We respect and are committed to protecting your privacy.

Read on for our privacy policy, including how we collect and use personal information, how you can access and correct any information we hold and how we keep your data secure.

---

How to contact us

We always try to meet the highest standards in order to protect your privacy, however if you have any questions, comments, concerns or complaints about our privacy practices, please get in touch.

You also see our process for handling complaints in our complaints management policy.

You can contact us with any questions or concerns:

Nicola Rivers and Elizabeth McKinnon, Co-CEOS
Environmental Justice Australia
PO Box 12123
A'Beckett St VIC 8006
(03) 8341 3100
[email protected]

---

1. About this privacy policy

Environmental Justice Australia (EJA) is bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth).

EJA is committed to protecting and upholding the right to privacy of clients, staff, volunteers, supporters and others in accordance with the Principles.

Like any other law firm, EJA is bound not to disclose confidential communications with its clients, and it is very familiar with its solicitor-client obligations in regard to protecting client information, including personal information.

2. What does "personal information" mean?

For the purposes of this policy, “personal information” means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

The types of personal information that EJA collects includes personal information regarding EJA legal practice clients, members, supporters, volunteers, donors, personnel or other persons with whom EJA or a third party has contact in connection with EJA’s activities.

3. Collection of personal information

EJA collects personal information about individuals where that information is necessary for any of the following primary purposes:

1. fulfilling EJA’s role in educating the community about issues of environmental significance and sustainability;
2. assisting EJA to participate in relevant civic and political debates, and assisting EJA supporters in also doing so;
3. providing legal representation and advice to individuals and organisations;
4. complying with requirements of funding bodies, insurers, and regulatory agencies;
5. identifying environmental breaches and highlighting environmental and sustainability concerns;
6. notifying individuals of EJA’s activities and campaigns and inviting participation in initiatives;
7. forging corporate and professional alliances, and supporting likeminded organisations to
8. achieve environmental and sustainability outcomes, including by sharing information with them;
9. seeking new members and donors, including through marketing activities, and processing, renewing and maintaining EJA memberships and subscription services, including the use of third parties;
10. increasing EJA’s financial support, through various fundraising activities, in order to maintain and enhance EJA’s campaigning capacity;
11. (9) and (10) above include building a comprehensive understanding of individual interests and habits to enable effective engagement with members, supporters and future supporters;
12. improving our websites;
13. recruiting staff, Board and Council members and volunteers; and
14. responding to your comments or questions and receiving feedback or complaints on any of the above functions or activities.

4. When and how we will collect personal information

EJA will only collect personal information (other than sensitive information) when the information is reasonably necessary for one of more of EJA’s functions or activities set out in section 3.

EJA will only collect personal information by lawful and fair means. Personal Information is obtained in many ways including interviews, correspondence by telephone and facsimile, by email, via our website (www.envirojustice.org.au), from cookies, from donation forms, from partner organisations or clients, or via other websites which we use to run fundraising campaigns, surveys, petitions or online actions.

At or before the time EJA collects personal information about an individual from an individual, or as soon as practicable after, EJA will take such steps as are reasonable to ensure that the individual is aware of:

1. the identity of EJA and how to contact EJA;
2. the fact that they are able to gain access to and seek correction of the information;
3. the purposes for which the information is collected;
4. organisations (or the types of organisations) to which EJA usually discloses information of the kind collected, and if practicable the countries in which any overseas recipients are located;
5. if the collection of the information is required or authorised by or under any Australian law or a court/tribunal order – the fact that collection is so required and relevant details of that requirement; and
6. the main consequences (if any) for the individual if all or part of the information is not provided.

If it is reasonable and practicable to do so, EJA will collect personal information about an individual only from that individual. EJA will, from time to time, collect personal information from third parties, social media and via the use of cookies on EJA’s website.

If EJA collects personal information about an individual from someone else, or the personal
information is unsolicited, it will take reasonable steps to ensure that the individual is or has been made aware that the information has been collected, the information and the circumstances of the collection.

EJA will determine within a reasonable period of time whether personal information about an individual which was collected from someone else or personal information which was unsolicited could not have been lawfully collected by the EJA, and:

1. if so, the information will be dealt with in accordance with this privacy policy; or
2. if not, and the information is not contained in a Commonwealth record, EJA will, as soon as practicable but only if lawful and reasonable to do so, destroy the information or ensure that the information is de-identified.

5. Sensitive information

EJA will not collect sensitive information about an individual, including information about that
individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, or criminal record unless:

• the individual has consented to the collection of that information and the information is reasonably necessary for one or more of EJA’s functions or activities; or
• the collection of the information is required or authorised by or under an Australian law or a court/tribunal order; or
• a “permitted general situation” (as defined in subsection 16A of the Act) exists in relation to the use or disclosure of the information, including:
  • where it is unreasonable or impracticable to obtain consent and EJA reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of an individual or to public health or safety; or
  • EJA has reason to suspect an unlawful activity or misconduct of a serious nature that relates to EJA’s functions or activities has been or may be engaged in an reasonably believes the use or disclosure is necessary in order for EJA to take appropriate action; or
  • EJA reasonably believes that the use or disclosure is reasonably necessary to assist anyone to locate a person reported as missing and the use or disclosure complies with any rules made under s16(A)(2) of the Act; or
  • the use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim or a confidential alternative dispute resolution process; or
  • the information relates to the activities of EJA and the information relates solely to the members of EJA, or to individuals who have regular contact with EJA in connection with its activities.

6. Use and disclosure of personal information

EJA may sometimes use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose. However, EJA will only use or disclose personal information about an individual for a secondary purpose in limited circumstances.

EJA may use personal information about an individual for a secondary purpose if:

• the individual has consented to the use or disclosure; or
• the individual would reasonably expect EJA to use or disclose the information for the secondary purpose and the secondary purpose is;
  • i. if the information is sensitive information — directly related to the primary purpose; or
  • ii. if the information is not sensitive information — related to the primary purpose; or
• the use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or
• a “permitted general situation” (as defined in subsection 16A of the Act) exists in relation to the use or disclosure of the information, including:
  • where it is unreasonable or impracticable to obtain consent and EJA reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of an individual or to public health or safety; or
  • EJA has reason to suspect an unlawful activity or misconduct of a serious nature that relates to EJA’s functions or activities has been or may be engaged in and reasonably believes the use or disclosure is necessary in order for EJA to take appropriate action; or
  • EJA reasonably believes that the use or disclosure is reasonably necessary to assist anyone to locate a person reported as missing and the use or disclosure complies with any rules made under s16(A)(2) of the Act;
  • the use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim or a confidential ADR process; or
• EJA reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body (and will make a written note about such use).

In this Policy “consent” means voluntary and informed agreement to some act, practice or purpose.

EJA will, wherever possible, seek consent from individuals before using their personal information for a secondary purpose. Where EJA deems that a child or young person is unable to give sufficient consent to the use of their personal information for a particular purpose, EJA will seek such consent from their parent or guardian.

EJA may use personal information about an individual for the secondary purpose of promoting EJA products, marketing of products or services of third parties with whom EJA has an association, activities, materials, educational resources and competitions to the individual and to inform the individual of issues of environmental significance or sustainability generally (direct marketing).

EJA may use personal information (other than sensitive information) about an individual for direct marketing if:

• EJA collected the information from the individual and:
  • The individual would reasonably expect EJA to use or disclose the information for that purpose; and
  • EJA has provided a simple means by which the individual may easily request not to receive direct marketing communications from EJA; and
  • the individual has not made a request to EJA to not receive direct marketing communications from EJA.
• EJA collected the information from someone other than the individual and:
  • it is impracticable to obtain the individual’s consent; and
  • the individual would reasonably expect EJA to use or disclose the information for that purpose; and
  • EJA has provided a simple means by which the individual may easily request not to receive direct marketing communications from EJA; and
  • the individual has not made a request to EJA to not receive direct marketing communications from EJA.

EJA may only use or disclose sensitive information about an individual for the purpose of direct marketing if the individual has consented to the use or disclosure of the information for that purpose.

EJA may use or disclose personal or sensitive information for the testing of EJA security systems and database performance.

If EJA uses or discloses personal information about an individual for:

• direct marketing, an individual may request not to receive direct marketing communications from EJA and EJA must give effect to the request within a reasonable period of time; or
• the purposes of facilitating direct marketing by other organisations, an individual may request EJA not to use or disclose the individual’s information for the purpose of facilitating direct marketing by other organisations and EJA must give effect to the request within a reasonable period of time,

and the individual may request EJA to be provided with the source of the information and EJA must within a reasonable period of time after the request was made, provide details of the source unless it is impractical or unreasonable to do so.

EJA will not charge any individual for the making of, or to give effect to, such requests.

7. Data quality

EJA will take such steps as are reasonable in the circumstances to ensure that the personal
information it collects is accurate, complete and up-to-date and, having regard to the purposes of the use or disclosure of the personal information that is collected, relevant.

8. Data security

EJA will take such steps as are reasonable in the circumstances to protect the personal information it holds from misuse, interference (which may include measures to protect against computer attacks) and loss and from unauthorised access, modification or disclosure.

EJA will take such steps as are reasonable in the circumstances to destroy or permanently de-identify personal information about an individual that it holds if it is no longer needed for any purpose for which the information may be used or disclosed, and is not required to be retained by law or a court/tribunal order.

If there is a suspicion that EJA has lost, damaged or compromised security of client or other personal information, EJA will:

• take each data breach or suspected data breach seriously.
• proceed to take the following steps:

1. Contain the data breach to prevent any further compromise of personal information.
2. Assess the data breach by gathering the facts and evaluating the risks, including
   potential harm to affected individuals and, where possible, taking action to remediate
   any risk of harm.
3. Notify affected individuals (and the Commissioner if required by the particular
   circumstances).
4. Review the incident and consider what actions can be taken to prevent future
   breaches.

• In some cases, EJA may notify individuals immediately, before containment or assessment of the breach occurs.
• EJA will determine how to respond on a case-by-case basis. Depending on the breach, not all steps may be necessary, or some steps may be combined. In some cases, EJA may take additional steps that are specific to the nature of the breach.

9. Open and transparent management

EJA has set out in this document, in an open and transparent way, its policies on the management of personal information. EJA will make this document publicly available on its website at www.envirojustice.org.au and will take reasonable steps to provide a copy of this policy, free of charge, to anyone who asks for it (see section 16 of this Policy for contact details).

On request by a person, EJA will take reasonable steps to let the person know, generally, what sort of personal information EJA holds in relation to that person, for what purposes, and how it collects, holds, uses and discloses that information.

10. Access and correction

If EJA holds personal information about an individual, EJA will provide the individual with access to the information on request by the individual unless any of the following exceptions apply:

EJA reasonably believes that giving access would pose a serious threat to the life, health or
safety of any individual, or to public health or public safety; or
(b) giving access would have an unreasonable impact upon the privacy of other individuals; or
(c) the request for access is frivolous or vexatious; or
(d) the information relates to existing or anticipated legal proceedings between EJA and the
individual, and the information would not be accessible by the process of discovery in those
proceedings; or
(e) providing access would reveal the intentions of EJA in relation to negotiations with the
individual in such a way as to prejudice those negotiations; or
(f) providing access would be unlawful; or
(g) denying access is required or authorised by or under an Australian law or a court/tribunal
order; or
(h) both of the following apply:

• EJA has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to EJA functions or activities has been or is being or may be engaged in; and
• giving access would be likely to prejudice the taking of appropriate action in relation to
• the matter;

(i) providing access would be likely to prejudice one or more enforcement-related activities
conducted by, or on behalf of, an enforcement body; or
(j) giving access would reveal evaluative information generated within EJA in connection with a commercially sensitive decision-making process

The access request can be made to the individual(s) listed in Section 16 of this Policy. EJA will respond to an access request within a reasonable period after the request is made and will give access to the personal information in the manner requested by the individual, if it is reasonable and practicable to do so. EJA may, in appropriate circumstances, charge the individual for giving access to the personal information. Such a charge will not be excessive.

If EJA refuses to give access to personal information in the manner requested by the individual or because one or more of the exceptions apply EJA will take such steps as are reasonable in the circumstances to give access in a way that meets the needs of EJA and the individual.

If EJA refuses to give access to personal information in the manner requested by the individual or because one or more of the exceptions referred to in section 10 of this policy apply, EJA will give the individual a written notice that sets out the reasons for the refusal, except to the extent that, having regard to the grounds of refusal it would be unreasonable to do so and the mechanisms available to complain about the refusal (and such other matters prescribed by the regulations). If the reason for refusal is the exception referred to in paragraph 10(j) of this policy, the reasons for refusal may include an explanation for the commercially sensitive decision.

An individual can request EJA to correct personal information held by EJA. EJA will respond to the request within a reasonable period of time after the request is made and will take such steps as are reasonable in the circumstances to correct the information to ensure that, having regard to the purpose for which it is held, it is accurate, up to date, complete, relevant and not misleading. EJA may also take such steps on its own initiative, if EJA is satisfied, having regard to the purpose for which personal information about an individual is held, it is inaccurate, out of date, incomplete, irrelevant or misleading.

If EJA refuses to correct the personal information as requested by the individual, EJA will give the individual a written notice that sets out the reasons for the refusal, except to the extent that, having regard to the grounds of refusal it would be unreasonable to do so, and the mechanisms available to complain about the refusal (and such other matters prescribed by the regulations).

An individual can request EJA to notify another Australian Privacy Principles entity to whom EJA has previously disclosed personal information about the individual, of corrections made to their personal information. EJA will take such steps as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

An individual can request EJA to associate with the information a statement that the information is inaccurate, out of date, incomplete, irrelevant or misleading. EJA will respond to a request within a reasonable period after the request is made and will take such steps as are reasonable in the circumstances to associate the statement in such a way that will make the statement apparent to the users of the information.

11. Government related identifiers

EJA will not adopt a government related identifier of an individual as its own identifier of the individual unless:

• the adoption of the government related identifier is required or authorised by law or a court/tribunal order; or
• EJA is a prescribed organisation, the identifier is prescribed and the adoption, use or disclosure occurs in prescribed circumstances.

EJA will not use or disclose a government related identifier of an individual unless:

• the use or disclosure of the identifier is reasonably necessary for EJA to verify the identity of the individual for the purposes of the EJA’s activities or functions; or
• the use or disclosure of the identifier is reasonably necessary for EJA to fulfil its obligations to an agency or a State or Territory authority; or
• the use or disclosure of the identifier is required or authorised by or under an Australian law or a court/tribunal order; or
• a “permitted general situation” as defined in subsection 16A of the Act exists (excluding items 4 & 5) in relation to the use or disclosure of the identifier, including:
  • where it is unreasonable or impracticable to obtain consent and EJA reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of an individual or to public health or safety; or
  • EJA has reason to suspect an unlawful activity or misconduct of a serious nature that relates to EJA’s functions or activities has been or may be engaged in and reasonably believes the use or disclosure is necessary in order for EJA to take appropriate action; or
  • EJA reasonably believes that the use or disclosure is reasonably necessary to assist anyone to locate a person reported as missing and the use or disclosure complies with any rules made under s16(A)(2) of the Act; or
  • EJA reasonably believes that the use or disclosure of the identifier is reasonably necessary for one or more enforcement-related activities conducted by, or on behalf of, an enforcement body; or
• the use or disclosure arises because EJA is a prescribed organisation.

In this section “identifier” includes a number assigned by EJA to an individual to identify uniquely the individual for the purposes of EJA’s operations. However, an individual’s name or ABN (as defined in the A New Tax System (Australian Business Number) Act 1999) is not an identifier.

12. Anonymity and pseudonymity

Provided it is not unlawful or impracticable, individuals will have the option of not identifying themselves, or of using a pseudonym, when dealing with EJA. For example, donations made to EJA can be made anonymously or by use of a pseudonym.

Circumstances where it will be unlawful or impracticable to allow an individual to deal with EJA anonymously or by use of a pseudonym include where name and address details need to be provided to allow a receipt to be issued for tax-deductible donations, or where an individual seeks to retain EJA to provide legal services.

13. Cross-border disclosure of personal information

EJA often liaises with international environmental organisations in an effort to strengthen links within the international environmental movement. Occasionally, EJA may transfer personal information about an individual to someone (other than EJA or the individual) who is in a foreign country. EJA will only do so if EJA has taken reasonable steps to ensure that the information, which it has transferred, will not be held, used or disclosed by the recipient of the information inconsistently with the Australian Privacy Principles, unless:

• EJA reasonably believes that the recipient of the information is subject to a law, binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the Australian Privacy Principles and there are mechanisms an individual can access to enforce the protection of the law or binding scheme; or
• the individual consents to the transfer after having been informed that EJA will not be required to take reasonable steps to ensure that the information, which it has transferred, will not be held, used or disclosed by the recipient of the information inconsistently with the Australian Privacy Principles; or
• the use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or
• a “permitted general situation” as defined in subsection 16A of the Act) exists (excluding items 4 & 5) in relation to the use or disclosure of the information, including:
  • where it is unreasonable or impracticable to obtain consent and EJA reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of an individual or to public health or safety; or
  • EJA has reason to suspect an unlawful activity or misconduct of a serious nature that relates to EJA’s functions or activities has been or may be engaged in and reasonably believes the use or disclosure is necessary in order for EJA to take appropriate action; or
  • EJA reasonably believes that the use or disclosure is reasonably necessary to assist anyone to locate a person reported as missing and the use or disclosure complies with any rules made under s16(A)(2) of the Act.

14. Complaints

EJA will consider complaints made by an individual in relation to:

1. a decision to refuse access to personal information the individual requests; or
2. a decision not to correct personal information; and

will respond within a reasonable period after the complaint is received. The EJA response to a complaint is final.

An individual may make a complaint about EJA’s handling of the individual’s personal information to the Office Australian Information Commissioner (OAIC). Further information is available on the OAIC website: http://www.oaic.gov.au/privacy/privacy-complaints.

15. Responsibilities for managing privacy

All staff are responsible for the management of personal information to which they have access, and in the conduct of research, consultation or advocacy work.

The CEO is responsible for content in EJA publications, communications and website and must ensure the following:

• appropriate consent is obtained for the inclusion of any personal information about any individual including EJA personnel;
• information being provided by other agencies or external individuals conforms to privacy principles;
• that the website contains a Privacy statement that makes clear the conditions of any collection of personal information from the public through their visit to the website.

The CEO is responsible for safeguarding personal information relating to EJA staff, Board, volunteers, contractors and EJA members and supporters.

Principal Lawyer(s) are responsible for ensuring that privacy and confidentiality obligations are met in relation to the EJA legal practice, including client information.

16. Privacy Impact Assessments

Where EJA takes on a substantial new project or case where personal information might be handled in a different way, or when a change is proposed to information handling practices, EJA will conduct a Privacy Impact Assessment (PIA). Whether a PIA is appropriate will depend on a project's size, complexity and scope, and the extent to which personal information will be collected, used or disclosed.

17. Staff training, information and supervision

EJA staff will be trained in this Privacy Policy and provided with regular information on how the Principles apply to the EJA, and its practices, procedures and systems. Staff who regularly handle personal information will be appropriately supervised.

Contact details

All queries or complaints regarding this Privacy Policy, or requests for access to, or correction of, personal information should be directed to:

Nicola Rivers and Elizabeth McKinnon, co-CEOs
Environmental Justice Australia
PO Box 12123
A'BECKETT ST VIC 8006
(03) 8341 3100
[email protected]