APRA's Privacy Policy

Policy statement

Purpose

The purpose of this policy is to:

• provide guidance to Australian Prudential Regulation Authority (APRA) staff, secondees  and contractors (APRA staff) on the Privacy Act 1988 (Privacy Act) and the Australian  Privacy Principles (APPs) specifically on the collection, storage and use of personal and sensitive information;
• clearly communicate to APRA staff and the public a better understanding of the sort of personal and sensitive information that APRA holds and APRA's information handling practices; and
• enhance the transparency of APRA's operations in relation to holding personal and sensitive information including the notification of eligible data breaches as required under the Privacy Act.

This policy applies to both paper and digital records.

Policy

APRA is the prudential regulator of the Australian financial services industry. It oversees authorised deposit-taking institutions (such as banks, building societies and credit unions), general insurers, life insurers, friendly societies, private health insurers, reinsurance companies, and most of the superannuation industry. APRA also acts as a national statistical agency for the Australian financial sector. 

APRA collects, stores and uses a variety of personal and sensitive information in a number of capacities, including as the prudential regulator, a government agency and as an employer and contractor. The APPs set out standards, rights and obligations in relation to the collecting, handling, holding, accessing and correcting of personal and sensitive information. 

The APPs require the collection of personal and sensitive information about an individual only from the individual unless it is unreasonable or impracticable to do so. 

APRA as the prudential regulator has collection powers that apply to regulated entities. Personal and sensitive information about an individual will normally be collected from regulated entities and will not be collected from the individual as it is unreasonable or impracticable to do so. APRA in its capacity as an employer and a contractor will obtain personal and sensitive information about an individual from that individual unless it is unreasonable or impracticable to do so.

APRA is committed to: 

• having access to the appropriate information, including personal and sensitive information, to enable APRA to fulfil its prudential regulatory remit and its obligations as an employer, contractor and Australian Government agency; 
• ensuring that personal and sensitive information held is accurate and securely maintained; and 
• ensuring individuals have a means to access and, if necessary, request the correction of personal and sensitive information held by APRA

To support this commitment, APRA has an appropriate framework to monitor and manage personal and sensitive information.

Personal information is defined in the Privacy Act to mean: 

‘information or an opinion about an identified individual, or an individual who is reasonably identifiable: 

• whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not’.

Sensitive information is defined to mean: 

1. information or an opinion about an individual’s:
2. racial or ethnic origin; or
3. political opinions; or
4. membership of a political association; or
5. religious beliefs or affiliations; or
6. philosophical beliefs; or
7. embership of a professional or trade association; or
8. membership of a trade union; or
9. sexual orientation or practices; or
10. criminal record;

that is also personal information; or

1. health information about an individual; or
2. genetic information about an individual that is not otherwise health information; or
3. biometric information that is to be used for the purpose of automated biometric  verification or biometric identification; or
4. biometric templates

The following principles guide the management by APRA of personal and sensitive information collected: 

1. Personal and sensitive information is collected as part of APRA’s: - prudential regulation – information is only collected when it is reasonably necessary and directly related to prudential supervision; - responsibilities as an Australian Government agency; and - role as an employer and a contractor.
    
2. Individuals, other than APRA staff, have the option of not identifying themselves, or of using a pseudonym when dealing with APRA. Individuals must be identified when required by a prudential framework law.¹
    
3. APRA staff have the option of not identifying themselves or using a pseudonym when making a public interest disclosure.
    
4. Unsolicited personal and sensitive information will only be kept if it is relevant to APRA’s activities; and then only in accordance with the Archives Act 1983.
    
5. Personal and sensitive information collected during a prudential review will be primarily used for APRA prudential regulation and enforcement-related activities both within Australia and, if necessary after the appropriate safeguards are put in place, overseas, and will ordinarily not be disclosed to external parties.
    
6. APRA will take the necessary reasonable steps to ensure that both personal and sensitive information collected as part of APRA’s activities as an employer and contractor is kept accurate, up-to-date, complete and relevant.
    
7. APRA will protect personal and sensitive information collected in its activities:
    
   • from misuse, interference and loss; and
      
   • from unauthorised access, modification and disclosure
      
8. In the unlikely event that an information data breach occurs, APRA must provide notification of the breach to the Office of the Australian Information Commissioner (OAIC) if it is an eligible data breach under the Privacy Act.
    
9. Where it holds information about an individual, APRA will give that individual access to that information, except where: 
   • the information is protected under section 56 of the Australian Prudential Regulation Authority Act 1998 (APRA Act);
      
   • access can be refused under the Freedom of Information Act 1982 (FOI Act) when appropriate; or
      
   • giving access would be likely to prejudice APRA’s enforcement-related activities

Personal and sensitive information that APRA collects is used:

• for prudential regulation and enforcement activities in respect of the Australian financial services industry;
• to respond to requests under the FOI Act or Privacy Act;
• to provide information to those requesting to be on an APRA mailing list;
• to employ staff, engage contractors and maintain the operations of APRA in compliance with legislation, rules and guidelines;
• to answer inquiries and process complaints made to APRA or respond to inquiries from the Commonwealth Ombudsman; and
• in correspondence with overseas regulators. 

The Chief Security Officer has been delegated authority to approve minor revisions to this policy statement and to approve any standards, procedures and guidelines that are required to support this policy.

Procedure

Purpose

The purpose of the Procedures is to support the Privacy Policy.

The APPs guide the implementation and conduct of this procedure

Background

The purposes for establishing APRA are set out in section 8 of the APRA Act, which states: 

1. APRA exists for the following purposes: 
   
   1. regulating bodies in the financial sector in accordance with other laws of the Commonwealth that provide for prudential regulation or for retirement income standards;
   2. administering the financial claims schemes provided for in the Banking Act 1959 and the Insurance Act 1973; 
   3. developing the administrative practices and procedures to be applied in performing that regulatory role and administration.
       
2. In performing and exercising its functions and powers, APRA is to balance the objectives of financial safety and efficiency, competition, contestability and competitive neutrality and, in balancing these objectives, is to promote financial system stability in Australia.

APRA is an Australian Government agency that employs staff and engages contractors. 

In fulfilling its purposes, APRA consults with a number of bodies including:

• regulated entities or the representatives of regulated entities;
• other Government agencies;
• other organisations with which APRA has entered into a Memoranda of Understanding;
• certain overseas regulators and other international bodies involved in prudential regulation policy development; 
• members of the public; and
• the OAIC, regarding matters that relate to Privacy Act and Freedom of Information Act functions. 

The list of Memoranda of Understanding that APRA has entered into is available on APRA’s website.²

Collection and use of personal and sensitive information

1. Collection and use of personal and sensitive information as the prudential regulator and Australian Government agency 

APRA only collects and uses personal and sensitive information for purposes that are directly related to its functions or activities, and only when exercising its powers as the prudential regulator and as an Australian Government agency and it is necessary for or directly related to such purposes. 

Personal and sensitive information is collected from individuals, third parties, Commonwealth, State, Territory and overseas agencies, and public sources. Personal and sensitive information is collected:

• under prudential regulation framework laws;
• under other relevant legislation;
• for law enforcement purposes; or
• for the purposes of APRA’s operations

APRA’s collection and use of personal and sensitive information is carried out by lawful and fair means, by exercising its powers and duties to prudentially regulate the financial sector, administer the Financial Claims Schemes provided for under the relevant Acts and develop the administrative practices and procedures to be applied in performing APRA’s role as an Australian Government agency.

APRA collects and uses personal and sensitive information:

• where it is required, authorised or for the purpose of a ‘prudential regulation framework law‘³ ;
   
• where it is required or authorised in any regulation or statutory instrument made under the relevant Acts;
   
• where it is required or authorised under the:
  • Privacy Act 1988;
     
  • Freedom of Information Act 1982; and
     
  • Public Governance, Performance and Accountability Act 2013, Rules and guidelines;
     
• other relevant Commonwealth legislation and guidelines;
   
• from consultations APRA conducts. Personal and sensitive information may be collected as part of the consultation process. APRA publishes all submissions on the APRA website unless a respondent expressly requests APRA in writing that all or part of a submission is to remain in confidence. Such information will not be released unless APRA is under a legal obligation to do so;
   
• from responses to inquiries and complaints made to APRA;
   
• from requests to be on mailing lists to provide information about APRA’s activities; and
   
• from information required to be collected and used as a Government agency. \

APRA’s Annual Report contains further information about APRA’s collection, handling and disclosure of personal information. APRA’s Annual Reports are available on APRA’s website.

2. Collection and use of personal and sensitive information of staff, secondees and contractor information

APRA collects and uses personal and sensitive information about its staff, secondees and contractors (and applicants for those positions) for personnel, security and related purposes. That collection is authorised by:

Commonwealth laws, including:

• APRA Act;
  • Safety, Rehabilitation and Compensation Act 1988;
  • Work Health and Safety Act 2011;
  • Long Service Leave (Commonwealth Employees) Act 1976;
  • Maternity Leave (Commonwealth Employees) Act 1973;
  • Paid Parental Leave Act 2010; - Superannuation Act 1976;
  • Superannuation Act 1990;
  • Superannuation Benefits (Supervisory Mechanisms) Act 1990;
  • Superannuation Guarantee (Administration) Act 1992; 
  • Superannuation Productivity Benefit Act 1988; and
     
• other government guidelines and directions.

The personal information relates to the employee, secondee or contractor and may include:

• applications for employment including the employee’s résumé; statements addressing the assessment criteria for positions applied for, psychometric assessment reports utilised throughout the selection process and referees’ reports; 
• written tasks undertaken by the potential employee during the selection process for positions applied for; 
• notes from the selection committee during the selection process;
• the employee’s employment and contractor’s contract, and other records relating to their terms and conditions of employment and engagement;
• details of personal interests and their immediate family members supplied by some employees for the purpose of managing perceived or potential conflicts of interest;
• copies of academic qualifications;
• records relating to the employee’s salary, benefits and leave;
• medical certificates or health-related information supplied by an employee, their medical practitioner, or obtained by APRA through an independent medical examination;
• contact details; 
• taxation details;
• superannuation contributions; and 
• information relating to the employee’s training and development, and pay and performance reviews.

Personnel and sensitive information of APRA staff, secondees and contractors is disclosed to Commonwealth agencies, law enforcement agencies, health providers and advisors, and other persons authorised by Commonwealth, State or Territory law to receive it. It is also disclosed to other entities to whom a person gives APRA consent to disclose personal and/or security information.