1.1 The National Centre for Vocational Education Research Limited (NCVER), ABN 87 007 967 311, is a not-for-profit company owned by the Commonwealth and state and territory ministers with responsibility for vocational education and training (VET). It is the official collection agency for VET statistics. Its major role is research and compilation of statistical collections. Widely disseminating this information is an important responsibility. NCVER also undertakes commercial consultancy services.
1.2 NCVER complies with the Privacy Act 1988 (Commonwealth). This policy describes how NCVER collects, manages, uses, discloses, protects, and disposes of personal information in accordance with the thirteen Australian Privacy Principles (APPs) outlined in Schedule 1 of the Privacy Amendment (Enhancing Privacy Protection) Act 2012.
2.1 Under the Privacy Act 1988 and Privacy Amendment (Enhancing Privacy Protection) Act 2012 (s6(1)), personal and sensitive information is defined as follows:
- Personal information: “information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not.”
- Sensitive information: “(a) information or an opinion about an individual’s: (i) racial or ethnic origin, or (ii) political opinions, or (iii) membership of a political association, or (iv) religious beliefs or affiliations, or (v) philosophical beliefs, or (vi) membership of a professional or trade association, or (vii) membership of a trade union, or (viii) sexual preferences or practices, or (ix) criminal record, that is also personal information; or (b) health information about an individual; or (c) genetic information about an individual that is not otherwise health information; or (d) biometric information that is to be used for the purposes of automated biometric verification or biometric identification; or (e) biometric templates”.
3. Collection, use and disclosure of personal information
3.1 NCVER operates within a multi-layered authorising environment, including the Australian and state and territory governments, together with industry and registered training providers. NCVER’s mandate is to ensure that its outputs add maximum value to the VET system by aligning its research and statistical services to inform and influence decisions of government, industry and providers.
3.2 Under the authority of ministers responsible for education and training, and the registration requirements legislated for training providers under national VET regulation, NCVER collects, manages, analyses, evaluates and communicates research and statistics about VET and the links between education and the labour market more generally. Research is undertaken against ministerial-endorsed priorities.
Collection and use
3.3 NCVER collects personal information, either directly or indirectly, that is reasonably necessary for, or directly related to its functions and activities. Some of the information collected may be regarded as ‘sensitive’ as defined by the Privacy Act. In broad terms the kinds of personal information and purposes for which it is collected are:
- Contact information such as name, organisation, position, address, telephone, and email are collected for marketing, help-desk services (where needed), servicing data requests, managing research grants, VOCEDplus research database services, and for communicating with stakeholders and suppliers as part of day to day business.
- In addition to information collected on VET [see the Australian Vocational Education and Training Management Information Statistical Standard (AVETMISS) data elements for details http://www.ncver.edu.au/wps/portal/vetdataportal/data/menu/avetmiss] and VET related research topics, names and addresses are collected for the VET data collections, national VET surveys, and for research and consultancies (where this is necessary).
- Names, addresses, phone numbers, emergency contact details and other employment related information is collected from employees for the purpose of managing human resources. The management of staff personal information complies with this policy.
- National VET data collections—Including the VET provider and financial collections and the apprentice and trainee collection. The data elements collected are prescribed by the AVETMIS Standard. The information is collected directly by registered training providers and apprenticeship centres and is then submitted to NCVER for managing, analysing, evaluating, and reporting.
- National VET surveys—Including the Student Outcomes Survey, the Survey of Employer Use and Views of the VET System, and the analytical program of the Longitudinal Surveys of Australian Youth (LSAY). Data are collected via questionnaire endorsed by NCVER’s stakeholders. Except for LSAY (where data is collected by a third party contracted by the Commonwealth government), NCVER contracts an Australian-based third-party to collect the survey data either by telephone interview or via online surveys.
- Data requests—Personal contact information is collected directly from individuals who make data requests either by telephone or email.
- Help-desk—Personal contact information is collected directly from individuals who request assistance with AVETMISS data submissions, including the AVETMISS Validation Software, and the Competency Completion Online System (CCOS); or who enquires about NCVER business.
Research—NCVER’s research component encompasses the management of national competitive research grants, NCVER’s own research program, research consultancy, and the VOCEDplus database.
- Managed research grants: Personal information is collected directly from researchers by telephone and/or written communications.
- NCVER’s own research program and research consultancy: Personal contact information is collected directly from individuals and only when essential to conduct the research.
- VOCEDplus research database: Personal contact information is collected directly from end-users via online forms for services including document delivery, reference queries, document submission for inclusion in the research database, general enquiries, and application for membership to the Pathways Practitioners Community.
- Marketing—Personal information is collected directly from individuals via the Portal online subscription service for marketing material; from individuals registering for events (such as research forums) and NCVER hosted webinars; and from stakeholders for day-to-day business and information dissemination.
- NCVER staff—Personal information is collected from individuals on employment commencement.
Personal information collected by NCVER that may be regarded as ‘sensitive’ under the Privacy Act includes:
- ‘Disability’ and ‘long-term impairment status’ (health); and ‘indigenous status’, ‘language spoken at home’, ‘proficiency in spoken English’, ‘country of birth’ (implies ethnic/racial origin). This information is specified in the AVETMISS data elements and is collected for the national VET data collections, national VET surveys, and may be collected for VET-related research.
- ‘Dietary requirements’ (health-related) are collected for event catering purposes only.
- Biographical information, which may contain information on ‘affiliations’ and ‘membership of a professional or trade association’ are obtained from key note speakers for event marketing purposes.
- ‘Memberships of professional associations’ and ‘health and work injury information’ is collected from NCVER employees for HR management purposes.
- NCVER respects an individual’s right not to receive marketing material, and provides an option within communications and on its website for individuals to unsubscribe from receiving marketing material. NCVER conducts its marketing communications and dissemination of research and statistics in accordance with Australian Privacy Principle 7 (Direct marketing), the Spam Act 2003 (in respect of electronic communications), and the Do Not Call Register Act 2006. It is not, however, NCVER’s practice to ‘cold call’ for the purpose of marketing its products and services.
Google Analytics, clickstream data and cookies
- The web servers for the Portal, LSAY, AVETMISS Validation Software, and VOCEDplus websites automatically log information such as server address, date and time of visit and web pages accessed. No personal information is recorded. These logs are used for website management and improvement.
Unsolicited personal information
- If NCVER should receive unsolicited personal information, it will be treated and managed according to the Australian Privacy Principles if found to be related to one of its collections, otherwise it will be destroyed or de-identified if lawful to do so.
Anonymity and pseudonymity
3.4 As far as practicable, NCVER aims to offer individuals the options of anonymity and pseudonymity when collecting personal information.
3.5 It is possible to offer pseudonymity for marketing subscriptions and other online forms such as feedback, general contact queries, library reference queries and requests, webinars, and one-off surveys.
3.6 Anonymity of individuals can be offered for general telephone enquiries about NCVER business or general help-desk assistance.
3.7 It is not practicable for NCVER to offer the option of anonymity or pseudonymity for the following activities:
- Collection of data for the national VET data collections and national VET surveys; however, the data is de-identified for all other data administration, analysis, and reporting activities.
- Providing data for data requests as this involves sending the data to the requester and invoicing for the data provided.
- Resolving a help-desk query which requires investigation or assistance from NCVER’s IT department, or requires information to be sent to the requester, or requires online assistance in the use of AVETMISS Validation software (AVS) or the Competency Completion Online System (CCOS).
- Research requiring communication with specific individuals.
- Registration for research forums, conferences and other events where fees and payments are required.
- Document delivery requests as copyright law requires a record of the requester.
- HR management.
Notification of collection
3.8 NCVER aims to notify individuals of the collection of their personal information before, or at the time of collection, or as quickly as possible thereafter. Notifications are usually in writing, but may be verbal for telephone help-desk services, or research conducted by telephone interview.
- Marketing – notification is provided on the Portal registration page for subscription to NCVER marketing communications. Individuals are also notified at the time of collecting personal information for events or webinars. A privacy notice is provided in all NCVER marketing communications.
- VET data collections – notification is given by registered training providers and apprenticeship centres at the time of student enrolment. This policy indicates that NCVER is a recipient of the data collected by these entities.
- National VET surveys – notification is provided in the letter of invitation to participate in the surveys and also at the time of collecting the information (online or by telephone).
- Help-desk – notification is provided verbally by telephone when names and contact details are recorded in providing assistance.
- Research and consultancy – Notification is provided ahead of conducting research interviews or at the time of inviting individuals to participate in a survey. Where children are involved in the research, a Police check and children’s privacy consent declaration is obtained.
- Management of research grants – Notification is provided when: applicants apply for funding, reviewers are invited to be part of the editorial board, and when respondents are invited to participate in a survey.
- VOCEDplus database – Notification is provided at the point of collecting personal information via online service forms.
- NCVER staff – Notification is provided on employment commencement.
Disclosure of personal information
3.9 NCVER does not disclose personal information other than for the purpose for which it was collected, or an individual has consented to a secondary purpose, or an individual would reasonably expect this (such as receiving communications about upcoming events), or if required by law.
3.10 NCVER may share personal information with the Commonwealth government in accordance with Commonwealth contractual obligations. In these circumstances NCVER will take reasonable steps to inform and seek consent from the individuals concerned and take all reasonable steps to ensure that the recipient handles the personal information according to the APPs.
3.11 NCVER does not sell its mailing lists to third-parties for marketing purposes.
3.12 NCVER does not disclose personal information to overseas recipients. While people around the world can access material published on the Portal, LSAY and VOCEDplus websites, no statistical or research publications contain identifiable personal information.
3.13 NCVER does not adopt or disclose a government related identifier of an individual as its own identifier, unless NCVER is authorised by law and prescribed by regulations to do so.
3.14 NCVER may use a government related identifier to identify an individual in relation to NCVER’s business activities; for example requiring an ABN number for the purpose of contracting services to suppliers and researchers, or asking for a registered training organisation number for verifying a caller’s credentials before providing assistance with the AVETMISS Validation Software (AVS) or the Competency Completion Online System (CCOS), or requiring staff tax file numbers for payroll and tax purposes.
4. Management of personal information
Quality of personal information
4.1 NCVER endeavours to ensure the personal information it collects and uses or discloses is accurate, up to date, complete and relevant. NCVER routinely updates the information held in its customer relationship management system. In addition to periodically checking with stakeholders if their personal contact details have changed, individuals with Portal and LSAY website subscription accounts are invited to keep their information up to date.
Access to and correction of personal information
4.2 Individuals may, subject to the exceptions prescribed by the Australian Privacy Principles, request access to and correction of their personal information where this is collected directly from individuals by NCVER.
4.3 NCVER does not charge for giving access to or for correcting personal information.
4.4 Requests for access to or correction of personal information should be made in writing and addressed to the Privacy Officer at email@example.com. Requests will be answered within 14 business days.
4.5 Individuals with subscription accounts on the Portal and LSAY website can access their accounts at any time to make corrections to their personal information or to unsubscribe.
Information retention and disposal
4.6 Personal information is held in electronic and paper format:
- Information collected for the national collections and national surveys is held in databases.
- Names and contact details of stakeholders are held in a customer relationship management system and email contact lists.
- Names and contact details collected during a research project may be held either in electronic form in NCVER’s document management system or in paper documents which are locked in cupboards and filing cabinets.
- Names and contact details collected for data and help-desk requests are held in electronic form in NCVER’s document management system.
- In accordance with copyright requirements, a paper copy is kept of all document delivery requests. These are held in locked cupboards.
- Personal information for subscription accounts is held in the Portal database. Names and contact details collected via online forms for VOCEDplus services are held in the VOCEDplus database.
- Names and contact details collected for event registrations and webinars are held in the databases of third-party web service providers within Australia.
- Personal staff information is held in a HR management database.
- Backup copies of all electronic files held in NCVER’s systems are kept in the event of system failure/loss. All backup copies of system files are secured.
4.7 NCVER retains personal information for as long as it is required for its business activities and functions, and for as long as we are legally required to retain the information or are required by or under a court/tribunal order to retain the information.
4.8 When personal information is no longer necessary for NCVER’s business functions, and it is lawful to do so, NCVER destroys or takes reasonable steps to de-identify the information.
4.9 NCVER takes active steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
- NCVER’s systems and internal network are protected from unauthorised access using appropriate technologies. Most system data transferred over the internet is protected by Secure Socket Level protocol (SSL). The inherent risks associated with data transmission over the internet are, however, commonly acknowledged. Individuals, who do not wish to provide their personal information via the online website forms have the option of mailing this information to NCVER.
- Access to databases is protected through user log-on and password, and assignment of user access rights.
- All entities submitting data to NCVER for the national data collections must be registered and have a unique log-on and password. Before NCVER staff work on the data, all names and addresses of individuals are encrypted.
- Names and addresses of individuals are removed before fieldwork contractors submit data to NCVER for the national surveys.
- Third-party providers used by NCVER for surveys fieldwork, event management, and webinar hosting services are all located within Australia and are required to be compliant with the Australian Privacy Principles and offer appropriate safeguards to protect personal information.
- NCVER’s premises and server room are fully secured. A current business continuity and disaster recovery plan is in place and is reviewed regularly. NCVER practices clean-desk policy and locking workstations when working with personal information. Paper documents containing names and addresses are required to be locked away and shredded in confidential bins when destroyed. All hardware is properly ‘sanitised’ before disposal.
5. Complaints and concerns
5.1 Complaints or concerns about NCVER’s management of personal information should be directed in writing to NCVER’s Privacy Officer at firstname.lastname@example.org. NCVER will respond in writing within 14 business days.
6. Contact information
6.1 For all privacy related enquiries or to request this policy in an alternative format, contact:
P. 08 8230 8400
NCVER, Level 11, 33 King William Street, ADELAIDE, SA 5000.
7. Policy review
7.1 This policy is effective from 12 March 2014. It will be reviewed once annually or more frequently as necessary. The revision history in this policy indicates when the policy has been changed. A copy of the latest version of this policy will be posted on all NCVER’s websites. There is no charge for this policy.
8. Policy revision history