OP8111 - Information Privacy Policy
1. Policy statement
Unitywater is a statutory authority established in accordance with section 8 of the South-East Queensland Water (Distribution and Retail Restructuring) Act 2009 (Qld). We provide water and wastewater services to the Moreton Bay, Sunshine Coast and Noosa local authority areas.
Unitywater recognises that privacy is a fundamental human right. We are committed to protecting the privacy of our customers, team members, and every individual we engage with, by ensuring the personal information we collect is handled with care, transparency, and integrity.
2. Purpose and objectives
The purpose of this policy is to detail how Unitywater will collect, store, use, disclose and provide access to Personal Information in accordance with the Information Privacy Act 2009 (Qld) (the IP Act) and its Queensland Privacy Principles (QPPs).
This policy outlines how Unitywater upholds and facilitates individuals’ rights in relation to their personal information in accordance with the Information Privacy Act 2009 (Qld), including rights of access, correction and complaint.
3. Scope
This policy applies to the following:
- all Unitywater team members, contractors, agents, contracted service providers and outsourced business functions who handle personal information on behalf of Unitywater
- all personal information collected, stored, used and disclosed by Unitywater, regardless of format, medium and source, unless otherwise exempted by legislation
- all administrative and technological environments in which Unitywater business is conducted.
3.1 Collection of Personal Information
What is Personal Information?
Personal Information is defined in section 12 of the IP Act to include ‘information or an opinion about an identified individual or an individual who is reasonably identifiable from the information or opinion, whether the information or opinion is true or not, and whether the information or opinion is recorded in material form or not’.
What Personal Information is collected and why?
Unitywater collects Personal Information as may be reasonably necessary for or directly related to Unitywater’s functions or activities. This may include (but is not limited to) the end-to-end delivery, operation and continual improvement of safe, reliable, and sustainable water and wastewater services, in accordance with our statutory functions and regulatory obligations.
Collection notices are mandatory and must be provided whenever personal information is collected, unless a lawful exception applies, in accordance with the Information Privacy Act 2009 (Qld).
Customers and members of the Community
Unitywater collects Personal Information from customers, members of the community and their authorised representatives to:
- provide products and services
- process and respond to enquiries
- identity and verification purposes
- process bill payments, recover money or payments, to process refunds
- process applications and complaints
- conduct maintenance activities on our network
- manage access to our network
- manage security, health, safety
- occasionally conduct customer and market research to improve our services.
The Personal Information collected for these purposes may include:
- names, addresses, contact and billing details
- water consumption and other related property ownership or occupancy data
- relevant personal circumstances
- voice recordings via our phone system
- opinions
- images
- licences, certifications, qualifications or professional memberships for individuals accessing our network
- statistical data relating to the use of our website or social media sites.
Job Applicants, Team Members and Third Parties
Unitywater collects Personal Information from job applicants, team members, contractors, suppliers, and their authorised representatives for the purposes of conducting recruitment activities, managing employment and contractual relationships, procurement of services, managing health and safety, managing security and access to Unitywater sites and other legislative requirements.
The Personal Information collected for these purposes may include:
- names, addresses, images, contact and financial details (i.e. tax file number, bank account details)
- work history and relevant personal circumstances including medical conditions, vaccination status, criminal history check results, drug and alcohol test results, psychometric test results
- information related to referees or emergency contact details
- relevant licences, certifications, qualifications and memberships
- site attendance, location data, vehicle registrations and system usage data.
Site and office visitors
Unitywater collects Personal Information from individuals who attend our sites and facilities for the purposes of managing cleaning, security, health and safety, and administering contractual or supply agreements and other legislative requirements.
The Personal Information collected for these purposes may include:
- names, addresses, contact details
- signatures
- images
- relevant licences, certifications, qualifications, medical and vaccination history.
How Personal Information is collected
Unitywater takes all reasonable steps to ensure that Personal Information will only be collected in a lawful manner, that it is reasonably necessary for or directly related to Unitywater’s functions or activities.
Unitywater collects Personal Information:
- directly from individuals or their authorised representatives via phone, email, online forms, in writing or in person
- indirectly through an individual’s use of our products, services, facilities, websites (including online portals), social media sites, participation in surveys, use of our systems or assets
- from third parties, including other government agencies, local councils and contractors
- from publicly available information sources
- via digital transfers from the Queensland Titles Registry following the transfer of a property in Unitywater’s service area (pursuant to section 99AX of the South-East Queensland Water (Distribution and Retail Restructuring) Act 2009 (Qld), or
- as otherwise required or authorised by law.
3.2 Collection of Sensitive Information
Sensitive information is defined within Schedule 5 of the IP Act to mean, for an individual:
- information or an opinion, that is also personal information, about the individual’s:
- racial or ethnic origin, or
- political opinions, or
- membership of a political association, or
- religious beliefs or affiliations, or
- philosophical beliefs, or
- membership of a professional or trade association, or
- membership of a trade union, or
- sexual orientation or practices, or
- criminal record
- health information about the individual
- genetic information about the individual that is not otherwise health information
- biometric information that is to be used for the purpose of automated biometric verification or biometric identification, or
- biometric templates.
What Sensitive Information is collected and why?
Sensitive information is a special category of Personal Information that may be collected by Unitywater when necessary, in connection with job applications and resumes, interviews, professional memberships, criminal records, race and origin information or when disclosed by individuals in connection with a complaint or matter requiring Unitywater investigation.
Unitywater will only collect Sensitive Information where:
- you agree to the collection
- it is reasonably necessary for, or directly related to, one or more of our functions or activities
- the secondary purpose is directly related to the primary purpose for which the information was collected, or
- otherwise in accordance with law.
Dealing with Unitywater anonymously or using a pseudonym
Where lawful and practicable, individuals have the option to engage with Unitywater without identifying themselves, or by using a pseudonym (e.g. general service enquiries). Unitywater will try to accommodate all reasonable request for anonymity, however identification will be required where it is necessary for Unitywater to provide a particular service, process a complaint, to meet Unitywater’s legal obligations or where it is impracticable for Unitywater to deal with an individual who has not identified themselves.
3.3 Use or disclosure of Personal Information
Use and disclosure of Personal Information
Personal information may be used and disclosed without consent where reasonably necessary to deliver water and wastewater services, in accordance with the Information Privacy Act 2009 (Qld).
Unitywater will only use or disclose your Personal Information in the following circumstances:
- the use or disclosure is directly related to the purposes we collected it
- you have consented to the use or disclosure
- you would reasonably expect Unitywater to use or disclose your information for that particular (secondary) purpose
- the use or disclosure is reasonably necessary to lessen or prevent a serious threat to life, health, or safety
- the information has been deidentified and is being used for statistical or analytical purposes, or
- if the use or disclosure is otherwise authorised or required by law.
Overseas disclosure of Personal Information
Personal Information is not routinely disclosed by Unitywater outside of Australia, however due to the nature of our services and use of third-party providers, Unitywater may need to disclose your Personal Information overseas in connection with the delivery of our core functions and activities.
Unitywater may disclose your Personal Information overseas in the following circumstances:
- where a service provider is based overseas
- for the use of Software as a Service (SaaS) or other online platform services
- disaster recovery or data back-up centres, or
- overseas payment gateways.
The main locations where your Personal Information may be disclosed include Europe, United States of America, Ireland and Singapore.
In the limited circumstances where overseas disclosure is necessary, Unitywater will take reasonable steps to ensure that your Personal Information is protected and handled in accordance with the privacy obligations set out herein.
3.4 Security and storage
How Personal Information is stored and secured
Where Unitywater holds Personal Information, reasonable steps will be taken to protect that information from misuse, interference, loss, unauthorised access, modification or unauthorised disclosure.
Unitywater securely stores your Personal Information in our business systems, databases and secure storage facilities. Unitywater security measures include firewalls, server and closed network environments, encryption, regular back-ups of information and access controls.
Where Personal Information is managed or stored by a third party or supplier, Unitywater will take reasonable steps to ensure it is protected and handled in accordance with the privacy obligations set out herein.
Your Personal Information will only be retained for the period necessary for Unitywater to conduct our business functions and activities, and in accordance with applicable records retention obligations under the Public Records Act 2023 (Qld). Unitywater takes reasonable steps to securely destroy or de-identify Personal Information when it is no longer required for the original purpose of collection.
3.5 Accessing and amending your Personal Information
Unitywater takes reasonable steps to ensure that any Personal Information that is collected is accurate, up to date and compete. To amend your personal records with Unitywater, you must submit a formal application using the form available on our website: Apply to amend personal information.
3.6 Privacy complaints
If you wish to make a complaint about the way we handle your Personal Information and our compliance with the IP Act or QPPs, please contact our Privacy Officer in writing using the details below:
Email: customer.service [at] unitywater.com
Postal address: PO Box 953, Caboolture QLD 4510
Unitywater will acknowledge receipt of the complaint within 10 working days and provide a response within 45 business days of receipt.
If you are not satisfied with our response to your privacy complaint, you may escalate the matter to the Office of the Information Commissioner (OIC) Queensland for independent review.
3.7 Policy review
Unitywater will regularly review this Information Privacy Policy in accordance with our Policy and Procedure Framework.
4. Roles and responsibilities
Unitywater assigns clear roles and responsibilities to ensure compliance with the IP Act. Accountability for protecting Personal Information is shared across the organisation, with defined governance, oversight, and operational responsibilities.
| Position title | Responsible for |
|---|---|
| Chief Financial Officer (CFO) (Policy owner) | The CFO is the accountable Executive for Unitywater’s compliance with the IP Act, IPOLA, and related obligations.
|
| Executive Leadership Team (ELT) | The ELT provides strategic direction and organisational leadership for privacy across Unitywater.
|
| Privacy Officer | The Privacy Officer leads the development and implementation of Unitywater’s Privacy Framework.
|
| Team members |
|
5. Definitions
| Term | Meaning |
|---|---|
| IP Act | Information Privacy Act 2009 (Qld) |
| QPPs | Queensland Privacy Principles |
6. References and resources
| Source | Reference |
|---|---|
| External |
|
| Internal | OP8112 - Right to Information Policy |
This document and its contents are the property of Unitywater and are subject to copyright laws. No part of this document may be reproduced, distributed or transmitted in any form or by any means including photocopying, recording or other electronic transmission without the prior written consent of Unitywater.