Privacy policy

The ACMA is bound by the Privacy Act 1988 (the Privacy Act), including the Australian Privacy Principles (the APPs). The APPs set out the standards, rights and obligations for how personal information is collected, stored, used, disclosed, quality-assured and secured. 

We are also bound by obligations outlined in the Privacy (Australian Government Agencies – Governance) APP Code 2017. 

This policy sets out:

• the kinds of personal and sensitive information the ACMA collects and holds
• how that information is collected and held by the ACMA
• the purposes for which the ACMA collects, holds, uses and discloses personal and sensitive information
• how you can access, correct or manage your personal information
• how to contact us or make a complaint. 

This policy applies to all ACMA activities that involve the management of personal information (whether digitally, in paper form or otherwise) by any staff or any contracted service providers of the ACMA.

We regularly review this privacy policy and will update it if our information-handling practices change. 

The ACMA is an independent statutory authority established under the Australian Communications and Media Authority Act 2005 (the ACMA Act). The ACMA operates under the Public Governance, Performance and Accountability Act 2013 (the PGPA Act).

The ACMA is responsible for the regulation of broadcasting, telecommunications, radiocommunications and some aspects of the internet in Australia. These responsibilities are set out in a range of Acts, the principal Acts being: 

• the Broadcasting Services Act 1992
• the Radiocommunications Act 1992
• the Telecommunications Act 1997
• the Telecommunications (Consumer Protection and Service Standards) Act 1999.

The ACMA is also responsible for administering the Interactive Gambling Act 2001 (including the National Self-exclusion Register established under that Act) and for the regulation of unsolicited communications under the Do Not Call Register Act 2006 and the Spam Act 2003.

The key activities undertaken by the ACMA under these laws are:

1. Regulation – including the development of codes of practice in consultation with industry groups and the maintenance of statutorily prescribed public registers.

2. Compliance and enforcement – including the conduct of investigations of alleged breaches of an Act, legislative instrument or registered code.

3. Planning and management of radiofrequency spectrum

4. Licensing – including the issuing and renewal of carrier, television, radio, spectrum and apparatus licences.

5. Revenue collection – including the collection of licence fees, taxes and charges.

6. Research, education, advice and reporting on matters relating to the media and communications industry – including engaging in public consultations and participation in international regulatory forums.

In addition, the ACMA undertakes a range of corporate activities, including the management and recruitment of staff, procurement and contract management.

The ACMA is subject to the Freedom of Information Act 1982 (FOI Act) and the Ombudsman Act 1976. 

Find out more about the FOI Act. 

The ACMA’s information management processes must comply with the Archives Act 1983 and the Privacy Act, as applicable.

The Privacy Act imposes obligations in relation to the collection, security, quality, access, use and disclosure of personal information. These obligations are detailed in the APPs, which are found in Schedule 1 to the Privacy Act. These privacy obligations apply to the ACMA.

Find out more about the Privacy Act.

This is information that identifies you, or could reasonably identify you. It can include things like your name, contact details or other information linked to you. 

Sensitive information is a type of personal information that includes things like your: 

• health or biometric information
• religious beliefs
• political views
• union membership
• criminal history. 

You can find the types of personal information the ACMA may collect and hold below. 

We collect and hold personal information that is necessary for, or directly related to, our functions and activities. 

The types of personal information we collect may include: 

• identity and contact details (such as name, address, phone number and email address)
• information provided on complaints, investigations or regulatory processes
• financial or transactional information
• technical and online information (such as IP address, device identifiers and website usage data
• sensitive information where permitted or required by law. 

The recruitment and management of staff may involve the collection and storage of some sensitive information, for example, criminal history or health information. Such information will only be collected where the relevant staff member has consented to the collection and the information is reasonably necessary for, or directly related to, those personnel management activities. However, most activities undertaken by the ACMA will ordinarily not involve the collection of sensitive information.

We collect and hold personal information that is necessary for, or directly related to, our functions and duties. We collect personal information directly from an individual where possible. 

In some cases, we may collect personal information from publicly available sources or from third parties where:

• we are required or authorised to do so, for example, obtaining information for the purposes of an investigation
• we have your consent to do so
• it is not reasonably practicable to collect the information from you.

The third-party information may also be collected from either: 

• your authorised representative, if you have one
• applicants, complainants or respondents to a complaint or investigation
• other government agencies, including state or territory authorities, where information sharing is permitted. 

When we collect personal information from an individual, we will take steps to notify the person of:

• the purpose of the collection
• any usual disclosures
• the consequences of not providing the information.

The primary ways we collect personal information are discussed below.

Correspondence

Personal information may be collected when you:

• complete a complaint or enquiry form
• send us an email
• post comments on our website
• send us a letter or facsimile
• contact us by telephone.

Collection may be solicited by the ACMA (where you provide the information in response to an ACMA initiated interaction or invitation) or unsolicited (where you initiate the contact and correspond with the ACMA).

If personal information is unsolicited, it will not be collected unless it is reasonably necessary for, or directly related to, one or more of the ACMA’s functions or activities (see APP 3, APP 4 and the meaning of purpose of collection).

Whether you will be able to correspond with the ACMA on an anonymous basis or by using a pseudonym will depend on the circumstances, including the purpose for your corresponding with the ACMA. In some instances, anonymity may not be practical as the ACMA may require proof of your identity before it can take action on the matter, for example, licensing decisions. In other instances, anonymity or use of a pseudonym may be permitted.

If you provide your contact details to us (for example, to our Customer Service Centre, through an online enquiry form or email, or by subscribing to an ACMA newsletter) we may invite you to participate in customer experience research. This is entirely voluntary, and all responses will be kept confidential and anonymous, and will be used only for research purposes. We will inform you at the time we collect your personal information that you may be contacted for this purpose, and you may opt out of this research at any time. 

Forms and notices

There is a range of forms and notices which may be used to collect personal information to enable the ACMA to fulfil its statutory obligations.

The ACMA’s purpose and legal authority to collect personal information will typically be set out in the form or notice.

The purpose of the collection will vary according to the law which authorises or requires the collection, for example, investigations; licence applications, renewals and transfers; control and compliance notifications; payment of licensing fees, taxes and charges; applications for exemptions/exceptions; declarations of conformity.

In some instances, the form or notice will also explain how the information provided will be managed, for example, the ‘Application for apparatus licence(s) (R057)’ form has a number of fields marked with an asterisk. A note on the form advises the applicant that the personal information provided in the fields so marked will be included in the Register of Radiocommunications Licences and will be made available to the public.

Recruitment

The ACMA has an online recruitment system for job applicants. In order to use this system, you will need to register and provide your name, email address and a password.

Any application submitted by you will include additional relevant personal information, including details of your employment history and preferred contact details, for example, a telephone number or email address.

The personal information of job applicants is collected and held to enable the ACMA to manage the recruitment processes as required by the Public Service Act 1999.

Some positions within the ACMA require a security clearance. The ACMA’s clearance process is required to comply with the requirements prescribed in the Australian Government’s Protective Security Policy Framework and Personnel Security Protocol.

All information provided by you for a security process is only used for assessing your suitability to hold the relevant security clearance.

Find out more about the ACMA’s online recruitment process. 

Find out more about the Protective Security Policy Framework and the Personnel Security Protocol.

Procurement

Procurement is a process undertaken by the ACMA to acquire goods and services. The ACMA’s procurements must comply with, among other things, the Australian Government’s Commonwealth Procurement Rules.

A procurement may involve approaching the market to tender. The tender process will involve the collection of personal information, for example, names, telephone numbers and contact details of tenderers.

Contracts entered into by the ACMA on behalf of the Commonwealth may contain personal information. The information may include names, telephone numbers and contact details of the contracting parties.

The personal information is collected and held to enable the ACMA to meet its legal obligations, including those under the PGPA Act and the Commonwealth Procurement Rules.

Public consultation

From time to time, the ACMA undertakes public consultation to invite submissions from interested persons. The ACMA may also conduct surveys and hold public forums inviting feedback and information on specific issues.

The ACMA is committed to ensuring the effectiveness of its stakeholder consultation processes, which are an important source of evidence for its regulatory development activities.

The consultation documentation will make clear the purpose of the consultation and the purpose of the collection of personal information. This information is provided prior to the collection of personal information. In general, the ACMA publishes all submissions received, including any personal information in the submissions. If a submitter wishes to provide particular information in confidence, they are asked to identify the material (including any personal information) over which confidentiality is claimed and to provide a written explanation for the claim. Each confidentiality claim is assessed by the ACMA on a case-by-case basis. If the ACMA accepts a claim, the information will not be published.

If a submitter wishes to make a submission anonymously or through use of a pseudonym, they are asked to contact the ACMA to see whether it is practicable to do so, in light of the subject matter of the consultation. If it is practicable, the ACMA will notify the submitter of any procedures that need to be followed and whether there are any other consequences of making a submission in that way.

Access to online and subscription services

If you register for access to an online or subscription service we will collect and store all the details you provide in the course of registering, for example, your name, your organisation, your contact details and communication preferences. This information is collected and held to enable the ACMA to manage user access and to provide the service requested.

The ACMA has online payment systems to assist people with making a payment to the ACMA, for example, payment of Numbering and Do Not Call services. The ACMA uses the secure online credit card processing facility operated by a third party. 

We do not collect or hold any credit card details. 

You will receive information about the terms and conditions of gaining access to an online or subscription service before any personal information is collected.

Whether you will be able to use a pseudonym in an online or subscription service will depend on the nature of the service.

The ACMA’s website, including ACMA Assist, uses session-based cookies (or temporary cookies) and persistent cookies. A session-based cookie only lasts for as long as your browsing session and ends when you close your browser. A persistent cookie remains on your computer after you close your browser and will be sent back to the website each time you visit until you clear the cookie from your browser.

You can set your browser to notify you before you receive a cookie so that you may refuse to accept it. You can also set your browser to turn off cookies and you can delete them. If you turn off or delete cookies, this may affect your access to certain features of the ACMA’s website. Please note that some data may still be collected separately by tools such as Google Analytics, even though you may have set your browser preferences to reject all cookies. 

When you browse our website, our server collects and holds the following information:

• your server address
• your top-level domain name, for example, .gov, .com, .edu, .org, .au, .nz
• the pages you accessed and how long you stayed on a page
• the date and time you visited the site
• the previous site you visited
• your physical geographical location (aggregated or approximate location information)
• the type of browser and operating system you used, for example, Microsoft Edge, Windows
• the type of device and brand you used.

We collect this information primarily in de-identified or aggregated form where possible, and use it for: 

• system administration
• security monitoring
• improving our services. 

If you sign up to one or more of our subscription services, our server will collect and hold the following additional information for the purpose of customising the information and products to be provided:

• your identity, linked to the information you provided to us in your subscription form, for example, given name, surname and email address
• whether you opened a subscription e-mail that we sent you
• which links, if any, you clicked on in a subscription e-mail that we sent you.

No attempt will be made to identify users or their browsing activities, except where:

• a user has signed up to one of our subscription services
• in the event of an investigation, when a law enforcement agency or other government agency may exercise its legal authority to inspect our web server logs.

The ACMA’s website uses both Australian Government and commercial web-hosting facilities.

We will only collect personal information if it is reasonably necessary for, or directly related to, one or more of the ACMA’s functions or activities. 

We ensure that our collection, use and disclosure of personal information is fair, lawful and reasonable in the circumstances. 

If the information is sensitive information, the collection will only occur if you have consented to it or it is otherwise permitted under the Privacy Act. This includes where an exception applies (such as where collection is necessary for enforcement-related activities conducted by, or on behalf of, an enforcement body).

We use and disclose your personal information for its original purpose or a related secondary purpose. 

We will not use your personal information for any other purpose, unless:

• you have provided your consent
• you would reasonably expect the use and disclosure, and it is related (or directly related for sensitive information) to the primary purpose
• the use or disclosure is required or authorised by or under an Australian law, for example, the FOI Act, Part 7A of the ACMA Act, or Division 7 of Part 7B of the Interactive Gambling Act 2001 (see below), or a court/tribunal order, for example, a subpoena
• it is necessary for one or more enforcement-related activities
• it is otherwise under the Privacy Act.

We will take steps to ensure that any use or disclosure is proportionate and limited to what is necessary. 

Part 7A of the ACMA Act empowers the ACMA to share authorised disclosure information (defined in section 3 of that Act) in certain circumstances, including to an authority of a foreign country responsible for regulating matters relating to communications or media (see section 59D). The definition of authorised disclosure information encompasses personal information given in confidence to the ACMA in connection with the performance of any of its functions or the exercise of any of its powers. The ACMA may make a disclosure on request or of its own volition. The decision to disclose will be made in light of the facts. For more information see the ACMA’s Regulatory Guide No 3 – Information sharing under Part 7A of the ACMA Act.

The ACMA has also entered into memoranda of understanding (MOUs) with a number of domestic and international agencies. The MOUs do not provide the legal basis for making disclosures. They assist the ACMA and the other signatory to respond appropriately to, and manage requests for, assistance, including requests for access to information held by the ACMA.

Information on the operation of the FOI Act is available here.

In limited circumstances, we may share your personal information with organisations outside Australia (for example, other regulators). Disclosure may be in accordance with legislation or international information-sharing agreements. This may occur, for example, in relation to a law enforcement matter such as a criminal investigation.

When we do this, we take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information. These steps may include entering into contractual arrangements, conducting due diligence on recipients, or applying other safeguards appropriate to the circumstances. In some cases, we may rely on an exception under APP 8 (for example, where the disclosure is required or authorised by law).

Such disclosures may occur to regulators, enforcement bodies or service providers located in jurisdictions outside Australia.

The protection and security of personal information held by the ACMA is of critical importance.

The ACMA has a range of measures in place to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include: 

• technical controls (such as access controls, encryption and system security measures)
• organisational controls (such as policies, procedures and staff training). 

All information collected by the ACMA is secured and managed in accordance with the Australian Government’s Protective Security Policy Framework, Information Security Manual and the Archives Act (and see also the National Archives of Australia website page regarding Commonwealth records management).

We use artificial intelligence (AI) to help us deliver our services and carry out our functions. 

AI may be used in activities such as data analysis, service delivery and process automation. Where AI is used:

• we aim to minimise the use of personal information
• we maintain appropriate human oversight
• we assess privacy risks before implementation
• we implement safeguards to prevent unauthorised or unfair impacts on individuals.

More information about our use of AI can be found in our AI transparency statement.
 

We may use automated processes or systems to assist in decision-making (for example, processing applications).

Where a decision is made by automated means and may affect you, we will provide information about:

• how personal information is used in those processes
• the types of decisions made
• the potential impact on individuals
• any available avenues for review or human intervention (where applicable).

The ACMA retains personal information only for as long as required, and in accordance with:

• the Archives Act 1983
• applicable records authorities issued by the National Archives of Australia. 

Retention periods vary depending on the type of information and legal requirements. Where personal information is no longer required, we take steps to destroy or de-identify it. 

If you believe we have mishandled your personal information, you can make a complaint. 

We will:

• acknowledge your complaint
• investigate the issue
• respond within a reasonable timeframe.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner.

In the event of an eligible data breach, we will comply with the Notifiable Data Breaches scheme. This includes notifying affected individuals and the Office of the Australian Information Commissioner where required.
 

Applying for access to and correction of personal information

You may request access to, or correction of, your personal information.

These rights are set out in APP 12 and APP 13 in the Privacy Act.

We may require you to provide some proof of your identity in order to handle your request.

If you wish to apply for access to, or the correction of, your personal information, please use the contact details under Contact us.

If you are applying for correction of personal information, you should:

• specify the personal information
• explain why you consider that the personal information should be corrected, that is, why that personal information is inaccurate, out-of-date, incomplete, irrelevant or misleading
• provide any documents/information in support.

Your application will be acknowledged on receipt. You will be advised in writing of the outcome of your application. If your application is refused, we will explain our reasons for that decision.

Privacy governance and contact information

We maintain internal governance arrangements to support our privacy obligations, including:

• a designated Privacy Officer
• Privacy Impact Assessments for high privacy risk projects
• internal policies and procedures.

Contact details

By email: privacy@acma.gov.au

By post:

Privacy Contact Officer
Australian Communications and Media Authority
PO Box Q500 Queen Victoria Building
Sydney NSW 1230

Telephone: 02 9334 7700

Enquiries and feedback