1.1 In the course of our business in Australia, there may be circumstances where we collect personal information. Our privacy policy has been developed to ensure that such information is handled appropriately.
1.2 We are committed to complying with the Privacy Act 1988 (Cth) (Privacy Act) in relation to all personal information we collect. This commitment is demonstrated in this policy. The Privacy Act incorporates the Australian Privacy Principles (APPs). The APPs set out the way in which personal information must be treated.
Who does this privacy policy apply to?
1.3 This policy applies to any person for whom we currently hold, or may in the future collect, personal information.
1.4 This policy does not apply to acts and practices which relate directly to the employee records of our current and former employees.
What information does this privacy policy apply to?
1.5 In broad terms, ‘personal information’ is information or opinions relating to a particular identifiable individual.
1.6 Information or opinions are not personal information where they cannot be linked to a particular individual.
2.1 We manage the personal information we collect by:
(a) providing policies and procedures on privacy compliance for our staff;
(b) implementing procedures such as providing privacy statements when dealing with a client’s personal information;
(c) regularly reviewing our privacy compliance, including privacy audits;
(d) implementing security measures to keep the personal information we collect safe, including using unique usernames and passwords on systems that can access personal information, security cards and personal identification numbers to limit access on-site information; and
(e) appointing a designated privacy officer to monitor privacy compliance and be a contact for any privacy complaints and access or correction requests.
2.2 In limited circumstances, it may be possible for an individual to use a pseudonym or remain anonymous when dealing with us. If an individual wishes to use a pseudonym or remain anonymous they should notify us when making first enquiries or providing initial instructions. We will use our best endeavours to deal with the individual as requested, subject to our professional obligations and ability to perform the legal service without using the individual’s name. In most cases, our professional obligations will require the individual to deal with us using their real name.
2.3 We must comply with our professional obligations (including confidentiality obligations) in dealing with an individual’s personal information at all times.
3.1 We are a diverse law firm operating across the full spectrum of commercial and property law and litigation and hold different information depending on the legal services provided to clients or, in the case of prospective employees, the information needed to assess future employment with us. Generally, the types of information that we may collect and hold include:
(a) contact information;
(b) financial information;
(c) business circumstances;
(d) family circumstances;
(e) information about assets and investments;
(f) employment history;
(g) date and place of birth;
(h) banking and credit card details;
(i) tax file numbers;
(j) driver’s licence and other photographic information;
(k) video or photographic footage or text messages given by clients to us for legal advice;
(l) information otherwise required by law; and
(m) any other personal information required to perform legal services to the individual.
3.2 Where possible, we will only collect the personal information required to provide legal services to the individual, or as required by our professional obligations.
4.1 ‘Sensitive information’ is a subset of personal information and includes personal information that could have serious ramifications for the individual concerned if used inappropriately.
4.2 The sensitive information that we collect and hold about an individual will include any information necessary to provide legal services or future employment to the individual. This may include:
(a) health information;
(b) racial or ethnic origins;
(c) political opinions and membership of political associations;
(d) sexual preferences or practices;
(e) criminal records;
(f) any sensitive information required to be disclosed by law; and
(g) any other sensitive information required to perform the legal service to the individual.
4.3 We will not collect sensitive information without the individual’s consent to which the information relates unless permitted under the Privacy Act.
5.1 Where reasonable and practicable, we will collect personal information directly from the individual to whom the personal information relates.
5.2 However, we have a large referral network and also collect personal information from numerous other sources. It is not possible to provide an exhaustive list of these sources, but they may include:
(a) professional advisors or agents for individuals who we act for;
(b) banks and financial institutions;
(c) government bodies;
(d) businesses about their current or former employees, contractors, customers or suppliers;
(e) barristers and other solicitors;
(f) recruitment and other professional service agencies; and
(g) from paid search providers.
6.1 We hold personal information:
(a) physically:
(i) on our premises; and
(ii) by a third party storage provider in Queensland;
(b) electronically:
(i) on an internal server;
(ii) on electronic storage devices, including DVD and USB;
(iii) on a backup server in Queensland, maintained by our third party IT provider; and
(iv) with a third party cloud provider in Australia.
6.2 It is also possible that we may store information in a private cloud in the future. We will not store information in a private cloud unless we are satisfied with the security and safety of the relevant cloud provider.
6.3 We will take all reasonable steps to ensure that all personal information we hold is secure from any unauthorised access, misuse or disclosure. However, we do not guarantee that personal information cannot be accessed by an unauthorised person (e.g. a hacker) or that unauthorised disclosures will not occur.
6.4 Some of the methods we use to store and secure information include:
(a) using security cards to access areas that contain personal information;
(b) using individual personal identification numbers to access photocopiers;
(c) using unique usernames, passwords and other protections on systems that can access personal information; and
(d) using our document retention system (authorised access only) for important documents such as Wills and other original documents.
7.1 We take reasonable steps to use and disclose personal information for the primary purpose for which it is collected. The primary purpose for which information is collected varies, depending on the particular service being provided, but is generally to provide legal advice and services to an individual or their business.
7.2 In the case of potential employees, the primary purpose the information is collected is to assess the individual’s suitability for a position with us.
7.3 Personal information may also be used or disclosed by us for secondary purposes which are within the individual’s reasonable expectations and related to the primary purpose of collection.
7.4 For example, we may use personal information for the following secondary purposes:
(a) to add an individual’s details to our legal alerts list, to inform the individual of updates and changes to the law that may affect them and to invite them to legal events relevant to their industry (which can be unsubscribed from at any time); or
(b) to provide a referral;
(c) as an intermediary; or
(d) for audit purposes.
7.5 We may disclose personal information:
(a) to other service providers or referral partners, in order to provide the legal service to the individual (for example, other solicitors, barristers, experts, accountants, as the context of the legal service requires);
(b) with the consent of the individual to whom the information relates;
(c) to government agencies;
(d) to banks and other financial institutions with your consent;
(e) to related entities with the consent of the individual to whom the information relates; and
(f) to third party contractors where we contract out any financial, administrative, information technology or other services.
7.6 Otherwise, we will only disclose personal information to third parties with the relevant individual’s consent or if the disclosure is permitted by the Privacy Act.
8.1 We do not disclose personal information to overseas recipients apart from our email filtering host that is headquartered in Ireland.
9.1 We do not use an individual’s personal information to assess their credit eligibility. However, during the course of providing the legal service to the individual, we may collect credit information that is necessary to provide them with the legal service. What kinds of credit information may we collect?
9.2 The main kind of credit information we collect is an individual’s identification information.
9.3 However, in the course of providing legal services to you, we may be given (and subsequently hold) the following other kinds of credit information:
(a) information about any credit that has been provided to you;
(b) your repayment history;
(c) information about your overdue payments;
(d) if terms and conditions of your credit arrangements are varied;
(e) if any court proceedings are initiated against you in relation to your credit activities;
(f) information about any bankruptcy or debt agreements involving you;
(g) any publicly available information about your credit worthiness; and
(h) any information about you where you may have fraudulently or otherwise committed a serious credit infringement.
9.4 We do not collect your credit information from credit reporting bodies, banks or other credit providers unless it is necessary to provide you with the legal service or you have expressly asked us to.
How and when do we collect credit information?
9.5 In most cases, we will only collect credit information about you if you disclose it to us and it is relevant in providing you with the legal service.
9.6 Other sources we may collect the credit information from include:
(a) banks and other credit providers;
(b) other individuals and entities via referrals; and
(c) your suppliers and creditors.
9.7 However, in most cases you will be aware that this information is being collected as part of the legal service we are providing to you.
How do we store and hold the credit information?
9.8 We store and hold credit information in the same manner as outlined in section 6 of this policy. Why do we collect the credit information?
9.9 Our usual purpose for collecting, holding, using and disclosing credit information about you is to enable us to provide you with the legal service.
9.10 We may also collect credit information to process payments.
Overseas disclosure of the credit information
9.11 We will not disclose your credit information to overseas entities unless you expressly advise us to, apart from the following circumstances:
(a) to the extent that your credit information is contained in emails which are filtered by our email filtering host that is headquartered in Australia; or
(b) to the extent that it is necessary or desirable to make such a disclosure to obtain payment of money owed to us. How can I access my credit information, correct errors or make a complaint?
9.12 You can access and correct your credit information, or complain about an interference with your privacy in the same manner as set out in section 10 of this policy.
10.1 It is important that the information we hold about you is up-to-date. You should contact us if your personal information changes.
Access to information and correcting personal information
10.1 You may request access to the personal information held by us or ask us for your personal information to be corrected by using the contact details in this section.
10.2 We will grant you access to your personal information as soon as possible, subject to the request circumstances.
10.3 We may deny access to personal information if:
(a) the request is unreasonable;
(b) providing access would have an unreasonable impact on the privacy of another person;
(c) providing access would pose a serious and imminent threat to the life or health of any person;
(d) providing access would compromise our professional obligations; or
(e) there are other legal grounds to deny the request.
10.4 We may charge a fee for reasonable costs incurred in responding to an access request. The fee (if any) will be disclosed prior to it being levied.
10.5 If the personal information we hold is not accurate, complete and up-to-date, we will take reasonable steps to correct it so that it is accurate, complete and up-to-date, where it is appropriate to do so.
Complaints
10.6 If you wish to complain about an interference with your privacy, then you must follow the following process:
(a) The complaint must be firstly made to us in writing, using the contact details in this section. We will have a reasonable time to respond to the complaint.
(b) In the unlikely event the privacy issue cannot be resolved, you may take your complaint to the Office of the Australian Information Commissioner.
Who to contact
10.7 A person may make a complaint or request to access or correct personal information about them held by us. Such a request must be made in writing to the following address:
Contact person: Privacy Officer (Practice Manager)
Telephone number: +61 7 5556 7400
Email address: osheay@hickeylawyers.com.au
Postal address:
PO Box 5559, Gold Coast Mail Centre, Bundall, Queensland 9726
11.1 We may update, modify or remove this policy at any time without prior notice. Any changes to the privacy policy will be published on our website.
11.2 This policy was last updated in October 2019. If you have any comments on the policy, please contact our privacy officer on the contact details in section 10 of this policy.
