Privacy

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.  

Special provisions apply to the collection of personal information which is sensitive such as health information and information about a person's race, ethnic origin, political opinions, membership of political, professional or trade associations, religious or philosophical beliefs, sexual preferences and criminal history.

What personal information does the NTC collect?

In the course of business, the NTC may collect personal information that is reasonably necessary for, or directly related to, our functions or activities.  The NTC will only collect personal information by lawful and fair means and not in an unreasonably intrusive manner. 

The NTC may collect personal information about:

• persons who contact the NTC in relation to its activities and services
• persons who participate in any public consultations, reform proposals, surveys or market research conducted by or on behalf of the NTC
• subscribers to publications of the NTC (such as newsletters, news releases and reports)
• third parties providing a service to the NTC
• employees, contractors and consultants of the NTC.

Our functions and activities and our range of services may change from time to time.

The types of personal information we may collect and hold may vary depending on the nature of our interaction with the individual and may include:

• identifying and contact information (for example, name, address, date of birth, email address and emergency contact details
• responses or submissions to any consultations, reform proposals, surveys or market research of the NTC
• bank account, tax file number and credit card details
• information relating to employment or engagement by the NTC including education and qualifications, superannuation details, insurance details and results of psychometric testing, reference checks, police checks and ergonomic assessments.

Through our website, we may also collect de-identified information about a user’s computer which may include IP address, type of browser, operating system, domain name and the details of any website which has referred the user to the NTC's website.  We may also collect de-identified information about the user’s activities on our website (for example, tracking which areas of the website are visited and the content viewed).

Why does the NTC collect personal information?

The Privacy Act generally requires the NTC to use personal information only for the primary purpose for which it is collected, or for secondary purposes which are related (or directly related in the case of sensitive information) to the primary purpose.

In general, the NTC collects, holds, uses and discloses personal information for the following purposes:

• to consider, develop and deliver regulatory and operational reform in respect of Australia's road, rail and intermodal transport systems including conducting public consultations, surveys and research, reviewing and publishing submissions and forming final recommendations/positions for consideration by the Infrastructure and Transport Ministers' Meetings (previously the Transport and Infrastructure Council)
• if requested, to provide copies of our publications (such as newsletters, news releases and reports)
• to manage our relationship with stakeholders including members of the public, responding to queries or requests, and for follow up purposes
• to verify and update any personal information held by us
• to recruit and manage personnel (including employees, contractors and consultants)
• to review, develop and improve our functions and activities and business processes including our website
• to comply with legal or regulatory obligations
• for other purposes required or authorised by or under law, including purposes for which we have obtained express or implied consent.

If anyone provides the NTC with their email address, telephone and/or mobile phone number, they also consent to the NTC using that email address, telephone and/or mobile phone number for contact purposes (including by telephone call, SMS or email) for any of the above reasons.

How does the NTC collect personal information?

The NTC may collect personal information in a number of ways, including

• through our website, submissions made to the NTC, forms and correspondence (written and verbal) received
• from third parties such as persons or organisations engaged by the NTC to assist the NTC in carrying out its business processes such as ergonomic assessment providers, market researchers and recruitment organisations.

How does the NTC store personal information?

The NTC will store personal information securely in its systems providing restricted access to staff for work purposes only. The personal information is maintained and disposed in accordance with the NTC’s information management policy.  

To whom may the NTC disclose personal information?

To carry out the above purposes, the NTC may disclose personal information:

• to the public through publishing submissions on our website (unless requested not to publish online or to only publish online on an anonymous basis)
• to the Infrastructure and Transport Ministers' Meetings (previously the Transport and Infrastructure Council) when forming final recommendations/positions on a public consultation matter (although the NTC typically prepares such recommendations and submissions in a de-identified form)
• to persons or organisations engaged by the NTC to assist the NTC in carrying out its business processes such as online survey platform providers, enews providers, recruitment organisations, website developers, IT support providers, compliance program providers, record management system providers, insurers and professional advisors
• for other purposes required or authorised by or under law or to comply with legal or regulatory obligations. 

Does the NTC transfer personal information overseas?

The NTC may disclose personal information to service providers located overseas including online survey platform providers located overseas.  

If the NTC transfers personal information to another party outside Australia, we will take such steps as are reasonable in the circumstances to ensure that the overseas recipient will not breach the privacy principles set out in the Privacy Act in relation to the information.

The NTC also utilises Google Analytics in the USA to provide us with information, reports and analysis about the usage and browsing patterns of users of our website.  All information provided is de-identified.

Marketing

The NTC may use personal information for contact purposes (including by telephone call, SMS or email) in relation to publications, surveys, notifications about public consultations or other such initiatives.   

Opting-out of receiving such marketing information from the NTC can be done at any time by contacting us using the contact details which appear immediately below under the heading "How can you access or correct your personal information and contact the NTC?" or clicking the unsubscribe link found at the bottom of any electronic newsletter, news alert or promotional email that may be received from us.

How can personal information be accessed and/or corrected?

Contact the NTC’s Privacy Officer – see contact details section – to seek access to or request that we correct personal information held by the NTC.

The NTC will generally provide access to personal information if practicable, and will take reasonable steps to amend any inaccurate or out-of-date personal information.  In some circumstances and in accordance with the Privacy Act, the NTC may not permit access, or may refuse to correct personal information, in which case reasons will be provided for this decision.

The access and correction requirements in the Privacy Act operate alongside and do not replace other informal or legal procedures by which access to, or correction of, personal information can be made including the Freedom of Information Act 1982 (Cth).

What happens if personal information is lost or subjected to unauthorised access, modification, disclosure or other misuse?

Following a risk assessment, the NTC will invoke its notifiable data breach plan and will notify affected individuals where the breach has been assessed as likely to cause a real risk of serious harm to the individual.  

Notification will include:

• The description of the incident
• Type of personal information involved
• The NTC’s response to the breach
• What assistance is available to those affected
• How to lodge a complaint to the NTC or the Office of the Australian Information Commissioner (OAIC)

How to make a complaint

Any concerns or complaints about the manner in which personal information has been collected or handled by the NTC, should be advised to the NTC in writing to the NTC’s Privacy Officer – see contact details section. Concerns or complaints will be considered or investigated and will be responded to within 30 days from the day of request.

Any complaint not resolved to the complainant’s satisfaction can be referred to the Office of the Australian Information Commissioner who may investigate the complaint further.

The Privacy (Australian Government Agencies — Governance) APP Code 2017 (APP Code) requires all agencies to conduct a privacy impact assessment for all high-risk privacy projects.

A project is considered a high-risk privacy project if we consider that it involves any new or changed ways of handling personal information which is likely to have a significant impact on the privacy of individuals.

From 1 July 2018, the NTC is required by the APP Code to maintain and publish a register of all PIAs.

NTC’s PIA register lists all PIAs conducted by us since 1 July 2018.

This table will be updated as privacy impact assessments are released.

Last updated: 9 June 2023.

NTC Privacy Officer

• Executive Leader, Business and Resources
• enquiries@ntc.gov.au
• +61 3 9236 5000
• Level 3/600 Bourke Street Melbourne VIC 3000

More information about the application of the Privacy Act is available on the Office of the Australian Information Commissioner website.

Changes to our Privacy Policy

This Privacy Policy is effective from January 2018.