This policy sets out the intention and direction by which the National Library of Australia approaches and manages the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Clth).
The Privacy Act regulates how Commonwealth agencies store, use and disclose personal information, and how individuals can access information held. It requires the Library to comply with the APPs and take reasonable steps to implement practices, procedures and systems relating to personal information.
This policy does not apply to personal information contained in library material held, managed and made accessible by the Library, whether published (such as books, journals, newspapers and websites) or unpublished (oral history interviews, photographs and archival collections). The Privacy Act includes a general exemption for all such material held by Australian libraries. This includes electronic collection material and library collection material which has been digitised, as well as the associated metadata assembled to maintain, describe and provide access to the collection. Library collection metadata may include personal information such as full names and life dates and provenance information in bibliographic and authority records in the Library’s catalogue and other discovery services, including the more extended information found in biographical notes in Manuscript collection finding aids, summary material relating to Oral History interviews, and Trove party (people and organisation) records
This policy applies only to personal information the Library specifically collects from individuals using Library services or products or services provided by the Library.
This policy applies to all Library employees, temporary staff, volunteers and contractors.
In accordance with APP 1, this policy supports the principles outlined in the Privacy Act by:
- providing general guidance for managing personal information collected, held, used or disclosed by the Library;
- promoting the management of all personal information held by the Library in an open and transparent way;
- addressing the APPs in the Library context; and
- encouraging, promoting and facilitating a Library-wide understanding of the principles and how they apply.
1.3. Who should read this policy?
- Library employees and volunteers;
- contractors, consultants, suppliers or vendors of goods or services to the Library;
- applicants to the Library for information under the Freedom of Information Act 1982;
- individuals whose personal information may be collected, held, used or disclosed by the Library.
1.4. The National Library and Privacy
This policy sets out how the Library complies with the Privacy Act. The key areas of Library functions which may involve the collection of personal information include : public access to items in the collection; engagement with the public via social media and online services; public events and activities; e-commerce activities; personnel management; physical and Information Technology security; and stakeholder liaison.
1.5. Personal Information collected by the Library
In accordance with APP 1, personal information about individuals may be collected by the Library from the individual, or from a third party.
The Library uses forms, online systems and other electronic or paper correspondence to collect personal information. The Library will not collect personal information unless the information is deemed reasonably necessary for or directly related to one or more of the Library’s functions or activities.
The Library is required to ensure that any information it collects is relevant for the purpose for which it is collected. The Library may only collect personal information by lawful and fair means and generally collects the information from the individual personally.
The Library currently collects and holds the following classes of personal information:
- reference and user enquiries;
- library card applications;
- registered Trove users;
- Copies Direct requests from individuals;
- applications for grants, fellowships and scholarships;
- membership records of Friends of the National Library of Australia Inc;
- records of National Library volunteers;
- user feedback database;
- surveys and evaluations;
- online event ticketing;
- Libraries Australia members;
- interlibrary loan requests from libraries and Loansome Doc registration;
- sponsorship and fundraising information;
- electronic mailing lists relating to the activities of the Library;
- personnel records;
- corporate mailing lists;
- financial information and accounting system records; and
- footage from closed circuit cameras.
Sensitive personal information
There is a distinction in the Privacy Act between personal information and ‘sensitive information’. The Library will not seek information which it does not need. Sensitive personal information includes information or opinion about an individual’s:
- racial or ethnic origin;
- political opinions and association;
- religious beliefs or affiliations;
- philosophical beliefs;
- sexual preferences or practices;
- trade or professional associations and memberships;
- union membership;
- criminal record; and
- health or genetic information.
The Library will not collect this personal information unless the individual consents and the information is reasonably necessary or directly related to the Library’s functions or activities.
1.6. Authority and purpose for collecting personal information
In accordance with APP 1 the purpose for which the Library collects personal information complies with the objectives of the National Library Act 1960 which identify the Library’s functions as:
- to maintain and develop a national collection of library material, including a comprehensive collection of library material relating to Australian and Australian people;
- to make library material in the national collection available to such persons and institutions and in such manner and subject to such conditions, as the Council determines, with a view to the most advantageous use of that collection in the national interest;
- to make available such other services in relation to library matters and library material (including bibliographical services) as the Council thinks fit and, in particular, services for the purposes of:
- the library of Parliament;
- the authorities of the Commonwealth;
- the Territories;
- the Agencies (within the meaning of the Public Service Act 1999); and
- to cooperate in library matters (including the advancement of library science) with authorities or persons, whether in Australia or elsewhere, concerned with library matters.
1.7. How the Library holds personal information
In accordance with APP 1, the Library holds personal information in searchable electronic data bases; financial management systems; online booking systems; Excel and Access applications; user management systems; electronic and paper files. Access to the databases, systems and electronic and paper files is limited to authorised users only.
1.8. Access to and correction of personal information
In accordance with APP 1, an individual may access his or her personal information held by the Library and may seek correction of such information.
Access to personal information – APP 12
An individual has a right under APP 12 to access his or her personal information held by the Library. The right of access is subject to the relevant exemptions in the Freedom of Information Act and any Act of the Commonwealth.
The Library has a legal obligation to respond to requests for access to personal information within 30 days and to give written reasons for any refusal to release information.
Amendment of personal information – APP 13
The Library will take reasonable steps to correct personal information that it holds to ensure it is accurate, up-to-date, complete, relevant and not misleading.
Individuals can request information the Library holds about them to be corrected. The Library has a legal obligation to respond within 30 days and must provide written reasons if the request to amend personal information is refused.
1.9. Use and disclosure of personal information
APP 6 provides guidance about the use and disclosure of personal information. The Library holds personal information that is collected for particular purposes and will not use or disclose it for another purpose, unless the individual provides consent to disclosure, or disclosure falls within the guidelines set out in APP 6.
Under the National Library of Australia Act, the Library uses collected information, including personal information, to meet its statutory obligations.
1.10. Disclosure of personal information to overseas recipients
In accordance with APP 1, the Library is unlikely to disclose personal information to overseas recipients, except in relation to activities such as interlibrary loan and document delivery or the exchange of library collection metadata records.
APP 8 places obligations on the Library for disclosure of personal information to overseas entities, when the recipient is not in Australia or an external Territory. If personal information is disclosed overseas, the Library will take reasonable steps to ensure that the overseas recipient does not breach the APPs.
1.11. Accidental or unauthorised disclosure of personal information
The Library protects personal information it holds and will take seriously and deal promptly with any accidental or unauthorised disclosure of personal information.
External service providers who handle personal information about the Library’s staff, customers or other individuals are required to comply with the requirements of the Privacy Act. Any possibility of unauthorised disclosure by staff, contractors or service providers is also covered by the following legislation:
- Library employees are subject to the Public Service Act 1999, the Public Service Regulations 1999 and the Australian Public Service Values and Code of Conduct. If employees disclose official information without authority they may face disciplinary sanctions including, in the most serious cases, termination of employment; and
- current and former employees and service providers are generally covered by the Crimes Act 1914 which provides criminal penalties for unauthorised disclosure of official information; the Criminal Code Act 1995 provides similar penalties if former employees dishonestly use official information gained during their employment to benefit themselves or others or to cause harm to another person.
1.12. Data quality storage and security
APP 11 requires that the Library takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
The Library manages its online services and IT systems in accordance with the Australian Government Protective Security Policy Framework and the Australian Government Information Security Manual.
The objectives of the Library’s IT Security framework are:
- To ensure that appropriate, cost effective safeguards and procedures are adopted to protect Library information assets and associated information technology resources;
- To ensure that Library personnel, contractors, vendors and visitors are aware of their accountability for the effective operation of these safeguards; and
- To ensure auditability of Library information technology resource safeguards and procedures.
The Library’s IT management procedures and practices require that:
- personal information must be stored on a network file server with restricted access permissions;
- safeguards include procedures for cleansing PCs, servers and storage systems of personal information prior to the PC being disposed or used for another purpose;
- personal information may only be stored on a removable media provided it is password-protected and stored in a secure place;
- controls to address the risk of unauthorized access to personal data through Internet-based hackers, weak passwords or malware and viruses; and
- a responsible staff culture is fostered through continual information security awareness and training tailored to roles and responsibilities.
Storage of information (and the disposal of information when no longer required) is managed in accordance with Australian Government records management regulations, guidelines and authorities, including the Archives Act, Records Authorities and General Disposal Authorities.
1.13. Our website
The Library publishes a privacy notice on its website explaining the privacy aspects of clickstream data, web analytics, cookies and e-mail.
In accordance with APP 1, an individual may complain about a breach of the APPs. The Library will take reasonable steps to deal with enquiries or complaints about compliance with the APPs. The Library will send a considered response to complaints or suggestions within 30 days. The Library is committed to quick and fair resolution of complaints and will ensure that all complaints are taken seriously.
Complaints about the Library’s personal information handling practices may also be made to the Office of the Australian Information Commissioner.
3. How to contact us
In accordance with APP1, an individual may contact the Privacy Contact Officer to:
- obtain access to their personal information;
- make a complaint about a breach of privacy;
- query how personal information is collected, stored, used or disclosed;
General enquiries about the Library’s compliance with the APPs can be made via:
Telephone 02 62621600
National Relay Service 133 677 (for hearing impaired callers)
Fax +[02 6257 1703]
Or writing to
Privacy Contact Officer
National Library of Australia
Parkes ACT 2610
3.1. Related documents
Australian Government documents:
- Privacy Act 1988 (Cth);
- Criminal Code Act 1995 (Cth);
- Freedom of Information Act 1982 (Cth);
- Human Rights and Equal Opportunity Commission Act 1986 (Cth);
- Merit Protection (Australian Government Employees) Act 1984 (Cth);
- National Library Act 1960 (Cth);
- Australian Information Commissioners Act 2010 (Cth);
- Public Service Act 1999 (Cth); and
- Ombudsman Act 1976 (Cth).
In accordance with APP 1 the Library reviews this policy every 12 months to ensure it is up-to-date.