WorkCover Queensland privacy policy

About WorkCover Queensland

WorkCover Queensland is responsible for ensuring the effective operation of the workers' compensation scheme in Queensland under the Workers' Compensation and Rehabilitation Act 2003 (Qld). It provides insurance, manages claims, and focuses on supporting injured workers through rehabilitation and return to work.

About this policy

WorkCover Queensland (WorkCover) is committed to protecting privacy by responsibly managing the personal information WorkCover holds in a manner consistent with the Information Privacy Act 2009 (Qld) (IP Act). Personal Information is defined in the IP Act as:

“information or an opinion about an identified individual or an individual who is reasonably identifiable from the information or opinion (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not.”

The IP Act states Queensland Privacy Principles (QPPs) to which WorkCover must adhere. The QPPs require WorkCover to have a clearly expressed and up-to-date policy about WorkCover’s management of personal information.

This document is WorkCover’s privacy policy.

Kinds of personal information WorkCover collects and holds

All WorkCover services generally involve WorkCover collecting and holding name, date of birth and contact details.

Other kinds of personal information may be collected and held by WorkCover depending on who WorkCover is dealing with. WorkCover’s main dealings are with injured workers or their representatives, their employers, service providers involved in workers compensation claims (for example medical or other health service providers or banks) and WorkCover’s employees or those applying for employment at WorkCover.

Other kinds of personal information would generally be:

financial details (for example bank details)
tax file number
identity information (for example driver licence details)
health information (for example details of a worker's injuries and treatment)
details of a worker's claims history
employer, occupation and wages
details of benefits received by an injured worker (for example Centrelink benefits and insurance payouts)
employment history and qualifications
service provider roles and qualifications (for example General Practitioner).

For WorkCover’s management of personal information collected via closed-circuit television (CCTV) or call recording, see “CCTV and call recording” below.

Because of the nature of WorkCover's services, WorkCover does not generally give individuals the option of communicating with WorkCover anonymously or of using a pseudonym.

How WorkCover collects and holds personal information

Collection

WorkCover collects personal information via forms or other documents in the course of receiving workers compensation claims and assessing and managing those claims. WorkCover’s collection of personal information is mostly done online, but WorkCover may also collect personal information by phone and in person.

WorkCover may collect personal information directly from a worker or from others who may be identified or involved in a worker’s claim. These may be a worker’s authorised representative or employer or medical and other health providers and financial institutions. These may also be government agencies (for example Centrelink, the Health Insurance Commission, child support agencies and those interacting with WorkCover as provided in the Workers' Compensation and Rehabilitation Act 2003 (for example Workplace Health and Safety)).

How WorkCover holds personal information

We hold digital personal information in servers within our data centres as well as cloud computing platforms hosted by our service providers. We also hold physical records at our premise. We use a range of physical and electronic security measures with the aim of protecting personal information we hold from misuse, interference or loss. These steps include but are not limited to:

system technical measures to protect from unauthorised access, modification and theft such as only providing access to authorised personnel on a need-to-know basis and monitoring access;
physical site security such as through the use of access passes;
continuous programs to meet the requirements for state legislation, security standards and guidelines for the protection of personal information

We have processes and procedures for the retention and disposal of records including personal information. This is in accordance with the Public Records Act 2023 (Qld) and corresponding WorkCover retention and disposal schedules. We may be required to hold personal information under an Australian law, court or tribunal order.

Purposes of WorkCover’s personal information management

General

WorkCover collects, holds, uses and discloses personal information for the primary purpose of assessing workers’ entitlements to workers compensation and managing their workers compensation claims. These purposes involve activities such as:

providing insurance when a worker sustains an injury at the workplace
assessing claims, calculating and paying weekly compensation
assisting with rehabilitation
administering and managing workers compensation services, for example paying, charging, billing and collecting debts
confirming qualifications and accreditations of service providers and arranging for payment of their services
managing compliance and audit activities in accordance with the requirements of the Workers Compensation and Rehabilitation Act 2003 (Qld)
maintaining and developing WorkCover's services, systems and infrastructure, including testing and upgrading
maintaining employee records including payroll information and personnel records
assessing individuals for a position within WorkCover and conducting personal reference checks
responding to general correspondence and to executive government requests regarding WorkCover's functions and activities.

These activities may involve disclosing personal information to:

employers
medical and allied health service providers
those authorised to represent the individual
credit-reporting and fraud-checking agencies
professional advisers (for example, accountants, auditors, and lawyers) and
government and government agencies and regulatory authorities, for example, Australian Electoral Office, Department of Family Services, Child Support Agency, Centrelink, Australian Taxation Office and Department of Immigration).

Workers’ health, medical conditions, and other sensitive information

In the course of its services, WorkCover collects, holds, uses and discloses personal information about workers' health or medical conditions. Such personal information is a special kind of personal information and is referred to as sensitive information. Depending on the particular claim’s circumstances, there may be other kinds of sensitive information which WorkCover manages. For example WorkCover may collect information about a person's racial/ethnic origin or political opinions, or gender if it is relevant to their claim for compensation.

There is a range of provisions under Workers' Compensation and Rehabilitation Act 2003 (Qld) authorising or requiring WorkCover to collect or disclose information (including sensitive information) relevant to workers’ compensation claims from or to workers and third parties (for example doctors, health authorities, allied health providers, rehabilitation providers, employers, other insurers, lawyers and Commonwealth and State agencies). Where these provisions apply, WorkCover may not seek workers’ specific written consent to WorkCover's collection, holding, use or disclosure of their personal information.

Other purposes

In limited circumstances, WorkCover may collect, use, hold and disclose personal information for purposes other than assessing workers' entitlements to workers compensation and managing workers compensation claims. This may occur where:

WorkCover has consent. An example concerns call recording – see “CCTV and call recording” below
the individual would reasonably expect the relevant use or disclosure. For example, WorkCover might give an injured worker’s name and contact details to a treatment provider when making a booking an independent medical review.
WorkCover is required or authorised under an Australian law or a court or tribunal order. The Workers' Compensation and Rehabilitation Act 2003 provisions are referred to above. Another example is where WorkCover responds to a court order for the production of documents
WorkCover becomes aware of the risk of a serious threat to life, health or safety, or has reason to suspect that unlawful activity or misconduct of a serious nature relating to its services may happen. For example, WorkCover may need to give a person’s contact details to an emergency services if claims information available to it reveals serious and imminent threat to someone's safety.

CCTV and call recording

CCTV

WorkCover's offices are protected by Closed Circuit Television (CCTV). WorkCover’s CCTV systems provide 24-hour video surveillance. The purpose of this is to provide a safe and secure work environment for WorkCover staff, visitors and members of the general public, including to deter aggressive, harmful or unlawful behaviour and to assist in identifying offenders. CCTV footage is not used to monitor staff performance. It may be used, however, to investigate allegations of serious misconduct by staff. CCTV footage may be disclosed by WorkCover for the purpose of reporting unlawful acts to the police, investigating and managing occupational health and safety complaints and for other purposes where required by law (for example a court order). WorkCover maintains controlled access to CCTV footage. Copies of CCTV footage are retained for 75 days in a secure and lockable area. Enquiries about WorkCover’s CCTV surveillance may be directed to WorkCover’s Property and Facilities Department by calling 1300 362 128.

WorkCover call centre

Calls to and from WorkCover’s customer facing teams are recorded and reviewed for quality control and training purposes. All call participants will be played a disclosure statement and may decline consent to have their calls recorded.

Access and correction

Access

Individuals can ask WorkCover in writing for access to a document containing their personal information. WorkCover will need some identity verification to progress such a request.

No application fee is payable for access to a document if the only document applied for contains personal information of the applicant.

There are limited circumstances in which WorkCover may not give such access. These are set out in the Right to Information Act 2009 (Qld). Examples are where giving access might prejudice someone's health or well-being, or because the document is non-existent or unlocatable.

If an individual is an injured worker or employer, and would like more information on accessing personal information, they may visit WorkCover’s right to information page.

If individuals are applying or have applied for a position of employment with WorkCover, they can access their personal information online through PageUp using their applicant identification number and password. For such personal information which is not available online, they can contact WorkCover’s People Group on 1300 362 128.

For WorkCover’s employees, they can access the majority of their personal information online or by contacting WorkCover’s Payroll team and/or People Group.

Correction

Individuals may ask WorkCover to correct a document which WorkCover holds containing their personal information. They can do this if the personal information WorkCover holds is inaccurate, out of date, incomplete, irrelevant or misleading. "WorkCover's privacy contacts" below gives contact details for making correction requests.

Correction requests will need to be in writing. WorkCover will ask for:

sufficient information concerning the relevant document to enable WorkCover to identify it
evidence of the individual’s identity (and where there is an agent representing the individual, evidence of the agent’s authorisation) and
the information claimed to be inaccurate, incomplete, irrelevant, out of date or misleading, how this is so and the amendments being sought.

WorkCover will decline a request for correction if WorkCover is not satisfied about its merits, or the relevant information relates to personal information other than that of the person making the request or their suitably authorised agent.

WorkCover may also decline a request for correction if the document in question is not part of a record available for use in the day-to-day ordinary performance of WorkCover’s functions.

WorkCover may decline to make a correction where, on balance, it would be contrary to the public interest. This is where the work involved in dealing with a request would substantially and unreasonably divert WorkCover’s resources or where the correction request concerns the same document sought to be amended under a previous request.

Where WorkCover declines to make a correction, the individual who made the request may ask for a note to be made apparent to users of the information. Where WorkCover has declined because it was not satisfied about the merits of the request, that note would be a statement that the personal information is asserted to require correction. Otherwise, the note would be to the effect that the personal information is incorrect and would provide the correct information.

If individuals are applying or have applied for a position of employment with WorkCover, they can ask to correct their personal information in the same ways they can access their personal information as referred to above. For WorkCover’s employees, they can ask to correct their personal information online or by contacting WorkCover’s payroll services section.

More information about applications under the Right to Information Act and IP Act is available at applications under Right to Information and Information Privacy.

Complaints

If individuals have concerns about any aspect of WorkCover's management of their personal or sensitive information, they may make a privacy complaint. WorkCover asks that a privacy complaint:

be in writing,
provide an address where WorkCover can send a response e.g. email or postal address,
give WorkCover details of the privacy complaint. For example, the privacy complaint could be about a possible breach of WorkCover's obligations under the QPPs or of matters pertaining to the IP Act's notifiable data breach scheme and
be made within 12 months after the complainant became aware of the relevant issues. Depending on the circumstances, WorkCover may agree to a period longer than 12 months.

WorkCover’s contact details for privacy complaints are under “Contact details for WorkCover” below. WorkCover is able to provide reasonable help to individuals to put their complaint in writing.

WorkCover has designated personnel whose role it is to consider privacy complaints. Privacy complaints received by WorkCover will be escalated for consideration and response by these personnel.

WorkCover‘s response time for privacy complaints is generally 45 business days after receiving it, but in some circumstances WorkCover may ask for a further period/s of time. If WorkCover does this, it will continue considering the relevant complaints and respond to them until WorkCover’s request is refused, the matter has been referred to the Queensland Information Commission or until the end of any extended period WorkCover requested.

WorkCover will respond in writing to each privacy complaint and send this to the address provided as part of the privacy complaint.

Individuals have other avenues for making privacy complaints concerning us. Questions about these other avenues may be addressed to the Office of the Queensland Information Commissioner, whose contact details are:

Office of the Queensland Information Commissioner
Telephone: (07) 3234 7373 or 1800 642 753
Email: enquiries@oic.qld.gov.au
Postal address: PO Box 10143, Adelaide Street, Brisbane Queensland 4000

For suspected or actual data breach incidents involving personal information, see also WorkCover’s Data Breach Policy.

Disclosures outside Australia

WorkCover may transfer an individual's personal information outside Australia only if they agree, it’s authorised or required by law, there’s a serious safety risk, or there are safeguards in place to ensure the information is protected in line with Australian privacy principles.

Contact details for WorkCover

For all privacy-related enquiries or Communications with WorkCover (including Privacy Complaints), please use the following contact details:

Address: WorkCover Queensland, GPO Box 2459, Brisbane QLD 4001
Attention: Corporate Relations Manager
Email: corporate.affairs@workcoverqld.com.au
Telephone: 1300 362 128

Modifications and updates

WorkCover reviews and updates its privacy policies annually, or as needed. Any updates to the policy will be communicated on WorkCover’s website with a minimum of 14 days’ prior notice.