Collection of personal information instruction
This is a supporting document for the Privacy and Data Protection Policy and guides information management in accordance with that policy and relevant privacy law.
Instruction steps and actions
1. Collection fundamentals
Collection is a fundamental part of privacy protection and it is essential that it is managed correctly. In simple terms the rules are:
- Collect only what you need
- Do it lawfully and fairly
- Don’t intrude unreasonably.
- Tell people you are doing it.
In practice this means that you should only collect personal information if it is necessary for one or more of the RMIT’s functions or activities.
2. Use of privacy collection statements
Collecting personal information in a fair and lawful manner often relates to the information given to the person at the point of collection. In day to day RMIT business, this may be covered by using collection statements in forms, in survey participation or via the use of consent forms.
Information to be contained in a collection statement should include:
- the identity of RMIT and how to contact it
- the fact that he or she is able to gain access to the information
- the purposes for which the information is collected
- to whom (or the types of individuals or organisations to which) RMIT usually discloses information of that kind
- any law that requires the particular information to be collected
- the main consequences (if any) for the individual if all or part of the information is not provided.
RMIT has two overarching collection statements, one provided to students at the point of enrolment and one for staff published on the RMIT privacy website. Where information is collected outside of commencement and for specific purposes, a separate collection statement should be used for that specific purpose.
For advice on creating a privacy collection statement, please contact the RMIT Privacy Officer, or appropriate privacy or legal officer.
3. Unsolicited personal information
Personal information may be given to RMIT that was not requested (unsolicited). Unsolicited personal information must also be managed in accordance with RMIT’s privacy and data protection policy and relevant privacy law.
Examples of unsolicited information may be letters to RMIT from members of the public, comments from students on RMIT social network groups, or information contained within complaints or requests for special consideration.
Individuals have a right to anonymity in their dealings with RMIT, where that is both lawful and practicable.
In situations where there is no need to seek a person’s personal information this should be accommodated if requested. An example where it is not necessary to collect personal information (e.g. name and address) is when someone contacts RMIT to seek general information.
However, the nature of RMIT business means that, generally, it is not possible to provide services to, or interact with, student or staff members in an anonymous way.
5. Sensitive and health information
Sensitive information about people – like their ethnic background, religion, political views or affiliations, sexual preference or criminal records – has special protection under law. Such information can only be collected if it is essential for RMIT operations, required by law, or with specific and informed consent. Don’t collect it without checking the rules first.
Sensitive and health information have special protections because this kind of information can be used to discriminate against individuals.
It is advised not to collect sensitive or health information about an individual unless certain conditions are met, including:
- the individual has consented
- the collection is required under law
- the collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual.
There are certain exemptions to the above requirements, such as where:
- the collection is necessary for research, or the compilation or analysis of statistics, relevant to government funded targeted welfare or educational services;
- the information relates to an individual’s racial or ethnic origin and is collected for the purpose of providing government funded targeted welfare or educational services;
- there is no reasonably practicable alternative to collecting the information for that purpose;
- it is impracticable for RMIT to seek the individual’s consent to the collection.