Friendly Conversations or Privacy Breaches? Protecting Your Patrons’ Data

This article highlights key risks and outlines practical steps clubs can take - such as staff training, express consent practices and enhanced privacy options - to safeguard personal information and support vulnerable individuals.

Understanding Privacy Situations

It is important to note that while smaller clubs (particularly those with an annual turnover of less than $3 million) may not have direct obligations under the Privacy Act 1988 (Cth) (the Act), they must still follow best practices for handling personal information. 

Clubs that meet or exceed the revenue threshold, or voluntarily opt in, must comply with the Act and its Australian Privacy Principles (APPs), ensuring responsible handling, storage and disclosure of personal information. 

Smaller clubs, though not prima facie required to adhere to the Act and APPs, must still consider privacy risks when dealing with personal information, especially of vulnerable persons, to ensure they are safeguarding their patrons' personal information.

Regardless of legal obligations, clubs, particularly in regional communities, and in particular a club’s staff, are key custodians of personal and sometimes sensitive information about their patrons, making privacy a crucial responsibility. 

While fostering friendly and open relationships with patrons is important, clubs must be careful not to inadvertently disclose personal information.

What is Personal Information? 

Under the Act, personal information is defined as: "Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not."

Examples of personal information include:

• Contact Details: Name, address, phone number and email address.
• Personal Identifiers: Date of birth, employment details.
• Financial Information: Bank account details.
• Health Records: Medical history, treatment details.
• Media: Photos, videos or voice recordings.

Sensitive information (a subset of personal information) includes details about race, political opinions, religious beliefs, sexual orientation, and health and criminal records.

Common Privacy Risks for Clubs

• Friendly Conversations: Staff might unintentionally disclose personal information when casually discussing patrons with other staff, patrons or third parties. Even innocent exchanges about a patron's activity or whereabouts can lead to privacy issues or breaches of the Act. Staff must not discuss patrons' private matters, even casually, without consent.
• Patron Enquiries: If a staff member is asked for a patron’s contact details, whereabouts or membership status, staff may feel inclined to assist. However, sharing this information - especially regarding vulnerable individuals - could have consequences for the individual.
  • Vulnerable people: Sharing personal information informally, even with good intentions, can be a breach of an individual’s privacy and have serious consequences for vulnerable people of the community, such as:
    1. Individuals experiencing financial hardship or domestic violence (who may be at greater risk of harm if their personal information is mishandled).
    2. The elderly (especially those with cognitive impairments, whose personal details must be safeguarded to prevent exploitation or abuse).
    3. People with disabilities (who may need assistance managing their personal information and must have their privacy protected).
    4. Indigenous Australians (who may have specific cultural sensitivities around information sharing and whose privacy must be respected).
    5. People in witness protection (whose new identities and personal details must remain confidential to be afforded the protection designed by witness protection programs).

Even well intended disclosures can compromise a patron’s safety and privacy. Staff must never share information without the explicit consent from the patron.

• Public Announcements: In some cases, clubs might publicly recognise patrons for achievements, events or other activities, for example on social media, inadvertently exposing personal information such as full names, locations or specific details about their private lives without their explicit permission. Clubs must obtain explicit consent before publishing personal details online or offline.

How Clubs Can Mitigate Privacy Risks

1. Staff Training: Provide regular, mandatory training for all staff at all levels to emphasise and reinforce the importance of not disclosing personal information, even in casual conversations. All staff must understand what information can and cannot be shared without a patron’s prior explicit consent.
2. Obtain Express Consent from Patrons: Ensure a club’s terms and conditions for all patrons address an express consent requirement which is required prior to the publication of a patron’s image, location or full name, whether online (including on social media), in newsletters or within the club etc. Without the appropriate consent, use only a patron's first name and the initial of their surname in any publications (eg Chris T). Clubs must also respect any patron’s request to opt out of their image being used in any of these formats.
3. Enhanced Privacy Options: Consider introducing a privacy preference tick box on membership applications offering an "enhanced privacy" option for patrons. This can be particularly useful for those in vulnerable situations (see examples of vulnerable people above) ensuring that only select individuals, like the club’s board, have access to their details.
4. Proactive Member Communication: Periodically inform patrons of their ability to opt into enhanced privacy measures. This demonstrates the club’s commitment to privacy and empowers patrons to control their personal information.

Striking the Right Balance

Balancing the need to be friendly and approachable with the responsibility to protect personal information is crucial. With the right training, clear privacy policies and privacy enhancing measures, clubs can foster a safe and trusting environment while upholding their duty to protect patrons’ privacy.