Privacy policy
Human Rights
Decision makers must act and make decisions in a way that is compatible with human rights. They must consider human rights in any decision, as required by section 58 of the Human Rights Act 2019 (Qld). Refer to the Human rights section on the for government employees website, or visit www.forgov.qld.gov.au/humanrights
Purpose
The Queensland Small Business Commissioner and Office of the Queensland Small Business Commissioner (collectively referred to as the QSBC) are subject to Queensland's Information Privacy Act 2009 (IP Act) and its Queensland Privacy Principles (QPPs), which set out how the QSBC must handle personal information. At times, and in relation to certain types of information, the QSBC may also have privacy obligations under the Privacy Act 1988 (Cth) and its Australian Privacy Principles (APPs). The APPs are similar in operation to the QPPs.
We are committed to protecting individuals' privacy, and we value the open, transparent and responsible handling of personal information. This privacy policy explains how QSBC collect and manage your personal information, including:
- the kinds of personal information QSBC collect and hold
- how QSBC collect and hold personal information
- the purposes for which QSBC collect, hold, use and disclose personal information.
- how you can access or amend your personal information
- how you can complain about QSBC’s handling of your personal information, and how we will deal with the complaint.
Scope
This policy applies to:
- All employees working for the QSBC, regardless of whether they are permanent, fixed-term temporary, full-time, part-time or casual employees, on a fixed term contract and/or on secondment from another department or participating in a mobility arrangement. It also applies to other persons who perform work for the QSBC, including contractors, students gaining work experience and volunteers. For the purposes of this policy, the term contractor includes on-hired temporary labour services (agency staff).
- All personal information collected by the QSBC, and all personal information in our possession or under our control.
All employees, contractors, students and volunteers working for the QSBC are responsible for collecting and managing personal information in accordance with this policy and associated policies.
This policy does not apply to:
- Mediation service providers, these providers abide by the privacy clause within their Standing Offer Arrangement agreements.
Collection of Personal Information
Personal information is defined as information about an identified (or reasonably identifiable) individual.
Why do we collect personal or sensitive information?
We collect personal information when it is reasonably necessary for, or directly related to, performing our functions and providing our services.
These functions and services include:
- assisting parties in reaching an informal resolution for small and family business disputes, including by facilitating the exchange of information between the parties
- providing alternative dispute resolution services and administering a mediation process for small and family business disputes
- advocating on behalf of small and family businesses to the State, the Commonwealth, another State or a local government; or any other entity involved in administering a matter relevant to small and family businesses.
You can find more information about our functions and services under:
- the "About Us” section of our homepage.
We also collect personal information to carry out our business functions, e.g. human resources management and recruitment processes.
How do we collect personal or sensitive information?
The QSBC may collect your personal information by various means, including in writing, by making a record of information provided to us verbally, through audio-visual recording or by other technical means. QSBC will only collect your personal information by lawful and fair means.
Generally, we will only collect personal information directly from you. However, we may collect your personal information from someone other than you if:
- you consent to the collection, or
- it's unreasonable or impractical for us to collect the information from you, or
- the collection is required or authorised under Australian law or a court or tribunal order; or
- you are listed as ‘the other party’ in an application for mediation.
When we collect your personal information from you or someone else, or as soon as possible afterwards, we will take reasonable steps to advise you of (or ensure that you're aware of) the details of the collection as required under QPP 5.
If your information is provided to the QSBC via an application for mediation, the applicant has agreed for the QSBC to provide you with the application details and any other relevant information or documents. This agreement is provided at the time of application.
Sensitive information
QSBC will only collect your sensitive information with your consent, unless the collection is authorised or required by law, or otherwise allowed under the IP Act.
The kinds of personal information the QSBC collect and hold
The kinds of personal information (including sensitive information) that we collect and hold include:
- name
- contact details (email address, physical address, telephone number)
- leasing information (including financial information)
- dispute details (including financial information).
Use and disclosure of personal information
The QSBC use and (where applicable) disclose your personal information to perform our functions, in accordance with our privacy obligations.
Generally, we will only use or disclose your personal information for the purpose for which it was collected, including:
- performing our functions and providing our services as described in the preceding section of this policy
- managing associated business processes, such as recruitment and human resources
administration.
We may also use or disclose personal information for secondary or alternative purposes as permitted under the IP Act. This may include where we are authorised or required under Australian law, with your consent, or where you would reasonably expect us to use or disclose it for a related – or in the case of sensitive information, directly related – secondary purpose.
When applying for mediation, the applicant consents to the below disclosures before submitting their application:
- the QSBC sharing the application for mediation and any other relevant information or documents with the other party
- the QSBC sharing the application for mediation and any other relevant information or documents with a QSBC Mediator and/or the Queensland Civil and Administrative Tribunal
- the QSBC collecting, sharing, disclosing and using your personal and other information (such as name, email address, telephone number, leasing information and dispute details) provided in this form to administer mediation services and provide dispute resolution services. You consent to your personal and other information being shared with other Queensland Government departments or agencies including agencies providing services for Queensland Government departments, to provide information and services to you.
Access to and amendment of personal information
If you want to access or amend personal information that we hold about you, you should contact the QSBC via commissioner@qsbc.qld.gov.au.
If the QSBC are unable to comply with your request, you may submit a formal access or amendment application to us under the Right to Information Act 2009. For further information, please refer to our Right to Information page.
Disclosure of personal information outside of Australia
The QSBC will only disclose your personal information overseas with your agreement, unless the disclosure is authorised or required by law, or otherwise allowed under the IP Act.
The QSBC would generally disclose personal information overseas only when necessary to fulfil our functions and provide our services. For instance, where a customer or complainant is overseas.
However, when you communicate with us via our social media channels, the social media providers and their partners may collect and hold your personal information overseas.
Dealing with the QSBC anonymously or using a pseudonym
You may engage with the QSBC anonymously or by using a pseudonym (a nickname or screen-name), and we will provide you with the option of doing so, unless:
- QSBC are required or authorised under Australian law, or a court or tribunal order, to deal with individuals who have identified themselves, or
- it is impractical for us to deal with individuals who have not identified themselves or who have used a pseudonym.
For example, QSBC can't engage with you anonymously or under a pseudonym in relation to (but not limited to):
- applications for employment
- applications for mediation
- dispute assistance requests
- discussing your personal information with you, and/or giving you access to your personal information
- certain types of complaints (e.g. privacy complaints).
Where the QSBC are required or authorised to engage with you as an identified individual, or where it's impractical for us to provide you with the option of engaging with us anonymously or under a pseudonym, we will collect only the minimum amount of personal information required to identify you, as relevant to the circumstances.
Security and retention of personal information
We hold personal information securely and we take reasonable steps to protect it from misuse, interference, loss, unauthorised access, modification or disclosure. We comply with the Queensland Government Information and cyber security policy (IS18) and the Department of Customer Services, Open Data and Small and Family Business Information Security Policy to protect personal information and ensure it can be accessed by authorised staff members only.
Data breaches
A data breach refers to any circumstance in which either of the following has occurred:
- unauthorised access to, or unauthorised disclosure of, information
- the loss of information in circumstances where unauthorised access to, or unauthorised
disclosure of, the information is likely to occur.
A data breach may or may not involve personal information. Where a data breach involves personal information, and where this is likely to result in serious harm to the individual/s whose information it is, this is known as an 'eligible data breach'. Except in limited circumstances, we are required to notify affected individuals and the appropriate privacy regulator of an eligible data breach.
We will manage data breaches, including eligible data breaches, in accordance with our Data Breach Policy.
Privacy complaints
If you believe that we've failed to handle your personal information appropriately, you can make a privacy complaint.
You can only make a privacy complaint on behalf of another person if:
- they have authorised you to do so
- they are a minor/child, and you are their parent or guardian
- they lack capacity and you are their guardian
- you have other legal authority to act for them.
To make a privacy complaint to the QSBC, you must send your complaint to us in writing and include:
- an address for QSBC to respond to you (e.g. an email address)
- details about the matter or issues you're complaining about (e.g. what we did, or what we failed to do, with your personal information that you believe has breached our obligations under the QPPs and the IP Act).
You must send your complaint to us within 12 months of becoming aware of the act or practice you think constitutes a breach of our obligations under the QPPs and the IP Act. If you're making a privacy complaint on behalf of someone else, please include an authority from them or other evidence (e.g. a birth certificate showing that they are a minor/child and you are their parent).
Contact address for submitting privacy complaints
Email
commissioner@qsbc.qld.gov.au
Post
Queensland Small Business Commissioner
c/o Department of Customer Services, Open Data and Small and Family Business
PO Box 15086
CITY EAST QLD 4002
Timeframe for handling privacy complaints
Under the IP Act, QSBC have 45 business days to respond to your privacy complaint. If we need additional time to respond to your complaint, we will ask you before the end of the 45-business-day period.
If you don't receive a response to your complaint within the response period, or if you're not satisfied with our response, you may refer your complaint to the Office of the Information Commissioner (OIC). For further information, please refer to OIC's Make a privacy complaint page.
References
The requirements set out in this policy are based on, and are consistent with, relevant government legislation, regulations, directives, information standards and/or policies at the time of publication.
Legislation and regulations
Queensland Government policy
CDSB policy