Privacy policy

1. Introduction

In the course of our activities, the Forcibly Displaced People Network (“FDPN”, “we”, “us” and “our”) collects personal information in relation to our clients, staff, volunteers, Board members, supporters, donors and others associated with FDPN.

 

FDPN respects the privacy of these stakeholders and we are committed to complying with our obligations in connection with the collection, storage and use of personal information under relevant privacy legislation, namely the Privacy Act 1988 (Commonwealth), in particular the Australian Privacy Principles (APP), Australian state or territory privacy laws, or any legislation that replaces those laws.

 

2. Scope

We apply this Policy to all individuals and entities who interact with FDPN. This includes (but is not limited to) Board Directors, employees, contractors, and volunteers, as well as community members and partner organisations using our services and/or programmes.

 

3. Definitions

‘Personal information’ refers to any information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in material form or not. This includes any information that directly or indirectly identifies, or could reasonably be used to identify, a living individual.

 

‘Sensitive information’ is a subset of ‘personal information’ and means information or an opinion about an individual’s:

• • racial or ethnic origin;
  • political opinions;
  •  membership of a political association;
  • religious beliefs or affiliations;
  • philosophical beliefs;
  • membership of a professional or trade association;
  • membership of a trade union;
  • sexual orientation or practices;
  • criminal record;
  • health information about an individual;
  • genetic information about an individual that is not otherwise health information;
  • biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or
  • biometric templates.

‘Health information’ is a subset of ‘personal information’ and includes information about a person’s health status, disability, an individual’s expressed wishes about the provision of health services, or a health service provided or to be provided.

 

‘Consent’ as defined by the Australian Privacy Principles Guidelines means expressed or implied consent. The four key elements of consent are the individual is adequately informed before giving consent; the individual gives consent voluntarily; the consent is current and specific; and the individual has the capacity to understand and communicate their consent.

 

‘Reasonable/reasonable grounds’ bear their ordinary meaning. What is reasonable is a question of fact in each individual case. It is an objective test that has regard to how a reasonable person, who is properly informed, would be expected to act in the circumstances. What is reasonable can be influenced by current standards and practices. It is the responsibility of FDPN to be able to justify that its conduct was reasonable.

 

‘Community member’ (also may be referred as ‘client) is an LGBTIQA+ forcibly displaced person who seeks protection, referral or other services provided by FDPN.

 

‘Unsolicited personal information’ refers to information (e.g., a letter or email) received by FDPN that was not requested, is intended for another recipient, or is beyond what is necessary for the functions or needs of FDPN.

 

‘Workers’ refers to FDPN Board Directors, FDPN members, employees, contractors, and volunteers.

 

4. Principles

FDPN will apply the following principles to all data protection and privacy practices:

• • FDPN will only collect personal information that is reasonably necessary for a legitimate organisational purpose. Information must not be collected merely because it may be useful in the future.
  • FDPN will collect sensitive information only where it is necessary and, unless an exception applies, only with the informed consent of the individual.
  • FDPN will be transparent about what information is collected, why it is collected, how it will be used, with whom it may be shared, how long it may be retained, and what steps are taken to protect it.
  • FDPN will only use or disclose personal information for the primary purpose for which it was collected, or for a directly related purpose that the individual would reasonably expect, unless disclosure is required by law or justified by serious safeguarding concerns.
  • FDPN will take reasonable steps to protect information from misuse, interference, loss, unauthorised access, modification, or disclosure.
  • FDPN will retain information only for as long as there is an ongoing need or lawful basis to retain it, and shall securely destroy or de-identify information that is no longer required.

5. Collection of personal information

5.1. Why we collect and hold personal information

We collect personal information that is necessary to enable us to perform our functions and activities.

 

We collect personal information for purposes including but not limited to:

• • Determining if our programmes or services are suitable for individuals;
  • Operating our programs and services, including improving and evaluating operations;
  • Connecting with and sending communications to members, donors, supporters and volunteers;
  • Assessing, placing and engaging staff and volunteers; and
  • Meeting regulatory obligations, including privacy, workplace safety, and government reporting.

 

5.2. What personal information we may collect and hold

5.2.1. For workers: 

• • For contractors, volunteers and prospective and current staff members: personal information including name, address, telephone number, email address, date of birth, demographics, next of kin, employment history, qualifications and experience, details of employment contract, visa status, driving licence, background checks, identity documents, photographs, job applications and declared conflicts of interests, relevant banking and financial details, and accessibility requirements.
  • For FDPN members and Board directors: personal information including name, address, telephone number, email address, date of birth, demographics, next of kin, employment history, qualifications and experience, declared conflicts of interests, and accessibility requirements.

5.2.2. For other persons engaging with FDPN: 

• • For donors and supporters: personal information including name addresses, email addresses, dates of birth, telephone numbers, bank account and credit card detail, details of donations including amount and/or frequency, communications preferences and records of any contact or correspondence you have with us.
  • For event participants: personal information including name addresses, email addresses, telephone numbers, professional affiliation, demographics, bank details, dietary, accessibility requirements, communications preferences and records of any contact or correspondence you have with us, and any opinions or information you provide.
  • For people who interact with us online via our website or social media, and who sign up to receive our email updates: personal information including name, email address, phone number, demographics, online behaviour, communications preferences, any opinions you provide and details about the information you access.

5.2.3. For community members, we may collect:  

• • Information that is reasonably necessary to assess eligibility, provide support, manage risk, verify identity, prepare referrals, comply with legal obligations, and protect the individual and the organisation.
  • Personal information including full name, previous names, and preferred names, pronouns, date of birth, place of birth, nationality, citizenship, gender as stated on documents, and gender as identified by the individual, contact and location details, including current residential address, current country of residence, phone number, email address, preferred language, interpreter needs, and lawful status or visa status in the country of current residence.
  • Information about family composition and relationships, including information about parents, siblings, children, partners, and relatives or contacts in Australia, where such information is relevant to eligibility, protection, migration history, dependency, safeguarding, or settlement considerations.
  • Immigration and displacement history, including previous visa applications, UNHCR registration, refugee status, previous asylum or resettlement applications, travel history, address history, and lawful entry and residence information.
  • Other information relevant to the humanitarian claim, including accounts of harm, persecution, discrimination, fear of future harm, inability to seek state protection, inability to safely relocate, and the basis upon which protection is sought.
  • Supporting contextual information such as employment history, education history, language skills, family background, and connections to Australia, where relevant to the case.
  • limited health or vulnerability information, including serious illness, disability, pregnancy, trauma indicators, mental health concerns, or other matters affecting safeguarding, communication, or resettlement, but only where such information is reasonably necessary.
  • character and integrity information where legally or operationally relevant, including military or police service, criminal charges or convictions, visa overstays, family violence orders, or other matters that may affect eligibility or case handling.
  • In meeting obligations with respect to the privacy of clients, FDPN will acknowledge that people with additional needs including vision or hearing impairments, and those of culturally and linguistically diverse backgrounds may require special consideration.

5.2.4. Not providing personal information

    

Some individuals may choose not to provide information to FDPN. The information requested is relevant to providing them with the care and services they need. If the individual chooses not to provide FDPN with some or all of the requested information, FDPN may not be able to provide them with the care and services they require.

 

5.2.5. Anonymity and pseudonymity

 

Individuals have the right to interact with FDPN anonymously or using a pseudonym (assumed name) unless it is impractical to provide the requested service or assistance without verifying identity or if identification is required by law or under a contractual obligation.

 

Where anonymity or pseudonymity is not feasible, FDPN will clearly explain why identification is necessary, limit the collection of personal information to only what is required, and ensure the information is handled securely and in accordance with privacy laws. Examples of when anonymity or pseudonymity applies include general enquiries, providing feedback, and accessing publicly available resources. However, anonymity or pseudonymity is not permitted when seeking to access our services for community members.

 

5.2.6. Collection of sensitive information

 

FDPN recognises that many of the categories of information it handles are highly sensitive. This includes information relating but not limited to demographic characteristics (e.g. sexual orientation, gender identity, sex characteristics, race, ethnicity, nationality, religion), experiences of violence or persecution, health conditions, political opinion, orimmigration status.

 

FDPN will not collect Sensitive Information, including Health Information, unless the collection of the information is necessary for, or directly related to our activities and functions. We will only collect sensitive information directly and with your consent, or as otherwise authorised by law.

 

Such information shall be collected only where necessary and handled with enhanced confidentiality. Access to such information shall be limited strictly to persons who require it for case handling, safeguarding, legal compliance, or direct support functions.

 

5.3. How we collect personal information

FDPN collects personal information through various channels, such as printed and electronic forms, online or digital platforms, and in-person interactions or over the telephone.

 

Personal information is collected when (but not limited to):

• • Provided directly by individuals,
  • Received from third parties and partner organisations,.
  • Received from government authorities to verify identity and service eligibility,
  • Submitted as part of documentation,
  • Shared through online interactions, including website feedback, cookies, and social media, and
  • Used for email communications, with an option to unsubscribe any time.

All information is collected lawfully and only when necessary for services and compliance.

 

5.3.1. Photo, Audio and Video Recording

 

We may collect personal information through audio, photography, or video recordings when necessary for our operations. This may occur during meetings, events, or other interactions. Where required by law, we will inform you and/or seek your consent before recording. All recordings are handled in line with the Australian Privacy Principles and applicable state and territory laws.

 

5.3.2. Personal information you provide about third parties

 

During your participation in our programs or interaction with us, you may be asked to provide personal information about other people, such as the names of personnel or employers, or family members and other dependants for community members.

 

By providing another person’s personal information, you confirm that you have brought this privacy notification to their attention.

 

5.3.3. How we deal with unsolicited personal information

 

If relevant legislation does not require FDPN to keep the unsolicited personal information, FDPN may either return, de-identify or destroy the information as soon as practicable, if it is lawful and reasonable to do so.

 

Whether FDPN notifies the sender will depend on what is reasonable in the circumstances. De-identification involves removing or altering details that could identify an individual, ensuring the information can no longer be linked to them.

 

5.4. How we use and disclose personal information

5.4.1. When community members engage with our services and programmes:

 

FDPN will use and disclose personal information only for the primary purpose for which it was collected, or for a directly related secondary purpose that the individual would reasonably expect.

 

Information may be disclosed to legal service providers, referral partners, migration or protection organisations, safeguarding authorities, regulators, or government bodies where the individual has consented, where disclosure is required or authorised by law, or where disclosure is necessary to prevent a serious threat to life, health or safety and to manage a safeguarding risk.

 

Where information is shared with a third party, FDPN will disclose only the minimum information or reasonably necessary for that purpose, with prior consent of community members.

 

FDPN will not disclose case information to sponsors, referrers, family members, community contacts, or external parties merely because they assisted the individual, unless there is lawful authority or valid consent to do so.

 

5.4.2. In our fundraising and marketing duties

 

People who engage with our website or email newsletter, and those on our donor lists, will only be contacted by FDPN for purposes related to the work of FDPN.

 

FDPN will store this information securely, and will not share, rent or sell it to any other organisation for their marketing purposes.

 

FDPN may use the information provided to communicate via social media

 

FDPN may share the information provided with our procured service providers to carry out communications and marketing on behalf of FDPN, or to complete donation transactions

 

Through the use of data, such as email address, FDPN may deliver targeted messages on social media platforms and identify other people on the Internet who are most likely to support FDPN’s work. This may require uploading a list of email addresses to social media platforms of service providers such as Facebook. These lists become encrypted upon upload and this data is not stored or reused by service providers.

 

5.5. Maintenance of personal information

We will take reasonable steps to ensure that personal information we collect, hold, use or disclose is accurate, complete and up to date.

 

5.5.1. Security and retention of personal information

 

We will take reasonable steps to store personal information securely (whether it is held in paper, electronic or any other form), protecting it from unauthorised access.

 

We will take reasonable steps to safeguard personal information collected from misuse, loss and modification. These measures will include role-based access controls, secure digital storage, password protection, multi-factor authentication for important systems, restricted access to email and document repositories, encrypted transmission where appropriate, secure destruction of paper records, and confidentiality obligations for all personnel.

 

We will destroy personal information in accordance with our professional obligations.

 

FDPN will ensure that staff and volunteers are trained in privacy and information handling and understand the particular risks associated with handling information about community members.

 

Shared accounts should be avoided wherever possible. Access to case files must be limited to those with a clear operational need.

 

5.5.2. Confidentiality of personal information

 

All employees, contractors, and volunteers at FDPN are bound by FDPN’s Privacy Policy; by state and federal privacy legislation; and by any agreement they sign with the FDPN (including any Contract of Employment, Volunteer Agreement, and/ or Confidentiality Agreement).

 

Our employees, contractors and volunteers are required not to provide information that can identify clients other than with their consent or on their instructions. This information must be kept confidential and not released into the public domain.

 

The obligations of staff and volunteers in relation to the confidential information survive after they cease working with FDPN and their obligations in relation to the confidential information shall be enforceable at any time at law or in equity and shall continue to the benefit of and be enforceable by FDPN.

 

We will ensure individuals have a right to seek access to information held about them and to correct such information if it is inaccurate, incomplete, misleading or not up-to-date, subject to exceptions permitted by law.

 

Some relevant exceptions are:

• • If providing access to the information would pose a serious and imminent threat to the life or health of any individual;
  • If providing access would have an unreasonable impact upon the privacy of other individuals; or
  • If providing access would be unlawful.

As the accuracy of information held depends largely on the information provided to us, we recommend that you:

• • Advise FDPN if there are any errors in your personal information, and
  • Keep FDPN up to date with changes to your personal information, such as name and address details.

 

5.5.4. Accuracy and quality of information

 

FDPN will take reasonable steps to ensure that the information it relies upon is accurate, complete, relevant, and up to date, especially where that information is used in case assessment, safeguarding, referral, or legal support processes.

 

Where discrepancies arise, the individual should be given an opportunity to clarify or correct the information, unless doing so would create a serious safeguarding or investigative risk.

 

5.5.5. Access to and correction of personal information

 

Subject to applicable law, individuals may request access to personal information held about them, seek correction of inaccurate information, withdraw consent to certain uses, or make a complaint about how their information has been handled.

 

FDPN may refuse access or correction where permitted by law, including where doing so would unreasonably affect the privacy of another person, prejudice an investigation, create a safeguarding risk, or conflict with legal obligations.

 

Any request or complaint must be handled promptly, fairly, and confidentially.

 

Any request should be addressed in writing to: Privacy Officer FDPN Email: admin@fdpn.org.au

 

6. Data breaches

A data breach occurs where personal information held by FDPN is lost, accessed, disclosed, altered, or destroyed without authorisation, or is otherwise compromised.

 

FDPN will maintain a data breach response procedure. Any actual, suspected, or reasonably foreseeable breach involving personal information or case records must be reported immediately to the designated Executive Director. Where a breach is likely to adversely affect the rights, safety, confidentiality, or interests of affected community member(s) or other individuals, reasonable steps will be taken to notify the affected individual(s) as soon as practicable and, where feasible, within seventy-two (72) hours of the organisation becoming aware of the breach. FDPN will assess the nature and scope of the breach, contain it where possible, evaluate the risk of harm, document the incident, and take corrective action.

 

Where required by law, including under the Notifiable Data Breaches scheme where applicable, FDPN shall notify affected individuals and the relevant regulator.

 

Given the sensitivity of FDPN’s case information related to community members, any breach involving personal information, including sensitive and health information shall be treated as high risk.

 

7. Complaints process

At FDPN, we are committed to fostering a culture that is respectful of the privacy of individuals.

 

Complaints will be handled in accordance with relevant privacy legislation. If necessary, FDPN may request that complaints be made in writing. Individuals can contact the Privacy Officer at FDPN for further assistance. We will promptly acknowledge and investigate any complaint we receive and respond in a reasonable period of time.

 

If you are not satisfied with our response, you may take your privacy complaint to the Office of the Australian Information Commissioner (OAIC). To make a complaint to the OAIC, please visit the OAIC’s website or phone 1300 363 992.