ABS Privacy Policy for Managing and Operating Our Business

We collect personal information to help manage our business operations and functions. This includes when we:

• buy goods and services
• coordinate, produce and share statistics
• handle privacy complaints and FOI requests 
• keep people, systems and buildings secure
• maintain employee records
• maintain mailing lists and subscriptions 
• manage enquiries, requests, complaints and other contact
• manage events and webinars
• process access and correction requests 
• receive submissions to consultation processes
• recruit new staff
• respond to data requests
• work with stakeholders and run consultations.

We aim to collect only the personal information we need for these activities.

Personal information we collect may include: 

• CCTV footage
• complaint information 
• contact information 
• correspondence records 
• employment and recruitment information 
• identity information 
• information about how you use our website
• payment information 
• recordings
• other information we need to carry out our business activities.

For more detailed information on the types of personal information we collect, refer to: 

• Your personal information - managing and operating our business 
• Your personal information – statistical purposes

We also go into more detail about our role as an employer in our Recruitment Privacy Statement. 

We collect personal information directly from you to support our business operations. This can include:

• as a user of ABS services
• when you apply for a job with the ABS
• when you contact us to request information or submit a complaint
• when you engage with us using communication channels, such as online forms and social media 
• when you give feedback via a consultation process.

We usually collect personal information directly from you. We may also collect it indirectly from:

• authorised representatives 
• government agencies 
• publicly available sources where lawful and appropriate
• recruitment providers 
• referees 
• service providers.

We take reasonable steps to ensure personal information is accurate, up to date, complete and relevant before we use or share it. When needed, we update our records, check information and correct any inaccuracies we become aware of.

Social Media Platforms

The ABS uses social media to communicate with members of the public and stakeholders.

We may collect personal information when you interact with us on social media. Social media providers have their own privacy policies and personal information handling practices.

We use your personal information for the reason it was collected and for related reasons permitted under the Privacy Act.

These can include:

• consulting with you on our products and statistical collections
• keeping you informed and involved in ABS activities and initiatives
• maintaining employee and recruitment records
• monitoring, recording and helping you use ABS products or services like TableBuilder or DataLab 
• obtaining goods and services
• responding to complaints, information requests and other enquiries.

We may share personal information when:

• you have given your consent
• you would reasonably expect us to share it
• the law requires or allows us to share it
• another exception under the Privacy Act applies.

For example, if you make a privacy complaint about the ABS to the Office of the Australian Information Commissioner (OAIC), we may need to share your personal information. This helps the OAIC investigate your complaint. 

The ABS does not usually share personal information with organisations outside Australia. If this happens, we take reasonable steps to ensure compliance with APP 8. We will also notify individuals where needed.

Storage

We store information in different ways, including: 

• browser storage 
• cloud storage 
• cookies
• our document and records management systems 

We store all personal information collected online on servers located in Australia. The ABS keeps control of any personal information held on those servers.

We use cookies (small files stored on your device) created both by us and third parties. If you prefer not to receive cookies, you can adjust your browser settings. If you adjust your browser settings, you may not be able to use the full functionality of the website. 

We use third-party sites such as: 

• Facebook 
• Instagram 
• TikTok
• X 
• YouTube 

These third-party sites may send their own cookies to your computer. We don’t control the setting of third-party cookies. We suggest you check the third-party websites for more information about their cookies and how to manage them. For information on how they handle your personal information, review their privacy policies. 

Security

We set high standards and take the security of your personal information seriously. We protect it from:

• interference 
• loss 
• misuse 
• unauthorised access, changes and sharing.

We keep your personal information safe with:

• access controls 
• monitoring and audit processes 
• procedures for responding to data breaches
• security assessments 
• secure environments for handling data 
• staff training.

The ABS regularly reviews its security arrangements to respond to emerging risks.  

We secure all our information in line with the Protective Security Policy Framework. Our IT systems meet the Australian Signals Directorate's (ASD) Information Security Manual requirements. 

We apply security controls such as: 

• independent security assessments 
• information technology and physical security audits 
• testing our systems to identify security weaknesses.

Keeping and deleting your information

We keep and destroy personal information in line with the Archives Act 1983. This means we will destroy your personal information when we no longer need it and are legally able to do so.

Privacy Impact Assessments 

We assess the impact of our activities on your individual privacy. These assessments are called Privacy Impact Assessments (PIAs). They help the ABS to:

• design new processes
• keep your information safe
• manage change
• minimise privacy risks 
• undertake new projects or programs.

We undertake PIAs when introducing new or changed ways of handling personal information that may present a high privacy risk. A high privacy risk arises when the way personal information is handled could seriously affect a person’s privacy.

Third-party partnerships

To help us carry out our work, we sometimes:

• contract third-party providers, such as recruitment services, IT software and applications
• engage external experts, such as independent advisers, for help and advice. 

These partners must follow the Privacy Act. They will also have their own privacy policies, processes and security protections. Where these third-parties handle personal information for us, we: 

• conduct privacy and security assessments, when needed
• make sure they protect the information in line with privacy and security standards 
• put agreements in place that set out how personal information must be handled
• take reasonable steps to make sure they follow privacy laws.

You can ask to see the personal information we hold about you and ask us to correct it if it is wrong. We will respond to requests as soon as possible and in line with the Privacy Act.

We are committed to protecting your privacy. If you believe the ABS has not protected your privacy, you can make a complaint to the ABS Privacy Officer. We will acknowledge your complaint, investigate the matter and respond.

If you submit a privacy complaint, we will:

• confirm that we have received your complaint within five working days 
• ask for more information to help with our investigation, if needed.

If the matter is complex and we need more than 60 days to investigate, we will let you know and provide an updated timeframe.

If you are not satisfied with our response to your complaint, you can request a review. The ABS Privacy Officer will undertake this review. You may also make a complaint to the Office of the Australian Information Commissioner.