Background to the Policy
The Queensland Tertiary Admissions Centre (QTAC) collects, holds, processes, uses, transfers and discloses personal information, including sensitive information, about individuals to enable it to function as a provider of centralised tertiary admissions. This personal information must be afforded appropriate and adequate protection as required by the Privacy Act 1988 (Cth).
QTAC discloses personal information about an individual to selected third-party entities to assist QTAC in providing its services, and/or to allow those third parties to provide services to that individual. QTAC may disclose personal information by making it accessible in person, by email, fax or telephone. QTAC may also disclose personal information by granting access to one or more of the following:
- Online Admissions Platform (OASys)
- QTAC Corporate Internet Services (Corporate Site)
- Year 12 databases(s)
- other services or databases as made available by QTAC from time to time.
This policy sets out the obligation of third parties who access, use or store personal information disclosed by QTAC. If a third party does not agree to comply with this Policy it should no longer access, use or store personal information disclosed by QTAC.
Compliance with this Policy does not guarantee access to the personal information. Access to personal information is granted by QTAC on a case-by-case basis. Failure to comply with this policy may lead to withdrawal of access to the personal information, but refusal or withdrawal of access may also occur as a result of factors unrelated to compliance with this policy.
Nothing in this policy has the effect of:
- obliging QTAC to disclose, or to continue to disclose, the personal information
- limiting QTAC from withdrawing, limiting, altering or attaching conditions to access the personal information.
This Policy supersedes any prior agreements and understandings (whether written or oral) between QTAC and third parties regarding privacy obligations in relation to personal information. This Policy does not otherwise alter any rights, obligations, agreements or understandings between QTAC and third parties.
Bold items in this policy have the meaning given in the Glossary of Terms.
Third parties may only use personal information disclosed by QTAC to the extent necessary to achieve authorised purposes. The authorised purposes for which personal information disclosed by QTAC may be used are:
- any purpose for which the third party has secured the prior consent of the individual to whom the personal information relates
- processing applications for admission to courses offered through the tertiary institution or Tertiary Admissions Centre
- carrying out checks to determine eligibility for courses for which the individual has applied
- allocating tertiary places to eligible applicants
- carrying out research or performing analysis that does not involve the identification of specific individuals
- dealing with a specific tertiary application enquiry made by the individual to whom the personal information relates or made by an authorised representative of that person
- any other purpose for which prior written authorisation is obtained from QTAC.
In addition to the authorised purposes listed above, a secondary school may use personal information disclosed by QTAC to provide counselling services to students (and recently graduated students) of that school in relation to that student's QTAC application and the outcome of that application.
Depersonalised or aggregate data
From time to time QTAC provides aggregate, non-personal data to third parties for research purposes. It is a condition of accessing this information that no data-matching or data-merging is conducted which has the effect, or may have the effect, of extracting personal information from the aggregate data. Any personal information discoverable in aggregate data is subject to this policy, and must only be used for the Authorised Purposes outlined above.
Security of personal information
The third party must take reasonable steps, to the satisfaction of QTAC, to ensure that personal information disclosed by QTAC is protected against misuse, interference, loss and unauthorised access, modification and disclosure. The third party must ensure that each of its employees who access, use or disclose personal information are aware of and comply with the obligations under the Policy when they are accessing, using or disclosing the personal information. If the third party becomes aware of any misuse, interference, loss, or unauthorised access, modification or disclosure of personal information disclosed by QTAC, the third party must immediately notify QTAC.
Third parties may store the personal information in a secondary database to the extent necessary to undertake an authorised purpose. If the personal information is held in a secondary database, the third party must maintain appropriate logs of all personal information accessed by employees. If the nature of the database prevents the maintenance of such logs, the third party must restrict access to the database using appropriate security measures and maintain records of the individuals with current and previous access to the database. If requested by QTAC, the third party must provide QTAC with access to these logs or records within seven (7) days of the request.
The third party must take reasonable steps to update personal information if notified by QTAC that the information is inaccurate, out-of-date, incomplete, irrelevant, or misleading taking into account the purpose for which the information is held by the third party. The third party must take reasonable steps to destroy or de-identify personal information that is no longer required to fulfil the purpose for which it was disclosed by QTAC.
An employee of a third-party entity to whom personal information is disclosed by QTAC may further disclose that personal information to other employees of that entity as necessary to undertake activities directed related to an authorised purpose.
Personal information disclosed by QTAC must not be further disclosed outside the third-party entity without prior express written permission of QTAC; or consent of the individual to whom the personal information relates.
Special Provisions for Queensland ATARs
Queensland ATARs are disclosed to third parties for restricted purposes governed by separate agreement. Queensland ATAR should be used only according to the terms of those agreements. Any enquiry about Queensland ATARs from students should be directed to the Queensland Curriculum and Assessment Authority (QCAA).
Third parties other than QTAC participants must not use personal information disclosed by QTAC for direct marketing.
QTAC participants may use personal information (excluding sensitive information) disclosed by QTAC to communicate directly with an individual who has that institution listed as a current preference on a QTAC application at the date of the communication. This communication must be consistent with other relevant QTAC policies, including the Communication with Applicants guidelines.
QTAC participants may not use sensitive information disclosed by QTAC to communicate with an individual about goods or services without the prior permission of QTAC's Manager of Public Relations and Information Services.
All direct marketing communications that use personal information disclosed by QTAC must comply with the Privacy Act 1988 (Cth) including containing a prominent statement offering a simple means to opt out of receiving direct marketing communications. This requirement applies regardless of whether or not the third party would otherwise be bound by the provisions of the Privacy Act 1988 (Cth).
If QTAC gives written notice to a QTAC participant that an individual has requested to no longer receive direct marketing from that QTAC participant, the QTAC participant must cease all such direct marketing using personal information disclosed by QTAC to that individual within thirty (30) days of receiving notice from QTAC.
Nothing in this policy is intended to relieve QTAC participants from obligations under the Spam Act 2003 or the Do Not Call Register Act 2006.
Withdrawal of access
If QTAC determines that the third party has breached this policy, QTAC may withdraw access to some or all of the personal information. QTAC may also require the third party to return and/or securely destroy personal information previously disclosed by QTAC. QTAC will elect whether it requires the personal information to be returned or destroyed.
Changes to this policy
QTAC reserves the right to amend this Policy from time to time. Printed copies of this policy are uncontrolled.
Glossary of terms
Authorised purposes - purposes for which personal information disclosed by QTAC may be used by third parties.
Direct Marketing - the use and/or disclosure of personal information to communicate directly with an individual to promote goods and services.
Disclosure - when personal information is made accessible to QTAC, but does not include instances when an individual exploits QTAC's security measures and gains unauthorised access to the personal information.
Consent - express consent or implied consent, where the consent is voluntary and informed, current and specific, and the individual has the capacity to understand and communicate the consent.
Counselling service - the provision of advice or counsel to a secondary school student by a suitably qualified member of staff at a secondary school.
Employee - an officer, employee, or agent (whether employed under a contract or otherwise), engaged by the third party to provide services in exchange for wages.
QTAC - the Queensland Tertiary Admissions Centre (QTAC).
QTAC Corporate Internet Services - the web-based service operated by QTAC that provides proprietary products and services to tertiary institutions and secondary schools.
QTAC participants - the entities participating in QTAC, as set out below:
- Australian Catholic University
- Australian Maritime College, Tasmania
- Bond University
- CQUniversity Australia
- Christian Heritage College
- Griffith College
- Griffith University
- James Cook University
- Queensland University of Technology
- SAE Creative Media Institute
- Southern Cross University
- TAFE Queensland
- The University of Queensland
- University of New England
- University of Southern Queensland
- University of the Sunshine Coast
- Other institutions as admitted from time to time to QTAC.
OASys - the online admissions platform operated by QTAC.
Personal information - information or an opinion about an identified individual, or an individual who is reasonably identifiable whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not.
Preference - a request made as part of a QTAC Tertiary application for an individual to be considered for entry into a specified course at a specified tertiary institution for a specified semester.
Secondary database - a collection of data controlled by the third party which includes personal information disclosed by QTAC.
Sensitive information - a subset of personal information that includes health information about an individual (whether or not the individual is identifiable), and any of the following in relation to identifiable individuals:
- racial or ethnic origin
- political opinions
- membership of a political association
- religious beliefs or affiliations
- philosophical beliefs
- membership of a professional or trade association
- membership of a trade union
- sexual orientation or practices
- criminal record.
Tertiary Admissions Centre - an entity providing centralised admissions and other services to tertiary institutions.
Tertiary application enquiry - an enquiry made by an individual about the progress, assessment or outcome of a Tertiary Application.
Tertiary institution - a public or private entity offering education or training courses at a tertiary level.
Tertiary application - an application by an individual to a tertiary institution or Tertiary Admissions Centre to be considered for a place.
Third-party entity - an organisation (including a QTAC participant) or individual to whom QTAC disclosed personal information.
Year 12 database(s) - database(s) controlled by QTAC that contain results of Australian Year 12 students including Queensland Year 12 students.