Privacy Framework

Introduction

This Framework supports the Main Roads Privacy Policy and provides the framework for how we manage personal information and support Main Roads’ ongoing commitment to maintaining the highest standards of privacy and complying with the Privacy and Information Sharing Act 2024 (WA) (the PRIS Act) (including the Information Privacy Principles (the IPPs)).

Information Privacy Principles

Main Roads complies with the IPPs when collecting, storing, using and disclosing personal information. In complying with the IPPs, we:

Collect personal and sensitive personal information only where fair and reasonable and necessary for the performance of our functions.
Use and disclose personal information only for its primary purpose, unless required or authorised, reasonably expected, consented to or otherwise permitted.
Apply safeguards to protect personal information from misuse, loss, unauthorised access, modification or disclosure.
Maintain accurate, complete and up-to-date personal information.
Ensure personal information is retained, de-identified or disposed of in accordance with privacy and record keeping requirements.
Assign and disclose unique identifiers only where lawful and necessary.
Respond promptly and appropriately to suspected or actual privacy breaches.

Information

What is Personal Information?

Personal Information is:

information or an opinion, whether true or not, and whether recorded in a material form or not, that relates to an individual, whether living or dead, whose identity is apparent or can reasonably be ascertained from the information or opinion; and
includes information of the following kinds
- a name, date of birth or address;
- a unique identifier, online identifier or pseudonym;
- contact information (such as phone numbers);
- information that relates to an individual’s location;
- technical or behavioural information in relation to an individual’s activities, preferences or identity;
- inferred information that relates to an individual, including predictions in relation to an individual’s behaviour or preferences and profiles generated from aggregated information; or
- information that relates to 1 or more features specific to the physical, physiological, genetic, mental, behavioural, economic, cultural or social identity of an individual.

What is Sensitive Personal Information?

Sensitive Personal Information is personal information:

that relates to an individual’s
- racial or ethnic origin;
- gender identity, in a case where the individual’s gender identity does not correspond with their designated sex at birth;
- sexual orientation or practices;
- political opinions;
- membership of a political association;
- religious beliefs or affiliations;
- philosophical beliefs;
- membership of a professional or trade association;
- membership of a trade union; or
- criminal record;
that is health information;
that is genetic or genomic information (other than health information);
that is biometric information; or
from which information of a kind referred to in any of the above can reasonably be inferred.

What is a Record?

For the purposes of this Policy, a Record includes information that is collected and stored in any form, including but not limited to:

written or printed, including braille;
maps, plans, diagrams or graphs;
drawings, pictorial or graphic works, or photographs;
anything on which there are figures, marks, perforations, or symbols, having a meaning for persons qualified to interpret them;
anything from which images, sounds or writings can be reproduced with or without the aid of anything else; and
anything on which information has been stored or recorded, either mechanically, magnetically, or electronically.

What information do we collect?

Information Collected

Personal Information

Main Roads only collects Personal Information necessary for Main Roads functions or activities, these may include:

person’s name;
residential and postal address;
gender and marital status;
date of birth;
public interest disclosure applications;
telephone numbers;
employment details
occupation information;
social media posts;
cookies;
insurance details;
educational qualifications;
government identifiers (e.g. Tax File Number);
security incident details;
content of email messages and email addresses of the sender and recipients.

Sensitive Personal Information

Main Roads only collects sensitive personal information necessary for Main Roads functions or activities and when required by law, consented to by an individual consent or otherwise permitted under IPP 1, this may include:

health information (including drug and alcohol tests, incident reports etc);
audio recordings;
crash information; and
closed circuit television (CCTV) video surveillance recordings.

Information recorded

Main Roads records the following communications for administrative, operational, management, safety, legal, security, training and quality reasons:

CCTV and audio surveillance recordings;
Internet usage;
Telephone and email conversations to and from our operational and customer facing support services; and
Online meetings.

Compulsory or optional collection

Main Roads collects information through the following mechanisms, each of these systems has different opt-in/opt out opportunities:

Phone calls – this is recorded unless a customer requests otherwise
Emails – this is collected unless a customer requests otherwise
Requests for Access to systems – this is compulsory for auditing purposes
In person – this is collected unless a customer requests otherwise
Permit applications – this is compulsory for auditing purposes
Online webforms – this is collected unless a customer provides anonymous data

Main Roads provides Collection Statements at each collection point. Please see our Website Privacy Statement for further digital collection methods.

Unique identifiers

Main Roads uses unique identifiers as part of business practices where necessary to enable it to perform its functions efficiently. These unique identifiers are not used as a general identifier across unrelated systems. These identifiers are also not disclosed externally unless authorised by law, required to deliver a service, or with consent.

How do we use Information?

Main Roads uses the information that is collected in the course of its functions and activities for the following purposes:

deliver its transport services safely and securely;
assist with communication activities for safety or operational needs;
assist with transport planning activities;
administering services and transactions;
managing access to systems;
maintaining accurate records;
meeting legal or regulatory obligations; and
for training and customer experience.

Personal information collected is not used for automated decision-making processes or functions.

CCTV and Body Camera Use

Main Roads may use CCTV and body camera recordings to:

deliver its transport services safely and securely;
assist with communication activities for safety purposes;
deter, detect, prevent, investigate and respond to safety or security incidents on Main Roads properties, the road reserve and any Main Roads owned or controlled land;
investigate and respond to liability claims on the road reserve and any Main Roads owned or controlled land; and
investigate and prosecute breaches of law, fraudulent activities, wrongdoing or infringements on the road reserve and any Main Roads owned or controlled land.

What Information do we Disclose?

Information disclosure

Where Main Roads holds a record containing personal or sensitive personal information that was collected for a particular purpose, that information will not be used or disclosed for any other purpose unless:

the individual concerned has consented to the use or disclosure of the information for that other purpose;
the individual would reasonably expect Main Roads to use or disclose the information for the secondary purpose and the secondary purpose is:
- if the information is personal Information, but not sensitive personal information – related to the primary purpose; or
- if the information is sensitive personal information – directly related to the primary purpose;
the use or disclosure of the information is required or authorised by or under a Western Australian or Australian law or a court/tribunal order;
Main Roads reasonably believes that the use or disclosure is necessary:
- to prevent or lessen a serious threat to the life, health, safety or welfare of any individual, or to public health, public safety or public welfare; or
- to investigate for suspected unlawful activities or reporting the matter to relevant persons or authorities;
- for a law enforcement function to be performed by a law enforcement agency; or
- for proceedings before a court or tribunal.
Main Roads reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

Disclosed for Enforcement

Where Personal Information is used or disclosed for a law enforcement function to be performed by a law enforcement agency, or proceedings before a court or tribunal, Main Roads must make a written note of the use or disclosure with the Record.

Internet Sites

Information about use of Main Roads internet sites will only be analysed on a bulk basis for broad demographic content and individual use will not be analysed. See our Website Privacy Statement for further detail.

Administer Services

In addition to the circumstances set out in paragraph 6.1, the Main Roads may use Personal Information to administer its services to its customers, manage customer relationships, market its services, improve its services, respond to customer questions or feedback, respond to a security incident, process transactions, assist in planning and research, and send newsletters, notifications or other Main Roads information to customers.

CCTV and Body Camera Disclosure

Main Roads may disclose CCTV and body camera recordings (including images and audio) to:

a law enforcement agency as part of its investigation on a suspected unlawful activity; and
a court or tribunal for proceedings.

CCTV footage is to be disposed of after 30 days unless required to conduct an investigation into an incident. Before any still photographs or video footage are used in social media, all reasonable steps are taken to deidentify individuals appearing in the imagery.

Third Parties or Other Entities

Main Roads may also disclose Personal Information to the following entities:

Ministers and other government departments, agencies or entities;
internal and external auditors;
law enforcement agencies (and their contractors) and regulators;
emergency services providers;
investigators and entities engaged to help identify and investigate improper activities or prevent fraud.

Third Party Disclosure

Where Main Roads discloses Personal Information to a third party, Main Roads must endeavour to ensure that the third party uses the Personal Information only for the specific purpose for which it is supplied and when required, additional consent is requested and a confidentiality agreement is in place.

Storage and Security of Personal Information

The following controls apply to the storage and security of Personal Information:

All digital Personal Information and Records collected by Main Roads are stored in a secure server, protected by security safeguards as are reasonable in the circumstances to guard against misuse, interference, loss and unauthorised access, modification or disclosure.
All Records are managed, retained and disposed of in accordance with the agency Record Keeping Policy and Record Keeping Plan.
Personal and Sensitive Information are retained, stored, deleted and/or de-identified from Records either at the request of an individual or where Main Roads no longer needs it. Main Roads must take such steps as are reasonable in the circumstances.
Where practicable, Main Roads only uses systems where data is stored within Australia, when this is not available, robust security processes and protocols are in place to ensure the safekeeping of Main Roads data.

Access to Records containing Personal Information

Where Main Roads has possession or control of a Record containing Personal Information, the individual concerned shall be entitled to have access to that Record, except to the extent that Main Roads is required or authorised to refuse to provide the individual with access to that Record under the applicable provisions of any law that provides for access by persons to documents (including the Freedom of Information Act 1992).

If access is refused, Main Roads will give the individual notice in writing and include the reasons for the decision to refuse access.

Alteration of Records containing Personal Information

Where Main Roads has possession or control of a Record containing Personal Information, the person responsible for that information must take such steps by way of making appropriate corrections, deletions and additions as are reasonable in the circumstances to ensure that the Record is, having regard to the purpose for which the information is held, accurate, relevant, up to date, complete and not misleading.

This requirement is subject to any applicable limitation in a law that provides a right to require the correction or amendment of documents.

Where Main Roads is not willing to amend a Record containing Personal Information in accordance with a request by the individual concerned, the person responsible for that information must take such steps (if any) as are reasonable in the circumstances to attach to the Record any statement provided by that individual of the correction, deletion or addition sought.

Privacy Policy breaches

Main Roads promote a workplace culture rooted in integrity and accountability, where all staff are expected to uphold the highest ethical and legal standards. Any breaches of information will be addressed appropriately as per the Public Sector Management Act 1994 and the Corruption, Crime and Misconduct Act 2003.

Complaints about Privacy

For any enquiries about this policy, to request access to your personal information, or to lodge a privacy complaint, please contact:

Email: privacy@mainroads.wa.gov.au