Inquiries into the transfer of personal information by City of Greater Geelong
MEDIA STATEMENT
The Office of the Victorian Information Commissioner (OVIC) made preliminary inquiries with the City of Greater Geelong in January 2020 about the proposed use of a third party service provider to manage marketing and communications with members of its fitness and leisure centres. That provider operates outside Australia.
In Victoria, the Privacy and Data Protection Act 2014 (PDP Act) protects personal information held by Victorian government organisations. Under the PDP Act, information privacy protections are embodied in the 10 Information Privacy Principles (IPPs). The IPPs govern the collection, use and handling of personal information by Victorian public sector organisations, local councils and contracted service providers.
Under IPP 9 – Transborder data flows, information may only be sent overseas if it will be subject to privacy protections at its destination.
After making enquiries, the City of Greater Geelong notified OVIC that the contract with the third party included a clause acknowledging that the third party was subject to the Australian Privacy Act 1988. Further, the City of Greater Geelong would remain responsible for any breach of the IPPs by the third party service provider.
Although the City of Greater Geelong can outsource marketing and communications functions, it cannot outsource its duty to protect the privacy of the people whose information it holds.
The City of Greater Geelong has advised OVIC that it does not intend to transfer personal information to the third party service provider at this time and is considering if it will use a different provider.
OVIC has recommended that the City of Greater Geelong notify its fitness and leisure centre members of the identity of any third-party marketing and communications providers it chooses to use in future. This is consistent with the City of Greater Geelong’s duties under IPP 1 – Collection and IPP 5 – Openness.
OVIC will continue to promote the responsible and transparent handling of personal information, to ensure that Victorians’ rights to privacy are protected and upheld.