Make-A-Wish Foundation Of Australia Ltd (Make-A-Wish) is committed to protecting the privacy of individuals. This policy outlines how we manage personal information.
Wish children, their families, supporters, volunteers and donors can have full confidence that when dealing with Make-A-Wish, their personal information will be kept private and that the data will be held securely.
Make-A-Wish supports and endorses the Australian Privacy Principles (APPs) contained in the Privacy Act 1988(Cth) (Privacy Act) and will only collect, use, disclose, and store personal information in accordance with these principles. Since Make-A-Wish collects health information, we will also comply with the requirements of the Health Records Act 2001 (Vic) (Health Records Act).
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:
- whether the information or opinion is true or not; and
- whether the information or opinion is recorded in a material form or not.
Sensitive information is a special category of personal information. Sensitive information includes:
- information or an opinion about an individual’s (i) racial or ethnic origin, (ii) political opinions, (iii) membership of a political association, (iv) religious beliefs or affiliations, (v) philosophical beliefs, (vi) membership of a professional or trade association, (vii) membership of a trade union, (viii) sexual orientation or practices, (ix) criminal record, that is also personal information;
- health information about an individual; and
- genetic information about an individual that is not otherwise health information.
What type of personal information does Make-A-Wish collect?
The type of information that Make-A-Wish collects and holds will depend on the nature of a person’s involvement with Make-A-Wish.
Generally, the personal information collected by Make-A-Wish may include (but is not limited to) a person’s name, residential address, email address, fax number, phone number, current employment information including occupation and place of work, gender, date of birth and bank account details.
It is also necessary in some cases for Make-A-Wish to collect sensitive information including health and medical information, racial and ethnic origin, details of the primary language spoken at home and details of family members.
A person is not required to provide the personal information and/or sensitive information requested by Make-A-Wish, however if a person chooses not to provide information as requested, it may not be practicable for Make-A-Wish to service the person’s needs. For instance it will not be possible for Make-A-Wish accept an electronic transfer for a donation without obtaining personal information. In such cases, if the person requests to remain anonymous, Make-A-Wish will note this on their record.
In circumstances where Make-A-Wish receives unsolicited personal information (meaning, personal information received where Make-A-Wish has taken no active steps to collect the information), Make-A-Wish will usually destroy or de-identify the information as soon as practicable if it is lawful and reasonable to do so unless the unsolicited personal information is reasonably necessary for, or directly related to, the Make-A-Wish functions or activities.
How does Make-A-Wish collect personal information?
Make-A-Wish will wherever practicable collect personal information directly from the individual including from hard copy forms, on-line applications and uploading of documents, face-to-face meetings, job applications, assessment reports, medical certificates, email correspondence, social media, questionnaires, and telephone calls.
Make-A-Wish may collect personal information from individuals such as staff members, current parents and/or guardians of Wish Children, donors and people who have expressed interest in donating to Make-A-Wish (Prospective Donors), contractors, and suppliers.
On occasion, Make-A-Wish may collect personal information from a third party. For example, personal information may be provided to Make-A-Wish by a medical professional with respect to a Wish Child.
Make-A-Wish will generally obtain consent from the owner of personal information, or a legal guardian if the person is unable to provide consent, to collect their personal information. Consent will usually be provided in writing however sometimes it may be provided orally or may be implied through a person’s conduct. Consistent with the APPs, Make-A-Wish recognises that some Wish Children under the age of 18 years have capacity to provide consent. Capacity to provide consent in relation to privacy is not determined by age alone, rather Make-A-Wish will consider a range of factors on a case by case basis including the person’s maturity and understanding.
Make-A-Wish will endeavour to only ask a person for personal information that is reasonably necessary for the activities that the person is seeking to be involved in.
In relation to the collection and disclosure of sensitive information, Make-A-Wish is bound by the APPs, which provide for the circumstances in which disclosure is permitted, or required by law.
How will Make-A-Wish use personal information?
Make-A-Wish may collect, hold, use or disclose a person’s personal information for the following general purposes:
- to identify a person;
- for the purpose for which the personal information was originally collected;
- for a purpose for which a person has consented;
- for any other purpose authorised or required by an Australian law; and
- for any other purpose authorised or required by a court or tribunal.
More specifically, Make-A-Wish may collect, hold, use or disclose a person’s personal information for the following purposes.
Donors and Prospective Donors
In relation to the personal information of donors and Prospective Donors, Make-A-Wish’s primary purpose of collecting the personal information is to enable Make-A-Wish to accept donations from members of the public and to notify donors and Anticipated Donors of current or upcoming donation opportunities.
In relation to the personal and sensitive information of Wish Children, Make-A-Wish’s primary purpose of collecting the personal and sensitive information is to enable Make-A-Wish to deliver the wishes of the Wish Children and protecting the health and safety of the Wish Child. This often includes liaising with the parents or guardians and medical practitioners of the Wish Children.
Staff members, contractors and Volunteers
In relation to the personal information of prospective and current staff members, contractors and volunteers, Make-A-Wish uses the personal information for purposes including:
- to enable Make-A-Wish to carry out its recruitment functions;
- correspond with the person, provide training and professional development;
- fulfil the terms of any contractual relationship; and
- ensure that the person can perform their duties pursuant to their engagement with Make-A-Wish.
Make-A-Wish may publish the images of staff, contractors and volunteers in publications, on social media, or in public advertisements.
If a person has any concerns about their personal information being used by Make-A-Wish in any of these ways, the person must notify Make-A-Wish.
Disclosure of personal information
Make-A-Wish may disclose personal information to a recipient overseas (for example where Make-A-Wish has outsourced a business activity to an overseas provider) in accordance with the Privacy Act.
In such circumstances, Make-A-Wish will take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information.
Otherwise, Make-A-Wish may disclose personal information to a recipient overseas in accordance with the Privacy Act where:
- the person has consented to the disclosure;
- Make-A-Wish reasonably believes that the overseas recipient is subject to a law or binding scheme that protects the information in a way that is substantially similar to the way the information is protected under the Privacy Act and the APPs; or
- the disclosure is required or authorised by an Australian law or a court order.
From time to time, Make-A-Wish may participate in data collectives where we share your personal information (other than sensitive information) with other like-minded organisations who may contact you with information that may be of interest to you. You can “opt out” from this data sharing use of your personal information at the time we collect it from you.
From time to time, and in support of Make-A-Wish’s future development and growth, Make-A-Wish will communicate information to donors, Prospective Donors and other people who have consented to receive such information.
Although Make-A-Wish treats marketing and seeking donations for the future growth and development of its ability to support Wish Children as an important part of ensuring that Make-A-Wish continues to make the wishes of the Wish Children come true, we understand that people do not always wish to receive this information and any requests for support.
In every situation where Make-A-Wish is permitted to use or disclose personal information for direct marketing, Make-A-Wish will allow the individual to 'opt out' and will act on the individual's request to “opt out”. Individual requests can also be made directly by email to [email protected]
How does Make-A-Wish store personal information?
Make-A-Wish takes all reasonable steps to protect personal information under its control from misuse, interference and loss and from unauthorised access, modification or disclosure.
Make-A-Wish protects personal information in a number of ways including:
- securely storing paper records;
- password restricted access to computerised records;
- routine security risk assessments;
- internal policies in relation to access to personal information and data retention and disposal; and
- cyber resilience and security education training for staff and volunteers.
How a person can update their personal information?
Make-A-Wish is committed to holding accurate and up-to-date personal information. To ensure the quality and accuracy of the personal information held by Make-A-Wish, donors are asked to confirm their personal details upon each donation.
A person may contact Make-A-Wish at any time to update their personal information held by Make-A-Wish.
Make-A-Wish will destroy or de-identify any personal information which is no longer required by Make-A-Wish for any purpose for which Make-A-Wish may use or disclose it, unless Make-A-Wish is required by law or under an Australian law or a court order to retain it.
Make-A-Wish may consider providing a person access to their personal information through the use of a mutually agreed intermediary if appropriate. For instance, if Make-A-Wish refuse a person access on the reasonable belief that access may lead the person to self-harm, Make-A-Wish may consider it safe to provide access through an intermediary.
How a person can access personal information?
If a person wishes to access personal information held about themselves or about a Wish Child for which they are a parent or guardian in order to seek correction of such information they may do so by contacting the Privacy Officer in writing via email, on [email protected]
In accordance with the Privacy Act, Make-A-Wish may refuse access to personal information in a number of circumstances including where giving access to the information would pose a serious threat to the life, health or safety of a person, giving access would have an unreasonable impact on the privacy of a person, the information relates to existing or anticipated legal proceedings and would not be available under the discovery process, or denying access is required or authorised by an Australian law or court order.
Make-A-Wish will seek to handle all requests for access to personal information as quickly as possible.
Make-A-Wish will investigate any complaint and notify the complainant, in writing, of any decision in relation to the complaint as soon as practicable.
Data breaches will be handled in accordance with Make-A-Wish’s data breach response plan and notifications will be made as required by law.
If a complainant is not satisfied with the response they can refer the complaint to the Office of the Australian Information Commissioner.