and trade associations, law enforcement agencies, referees and your current, previous and prospective employers.
MMRA may not be able to fulfil its functions without your personal information. We encourage you to contact us should you have any privacy queries.
A web server log is a file created by a web server which records all the activities it performs. MMRA may use standard web analytics software packages to analyse its web server log files in order to track usage of the Website.
Web server logs and cookies are used to gather statistical information about the use of the Website. These tools provide MMRA with general data including the number of visits, date and time of visits, pages viewed, browser types, methods of navigation, sections of the Website visited and other Website usage information. MMRA will not make any attempt to identify you or your individual browsing activity through these tools. The information collected is used by MMRA to update and improve the Website. MMRA does not use web server logs and cookies as the basis for direct marketing.
For further information, please visit the Google Privacy Center and related information at http://www.google.com/policies/privacy/.
Who do you contact for any privacy concerns?
Please contact MMRA if you wish to seek access to any personal information that MMRA holds about you, if you wish to have your personal information corrected, if you have any concerns about an image of you which has been published by MMRA or if you have a complaint about the way that MMRA has handled your personal information. Please address requests to the FOI Officer, Melbourne Metro Rail Authority, Level 12, 121 Exhibition Street, Melbourne VIC 3000.