AIM Privacy Policy

Privacy Act 1988 (Cth)
Effective 13 December 2001

• Overview
• Purpose
• Scope
• Breach
• Confidentiality
• AIMPP1: Collection
• AIMPP2: Use and Disclosure
• AIMPP3: Data Quality and Security
• AIMPP4: Openness
• AIMPP5: Access and Correction
• AIMPP6: Identifiers
• AIMPP7: Anonymity
• AIMPP8: Transborder Data Flows

Overview

The Australian Institute of Management - Qld & NT ABN 40 009 668 553 (AIM) has handled Personal Information in relation to membership, events and training for over 60 years and has been pro-active and committed to developing policies and procedures to protect the privacy of all clients. AIM see this is an essential measure in delivering superior customer service and consequently has implemented Information Technology infrastructure to effectively manage privacy requirements.

AIM has introduced a compliance program in order to comply with the Privacy Act, effective 21 December 2001. Relevant policies and procedures have been developed and consolidated with the aim of improving awareness of and regulating access to all information.

The AIM Privacy Policy seeks to

• Ensure Personal Information is collected, stored, and used in accordance with the Privacy Act 1988 (Cth);
• Acknowledge the responsibility of AIM in ensuring that client information is protected;
• Protect the privacy of clients by ensuring that only relevant Personal Information, which is necessary to provide products and services, is collected;
• Ensure that all Personal Information collected, used or disclosed is accurate, complete and up-to-date;
• Obtain consent to collect sensitive information;
• Take reasonable steps to make an individual aware of
  • Why we are collecting information about them;
  • Who else we might give it to; and
  • Other specified matters
• Destroy or permanently de-identify Personal Information if we no longer need it for any purpose for which we may use or disclose information.

• Assess, record and maintain personal contact details for marketing of upcoming events and training to members, non members, delegates and outside service providers;
• Develop and continue our relationship with members, non-members, delegates and outside service providers.

• The identity of AIM and its contact details;
• How the individual may obtain access to his or her Personal Information;
• Purposes for which the Personal Information is collected;
• To whom the Personal Information will be disclosed;
• What the consequences may be (if any) if the individual does not provide all of their Personal Information requested.

• Only Personal Information necessary to provide one or more of its functions or activities is collected;
• The collection of Personal Information should be conducted in a lawful and fair manner (approach taken is open and not misleading), and in a way that is not unreasonably intrusive;
• If it is reasonable and practicable to do so, collect Personal Information about an individual only from that individual;
• If Personal Information is collected about an individual from someone else, take reasonable steps to ensure that the individual is or has been made aware of the matters listed in 1 above.

• The 'primary' purpose for collection of data is always made clear.
• Consent for secondary purposes may be obtained at the same time of gathering information for the primary purpose or by future call/contact.

• Secondary purposes include:
  • Direct marketing;
  • Follow-up;
  • Relationship development; and
  • Promotion of AIM and journal publication.
• If the information is used for secondary purposes, both of the following apply:
  • The secondary purpose relates to the primary purpose of collection, and if the Personal Information is sensitive information, directly related to the primary purpose of collection;
  • The individual would reasonably expect the organisation to use or disclose the information for the secondary purpose; or
• The individual has consented to the use or disclosure; or
• If the information is not sensitive information and the use of the information is for the secondary purpose of direct marketing to non-members:
  
  • It is impracticable for AIM to seek the individual's consent before that particular use;
  • The individual has not made a request to the organisation not to receive direct marketing communications; and
  • AIM's procedures and guidelines on direct marketing are complied with.

• Online Member Profile Update forms;
• Verification of Personal Information during contact; and
• Compliance Program procedures.

• Misuse;
• Loss; or
• Unauthorised access, modification or disclosure

• Network access classes defined on a per user basis with access level based on a 'need to know' basis.
• General Ledger Access specified;
• Ability to lock-out all users;
• Physical Database server is kept in locked, temperature controlled room;
• IT supports 24x7, 365 days per year with a one-hour response time;
• Confidential documents are stored nightly in a lockable physical security area;
• Data is archived securely;
• Unique individual passwords for members and delegates.
  

AIMPP4: Openness

AIM will provide on request a Privacy Statement information sheet outlining AIM's Privacy Policy.

Privacy Statement
The Privacy Statement outlines:

• That the organisation is bound by a NPP's approved by the Office of the Federal Privacy Commissioner - September 2001;
• The reason certain types of information is collected;
• Anonymity and consequences;
• Contact details of the organisation.

• They are not required to provide a reason;
• All official requests for information must be in writing;
• An identity check is undertaken;
• Information is checked to ensure no information should be withheld (according to the Privacy Act).
• Where access to certain details is to be withheld, reasons for this decision will need to be provided to the individual;
• Once the Personal Information is prepared and cleared for access, the information can be provided in the form most appropriate to the situation. This will take into account the wishes expressed by the individual in his or her original request.

• The organisation reasonably believes that the recipient of the information is subject to a law, binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the National Privacy Principles; or
• The individual consents to the transfer; or
• The transfer is necessary for the performance of a contract between the individual and the organisation, or for the implementation of pre-contractual measures taken in response to the individual's request; or
• The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the individual between the organisation and a third party; or
• All of the following apply:
  • The transfer is for the benefit of the individual;
  • It is impracticable to obtain the consent of the individual to that transfer;
  • If it were practicable to obtain such consent, the individual would be likely to give it.