Handling Sensitive and Personal Information
Working at the Council means handling information about residents, ratepayers, applicants and colleagues. Most of it is personal information, and how you handle it is governed by law as well as by good practice.
This article covers the everyday decisions. For anything unusual, ask before you act.
What counts as personal information
Anything that could identify someone, on its own or combined with something else. That includes the obvious things such as name, address, phone number, email, date of birth and also:
- Property and rates records linked to an owner or occupier
- Development applications, objections and submissions
- Complaints, and who made them
- Animal registrations, infringements and enforcement records
- Health, disability or accessibility information
- Employment records, performance information and pay details
- Photographs and CCTV footage of identifiable people
Some categories need extra care because disclosure could cause real harm such as health information, information about children, anything relating to family violence or a safety concern, and the identity of a complainant.
Everyday rules
Only access what you need for your job. Having access to a system does not mean you should look at a record out of curiosity, or check on a neighbour, a relative or yourself. System access is logged.
Only share what is necessary, with people who need it. Inside the Council as well as outside.
Do not discuss identifiable cases where you can be overheard — the counter, a corridor, a café, an open-plan meeting.
Check the recipient before you send. Autocomplete picking the wrong similar name is the most common cause of small breaches, and it is entirely preventable by reading the To field before you press send.
Do not put personal information into tools that are not approved. This includes public AI tools — see Using AI at Kingborough Council.
Keep it in Council systems. Not on personal email, personal cloud storage, USB drives or a personal device outside approved arrangements.
Storing it properly
Records documenting Council decisions and dealings with the public belong in ECM, not only in your mailbox or OneDrive.
Personal information stored only in a personal drive disappears when you leave, and cannot be found when someone asks for it, both of which are problems.
If something goes wrong
Send an email to the wrong person, leave a file where it should not be, lose a device, or realise a record has been accessed inappropriately?
Tell your manager and tell us straight away. Same day.
It may need to be assessed as a data breach, and that assessment has a deadline. Small mistakes handled quickly usually stay small. The same mistake mentioned a fortnight later is a different problem entirely.
Nobody is in trouble for reporting this promptly.