This policy sets out how the National Library of Australia (the Library) approaches and manages the Australian Privacy Principles (APPs) contained in Schedule 1 to the Privacy Act 1988(Privacy Act).
The Privacy Act regulates how Commonwealth agencies such as the Library collect, store, use and disclose personal information, and how individuals can access or correct personal information the Library holds. It requires the Library to comply with the APPs and take reasonable steps to implement practices, procedures and systems to protect personal information.
The Privacy Act does not apply to library material held, managed and made accessible by the Library, whether published (such as books, journals, newspapers and websites) or unpublished (oral history interviews, photographs and archival collections).
A range of material is available to the public through Trove. This includes content from National and State Libraries Australia as well as collections from research and cultural institutions.
For information on privacy issues relating to Trove, please see the Trove Privacy Statement.
This policy supports the principles outlined in the Privacy Act by:
- setting out how the Library manages personal information collected in accordance with the Privacy Act;
- promoting the management of all personal information held by the Library in an open and transparent way.
1.3. Personal and sensitive information collected by the Library
This policy applies only to personal information the Library collects from:
- members of the public who:
- use Library services or products;
- request delivery of collection items for use;
- engage with the Library via social media or stakeholder liaison;
- register for, or attend public events or activities;
- make collection material or financial donations to the Library; or
- purchase products through our bookshop (physical or online)
- individuals who work with the Library:
- creators (and their agents)
- representatives of publishers, partner institutions (e.g. other libraries), vendors (e.g. our commercial suppliers)
- job applicants
- fellowship and grant holders and applicants
- Council and audit committee members of the Library
- all Library employees, temporary staff, volunteers and contractors from whom the Library collects personal information as part of personnel or IT security management.
Personal information about individuals may be collected by the Library from the individual, or from a third party where it is not reasonably practicable to collect directly from the individual.
The Library uses forms, online systems and other electronic or paper correspondence to collect personal information. The Library collects personal information only if it is reasonably necessary for or directly related to one or more of the Library’s functions or activities. We only collect sensitive information with the individual’s consent.
The type of personal information the Library may hold and collect includes, but is not limited to:
- mailing and/or street address;
- email address;
- telephone number;
- age and/or birth date;
- profession, occupation and/or job title;
- photographic images and/or pictorial representations;
- information you provide to us through enquiries and surveys;
- credit card and/or other financial information;
- medical certificates and/or other health information;
- information relating to training, conduct or performance;
- products and/or services you have purchased or used;
- information related to donations of collection material and/or financial donations
- Information related to individuals contained in generally available publications (in whatever form they are published) that is generally available to the members of the public
- Familial relationships in the context of rights.
The ways the Library collects this information includes, but is not limited to:
- reference and user enquiries;
- library card applications and renewals;
- Trove registrations;
- National e-Deposit;
- individuals making Copies Direct requests;
- applications for grants, fellowships and scholarships;
- membership records of Friends of the National Library of Australia Inc;
- records of National Library volunteers;
- user feedback database;
- surveys and evaluations;
- online event ticketing;
- Trove Collaborative Services members registrations;
- interlibrary loan requests;
- sponsorship and fundraising information;
- electronic mailing lists relating to the activities of the Library;
- job applications;
- personnel records of Library employees, temporary staff, volunteers and contractors
- corporate mailing lists;
- financial information and accounting system records; and
- footage from closed circuit cameras.
We collect personal information so that we can perform our functions and activities, and to provide high quality customer service.
The Library holds personal information in:
- searchable electronic data bases;
- financial management systems; online booking systems;
- Excel and Access applications;
- user management systems;
- software as a service;
- electronic and paper files;
- storage or holdings by third parties where the Library retains the right to deal with the information, including to access and amend the information.
Personal information that is held in the Library’s electronic databases is used to:
- facilitate access to and use of library materials
- provide library services, such as research assistance
- distribute information about Library events, activities and fundraising opportunities, including by email
- maintain membership and donor lists
- retain details of the Library’s donors, and publicly acknowledge those donors with their consent
- to inform and facilitate philanthropic and fundraising activities of the Library
- request and receive feedback about readers’ and visitors’ experiences
- generate invitations to events
- update the Library’s rights collection management system.
Sensitive personal information
Under the Privacy Act, ‘sensitive information’ is a subset of personal information which is afforded higher protections. Sensitive personal information includes information or opinion about an individual’s racial or ethnic origin; political opinions and association; religious beliefs or affiliations; philosophical beliefs; sexual preferences or practices; trade or professional associations and memberships; union membership; criminal record; and health or genetic information.
1.4. Authority and purpose for collecting personal information
The Library collects personal information to perform its functions under section 6 of the National Library Act 1960and to undertake activities incidental to those functions. The Library’s functions include maintaining and developing a national collection of library material, providing library services, and cooperating in library matters with other organisations.
1.5. Use and disclosure of personal information
The Library holds, uses and discloses personal information for the particular purpose for which it was collected. For example, if you apply for a grant, the Library will use personal information to assess your grant application. The Library will not use or disclose personal information for another purpose, unless the individual provides consent, or the use or disclosure falls within an exception set out in APP 6.2.
1.6. Disclosure of personal information to overseas recipients
The Library sometimes discloses personal information to overseas recipients, when it arranges an interlibrary loan, document delivery or the exchange of library collection metadata records. The country will depend on the location of the individual concerned.
If personal information is disclosed overseas, the Library will take reasonable steps to ensure that the overseas recipient does not breach the APPs.
The Library protects personal information it holds and will take seriously and deal promptly with any accidental or unauthorised disclosure of personal information. The Library uses a variety of electronic and physical measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
The Library manages its online services and IT systems in accordance with the Australian Government Protective Security Policy Framework and the Australian Government Information Security Manual.
The Library’s IT management procedures and practices require personal information to be stored on a network file server with restricted access permissions, safeguards including procedures for cleansing PCs, servers and storage systems of personal information prior to the PC being disposed or used for another purpose, use of removable media must be password-protected and stored in a secure place; and a responsible staff culture is fostered through continual information security awareness and training tailored to roles and responsibilities. Other physical security measures are also in place included restricted physical access to premises and use of lockable cabinets.
Storage and disposal of information is managed in accordance with Australian Government records management regulations, guidelines and authorities, including the Archives Act 1983, Records Authorities and General Disposal Authorities. Access to the databases, systems and electronic and paper files is limited to authorised users only.
External service providers who handle personal information about the Library’s staff, customers or other individuals are required to comply with the requirements of the Privacy Act.
The Library will respond to any potential or actual data breach in accordance with its Data Breach Response Plan. The Library is required to notify any data breach which is an ‘eligible data breach’ under Part IIIC of the Privacy Act.
Concerns regarding potential or actual data breaches should be raised with the Privacy Contact Officer.
1.8. Our website
The Library publishes a privacy statement on its website explaining the privacy aspects of web analytics, cookies and e-mail.
1.9. Access and correction to personal information
An individual may request access to their personal information held by the Library. If it is appropriate to process the request under the Freedom of Information Act 1982, we will let the individual know.
An individual who believes that their personal information held by the Library is inaccurate, out-of-date, incomplete, irrelevant or misleading can request that the information be corrected.
A request for access or correction can be made to the Privacy Officer.
The Library will respond to access or correction requests within 30 days and give written reasons for any refusal to release or correct information.
An individual may make a privacy complaint to the Library Privacy Contact Officer if they are unhappy with how the Library has handled their personal information. The Library will take reasonable steps to deal with enquiries or complaints about compliance with the APPs. The Library will send a considered response to complaints or suggestions within 30 days. The Library is committed to quick and fair resolution of complaints and will ensure that all complaints are taken seriously.
Complaints about the Library’s personal information handling practices may also be made to the Office of the Australian Information Commissioner.
3. How to contact us
An individual may contact the Privacy Officer to:
- obtain access to their personal information;
- request amendment of their personal information
- make a complaint about a breach of privacy;
- raise a potential or actual data breach;
- query how personal information is collected, stored, used or disclosed; or
General enquiries about the Library’s compliance with the Privacy Act can be made via:
Telephone: 02 62621600
National Relay Service: 133 677 (for hearing impaired callers)
Fax: +[02 6257 1703]
Or writing to:
Privacy Contact Officer
National Library of Australia
Parkes ACT 2610
The Library generally reviews this policy every 12 months to ensure it is up-to-date.